diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 5a80a11c5cbea..4cc0c8016f1d0 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -4,16 +4,15 @@ Summarize your PR. If it involves visual changes include a screenshot or gif.
 
 ### Checklist
 
-Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.
+Delete any items that are not applicable to this PR.
 
-- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)
 - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
 - [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials
 - [ ] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
 - [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)
+- [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)
+- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)
 
 ### For maintainers
 
 - [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
-- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
-
diff --git a/.github/workflows/pr-project-assigner.yml b/.github/workflows/pr-project-assigner.yml
index ccaa5b11aa80c..c85b4b3b8fe79 100644
--- a/.github/workflows/pr-project-assigner.yml
+++ b/.github/workflows/pr-project-assigner.yml
@@ -8,7 +8,7 @@ jobs:
     name: Assign a PR to project based on label
     steps:
       - name: Assign to project
-        uses: elastic/github-actions/project-assigner@v1.0.1
+        uses: elastic/github-actions/project-assigner@v1.0.2
         id: project_assigner
         with:
           issue-mappings: |
diff --git a/.github/workflows/project-assigner.yml b/.github/workflows/project-assigner.yml
index 737da4f7fe371..efcf53c722527 100644
--- a/.github/workflows/project-assigner.yml
+++ b/.github/workflows/project-assigner.yml
@@ -8,7 +8,7 @@ jobs:
     name: Assign issue or PR to project based on label
     steps:
       - name: Assign to project
-        uses: elastic/github-actions/project-assigner@v1.0.1
+        uses: elastic/github-actions/project-assigner@v1.0.2
         id: project_assigner
         with:
           issue-mappings: '[{"label": "Team:AppArch", "projectName": "kibana-app-arch", "columnId": 6173895}, {"label": "Feature:Lens", "projectName": "Lens", "columnId": 6219363}, {"label": "Team:Canvas", "projectName": "canvas", "columnId": 6187593}]'
diff --git a/.i18nrc.json b/.i18nrc.json
index 7d7685b5c1ef1..c171b842254ee 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -26,12 +26,15 @@
       "src/legacy/core_plugins/management",
       "src/plugins/management"
     ],
+    "advancedSettings": "src/plugins/advanced_settings",
+    "kibana_legacy": "src/plugins/kibana_legacy",
     "kibana_react": "src/legacy/core_plugins/kibana_react",
     "kibana-react": "src/plugins/kibana_react",
     "kibana_utils": "src/plugins/kibana_utils",
     "navigation": "src/plugins/navigation",
     "newsfeed": "src/plugins/newsfeed",
     "regionMap": "src/legacy/core_plugins/region_map",
+    "savedObjects": "src/plugins/saved_objects",
     "server": "src/legacy/server",
     "statusPage": "src/legacy/core_plugins/status_page",
     "telemetry": "src/legacy/core_plugins/telemetry",
diff --git a/.node-version b/.node-version
index 06c9b9d306348..5b7269c0a98f3 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-10.18.0
+10.19.0
diff --git a/.nvmrc b/.nvmrc
index 06c9b9d306348..5b7269c0a98f3 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-10.18.0
+10.19.0
diff --git a/NOTICE.txt b/NOTICE.txt
index e0c5d94eff6b3..69be6db72cff2 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -162,8 +162,6 @@ which is available under a "MIT" license. The files based on this license are:
 - windows_priv_escalation_via_accessibility_features.json
 - windows_persistence_via_application_shimming.json
 - windows_execution_via_trusted_developer_utilities.json
-- windows_execution_via_net_com_assemblies.json
-- windows_execution_via_connection_manager.json
 
 MIT License
 
diff --git a/docs/development/core/server/kibana-plugin-server.md b/docs/development/core/server/kibana-plugin-server.md
index a3abeff44c25c..482f014b226b9 100644
--- a/docs/development/core/server/kibana-plugin-server.md
+++ b/docs/development/core/server/kibana-plugin-server.md
@@ -25,6 +25,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsClient](./kibana-plugin-server.savedobjectsclient.md) |  |
 |  [SavedObjectsErrorHelpers](./kibana-plugin-server.savedobjectserrorhelpers.md) |  |
 |  [SavedObjectsRepository](./kibana-plugin-server.savedobjectsrepository.md) |  |
+|  [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md) | A serializer that can be used to manually convert [raw](./kibana-plugin-server.savedobjectsrawdoc.md) or [sanitized](./kibana-plugin-server.savedobjectsanitizeddoc.md) documents to the other kind. |
 |  [ScopedClusterClient](./kibana-plugin-server.scopedclusterclient.md) | Serves the same purpose as "normal" <code>ClusterClient</code> but exposes additional <code>callAsCurrentUser</code> method that doesn't use credentials of the Kibana internal user (as <code>callAsInternalUser</code> does) to request Elasticsearch API, but rather passes HTTP headers extracted from the current user request to the API.<!-- -->See [ScopedClusterClient](./kibana-plugin-server.scopedclusterclient.md)<!-- -->. |
 
 ## Enumerations
@@ -106,6 +107,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [RouteValidatorOptions](./kibana-plugin-server.routevalidatoroptions.md) | Additional options for the RouteValidator class to modify its default behaviour. |
 |  [SavedObject](./kibana-plugin-server.savedobject.md) |  |
 |  [SavedObjectAttributes](./kibana-plugin-server.savedobjectattributes.md) | The data for a Saved Object is stored as an object in the <code>attributes</code> property. |
+|  [SavedObjectMigrationMap](./kibana-plugin-server.savedobjectmigrationmap.md) | A map of [migration functions](./kibana-plugin-server.savedobjectmigrationfn.md) to be used for a given type. The map's keys must be valid semver versions.<!-- -->For a given document, only migrations with a higher version number than that of the document will be applied. Migrations are executed in order, starting from the lowest version and ending with the highest one. |
 |  [SavedObjectReference](./kibana-plugin-server.savedobjectreference.md) | A reference to another saved object. |
 |  [SavedObjectsBaseOptions](./kibana-plugin-server.savedobjectsbaseoptions.md) |  |
 |  [SavedObjectsBulkCreateObject](./kibana-plugin-server.savedobjectsbulkcreateobject.md) |  |
@@ -116,6 +118,8 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsBulkUpdateResponse](./kibana-plugin-server.savedobjectsbulkupdateresponse.md) |  |
 |  [SavedObjectsClientProviderOptions](./kibana-plugin-server.savedobjectsclientprovideroptions.md) | Options to control the creation of the Saved Objects Client. |
 |  [SavedObjectsClientWrapperOptions](./kibana-plugin-server.savedobjectsclientwrapperoptions.md) | Options passed to each SavedObjectsClientWrapperFactory to aid in creating the wrapper instance. |
+|  [SavedObjectsComplexFieldMapping](./kibana-plugin-server.savedobjectscomplexfieldmapping.md) | See [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md) for documentation. |
+|  [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md) | See [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md) for documentation. |
 |  [SavedObjectsCreateOptions](./kibana-plugin-server.savedobjectscreateoptions.md) |  |
 |  [SavedObjectsDeleteByNamespaceOptions](./kibana-plugin-server.savedobjectsdeletebynamespaceoptions.md) |  |
 |  [SavedObjectsDeleteOptions](./kibana-plugin-server.savedobjectsdeleteoptions.md) |  |
@@ -132,6 +136,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsImportUnknownError](./kibana-plugin-server.savedobjectsimportunknownerror.md) | Represents a failure to import due to an unknown reason. |
 |  [SavedObjectsImportUnsupportedTypeError](./kibana-plugin-server.savedobjectsimportunsupportedtypeerror.md) | Represents a failure to import due to having an unsupported saved object type. |
 |  [SavedObjectsIncrementCounterOptions](./kibana-plugin-server.savedobjectsincrementcounteroptions.md) |  |
+|  [SavedObjectsMappingProperties](./kibana-plugin-server.savedobjectsmappingproperties.md) | Describe the fields of a [saved object type](./kibana-plugin-server.savedobjectstypemappingdefinition.md)<!-- -->. |
 |  [SavedObjectsMigrationLogger](./kibana-plugin-server.savedobjectsmigrationlogger.md) |  |
 |  [SavedObjectsMigrationVersion](./kibana-plugin-server.savedobjectsmigrationversion.md) | Information about the migrations that have been applied to this SavedObject. When Kibana starts up, KibanaMigrator detects outdated documents and migrates them based on this value. For each migration that has been applied, the plugin's name is used as a key and the latest migration version as the value. |
 |  [SavedObjectsRawDoc](./kibana-plugin-server.savedobjectsrawdoc.md) | A raw document as represented directly in the saved object index. |
@@ -139,6 +144,8 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsResolveImportErrorsOptions](./kibana-plugin-server.savedobjectsresolveimporterrorsoptions.md) | Options to control the "resolve import" operation. |
 |  [SavedObjectsServiceSetup](./kibana-plugin-server.savedobjectsservicesetup.md) | Saved Objects is Kibana's data persistence mechanism allowing plugins to use Elasticsearch for storing and querying state. The SavedObjectsServiceSetup API exposes methods for creating and registering Saved Object client wrappers. |
 |  [SavedObjectsServiceStart](./kibana-plugin-server.savedobjectsservicestart.md) | Saved Objects is Kibana's data persisentence mechanism allowing plugins to use Elasticsearch for storing and querying state. The SavedObjectsServiceStart API provides a scoped Saved Objects client for interacting with Saved Objects. |
+|  [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) |  |
+|  [SavedObjectsTypeMappingDefinition](./kibana-plugin-server.savedobjectstypemappingdefinition.md) | Describe a saved object type mapping. |
 |  [SavedObjectsUpdateOptions](./kibana-plugin-server.savedobjectsupdateoptions.md) |  |
 |  [SavedObjectsUpdateResponse](./kibana-plugin-server.savedobjectsupdateresponse.md) |  |
 |  [SessionCookieValidationResult](./kibana-plugin-server.sessioncookievalidationresult.md) | Return type from a function to validate cookie contents. |
@@ -218,10 +225,13 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [RouteValidatorFullConfig](./kibana-plugin-server.routevalidatorfullconfig.md) | Route validations config and options merged into one object |
 |  [SavedObjectAttribute](./kibana-plugin-server.savedobjectattribute.md) | Type definition for a Saved Object attribute value |
 |  [SavedObjectAttributeSingle](./kibana-plugin-server.savedobjectattributesingle.md) | Don't use this type, it's simply a helper type for [SavedObjectAttribute](./kibana-plugin-server.savedobjectattribute.md) |
+|  [SavedObjectMigrationFn](./kibana-plugin-server.savedobjectmigrationfn.md) | A migration function defined for a [saved objects type](./kibana-plugin-server.savedobjectstype.md) used to migrate it's  |
+|  [SavedObjectSanitizedDoc](./kibana-plugin-server.savedobjectsanitizeddoc.md) |  |
 |  [SavedObjectsClientContract](./kibana-plugin-server.savedobjectsclientcontract.md) | Saved Objects is Kibana's data persisentence mechanism allowing plugins to use Elasticsearch for storing plugin state.<!-- -->\#\# SavedObjectsClient errors<!-- -->Since the SavedObjectsClient has its hands in everything we are a little paranoid about the way we present errors back to to application code. Ideally, all errors will be either:<!-- -->1. Caused by bad implementation (ie. undefined is not a function) and as such unpredictable 2. An error that has been classified and decorated appropriately by the decorators in [SavedObjectsErrorHelpers](./kibana-plugin-server.savedobjectserrorhelpers.md)<!-- -->Type 1 errors are inevitable, but since all expected/handle-able errors should be Type 2 the <code>isXYZError()</code> helpers exposed at <code>SavedObjectsErrorHelpers</code> should be used to understand and manage error responses from the <code>SavedObjectsClient</code>.<!-- -->Type 2 errors are decorated versions of the source error, so if the elasticsearch client threw an error it will be decorated based on its type. That means that rather than looking for <code>error.body.error.type</code> or doing substring checks on <code>error.body.error.reason</code>, just use the helpers to understand the meaning of the error:<!-- -->\`\`\`<!-- -->js if (SavedObjectsErrorHelpers.isNotFoundError(error)) { // handle 404 }<!-- -->if (SavedObjectsErrorHelpers.isNotAuthorizedError(error)) { // 401 handling should be automatic, but in case you wanted to know }<!-- -->// always rethrow the error unless you handle it throw error; \`\`\`<!-- -->\#\#\# 404s from missing index<!-- -->From the perspective of application code and APIs the SavedObjectsClient is a black box that persists objects. One of the internal details that users have no control over is that we use an elasticsearch index for persistance and that index might be missing.<!-- -->At the time of writing we are in the process of transitioning away from the operating assumption that the SavedObjects index is always available. Part of this transition is handling errors resulting from an index missing. These used to trigger a 500 error in most cases, and in others cause 404s with different error messages.<!-- -->From my (Spencer) perspective, a 404 from the SavedObjectsApi is a 404; The object the request/call was targeting could not be found. This is why \#14141 takes special care to ensure that 404 errors are generic and don't distinguish between index missing or document missing.<!-- -->\#\#\# 503s from missing index<!-- -->Unlike all other methods, create requests are supposed to succeed even when the Kibana index does not exist because it will be automatically created by elasticsearch. When that is not the case it is because Elasticsearch's <code>action.auto_create_index</code> setting prevents it from being created automatically so we throw a special 503 with the intention of informing the user that their Elasticsearch settings need to be updated.<!-- -->See [SavedObjectsClient](./kibana-plugin-server.savedobjectsclient.md) See [SavedObjectsErrorHelpers](./kibana-plugin-server.savedobjectserrorhelpers.md) |
 |  [SavedObjectsClientFactory](./kibana-plugin-server.savedobjectsclientfactory.md) | Describes the factory used to create instances of the Saved Objects Client. |
 |  [SavedObjectsClientFactoryProvider](./kibana-plugin-server.savedobjectsclientfactoryprovider.md) | Provider to invoke to retrieve a [SavedObjectsClientFactory](./kibana-plugin-server.savedobjectsclientfactory.md)<!-- -->. |
 |  [SavedObjectsClientWrapperFactory](./kibana-plugin-server.savedobjectsclientwrapperfactory.md) | Describes the factory used to create instances of Saved Objects Client Wrappers. |
+|  [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md) | Describe a [saved object type mapping](./kibana-plugin-server.savedobjectstypemappingdefinition.md) field.<!-- -->Please refer to [elasticsearch documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) For the mapping documentation |
 |  [ScopeableRequest](./kibana-plugin-server.scopeablerequest.md) | A user credentials container. It accommodates the necessary auth credentials to impersonate the current user.<!-- -->See [KibanaRequest](./kibana-plugin-server.kibanarequest.md)<!-- -->. |
 |  [SharedGlobalConfig](./kibana-plugin-server.sharedglobalconfig.md) |  |
 |  [StringValidation](./kibana-plugin-server.stringvalidation.md) | Allows regex objects or a regex string |
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectmigrationfn.md b/docs/development/core/server/kibana-plugin-server.savedobjectmigrationfn.md
new file mode 100644
index 0000000000000..629d748083737
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectmigrationfn.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectMigrationFn](./kibana-plugin-server.savedobjectmigrationfn.md)
+
+## SavedObjectMigrationFn type
+
+A migration function defined for a [saved objects type](./kibana-plugin-server.savedobjectstype.md) used to migrate it's 
+
+<b>Signature:</b>
+
+```typescript
+export declare type SavedObjectMigrationFn = (doc: SavedObjectUnsanitizedDoc, log: SavedObjectsMigrationLogger) => SavedObjectUnsanitizedDoc;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectmigrationmap.md b/docs/development/core/server/kibana-plugin-server.savedobjectmigrationmap.md
new file mode 100644
index 0000000000000..1f49b44f73a72
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectmigrationmap.md
@@ -0,0 +1,27 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectMigrationMap](./kibana-plugin-server.savedobjectmigrationmap.md)
+
+## SavedObjectMigrationMap interface
+
+A map of [migration functions](./kibana-plugin-server.savedobjectmigrationfn.md) to be used for a given type. The map's keys must be valid semver versions.
+
+For a given document, only migrations with a higher version number than that of the document will be applied. Migrations are executed in order, starting from the lowest version and ending with the highest one.
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectMigrationMap 
+```
+
+## Example
+
+
+```typescript
+const migrations: SavedObjectMigrationMap = {
+  '1.0.0': migrateToV1,
+  '2.1.0': migrateToV21
+}
+
+```
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsanitizeddoc.md b/docs/development/core/server/kibana-plugin-server.savedobjectsanitizeddoc.md
new file mode 100644
index 0000000000000..3c7cd591cd41b
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsanitizeddoc.md
@@ -0,0 +1,12 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectSanitizedDoc](./kibana-plugin-server.savedobjectsanitizeddoc.md)
+
+## SavedObjectSanitizedDoc type
+
+
+<b>Signature:</b>
+
+```typescript
+export declare type SavedObjectSanitizedDoc = SavedObjectDoc & Referencable;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.dynamic.md b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.dynamic.md
new file mode 100644
index 0000000000000..44e548c611b02
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.dynamic.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsComplexFieldMapping](./kibana-plugin-server.savedobjectscomplexfieldmapping.md) &gt; [dynamic](./kibana-plugin-server.savedobjectscomplexfieldmapping.dynamic.md)
+
+## SavedObjectsComplexFieldMapping.dynamic property
+
+<b>Signature:</b>
+
+```typescript
+dynamic?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.md b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.md
new file mode 100644
index 0000000000000..ecb5ec0e88911
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsComplexFieldMapping](./kibana-plugin-server.savedobjectscomplexfieldmapping.md)
+
+## SavedObjectsComplexFieldMapping interface
+
+See [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md) for documentation.
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectsComplexFieldMapping 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [dynamic](./kibana-plugin-server.savedobjectscomplexfieldmapping.dynamic.md) | <code>string</code> |  |
+|  [properties](./kibana-plugin-server.savedobjectscomplexfieldmapping.properties.md) | <code>SavedObjectsMappingProperties</code> |  |
+|  [type](./kibana-plugin-server.savedobjectscomplexfieldmapping.type.md) | <code>string</code> |  |
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.properties.md b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.properties.md
new file mode 100644
index 0000000000000..7ceb0f8ee43c5
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.properties.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsComplexFieldMapping](./kibana-plugin-server.savedobjectscomplexfieldmapping.md) &gt; [properties](./kibana-plugin-server.savedobjectscomplexfieldmapping.properties.md)
+
+## SavedObjectsComplexFieldMapping.properties property
+
+<b>Signature:</b>
+
+```typescript
+properties: SavedObjectsMappingProperties;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.type.md b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.type.md
new file mode 100644
index 0000000000000..ef0db5123c927
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscomplexfieldmapping.type.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsComplexFieldMapping](./kibana-plugin-server.savedobjectscomplexfieldmapping.md) &gt; [type](./kibana-plugin-server.savedobjectscomplexfieldmapping.type.md)
+
+## SavedObjectsComplexFieldMapping.type property
+
+<b>Signature:</b>
+
+```typescript
+type?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.enabled.md b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.enabled.md
new file mode 100644
index 0000000000000..b7e4203977763
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.enabled.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md) &gt; [enabled](./kibana-plugin-server.savedobjectscorefieldmapping.enabled.md)
+
+## SavedObjectsCoreFieldMapping.enabled property
+
+<b>Signature:</b>
+
+```typescript
+enabled?: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.fields.md b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.fields.md
new file mode 100644
index 0000000000000..880ef36cd73fc
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.fields.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md) &gt; [fields](./kibana-plugin-server.savedobjectscorefieldmapping.fields.md)
+
+## SavedObjectsCoreFieldMapping.fields property
+
+<b>Signature:</b>
+
+```typescript
+fields?: {
+        [subfield: string]: {
+            type: string;
+        };
+    };
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.index.md b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.index.md
new file mode 100644
index 0000000000000..31ff5a1d51948
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.index.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md) &gt; [index](./kibana-plugin-server.savedobjectscorefieldmapping.index.md)
+
+## SavedObjectsCoreFieldMapping.index property
+
+<b>Signature:</b>
+
+```typescript
+index?: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.md b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.md
new file mode 100644
index 0000000000000..4287921997098
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.md
@@ -0,0 +1,23 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md)
+
+## SavedObjectsCoreFieldMapping interface
+
+See [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md) for documentation.
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectsCoreFieldMapping 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [enabled](./kibana-plugin-server.savedobjectscorefieldmapping.enabled.md) | <code>boolean</code> |  |
+|  [fields](./kibana-plugin-server.savedobjectscorefieldmapping.fields.md) | <code>{</code><br/><code>        [subfield: string]: {</code><br/><code>            type: string;</code><br/><code>        };</code><br/><code>    }</code> |  |
+|  [index](./kibana-plugin-server.savedobjectscorefieldmapping.index.md) | <code>boolean</code> |  |
+|  [type](./kibana-plugin-server.savedobjectscorefieldmapping.type.md) | <code>string</code> |  |
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.type.md b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.type.md
new file mode 100644
index 0000000000000..8071217af861f
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectscorefieldmapping.type.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsCoreFieldMapping](./kibana-plugin-server.savedobjectscorefieldmapping.md) &gt; [type](./kibana-plugin-server.savedobjectscorefieldmapping.type.md)
+
+## SavedObjectsCoreFieldMapping.type property
+
+<b>Signature:</b>
+
+```typescript
+type: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsfieldmapping.md b/docs/development/core/server/kibana-plugin-server.savedobjectsfieldmapping.md
new file mode 100644
index 0000000000000..f31e18e8df670
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsfieldmapping.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsFieldMapping](./kibana-plugin-server.savedobjectsfieldmapping.md)
+
+## SavedObjectsFieldMapping type
+
+Describe a [saved object type mapping](./kibana-plugin-server.savedobjectstypemappingdefinition.md) field.
+
+Please refer to [elasticsearch documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) For the mapping documentation
+
+<b>Signature:</b>
+
+```typescript
+export declare type SavedObjectsFieldMapping = SavedObjectsCoreFieldMapping | SavedObjectsComplexFieldMapping;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsmappingproperties.md b/docs/development/core/server/kibana-plugin-server.savedobjectsmappingproperties.md
new file mode 100644
index 0000000000000..23c5a83afc1f8
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsmappingproperties.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsMappingProperties](./kibana-plugin-server.savedobjectsmappingproperties.md)
+
+## SavedObjectsMappingProperties interface
+
+Describe the fields of a [saved object type](./kibana-plugin-server.savedobjectstypemappingdefinition.md)<!-- -->.
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectsMappingProperties 
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.md b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.md
index a98d88700cd55..1b8db4a6c9f8d 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.md
@@ -17,5 +17,6 @@ export interface SavedObjectsMigrationLogger
 |  --- | --- | --- |
 |  [debug](./kibana-plugin-server.savedobjectsmigrationlogger.debug.md) | <code>(msg: string) =&gt; void</code> |  |
 |  [info](./kibana-plugin-server.savedobjectsmigrationlogger.info.md) | <code>(msg: string) =&gt; void</code> |  |
+|  [warn](./kibana-plugin-server.savedobjectsmigrationlogger.warn.md) | <code>(msg: string) =&gt; void</code> |  |
 |  [warning](./kibana-plugin-server.savedobjectsmigrationlogger.warning.md) | <code>(msg: string) =&gt; void</code> |  |
 
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warn.md b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warn.md
new file mode 100644
index 0000000000000..7ebb1dd5ee4d2
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warn.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsMigrationLogger](./kibana-plugin-server.savedobjectsmigrationlogger.md) &gt; [warn](./kibana-plugin-server.savedobjectsmigrationlogger.warn.md)
+
+## SavedObjectsMigrationLogger.warn property
+
+<b>Signature:</b>
+
+```typescript
+warn: (msg: string) => void;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warning.md b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warning.md
index a87955d603b70..689a799515094 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warning.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsmigrationlogger.warning.md
@@ -4,6 +4,11 @@
 
 ## SavedObjectsMigrationLogger.warning property
 
+> Warning: This API is now obsolete.
+> 
+> Use `warn` instead.
+> 
+
 <b>Signature:</b>
 
 ```typescript
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc._source.md b/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc._source.md
index dcf207f8120ea..332df982b23eb 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc._source.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc._source.md
@@ -7,5 +7,5 @@
 <b>Signature:</b>
 
 ```typescript
-_source: any;
+_source: SavedObjectsRawDocSource;
 ```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc.md b/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc.md
index b0130df01817f..3e3ad7da5aecd 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsrawdoc.md
@@ -9,7 +9,7 @@ A raw document as represented directly in the saved object index.
 <b>Signature:</b>
 
 ```typescript
-export interface RawDoc 
+export interface SavedObjectsRawDoc 
 ```
 
 ## Properties
@@ -19,6 +19,6 @@ export interface RawDoc
 |  [\_id](./kibana-plugin-server.savedobjectsrawdoc._id.md) | <code>string</code> |  |
 |  [\_primary\_term](./kibana-plugin-server.savedobjectsrawdoc._primary_term.md) | <code>number</code> |  |
 |  [\_seq\_no](./kibana-plugin-server.savedobjectsrawdoc._seq_no.md) | <code>number</code> |  |
-|  [\_source](./kibana-plugin-server.savedobjectsrawdoc._source.md) | <code>any</code> |  |
+|  [\_source](./kibana-plugin-server.savedobjectsrawdoc._source.md) | <code>SavedObjectsRawDocSource</code> |  |
 |  [\_type](./kibana-plugin-server.savedobjectsrawdoc._type.md) | <code>string</code> |  |
 
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.generaterawid.md b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.generaterawid.md
new file mode 100644
index 0000000000000..50fb4433b33c8
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.generaterawid.md
@@ -0,0 +1,26 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md) &gt; [generateRawId](./kibana-plugin-server.savedobjectsserializer.generaterawid.md)
+
+## SavedObjectsSerializer.generateRawId() method
+
+Given a saved object type and id, generates the compound id that is stored in the raw document.
+
+<b>Signature:</b>
+
+```typescript
+generateRawId(namespace: string | undefined, type: string, id?: string): string;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  namespace | <code>string &#124; undefined</code> |  |
+|  type | <code>string</code> |  |
+|  id | <code>string</code> |  |
+
+<b>Returns:</b>
+
+`string`
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.israwsavedobject.md b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.israwsavedobject.md
new file mode 100644
index 0000000000000..32d00ee1a9f7f
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.israwsavedobject.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md) &gt; [isRawSavedObject](./kibana-plugin-server.savedobjectsserializer.israwsavedobject.md)
+
+## SavedObjectsSerializer.isRawSavedObject() method
+
+Determines whether or not the raw document can be converted to a saved object.
+
+<b>Signature:</b>
+
+```typescript
+isRawSavedObject(rawDoc: SavedObjectsRawDoc): boolean;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  rawDoc | <code>SavedObjectsRawDoc</code> |  |
+
+<b>Returns:</b>
+
+`boolean`
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.md b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.md
new file mode 100644
index 0000000000000..5fa84af147b40
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.md
@@ -0,0 +1,29 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md)
+
+## SavedObjectsSerializer class
+
+A serializer that can be used to manually convert [raw](./kibana-plugin-server.savedobjectsrawdoc.md) or [sanitized](./kibana-plugin-server.savedobjectsanitizeddoc.md) documents to the other kind.
+
+<b>Signature:</b>
+
+```typescript
+export declare class SavedObjectsSerializer 
+```
+
+## Remarks
+
+Serializer instances should only be created and accessed by calling [SavedObjectsServiceStart.createSerializer](./kibana-plugin-server.savedobjectsservicestart.createserializer.md)
+
+The constructor for this class is marked as internal. Third-party code should not call the constructor directly or create subclasses that extend the `SavedObjectsSerializer` class.
+
+## Methods
+
+|  Method | Modifiers | Description |
+|  --- | --- | --- |
+|  [generateRawId(namespace, type, id)](./kibana-plugin-server.savedobjectsserializer.generaterawid.md) |  | Given a saved object type and id, generates the compound id that is stored in the raw document. |
+|  [isRawSavedObject(rawDoc)](./kibana-plugin-server.savedobjectsserializer.israwsavedobject.md) |  | Determines whether or not the raw document can be converted to a saved object. |
+|  [rawToSavedObject(doc)](./kibana-plugin-server.savedobjectsserializer.rawtosavedobject.md) |  | Converts a document from the format that is stored in elasticsearch to the saved object client format. |
+|  [savedObjectToRaw(savedObj)](./kibana-plugin-server.savedobjectsserializer.savedobjecttoraw.md) |  | Converts a document from the saved object client format to the format that is stored in elasticsearch. |
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.rawtosavedobject.md b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.rawtosavedobject.md
new file mode 100644
index 0000000000000..6a8a006241297
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.rawtosavedobject.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md) &gt; [rawToSavedObject](./kibana-plugin-server.savedobjectsserializer.rawtosavedobject.md)
+
+## SavedObjectsSerializer.rawToSavedObject() method
+
+Converts a document from the format that is stored in elasticsearch to the saved object client format.
+
+<b>Signature:</b>
+
+```typescript
+rawToSavedObject(doc: SavedObjectsRawDoc): SavedObjectSanitizedDoc;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  doc | <code>SavedObjectsRawDoc</code> |  |
+
+<b>Returns:</b>
+
+`SavedObjectSanitizedDoc`
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.savedobjecttoraw.md b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.savedobjecttoraw.md
new file mode 100644
index 0000000000000..b0d2043665b54
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsserializer.savedobjecttoraw.md
@@ -0,0 +1,24 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsSerializer](./kibana-plugin-server.savedobjectsserializer.md) &gt; [savedObjectToRaw](./kibana-plugin-server.savedobjectsserializer.savedobjecttoraw.md)
+
+## SavedObjectsSerializer.savedObjectToRaw() method
+
+Converts a document from the saved object client format to the format that is stored in elasticsearch.
+
+<b>Signature:</b>
+
+```typescript
+savedObjectToRaw(savedObj: SavedObjectSanitizedDoc): SavedObjectsRawDoc;
+```
+
+## Parameters
+
+|  Parameter | Type | Description |
+|  --- | --- | --- |
+|  savedObj | <code>SavedObjectSanitizedDoc</code> |  |
+
+<b>Returns:</b>
+
+`SavedObjectsRawDoc`
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsservicesetup.md b/docs/development/core/server/kibana-plugin-server.savedobjectsservicesetup.md
index 64fb1f4a5f638..9981bfee0cb7d 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsservicesetup.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsservicesetup.md
@@ -20,9 +20,19 @@ When plugins access the Saved Objects client, a new client is created using the
 
 ## Example
 
+
+```ts
 import { SavedObjectsClient, CoreSetup } from 'src/core/server';
 
-export class Plugin() { setup: (core: CoreSetup) =<!-- -->&gt; { core.savedObjects.setClientFactory((<!-- -->{ request: KibanaRequest }<!-- -->) =<!-- -->&gt; { return new SavedObjectsClient(core.savedObjects.scopedRepository(request)); }<!-- -->) } }
+export class Plugin() {
+  setup: (core: CoreSetup) => {
+    core.savedObjects.setClientFactory(({ request: KibanaRequest }) => {
+      return new SavedObjectsClient(core.savedObjects.scopedRepository(request));
+    })
+  }
+}
+
+```
 
 ## Properties
 
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.createserializer.md b/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.createserializer.md
new file mode 100644
index 0000000000000..b0e7ae1db89c1
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.createserializer.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsServiceStart](./kibana-plugin-server.savedobjectsservicestart.md) &gt; [createSerializer](./kibana-plugin-server.savedobjectsservicestart.createserializer.md)
+
+## SavedObjectsServiceStart.createSerializer property
+
+Creates a [serializer](./kibana-plugin-server.savedobjectsserializer.md) that is aware of all registered types.
+
+<b>Signature:</b>
+
+```typescript
+createSerializer: () => SavedObjectsSerializer;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.md b/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.md
index cf2b4f57a7461..ad34d76bb33f4 100644
--- a/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.md
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectsservicestart.md
@@ -18,5 +18,6 @@ export interface SavedObjectsServiceStart
 |  --- | --- | --- |
 |  [createInternalRepository](./kibana-plugin-server.savedobjectsservicestart.createinternalrepository.md) | <code>(extraTypes?: string[]) =&gt; ISavedObjectsRepository</code> | Creates a [Saved Objects repository](./kibana-plugin-server.isavedobjectsrepository.md) that uses the internal Kibana user for authenticating with Elasticsearch. |
 |  [createScopedRepository](./kibana-plugin-server.savedobjectsservicestart.createscopedrepository.md) | <code>(req: KibanaRequest, extraTypes?: string[]) =&gt; ISavedObjectsRepository</code> | Creates a [Saved Objects repository](./kibana-plugin-server.isavedobjectsrepository.md) that uses the credentials from the passed in request to authenticate with Elasticsearch. |
+|  [createSerializer](./kibana-plugin-server.savedobjectsservicestart.createserializer.md) | <code>() =&gt; SavedObjectsSerializer</code> | Creates a [serializer](./kibana-plugin-server.savedobjectsserializer.md) that is aware of all registered types. |
 |  [getScopedClient](./kibana-plugin-server.savedobjectsservicestart.getscopedclient.md) | <code>(req: KibanaRequest, options?: SavedObjectsClientProviderOptions) =&gt; SavedObjectsClientContract</code> | Creates a [Saved Objects client](./kibana-plugin-server.savedobjectsclientcontract.md) that uses the credentials from the passed in request to authenticate with Elasticsearch. If other plugins have registered Saved Objects client wrappers, these will be applied to extend the functionality of the client.<!-- -->A client that is already scoped to the incoming request is also exposed from the route handler context see [RequestHandlerContext](./kibana-plugin-server.requesthandlercontext.md)<!-- -->. |
 
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.converttoaliasscript.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.converttoaliasscript.md
new file mode 100644
index 0000000000000..f2519b2600e2f
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.converttoaliasscript.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [convertToAliasScript](./kibana-plugin-server.savedobjectstype.converttoaliasscript.md)
+
+## SavedObjectsType.convertToAliasScript property
+
+If defined, will be used to convert the type to an alias.
+
+<b>Signature:</b>
+
+```typescript
+convertToAliasScript?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.hidden.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.hidden.md
new file mode 100644
index 0000000000000..9e611bc8faf27
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.hidden.md
@@ -0,0 +1,15 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [hidden](./kibana-plugin-server.savedobjectstype.hidden.md)
+
+## SavedObjectsType.hidden property
+
+Is the type hidden by default. If true, repositories will not have access to this type unless explicitly declared as an `extraType` when creating the repository.
+
+See [createInternalRepository](./kibana-plugin-server.savedobjectsservicestart.createinternalrepository.md)<!-- -->.
+
+<b>Signature:</b>
+
+```typescript
+hidden: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.indexpattern.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.indexpattern.md
new file mode 100644
index 0000000000000..18cb6fe936060
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.indexpattern.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [indexPattern](./kibana-plugin-server.savedobjectstype.indexpattern.md)
+
+## SavedObjectsType.indexPattern property
+
+If defined, the type instances will be stored in the given index instead of the default one.
+
+<b>Signature:</b>
+
+```typescript
+indexPattern?: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.mappings.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.mappings.md
new file mode 100644
index 0000000000000..3166a2604d728
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.mappings.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [mappings](./kibana-plugin-server.savedobjectstype.mappings.md)
+
+## SavedObjectsType.mappings property
+
+The [mapping definition](./kibana-plugin-server.savedobjectstypemappingdefinition.md) for the type.
+
+<b>Signature:</b>
+
+```typescript
+mappings: SavedObjectsTypeMappingDefinition;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.md
new file mode 100644
index 0000000000000..1e989652e52bf
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.md
@@ -0,0 +1,28 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md)
+
+## SavedObjectsType interface
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectsType 
+```
+
+## Remarks
+
+This is only internal for now, and will only be public when we expose the registerType API
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [convertToAliasScript](./kibana-plugin-server.savedobjectstype.converttoaliasscript.md) | <code>string</code> | If defined, will be used to convert the type to an alias. |
+|  [hidden](./kibana-plugin-server.savedobjectstype.hidden.md) | <code>boolean</code> | Is the type hidden by default. If true, repositories will not have access to this type unless explicitly declared as an <code>extraType</code> when creating the repository.<!-- -->See [createInternalRepository](./kibana-plugin-server.savedobjectsservicestart.createinternalrepository.md)<!-- -->. |
+|  [indexPattern](./kibana-plugin-server.savedobjectstype.indexpattern.md) | <code>string</code> | If defined, the type instances will be stored in the given index instead of the default one. |
+|  [mappings](./kibana-plugin-server.savedobjectstype.mappings.md) | <code>SavedObjectsTypeMappingDefinition</code> | The [mapping definition](./kibana-plugin-server.savedobjectstypemappingdefinition.md) for the type. |
+|  [migrations](./kibana-plugin-server.savedobjectstype.migrations.md) | <code>SavedObjectMigrationMap</code> | An optional map of [migrations](./kibana-plugin-server.savedobjectmigrationfn.md) to be used to migrate the type. |
+|  [name](./kibana-plugin-server.savedobjectstype.name.md) | <code>string</code> | The name of the type, which is also used as the internal id. |
+|  [namespaceAgnostic](./kibana-plugin-server.savedobjectstype.namespaceagnostic.md) | <code>boolean</code> | Is the type global (true), or namespaced (false). |
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.migrations.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.migrations.md
new file mode 100644
index 0000000000000..a7f933ef6e3f7
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.migrations.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [migrations](./kibana-plugin-server.savedobjectstype.migrations.md)
+
+## SavedObjectsType.migrations property
+
+An optional map of [migrations](./kibana-plugin-server.savedobjectmigrationfn.md) to be used to migrate the type.
+
+<b>Signature:</b>
+
+```typescript
+migrations?: SavedObjectMigrationMap;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.name.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.name.md
new file mode 100644
index 0000000000000..444152d239cdf
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.name.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [name](./kibana-plugin-server.savedobjectstype.name.md)
+
+## SavedObjectsType.name property
+
+The name of the type, which is also used as the internal id.
+
+<b>Signature:</b>
+
+```typescript
+name: string;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstype.namespaceagnostic.md b/docs/development/core/server/kibana-plugin-server.savedobjectstype.namespaceagnostic.md
new file mode 100644
index 0000000000000..5c68942276ec7
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstype.namespaceagnostic.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsType](./kibana-plugin-server.savedobjectstype.md) &gt; [namespaceAgnostic](./kibana-plugin-server.savedobjectstype.namespaceagnostic.md)
+
+## SavedObjectsType.namespaceAgnostic property
+
+Is the type global (true), or namespaced (false).
+
+<b>Signature:</b>
+
+```typescript
+namespaceAgnostic: boolean;
+```
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.md b/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.md
new file mode 100644
index 0000000000000..99983d3a9f02b
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.md
@@ -0,0 +1,45 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsTypeMappingDefinition](./kibana-plugin-server.savedobjectstypemappingdefinition.md)
+
+## SavedObjectsTypeMappingDefinition interface
+
+Describe a saved object type mapping.
+
+<b>Signature:</b>
+
+```typescript
+export interface SavedObjectsTypeMappingDefinition 
+```
+
+## Example
+
+
+```ts
+const typeDefinition: SavedObjectsTypeMappingDefinition = {
+  properties: {
+    enabled: {
+      type: "boolean"
+    },
+    sendUsageFrom: {
+      ignore_above: 256,
+      type: "keyword"
+    },
+    lastReported: {
+      type: "date"
+    },
+    lastVersionChecked: {
+      ignore_above: 256,
+      type: "keyword"
+    },
+  }
+}
+
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [properties](./kibana-plugin-server.savedobjectstypemappingdefinition.properties.md) | <code>SavedObjectsMappingProperties</code> |  |
+
diff --git a/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.properties.md b/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.properties.md
new file mode 100644
index 0000000000000..555870c3fdd7d
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-server.savedobjectstypemappingdefinition.properties.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsTypeMappingDefinition](./kibana-plugin-server.savedobjectstypemappingdefinition.md) &gt; [properties](./kibana-plugin-server.savedobjectstypemappingdefinition.properties.md)
+
+## SavedObjectsTypeMappingDefinition.properties property
+
+<b>Signature:</b>
+
+```typescript
+properties: SavedObjectsMappingProperties;
+```
diff --git a/docs/images/management-index-patterns.png b/docs/images/management-index-patterns.png
new file mode 100644
index 0000000000000..232d32893b96d
Binary files /dev/null and b/docs/images/management-index-patterns.png differ
diff --git a/docs/management/advanced-options.asciidoc b/docs/management/advanced-options.asciidoc
index 695a4d4f45b02..8a10a2bde3b44 100644
--- a/docs/management/advanced-options.asciidoc
+++ b/docs/management/advanced-options.asciidoc
@@ -1,7 +1,7 @@
 [[advanced-options]]
-== Setting advanced options
+== Advanced Settings
 
-The *Advanced Settings* page enables you to directly edit settings that control the behavior of the Kibana application.
+The *Advanced Settings* UI enables you to edit settings that control the behavior of Kibana.
 For example, you can change the format used to display dates, specify the default index pattern, and set the precision
 for displayed decimal values.
 
@@ -69,6 +69,9 @@ into the document when displaying it.
 `metrics:max_buckets`:: The maximum numbers of buckets that a single
 data source can return. This might arise when the user selects a
 short interval (for example, 1s) for a long time period (1 year).
+`pageNavigation`:: The style of navigation menu for Kibana.
+Choices are Individual, the legacy style where every plugin is represented in the nav,
+and Grouped, a new format that bundles related plugins together in nested navigation.
 `query:allowLeadingWildcards`:: Allows a wildcard (*) as the first character
 in a query clause. Only applies when experimental query features are
 enabled in the query bar. To disallow leading wildcards in Lucene queries,
diff --git a/docs/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc b/docs/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc
index 79bd0b8be3ce9..ba1d79710de05 100644
--- a/docs/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc
+++ b/docs/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc
@@ -1,30 +1,30 @@
 [role="xpack"]
 [[index-lifecycle-policies]]
-== Index lifecycle policies
+== Index Lifecycle Policies
 
-If you're working with time series data, you don't want to continually dump 
-everything into a single index. Instead, you might periodically roll over the 
-data to a new index to keep it from growing so big it's slow and expensive. 
-As the index ages and you query it less frequently, you’ll likely move it to 
+If you're working with time series data, you don't want to continually dump
+everything into a single index. Instead, you might periodically roll over the
+data to a new index to keep it from growing so big it's slow and expensive.
+As the index ages and you query it less frequently, you’ll likely move it to
 less expensive hardware and reduce the number of shards and replicas.
 
-To automatically move an index through its lifecycle, you can create a policy 
-to define actions to perform on the index as it ages. Index lifecycle policies 
-are especially useful when working with {beats-ref}/beats-reference.html[Beats] 
-data shippers, which continually 
-send operational data, such as metrics and logs, to Elasticsearch. You can 
-automate a rollover to a new index when the existing index reaches a specified 
-size or age.  This ensures that all indices have a similar size instead of having 
-daily indices where size can vary based on the number of Beats and the number 
+To automatically move an index through its lifecycle, you can create a policy
+to define actions to perform on the index as it ages. Index lifecycle policies
+are especially useful when working with {beats-ref}/beats-reference.html[Beats]
+data shippers, which continually
+send operational data, such as metrics and logs, to Elasticsearch. You can
+automate a rollover to a new index when the existing index reaches a specified
+size or age.  This ensures that all indices have a similar size instead of having
+daily indices where size can vary based on the number of Beats and the number
 of events sent.
 
-{kib}’s *Index Lifecycle Policies* walks you through the process for creating 
-and configuring a policy. Before using this feature, you should be familiar 
+{kib}’s *Index Lifecycle Policies* walks you through the process for creating
+and configuring a policy. Before using this feature, you should be familiar
 with index lifecycle management:
 
-* For an introduction, see 
-{ref}/getting-started-index-lifecycle-management.html[Getting started with index 
-lifecycle management].  
-* To dig into the concepts and technical details, see 
+* For an introduction, refer to
+{ref}/getting-started-index-lifecycle-management.html[Getting started with index
+lifecycle management].
+* To dig into the concepts and technical details, see
 {ref}/index-lifecycle-management.html[Managing the index lifecycle].
 * To check out the APIs, see {ref}/index-lifecycle-management-api.html[Index lifecycle management API].
diff --git a/docs/management/index-patterns.asciidoc b/docs/management/index-patterns.asciidoc
index 8e687f641c92b..d8073e4590c3c 100644
--- a/docs/management/index-patterns.asciidoc
+++ b/docs/management/index-patterns.asciidoc
@@ -89,39 +89,11 @@ pattern: `*:logstash-*`.
 Once an index pattern is configured using the {ccs} syntax, all searches and
 aggregations using that index pattern in {kib} take advantage of {ccs}.
 
+
 [float]
+[[reload-fields]]
 === Manage your index pattern
 
-Once you create an index pattern, manually or with a sample data set,
-you can look at its fields and associated data types.
-You can also perform housekeeping tasks, such as making the
-index pattern the default or deleting it when you longer need it.
-To drill down into the details of an index pattern, click its name in
-the *Index patterns* overview.
-
-[role="screenshot"]
-image:management/index-patterns/images/new-index-pattern.png["Index files and data types"]
-
-From the detailed view, you can perform the following actions:
-
-* *Manage the index fields.* You can add formatters to format values and create
-scripted fields.
-See <<managing-fields, Managing fields>> for more information.
-
-* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
-aware of which index pattern is the default. The first pattern
-you create is automatically designated as the default pattern. The default
-index pattern is loaded when you open *Discover*.
-
-* [[reload-fields]]*Refresh the index fields list.* You can refresh the index fields list to
-pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
-for the fields. The popularity counters are used in *Discover* to sort fields in lists.
-
-* [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
-Saved Objects in {kib}. You will not be able to recover field formatters,
-scripted fields, source filters, and field popularity data associated with the index pattern.
-Deleting an index pattern does
-not remove any indices or data documents from {es}.
-+
-WARNING: Deleting an index pattern breaks all visualizations, saved searches, and
-other saved objects that reference the pattern.
+To drill down into the fields and associated data types in an index pattern,
+click its name in the *Index patterns* overview page.
+For more information, refer to <<managing-fields, Index Patterns and Fields>>.
diff --git a/docs/management/index-patterns/images/edit_icon.png b/docs/management/index-patterns/images/edit_icon.png
new file mode 100644
index 0000000000000..d5af1751809cc
Binary files /dev/null and b/docs/management/index-patterns/images/edit_icon.png differ
diff --git a/docs/management/managing-beats.asciidoc b/docs/management/managing-beats.asciidoc
index 13e8f52f29b87..5a23b60307131 100644
--- a/docs/management/managing-beats.asciidoc
+++ b/docs/management/managing-beats.asciidoc
@@ -1,6 +1,6 @@
 [[managing-beats]]
 [role="xpack"]
-== Managing {beats}
+== {beats} Central Management
 
 include::{asciidoc-dir}/../../shared/discontinued.asciidoc[tag=cm-discontinued]
 
@@ -34,14 +34,14 @@ Central Management UI.
 
 You need to enroll {beats} to register them in central management and establish
 trust. Enrolled {beats} will have the credentials needed to retrieve
-configurations from {kib}. 
+configurations from {kib}.
 
 [float]
 === Create configuration tags
 
 A _configuration tag_ is a group of configuration blocks that you can apply to
 one or more {beats}. For example, you can create a tag called `development` to
-group configurations for {beats} running in your development environment. 
+group configurations for {beats} running in your development environment.
 
 The first time you walk through the enrollment process, you'll create a
 configuration tag that's applied to the {beats} instance you're enrolling.
@@ -62,7 +62,7 @@ Central management supports configuration settings for:
 * {filebeat} modules
 * {metricbeat} modules
 * {filebeat} inputs
-* {filebeat} and {metricbeat} outputs 
+* {filebeat} and {metricbeat} outputs
 
 NOTE: Central management supports the following outputs only: {es}, {ls}, Kafka,
 and Redis. Other output types are not supported for {beats} that are enrolled in
@@ -72,7 +72,7 @@ Use the Central Management UI to define and manage settings for supported
 configuration blocks. You cannot define those settings in local {beats}
 configuration files. For configuration blocks that are not supported by central
 management, configure the settings in the local configuration file after
-enrolling the Beat in central management. 
+enrolling the Beat in central management.
 
 [float]
 === Manage enrolled {beats}
diff --git a/docs/management/managing-fields.asciidoc b/docs/management/managing-fields.asciidoc
index 308e61abf70e5..f66976b3715d1 100644
--- a/docs/management/managing-fields.asciidoc
+++ b/docs/management/managing-fields.asciidoc
@@ -1,12 +1,56 @@
 [[managing-fields]]
-== Managing Fields
+== Index Patterns and Fields
 
-The fields for the index pattern are listed in a table. Click a column header to sort the table by that column. Click
-the *Controls* button in the rightmost column for a given field to edit the field's properties. You can manually set
-the field's format from the *Format* drop-down. Format options vary based on the field's type.
+The *Index patterns* UI helps you create and manage
+the index patterns that retrieve your data from Elasticsearch.
 
-You can also set the field's popularity value in the *Popularity* text entry box to any desired value. Click the
-*Update Field* button to confirm your changes or *Cancel* to return to the list of fields.
+[role="screenshot"]
+image::images/management-index-patterns.png[]
+
+[float]
+=== Create an index pattern
+
+An index pattern is the glue that connects Kibana to your Elasticsearch data. Create an
+index pattern whenever you load your own data into Kibana. To get started,
+click *Create index pattern*, and then follow the guided steps. Refer to
+<<index-patterns, Creating an index pattern>> for the types of index patterns
+that you can create.
+
+[float]
+=== Manage your index pattern
+
+To view the fields and associated data types in an index pattern, click its name in
+the *Index patterns* overview.
+
+[role="screenshot"]
+image::management/index-patterns/images/new-index-pattern.png["Index files and data types"]
+
+Use the icons in the upper right to perform the following actions:
+
+* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
+aware of which index pattern is the default. The first pattern
+you create is automatically designated as the default pattern. The default
+index pattern is loaded when you open *Discover*.
+
+* *Refresh the index fields list.* You can refresh the index fields list to
+pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
+for the fields. The popularity counters are used in *Discover* to sort fields in lists.
+
+* [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
+Saved Objects in {kib}. You will not be able to recover field formatters,
+scripted fields, source filters, and field popularity data associated with the index pattern.
+Deleting an index pattern does
+not remove any indices or data documents from {es}.
++
+WARNING: Deleting an index pattern breaks all visualizations, saved searches, and
+other saved objects that reference the pattern.
+
+[float]
+=== Edit a field
+
+To edit a field's properties, click the edit icon
+image:management/index-patterns/images/edit_icon.png[] in the detail view.
+You can set the field's format and popularity value.
 
 Kibana has field formatters for the following field types:
 
diff --git a/docs/management/managing-indices.asciidoc b/docs/management/managing-indices.asciidoc
index 7a3480c860b16..933a2ffbf6ee2 100644
--- a/docs/management/managing-indices.asciidoc
+++ b/docs/management/managing-indices.asciidoc
@@ -1,6 +1,6 @@
 [role="xpack"]
 [[managing-indices]]
-== Index management
+== Index Management
 
 *Index Management* enables you to view index settings,
 mappings, and statistics and perform index-level operations.
@@ -127,7 +127,7 @@ under the *Mapped fields* tab as follows:
 image::images/management-index-templates-mappings.png[Mapped fields page]
 
 You can create additional mapping configurations in the *Dynamic templates* and
-*Advanced options* tabs. No additional mappings are required for this example. 
+*Advanced options* tabs. No additional mappings are required for this example.
 
 In the fourth step, define an alias named `logstash`.
 
diff --git a/docs/management/managing-licenses.asciidoc b/docs/management/managing-licenses.asciidoc
index ecb550d3ab267..72accdb5fe2aa 100644
--- a/docs/management/managing-licenses.asciidoc
+++ b/docs/management/managing-licenses.asciidoc
@@ -1,32 +1,32 @@
 [[managing-licenses]]
-== License management
+== License Management
 
 When you install the default distribution of {kib}, you receive a basic license
 with no expiration date. For the full list of free features that are included in
-the basic license, see https://www.elastic.co/subscriptions[the subscription page].
+the basic license, refer to https://www.elastic.co/subscriptions[the subscription page].
 
 If you want to try out the full set of platinum features, you can activate a
-30-day trial license. Go to *Management > License Management* to view the 
+30-day trial license. Go to *Management > License Management* to view the
 status of your license, start a trial, or install a new license.
 
 NOTE: You can start a trial only if your cluster has not already activated a
 trial license for the current major product version. For example, if you have
-already activated a trial for v6.0, you cannot start a new trial until 
-v7.0. You can, however, contact `info@elastic.co` to request an extended trial
+already activated a trial for 6.0, you cannot start a new trial until
+7.0. You can, however, contact `info@elastic.co` to request an extended trial
 license.
 
-When you activate a new license level, new features appear in the left sidebar 
+When you activate a new license level, new features appear in the left sidebar
 of the *Management* page.
 
 [role="screenshot"]
 image::images/management-license.png[]
 
 At the end of the trial period, the platinum features operate in a
-<<license-expiration,degraded mode>>. You can revert to a basic license, 
-extend the trial, or purchase a subscription. 
+<<license-expiration,degraded mode>>. You can revert to a basic license,
+extend the trial, or purchase a subscription.
 
-TIP: If {security-features} are enabled, unless you have a trial license, 
-you must configure Transport Layer Security (TLS) in {es}. 
+TIP: If {security-features} are enabled, unless you have a trial license,
+you must configure Transport Layer Security (TLS) in {es}.
 See {ref}/encrypting-communications.html[Encrypting communications].
 {kib} and the {ref}/start-basic.html[start basic API] provide a list of all of
 the features that will no longer be supported if you revert to a basic license.
@@ -42,7 +42,7 @@ file that you install in {kib} or by using the
 
 TIP: If you are using a basic or trial license, {security-features} are disabled
 by default. In all other licenses, {security-features} are enabled by default;
-you must secure the {stack} or disable the {security-features}. 
+you must secure the {stack} or disable the {security-features}.
 
 [discrete]
 [[license-expiration]]
@@ -97,7 +97,7 @@ cluster.
 and start {dfeeds} are disabled.
 * All started {dfeeds} are stopped.
 * All open {anomaly-jobs} are closed.
-* APIs to create and start {dfanalytics-jobs} are disabled. 
+* APIs to create and start {dfanalytics-jobs} are disabled.
 * Existing {anomaly-job} and {dfanalytics-job} results continue to be available
 by using {kib} or APIs.
 
diff --git a/docs/management/managing-remote-clusters.asciidoc b/docs/management/managing-remote-clusters.asciidoc
index a776cdf0334cb..6b69cfef5b768 100644
--- a/docs/management/managing-remote-clusters.asciidoc
+++ b/docs/management/managing-remote-clusters.asciidoc
@@ -1,8 +1,8 @@
 [[working-remote-clusters]]
-== Working with remote clusters
+== Remote Clusters
 
-{kib} *Management* provides user interfaces for working with data from remote 
-clusters and managing the {ccr} process. You can replicate indices from a 
+{kib} *Management* provides user interfaces for working with data from remote
+clusters and managing the {ccr} process. You can replicate indices from a
 leader remote cluster to a follower index in a local cluster. The local follower indices
 can be used to provide remote backups for disaster recovery or for geo-proximite copies of data.
 
@@ -14,51 +14,51 @@ Before using these features, you should be familiar with the following concepts:
 
 [float]
 [[managing-remote-clusters]]
-== Managing remote clusters 
+== Managing remote clusters
 
-*Remote clusters* helps you manage remote clusters for use with 
-{ccs} and {ccr}. You can add and remove remote clusters and check their connectivity. 
+*Remote clusters* helps you manage remote clusters for use with
+{ccs} and {ccr}. You can add and remove remote clusters and check their connectivity.
+
+Before you use this feature, you should be familiar with the concept of
+{ref}/modules-remote-clusters.html[remote clusters].
 
-Before you use this feature, you should be familiar with the concept of 
-{ref}/modules-remote-clusters.html[remote clusters].  
- 
 Go to *Management > Elasticsearch > Remote clusters* to create or manage your remotes.
 
-To set up a new remote, click *Add a remote cluster*. Give the cluster a unique name 
-and define the seed nodes for cluster discovery. You can edit or remove your remote clusters 
+To set up a new remote, click *Add a remote cluster*. Give the cluster a unique name
+and define the seed nodes for cluster discovery. You can edit or remove your remote clusters
 from the *Remote clusters* list view.
 
 [role="screenshot"]
 image::images/add_remote_cluster.png[][UI for adding a remote cluster]
 
-Once a remote cluster is registered, you can use the tools under *{ccr-cap}* 
-to add and manage follower indices on the local cluster, and replicate data from 
+Once a remote cluster is registered, you can use the tools under *{ccr-cap}*
+to add and manage follower indices on the local cluster, and replicate data from
 indices on the remote cluster based on an auto-follow index pattern.
 
 [float]
 [[managing-cross-cluster-replication]]
 == [xpack]#Managing {ccr}#
 
-*{ccr-cap}* helps you create and manage the {ccr} process. 
-If you want to replicate data from existing indices, or set up 
-local followers on a case-by-case basis, go to *Follower indices*. 
-If you want to automatically detect and follow new indices when they are created 
-on a remote cluster, you can do so from *Auto-follow patterns*. 
+*{ccr-cap}* helps you create and manage the {ccr} process.
+If you want to replicate data from existing indices, or set up
+local followers on a case-by-case basis, go to *Follower indices*.
+If you want to automatically detect and follow new indices when they are created
+on a remote cluster, you can do so from *Auto-follow patterns*.
 
-Creating an auto-follow pattern is useful when you have time-series data, like a logs index, on the 
-remote cluster that is created or rolled over on a daily basis. Once you have configured an 
-auto-follow pattern, any time a new index with a name that matches the pattern is 
+Creating an auto-follow pattern is useful when you have time-series data, like a logs index, on the
+remote cluster that is created or rolled over on a daily basis. Once you have configured an
+auto-follow pattern, any time a new index with a name that matches the pattern is
 created in the remote cluster, a follower index is automatically configured in the local cluster.
 
-From the same view, you can also see a list of your saved auto-follow patterns for 
+From the same view, you can also see a list of your saved auto-follow patterns for
 a given remote cluster, and monitor whether the replication is active.
 
 Before you use these features, you should be familiar with the following concepts:
 
-* {ref}/ccr-requirements.html[Requirements for leader indices] 
+* {ref}/ccr-requirements.html[Requirements for leader indices]
 * {ref}/ccr-auto-follow.html[Automatically following indices]
 
-To get started, go to *Management > Elasticsearch > {ccr-cap}*. 
+To get started, go to *Management > Elasticsearch > {ccr-cap}*.
 
 [role="screenshot"]
 image::images/auto_follow_pattern.png[][UI for adding an auto-follow pattern]
diff --git a/docs/management/managing-saved-objects.asciidoc b/docs/management/managing-saved-objects.asciidoc
index 2daa4cf789f2a..a92a6ae4bdc09 100644
--- a/docs/management/managing-saved-objects.asciidoc
+++ b/docs/management/managing-saved-objects.asciidoc
@@ -1,9 +1,9 @@
 [[managing-saved-objects]]
-== Saved objects
+== Saved Objects
 
-*Saved Objects* helps you keep track of and manage your saved objects. These objects
+The *Saved Objects* UI helps you keep track of and manage your saved objects. These objects
 store data for later use, including dashboards, visualizations, maps, index patterns,
-Canvas workpads, and more.  
+Canvas workpads, and more.
 
 To get started, go to *Management > {kib} > Saved Objects*. With this UI, you can:
 
@@ -23,8 +23,8 @@ image::images/management-saved-objects.png[Saved Objects]
 
 * To view and edit an object in its associated application, click the object title.
 
-* To show objects that use this object, so you know the 
-impact of deleting it, click the actions icon image:images/actions_icon.png[Actions icon] 
+* To show objects that use this object, so you know the
+impact of deleting it, click the actions icon image:images/actions_icon.png[Actions icon]
 and select *Relationships*.
 
 * To delete one or more objects, select their checkboxes, and then click *Delete*.
@@ -33,19 +33,19 @@ and select *Relationships*.
 [[managing-saved-objects-export-objects]]
 === Import and export
 
-Using the import and export commands, you can move objects between different 
-{kib} instances. This action is useful when you 
-have multiple environments for development and production. 
-Import and export also work well when you have a large number 
-of objects to update and want to batch the process.  
+Using the import and export commands, you can move objects between different
+{kib} instances. This action is useful when you
+have multiple environments for development and production.
+Import and export also work well when you have a large number
+of objects to update and want to batch the process.
 
 
 [float]
 ==== Import
 
-You can import multiple objects in a single operation. Click *Import* and 
-navigate to the NDJSON file that 
-represents the objects to import.  By default, 
+You can import multiple objects in a single operation. Click *Import* and
+navigate to the NDJSON file that
+represents the objects to import.  By default,
 saved objects already in {kib} are overwritten.
 
 [float]
@@ -56,7 +56,7 @@ You have two options for exporting saved objects.
 * Select the checkboxes of objects that you want to export, and then click *Export*.
 * Click *Export x objects*, and export objects by type.
 
-This action creates an NDJSON with all your saved objects.  By default, 
+This action creates an NDJSON with all your saved objects.  By default,
 the NDJSON includes related objects. Exported dashboards include their associated index patterns.
 
 [float]
@@ -78,9 +78,9 @@ use the <<spaces-api-copy-saved-objects, copy saved objects to space API>> inste
 === Advanced editing
 
 Some objects offer an advanced *Edit* page for modifying the object definition.
-To open the page, click the actions icon image:images/actions_icon.png[Actions icon] 
-and select *Inspect*. 
-You can change the object title, add a description, and modify 
+To open the page, click the actions icon image:images/actions_icon.png[Actions icon]
+and select *Inspect*.
+You can change the object title, add a description, and modify
 the JSON that defines the object properties.
 
 If you access an object whose index has been deleted, you can:
@@ -90,7 +90,7 @@ If you access an object whose index has been deleted, you can:
 * Change the index name in the object's `reference` array to point to an existing
 index pattern. This is useful if the index you were working with has been renamed.
 
-WARNING: Validation is not performed for object properties. Submitting an invalid 
-change will render the object unusable. A more failsafe approach is to use 
-*Discover*, *Visualize*, or *Dashboard* to create new objects instead of 
+WARNING: Validation is not performed for object properties. Submitting an invalid
+change will render the object unusable. A more failsafe approach is to use
+*Discover*, *Visualize*, or *Dashboard* to create new objects instead of
 directly editing an existing one.
diff --git a/docs/management/rollups/create_and_manage_rollups.asciidoc b/docs/management/rollups/create_and_manage_rollups.asciidoc
index 06983c01f926d..b07f075f88032 100644
--- a/docs/management/rollups/create_and_manage_rollups.asciidoc
+++ b/docs/management/rollups/create_and_manage_rollups.asciidoc
@@ -1,14 +1,14 @@
 [role="xpack"]
 [[data-rollups]]
-== Rollup jobs
+== Rollup Jobs
 
 
-A rollup job is a periodic task that aggregates data from indices specified 
-by an index pattern and rolls it into a new index. Rollup indices are a good way to 
-compactly store months or years of historical 
+A rollup job is a periodic task that aggregates data from indices specified
+by an index pattern, and then rolls it into a new index. Rollup indices are a good way to
+compactly store months or years of historical
 data for use in visualizations and reports.
 
-You’ll find *Rollup Jobs* under *Management > Elasticsearch*. With this UI, 
+You’ll find *Rollup Jobs* under *Management > Elasticsearch*. With this UI,
 you can:
 
 * <<create-and-manage-rollup-job, Create a rollup job>>
@@ -17,22 +17,22 @@ you can:
 [role="screenshot"]
 image::images/management_rollup_list.png[][List of currently active rollup jobs]
 
-Before using this feature, you should be familiar with how rollups work. 
-{ref}/xpack-rollup.html[Rolling up historical data] is a good source for more detailed information. 
+Before using this feature, you should be familiar with how rollups work.
+{ref}/xpack-rollup.html[Rolling up historical data] is a good source for more detailed information.
 
 [float]
 [[create-and-manage-rollup-job]]
 === Create a rollup job
 
-{kib} makes it easy for you to create a rollup job by walking you through 
-the process. You fill in the name, data flow, and how often you want to roll 
-up the data.  Then you define a date histogram aggregation for the rollup job 
-and optionally terms, histogram, and metrics aggregations. 
+{kib} makes it easy for you to create a rollup job by walking you through
+the process. You fill in the name, data flow, and how often you want to roll
+up the data.  Then you define a date histogram aggregation for the rollup job
+and optionally define terms, histogram, and metrics aggregations.
 
-When defining the index pattern, you must enter a name that is different than 
-the output rollup index. Otherwise, the job 
-will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`, 
-you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`. 
+When defining the index pattern, you must enter a name that is different than
+the output rollup index. Otherwise, the job
+will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`,
+you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`.
 
 [role="screenshot"]
 image::images/management_create_rollup_job.png[][Wizard that walks you through creation of a rollup job]
@@ -41,38 +41,38 @@ image::images/management_create_rollup_job.png[][Wizard that walks you through c
 [[manage-rollup-job]]
 === Start, stop, and delete rollup jobs
 
-Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page, 
-where you can drill down for further investigation. The *Manage* menu in 
+Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page,
+where you can drill down for further investigation. The *Manage* menu in
 the lower right enables you to start, stop, and delete the rollup job.
 You must first stop a rollup job before deleting it.
 
 [role="screenshot"]
 image::images/management_rollup_job_details.png[][Rollup job details]
 
-You can’t change a rollup job after you’ve created it. To select additional fields 
-or redefine terms, you must delete the existing job, and then create a new one 
-with the updated specifications. Be sure to use a different name for the new rollup 
-job&mdash;reusing the same name can lead to problems with mismatched job configurations. 
-You can read more at {ref}/rollup-job-config.html[rollup job configuration]. 
+You can’t change a rollup job after you’ve created it. To select additional fields
+or redefine terms, you must delete the existing job, and then create a new one
+with the updated specifications. Be sure to use a different name for the new rollup
+job&mdash;reusing the same name can lead to problems with mismatched job configurations.
+You can read more at {ref}/rollup-job-config.html[rollup job configuration].
 
 [float]
 === Try it: Create and visualize rolled up data
 
-This example creates a rollup job to capture log data from sample web logs. 
+This example creates a rollup job to capture log data from sample web logs.
 To follow along, add the <<add-sample-data, sample web logs data set>>.
 
 In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
-to roll up once a day into the index `rollup_logstash`. You’ll bucket the 
-rolled up data on an hourly basis, using 60m for the time bucket configuration. 
+to roll up once a day into the index `rollup_logstash`. You’ll bucket the
+rolled up data on an hourly basis, using 60m for the time bucket configuration.
 This allows for more granular queries, such as 2h and 12h.
 
 [float]
 ==== Create the rollup job
 
-As you walk through the *Create rollup job* UI, enter the data shown in 
-the table below. The terms, histogram, and metrics fields reflect 
-the key information to retain in the rolled up data: where visitors are from (geo.src), 
-what operating system they are using (machine.os.keyword), 
+As you walk through the *Create rollup job* UI, enter the data shown in
+the table below. The terms, histogram, and metrics fields reflect
+the key information to retain in the rolled up data: where visitors are from (geo.src),
+what operating system they are using (machine.os.keyword),
 and how much data is being sent (bytes).
 
 |===
@@ -118,31 +118,28 @@ and how much data is being sent (bytes).
 |===
 
 
-You can now use the rolled up data for analysis at a fraction of the storage cost 
-of the original index. The original data can live side by side with the new 
+You can now use the rolled up data for analysis at a fraction of the storage cost
+of the original index. The original data can live side by side with the new
 rollup index, or you can remove or archive it using <<creating-index-lifecycle-policies,Index Lifecycle Management>>.
 
 [float]
 ==== Visualize the rolled up data
 
-Your next step is to visualize your rolled up data in a vertical bar chart. 
+Your next step is to visualize your rolled up data in a vertical bar chart.
 Most visualizations support rolled up data, with the exception of Timelion, TSVB, and Vega visualizations.
 
-Using the information from the example rollup configuration described above, 
-you can use `rollup_logstash` to match the rolled up index pattern, 
-and `kibana_sample_data_logs` to match the index pattern for raw data. 
-The notation for a combination index pattern with both raw and rolled up data 
+Using the information from the example rollup configuration described above,
+you can use `rollup_logstash` to match the rolled up index pattern,
+and `kibana_sample_data_logs` to match the index pattern for raw data.
+The notation for a combination index pattern with both raw and rolled up data
 is `rollup_logstash,kibana_sample_data_logs`.
 
 [role="screenshot"]
 image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
 
-You can then create a dashboard that contains visualizations of the rolled up 
+You can then create a dashboard that contains visualizations of the rolled up
 data, raw data, or both.  See <<visualize-rollup-data, Using rolled up data in a visualization>>
 for more information.
 
 [role="screenshot"]
 image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]
-
-
-
diff --git a/docs/maps/connect-to-ems.asciidoc b/docs/maps/connect-to-ems.asciidoc
index 37fbc6d78c8e4..bc93fc2ba55d4 100644
--- a/docs/maps/connect-to-ems.asciidoc
+++ b/docs/maps/connect-to-ems.asciidoc
@@ -8,7 +8,6 @@ If you are using Kibana's out-of-the-box settings, **Elastic Maps** is already c
 
 EMS requests are made to the following domains:
 
-* catalogue.maps.elastic.co
 * tiles.maps.elastic.co
 * vector.maps.elastic.co
 
diff --git a/docs/setup/install/targz.asciidoc b/docs/setup/install/targz.asciidoc
index d2143f39fba50..31970888a976b 100644
--- a/docs/setup/install/targz.asciidoc
+++ b/docs/setup/install/targz.asciidoc
@@ -1,14 +1,14 @@
 [[targz]]
-=== Install Kibana with `.tar.gz`
+=== Install {kib} from archive on Linux or MacOS
 
 Kibana is provided for Linux and Darwin as a `.tar.gz` package. These packages
 are the easiest formats to use when trying out Kibana.
 
-These packages are free to use under the Elastic license. They contain open 
-source and free commercial features and access to paid commercial features. 
-{stack-ov}/license-management.html[Start a 30-day trial] to try out all of the 
-paid commercial features. See the 
-https://www.elastic.co/subscriptions[Subscriptions] page for information about 
+These packages are free to use under the Elastic license. They contain open
+source and free commercial features and access to paid commercial features.
+{stack-ov}/license-management.html[Start a 30-day trial] to try out all of the
+paid commercial features. See the
+https://www.elastic.co/subscriptions[Subscriptions] page for information about
 Elastic license levels.
 
 The latest stable version of Kibana can be found on the
@@ -47,6 +47,27 @@ endif::[]
 [[install-darwin64]]
 ==== Download and install the Darwin package
 
+[IMPORTANT]
+.macOS Gatekeeper warnings
+====
+Apple's rollout of stricter notarization requirements affected the notarization
+of the {version} {kib} artifacts. If macOS Catalina displays a dialog when you
+first run {kib} that interrupts it, you will need to take an action to allow it
+to run.
+
+To prevent Gatekeeper checks on the {kib} files, run the following command on the
+downloaded `.tar.gz` archive or the directory to which was extracted:
+[source,sh]
+----
+xattr -d -r com.apple.quarantine <archive-or-directory>
+----
+
+Alternatively, you can add a security override if a Gatekeeper popup appears by
+following the instructions in the _How to open an app that hasn’t been notarized
+or is from an unidentified developer_ section of
+https://support.apple.com/en-us/HT202491[Safely open apps on your Mac].
+====
+
 ifeval::["{release-state}"=="unreleased"]
 
 Version {version} of Kibana has not yet been released.
@@ -68,9 +89,9 @@ cd kibana-{version}-darwin-x86_64/ <2>
     `kibana-{version}-darwin-x86_64.tar.gz: OK`.
 <2> This directory is known as `$KIBANA_HOME`.
 
-Alternatively, you can download the following package, which contains only 
+Alternatively, you can download the following package, which contains only
 features that are available under the Apache 2.0 license:
-https://artifacts.elastic.co/downloads/kibana/kibana-oss-{version}-darwin-x86_64.tar.gz  
+https://artifacts.elastic.co/downloads/kibana/kibana-oss-{version}-darwin-x86_64.tar.gz
 
 endif::[]
 
diff --git a/docs/setup/upgrade.asciidoc b/docs/setup/upgrade.asciidoc
index 8c03032bb8ac3..982f1167f3871 100644
--- a/docs/setup/upgrade.asciidoc
+++ b/docs/setup/upgrade.asciidoc
@@ -50,7 +50,7 @@ instructions.
 [[upgrade-6x]]
 === Upgrading from 6.x
 
-The recommended path is to upgrade to 6.7 before upgrading to 7.0. This makes it 
+The recommended path is to upgrade to 6.8 before upgrading to 7.0. This makes it 
 easier to identify the required changes, and enables you to use the Upgrade 
 Assistant to prepare for your upgrade to 7.0.
 
@@ -59,11 +59,11 @@ dashboards is supported.
 
 [float]
 [[upgrade-67]]
-=== Upgrading from 6.7
-To help you prepare for your upgrade to 7.0, 6.7 includes an https://www.elastic.co/guide/en/kibana/6.7/upgrade-assistant.html[Upgrade Assistant] 
-To access the assistant, go to *Management > 7.0 Upgrade Assistant*. 
+=== Upgrading from 6.8
+To help you prepare for your upgrade to 7.0, 6.8 includes an https://www.elastic.co/guide/en/kibana/6.8/upgrade-assistant.html[Upgrade Assistant] 
+To access the assistant, go to *Management > 7.0 Upgrade Assistant*.
 
-After you have addressed any issues that were identified by the Upgrade 
+After you have addressed any issues that were identified by the Upgrade
 Assistant, <<upgrade-standard,upgrade to 7.0>>.
 
 
diff --git a/docs/siem/images/detections-ui.png b/docs/siem/images/detections-ui.png
new file mode 100644
index 0000000000000..3139ffea0767d
Binary files /dev/null and b/docs/siem/images/detections-ui.png differ
diff --git a/docs/siem/images/hosts-ui.png b/docs/siem/images/hosts-ui.png
index 2569df8f419b8..be9fd29246b51 100644
Binary files a/docs/siem/images/hosts-ui.png and b/docs/siem/images/hosts-ui.png differ
diff --git a/docs/siem/images/network-ui.png b/docs/siem/images/network-ui.png
index 406ac854cd0a2..de8ce89273a02 100644
Binary files a/docs/siem/images/network-ui.png and b/docs/siem/images/network-ui.png differ
diff --git a/docs/siem/images/overview-ui.png b/docs/siem/images/overview-ui.png
index a34b2fea061c9..6ac02104d6123 100644
Binary files a/docs/siem/images/overview-ui.png and b/docs/siem/images/overview-ui.png differ
diff --git a/docs/siem/siem-ui.asciidoc b/docs/siem/siem-ui.asciidoc
index 7294cfbc414f4..f01575a21b9f6 100644
--- a/docs/siem/siem-ui.asciidoc
+++ b/docs/siem/siem-ui.asciidoc
@@ -33,6 +33,23 @@ investigation.
 [role="screenshot"]
 image::siem/images/network-ui.png[]
 
+[float]
+[[detections-ui]]
+=== Detections
+
+The Detections feature automatically searches for threats and creates 
+signals when they are detected. Signal detection rules define the conditions 
+for creating signals. The SIEM app comes with prebuilt rules that search for 
+suspicious activity on your network and hosts. Additionally, you can
+create your own rules.
+
+See {siem-guide}/detection-engine-overview.html[Detections] in the SIEM 
+Guide for information on managing detection rules and signals via the UI 
+or the Detections API.
+
+[role="screenshot"]
+image::siem/images/detections-ui.png[]
+
 [float]
 [[timelines-ui]]
 === Timeline
diff --git a/docs/user/index.asciidoc b/docs/user/index.asciidoc
index ebe6c10c49872..3911d57e05c9a 100644
--- a/docs/user/index.asciidoc
+++ b/docs/user/index.asciidoc
@@ -38,14 +38,6 @@ include::monitoring/index.asciidoc[]
 
 include::management.asciidoc[]
 
-include::{kib-repo-dir}/spaces/index.asciidoc[]
-
-include::security/index.asciidoc[]
-
-include::{kib-repo-dir}/management/watcher-ui/index.asciidoc[]
-
-include::{kib-repo-dir}/management/upgrade-assistant/index.asciidoc[]
-
 include::reporting/index.asciidoc[]
 
 include::api.asciidoc[]
diff --git a/docs/user/management.asciidoc b/docs/user/management.asciidoc
index 2c41d0072fe5b..1c55ffc73ca72 100644
--- a/docs/user/management.asciidoc
+++ b/docs/user/management.asciidoc
@@ -3,17 +3,115 @@
 
 [partintro]
 --
-The Management application is where you perform your runtime configuration of
-Kibana, including both the initial setup and ongoing configuration of index
-patterns, advanced settings that tweak the behaviors of Kibana itself, and
-the various "objects" that you can save throughout Kibana such as searches,
-visualizations, and dashboards.
+*Management* is home to UIs for managing all things Elastic Stack&mdash;
+indices, clusters, licenses, UI settings, index patterns, spaces, and more.
+
+[float]
+[[manage-Elasticsearch]]
+== Manage {es}
+
+[cols="50, 50"]
+|===
+
+a| <<working-remote-clusters, *Cross-Cluster Replication*>>
+
+Replicate indices on a remote cluster and copy them to a follower index on a local cluster.
+This is important for
+disaster recovery. It also keeps data local for faster queries.
+
+| <<index-lifecycle-policies, *Index Lifecycle Policies*>>
+
+Create a policy for defining the lifecycle of an index as it ages
+through the hot, warm, cold, and delete phases.
+Such policies help you control operation costs
+because you can put data in different resource tiers.
+
+a| <<managing-indices, *Index Management*>>
+
+View index settings, mappings, and statistics and perform operations, such as refreshing,
+flushing, and clearing the cache. Practicing good index management ensures
+that your data is stored cost effectively.
+
+| <<managing-licenses, *License Management*>>
+
+View the status of your license, start a trial, or install a new license. For
+the full list of features that are included in your license,
+see the https://www.elastic.co/subscriptions[subscription page].
+
+| <<working-remote-clusters, *Remote Clusters*>>
+
+Manage your remote clusters for use with cross-cluster search and cross-cluster replication.
+You can add and remove remote clusters, and check their connectivity.
+
+| <<data-rollups, *Rollup Jobs*>>
+
+Create a job that periodically aggregates data from one or more indices, and then
+rolls it into a new, compact index. Rollup indices are a good way to store months or
+years of historical data in combination with your raw data.
+
+| <<snapshot-repositories, *Snapshot and Restore*>>
+
+Define a policy that creates, schedules, and automatically deletes snapshots to ensure that you
+have backups of your cluster in case something goes wrong.
+
+| {ref}/transforms.html[*Transforms*]
+
+Use transforms to pivot existing {es} indices into summarized or entity-centric indices.
+
+| <<upgrade-assistant, *Upgrade Assistant*>>
+
+Identify the issues that you need to address before upgrading to the
+next major version of {es}, and then reindex, if needed.
+
+| <<watcher-ui, *Watcher*>>
+
+Detect changes in your data by creating, managing, and monitoring alerts.
+For example, create an alert when the maximum total CPU usage on a machine goes
+above a certain percentage.
+
+|===
+
+[float]
+[[manage-kibana]]
+== Manage {kib}
+
+[cols="50, 50"]
+|===
+
+a| <<advanced-options, *Advanced Settings*>>
+
+Customize {kib} to suit your needs. Change the format for displaying dates, turn on dark mode,
+set the timespan for notification messages, and much more.
+
+| <<managing-fields, *Index Patterns*>>
+
+Create and manage the index patterns that help you retrieve your data from {es}.
+
+| <<reporting-getting-started, *Reporting*>>
+
+Monitor the generation of reports&mdash;PDF, PNG, and CSV&mdash;and download reports that you previously generated.
+A report can contain a dashboard, visualization, saved search, or Canvas workpad.
+
+| <<managing-saved-objects, *Saved Objects*>>
+
+Copy, edit, delete, import, and export your saved objects.
+These include dashboards, visualizations, maps, index patterns, Canvas workpads, and more.
+
+| <<xpack-spaces, *Spaces*>>
+
+Create spaces to organize your dashboards and other saved objects into categories.
+A space is isolated from all other spaces,
+so you can tailor it to your needs without impacting others.
+
+| &nbsp;
+
+|===
 
 --
 
-include::{kib-repo-dir}/management/managing-licenses.asciidoc[]
+include::{kib-repo-dir}/management/advanced-options.asciidoc[]
 
-include::{kib-repo-dir}/management/rollups/create_and_manage_rollups.asciidoc[]
+include::{kib-repo-dir}/management/managing-beats.asciidoc[]
 
 include::{kib-repo-dir}/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc[]
 
@@ -25,16 +123,24 @@ include::{kib-repo-dir}/management/index-lifecycle-policies/add-policy-to-index.
 
 include::{kib-repo-dir}/management/index-lifecycle-policies/example-index-lifecycle-policy.asciidoc[]
 
+include::{kib-repo-dir}/management/managing-indices.asciidoc[]
+
 include::{kib-repo-dir}/management/managing-fields.asciidoc[]
 
-include::{kib-repo-dir}/management/managing-indices.asciidoc[]
+include::{kib-repo-dir}/management/managing-licenses.asciidoc[]
 
-include::{kib-repo-dir}/management/advanced-options.asciidoc[]
+include::{kib-repo-dir}/management/managing-remote-clusters.asciidoc[]
 
-include::{kib-repo-dir}/management/managing-saved-objects.asciidoc[]
+include::{kib-repo-dir}/management/rollups/create_and_manage_rollups.asciidoc[]
 
-include::{kib-repo-dir}/management/managing-beats.asciidoc[]
+include::{kib-repo-dir}/management/managing-saved-objects.asciidoc[]
 
-include::{kib-repo-dir}/management/managing-remote-clusters.asciidoc[]
+include::security/index.asciidoc[]
 
 include::{kib-repo-dir}/management/snapshot-restore/index.asciidoc[]
+
+include::{kib-repo-dir}/spaces/index.asciidoc[]
+
+include::{kib-repo-dir}/management/upgrade-assistant/index.asciidoc[]
+
+include::{kib-repo-dir}/management/watcher-ui/index.asciidoc[]
diff --git a/package.json b/package.json
index f9a3bfd99b109..a79d41a67f580 100644
--- a/package.json
+++ b/package.json
@@ -117,13 +117,13 @@
     "@babel/core": "^7.5.5",
     "@babel/register": "^7.7.0",
     "@elastic/apm-rum": "^4.6.0",
-    "@elastic/charts": "^16.1.0",
+    "@elastic/charts": "^17.0.2",
     "@elastic/datemath": "5.0.2",
     "@elastic/ems-client": "7.6.0",
     "@elastic/eui": "18.3.0",
     "@elastic/filesaver": "1.1.2",
     "@elastic/good": "8.1.1-kibana2",
-    "@elastic/numeral": "2.3.3",
+    "@elastic/numeral": "2.3.5",
     "@elastic/request-crypto": "^1.0.2",
     "@elastic/ui-ace": "0.2.3",
     "@hapi/wreck": "^15.0.1",
@@ -144,13 +144,13 @@
     "@types/react-grid-layout": "^0.16.7",
     "@types/recompose": "^0.30.5",
     "JSONStream": "1.3.5",
-    "abortcontroller-polyfill": "^1.3.0",
+    "abort-controller": "^3.0.0",
     "angular": "^1.7.9",
-    "angular-aria": "^1.7.8",
+    "angular-aria": "^1.7.9",
     "angular-elastic": "^2.5.1",
     "angular-recursion": "^1.0.5",
-    "angular-route": "^1.7.8",
-    "angular-sanitize": "^1.7.8",
+    "angular-route": "^1.7.9",
+    "angular-sanitize": "^1.7.9",
     "angular-sortable-view": "^0.0.17",
     "autoprefixer": "9.6.1",
     "babel-loader": "^8.0.6",
@@ -262,7 +262,7 @@
     "style-loader": "0.23.1",
     "symbol-observable": "^1.2.0",
     "tar": "4.4.13",
-    "terser-webpack-plugin": "^2.1.2",
+    "terser-webpack-plugin": "^2.3.4",
     "thread-loader": "^2.1.3",
     "tinygradient": "0.4.3",
     "tinymath": "1.2.1",
@@ -380,7 +380,7 @@
     "@types/zen-observable": "^0.8.0",
     "@typescript-eslint/eslint-plugin": "^2.15.0",
     "@typescript-eslint/parser": "^2.15.0",
-    "angular-mocks": "^1.7.8",
+    "angular-mocks": "^1.7.9",
     "archiver": "^3.1.1",
     "axe-core": "^3.3.2",
     "babel-eslint": "^10.0.3",
@@ -476,7 +476,7 @@
     "strip-ansi": "^3.0.1",
     "supertest": "^3.1.0",
     "supertest-as-promised": "^4.0.2",
-    "tree-kill": "^1.2.1",
+    "tree-kill": "^1.2.2",
     "typescript": "3.7.2",
     "typings-tester": "^0.3.2",
     "vinyl-fs": "^3.0.3",
@@ -485,7 +485,7 @@
     "zlib": "^1.0.5"
   },
   "engines": {
-    "node": "10.18.0",
+    "node": "10.19.0",
     "yarn": "^1.21.1"
   }
 }
diff --git a/packages/kbn-dev-utils/package.json b/packages/kbn-dev-utils/package.json
index cef29f33962cd..bea153d0a672b 100644
--- a/packages/kbn-dev-utils/package.json
+++ b/packages/kbn-dev-utils/package.json
@@ -18,7 +18,7 @@
     "load-json-file": "^6.2.0",
     "moment": "^2.24.0",
     "rxjs": "^6.5.3",
-    "tree-kill": "^1.2.1",
+    "tree-kill": "^1.2.2",
     "tslib": "^1.9.3"
   },
   "devDependencies": {
diff --git a/packages/kbn-es/package.json b/packages/kbn-es/package.json
index cb501dab3ddb7..f9d7bffed1e22 100644
--- a/packages/kbn-es/package.json
+++ b/packages/kbn-es/package.json
@@ -17,7 +17,7 @@
     "node-fetch": "^2.6.0",
     "simple-git": "^1.91.0",
     "tar-fs": "^1.16.3",
-    "tree-kill": "^1.2.1",
+    "tree-kill": "^1.2.2",
     "yauzl": "^2.10.0"
   }
 }
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index 8bded9d403c21..f3e401bedcef3 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -94,7 +94,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var _cli__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1);
 /* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "run", function() { return _cli__WEBPACK_IMPORTED_MODULE_0__["run"]; });
 
-/* harmony import */ var _production__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(703);
+/* harmony import */ var _production__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(705);
 /* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "buildProductionProjects", function() { return _production__WEBPACK_IMPORTED_MODULE_1__["buildProductionProjects"]; });
 
 /* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "prepareExternalProjectDependencies", function() { return _production__WEBPACK_IMPORTED_MODULE_1__["prepareExternalProjectDependencies"]; });
@@ -152,7 +152,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(16);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_3__);
 /* harmony import */ var _commands__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(17);
-/* harmony import */ var _run__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(689);
+/* harmony import */ var _run__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(690);
 /* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(34);
 /*
  * Licensed to Elasticsearch B.V. under one or more contributor
@@ -2507,8 +2507,8 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "commands", function() { return commands; });
 /* harmony import */ var _bootstrap__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(18);
 /* harmony import */ var _clean__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(587);
-/* harmony import */ var _run__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(686);
-/* harmony import */ var _watch__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(687);
+/* harmony import */ var _run__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(687);
+/* harmony import */ var _watch__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(688);
 /*
  * Licensed to Elasticsearch B.V. under one or more contributor
  * license agreements. See the NOTICE file distributed with
@@ -36382,15 +36382,24 @@ var spawn = childProcess.spawn;
 var exec = childProcess.exec;
 
 module.exports = function (pid, signal, callback) {
+    if (typeof signal === 'function' && callback === undefined) {
+        callback = signal;
+        signal = undefined;
+    }
+
+    pid = parseInt(pid);
+    if (Number.isNaN(pid)) {
+        if (callback) {
+            return callback(new Error("pid must be a number"));
+        } else {
+            throw new Error("pid must be a number");
+        }
+    }
+
     var tree = {};
     var pidsToProcess = {};
     tree[pid] = [];
     pidsToProcess[pid] = 1;
-    
-    if (typeof signal === 'function' && callback === undefined) {
-      callback = signal;
-      signal = undefined;
-    }
 
     switch (process.platform) {
     case 'win32':
@@ -46624,9 +46633,11 @@ function range(a, b, str) {
 
 try {
   var util = __webpack_require__(29);
+  /* istanbul ignore next */
   if (typeof util.inherits !== 'function') throw '';
   module.exports = util.inherits;
 } catch (e) {
+  /* istanbul ignore next */
   module.exports = __webpack_require__(510);
 }
 
@@ -46638,24 +46649,28 @@ try {
 if (typeof Object.create === 'function') {
   // implementation from standard node.js 'util' module
   module.exports = function inherits(ctor, superCtor) {
-    ctor.super_ = superCtor
-    ctor.prototype = Object.create(superCtor.prototype, {
-      constructor: {
-        value: ctor,
-        enumerable: false,
-        writable: true,
-        configurable: true
-      }
-    });
+    if (superCtor) {
+      ctor.super_ = superCtor
+      ctor.prototype = Object.create(superCtor.prototype, {
+        constructor: {
+          value: ctor,
+          enumerable: false,
+          writable: true,
+          configurable: true
+        }
+      })
+    }
   };
 } else {
   // old school shim for old browsers
   module.exports = function inherits(ctor, superCtor) {
-    ctor.super_ = superCtor
-    var TempCtor = function () {}
-    TempCtor.prototype = superCtor.prototype
-    ctor.prototype = new TempCtor()
-    ctor.prototype.constructor = ctor
+    if (superCtor) {
+      ctor.super_ = superCtor
+      var TempCtor = function () {}
+      TempCtor.prototype = superCtor.prototype
+      ctor.prototype = new TempCtor()
+      ctor.prototype.constructor = ctor
+    }
   }
 }
 
@@ -56566,12 +56581,18 @@ function runScriptInPackageStreaming(script, args, pkg) {
   });
 }
 async function yarnWorkspacesInfo(directory) {
-  const workspacesInfo = await Object(_child_process__WEBPACK_IMPORTED_MODULE_0__["spawn"])('yarn', ['workspaces', 'info', '--json'], {
+  const {
+    stdout
+  } = await Object(_child_process__WEBPACK_IMPORTED_MODULE_0__["spawn"])('yarn', ['--json', 'workspaces', 'info'], {
     cwd: directory,
     stdio: 'pipe'
   });
-  const stdout = JSON.parse(workspacesInfo.stdout);
-  return JSON.parse(stdout.data);
+
+  try {
+    return JSON.parse(JSON.parse(stdout).data);
+  } catch (error) {
+    throw new Error(`'yarn workspaces info --json' produced unexpected output: \n${stdout}`);
+  }
 }
 
 /***/ }),
@@ -68970,7 +68991,7 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(588);
 /* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(del__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var ora__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(675);
+/* harmony import */ var ora__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(676);
 /* harmony import */ var ora__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(ora__WEBPACK_IMPORTED_MODULE_2__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(16);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_3__);
@@ -69078,13 +69099,13 @@ const CleanCommand = {
 const {promisify} = __webpack_require__(29);
 const path = __webpack_require__(16);
 const globby = __webpack_require__(589);
-const isGlob = __webpack_require__(601);
-const slash = __webpack_require__(662);
-const gracefulFs = __webpack_require__(664);
-const isPathCwd = __webpack_require__(668);
-const isPathInside = __webpack_require__(669);
-const rimraf = __webpack_require__(670);
-const pMap = __webpack_require__(671);
+const isGlob = __webpack_require__(606);
+const slash = __webpack_require__(667);
+const gracefulFs = __webpack_require__(22);
+const isPathCwd = __webpack_require__(669);
+const isPathInside = __webpack_require__(670);
+const rimraf = __webpack_require__(671);
+const pMap = __webpack_require__(672);
 
 const rimrafP = promisify(rimraf);
 
@@ -69206,11 +69227,11 @@ module.exports.sync = (patterns, {force, dryRun, cwd = process.cwd(), ...options
 const fs = __webpack_require__(23);
 const arrayUnion = __webpack_require__(590);
 const merge2 = __webpack_require__(591);
-const glob = __webpack_require__(502);
-const fastGlob = __webpack_require__(592);
-const dirGlob = __webpack_require__(658);
-const gitignore = __webpack_require__(660);
-const {FilterStream, UniqueStream} = __webpack_require__(663);
+const glob = __webpack_require__(592);
+const fastGlob = __webpack_require__(597);
+const dirGlob = __webpack_require__(663);
+const gitignore = __webpack_require__(665);
+const {FilterStream, UniqueStream} = __webpack_require__(668);
 
 const DEFAULT_FILTER = () => false;
 
@@ -69512,5704 +69533,7286 @@ function pauseStreams (streams, options) {
 /* 592 */
 /***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
-
-const taskManager = __webpack_require__(593);
-const async_1 = __webpack_require__(621);
-const stream_1 = __webpack_require__(654);
-const sync_1 = __webpack_require__(655);
-const settings_1 = __webpack_require__(657);
-const utils = __webpack_require__(594);
-function FastGlob(source, options) {
-    try {
-        assertPatternsInput(source);
-    }
-    catch (error) {
-        return Promise.reject(error);
-    }
-    const works = getWorks(source, async_1.default, options);
-    return Promise.all(works).then(utils.array.flatten);
-}
-(function (FastGlob) {
-    function sync(source, options) {
-        assertPatternsInput(source);
-        const works = getWorks(source, sync_1.default, options);
-        return utils.array.flatten(works);
-    }
-    FastGlob.sync = sync;
-    function stream(source, options) {
-        assertPatternsInput(source);
-        const works = getWorks(source, stream_1.default, options);
-        /**
-         * The stream returned by the provider cannot work with an asynchronous iterator.
-         * To support asynchronous iterators, regardless of the number of tasks, we always multiplex streams.
-         * This affects performance (+25%). I don't see best solution right now.
-         */
-        return utils.stream.merge(works);
-    }
-    FastGlob.stream = stream;
-    function generateTasks(source, options) {
-        assertPatternsInput(source);
-        const patterns = [].concat(source);
-        const settings = new settings_1.default(options);
-        return taskManager.generate(patterns, settings);
-    }
-    FastGlob.generateTasks = generateTasks;
-})(FastGlob || (FastGlob = {}));
-function getWorks(source, _Provider, options) {
-    const patterns = [].concat(source);
-    const settings = new settings_1.default(options);
-    const tasks = taskManager.generate(patterns, settings);
-    const provider = new _Provider(settings);
-    return tasks.map(provider.read, provider);
-}
-function assertPatternsInput(source) {
-    if ([].concat(source).every(isString)) {
-        return;
-    }
-    throw new TypeError('Patterns must be a string or an array of strings');
-}
-function isString(source) {
-    /* tslint:disable-next-line strict-type-predicates */
-    return typeof source === 'string';
-}
-module.exports = FastGlob;
+// Approach:
+//
+// 1. Get the minimatch set
+// 2. For each pattern in the set, PROCESS(pattern, false)
+// 3. Store matches per-set, then uniq them
+//
+// PROCESS(pattern, inGlobStar)
+// Get the first [n] items from pattern that are all strings
+// Join these together.  This is PREFIX.
+//   If there is no more remaining, then stat(PREFIX) and
+//   add to matches if it succeeds.  END.
+//
+// If inGlobStar and PREFIX is symlink and points to dir
+//   set ENTRIES = []
+// else readdir(PREFIX) as ENTRIES
+//   If fail, END
+//
+// with ENTRIES
+//   If pattern[n] is GLOBSTAR
+//     // handle the case where the globstar match is empty
+//     // by pruning it out, and testing the resulting pattern
+//     PROCESS(pattern[0..n] + pattern[n+1 .. $], false)
+//     // handle other cases.
+//     for ENTRY in ENTRIES (not dotfiles)
+//       // attach globstar + tail onto the entry
+//       // Mark that this entry is a globstar match
+//       PROCESS(pattern[0..n] + ENTRY + pattern[n .. $], true)
+//
+//   else // not globstar
+//     for ENTRY in ENTRIES (not dotfiles, unless pattern[n] is dot)
+//       Test ENTRY against pattern[n]
+//       If fails, continue
+//       If passes, PROCESS(pattern[0..n] + item + pattern[n+1 .. $])
+//
+// Caveat:
+//   Cache all stats and readdirs results to minimize syscall.  Since all
+//   we ever care about is existence and directory-ness, we can just keep
+//   `true` for files, and [children,...] for directories, or `false` for
+//   things that don't exist.
 
+module.exports = glob
 
-/***/ }),
-/* 593 */
-/***/ (function(module, exports, __webpack_require__) {
+var fs = __webpack_require__(23)
+var rp = __webpack_require__(503)
+var minimatch = __webpack_require__(505)
+var Minimatch = minimatch.Minimatch
+var inherits = __webpack_require__(593)
+var EE = __webpack_require__(379).EventEmitter
+var path = __webpack_require__(16)
+var assert = __webpack_require__(30)
+var isAbsolute = __webpack_require__(511)
+var globSync = __webpack_require__(595)
+var common = __webpack_require__(596)
+var alphasort = common.alphasort
+var alphasorti = common.alphasorti
+var setopts = common.setopts
+var ownProp = common.ownProp
+var inflight = __webpack_require__(514)
+var util = __webpack_require__(29)
+var childrenIgnored = common.childrenIgnored
+var isIgnored = common.isIgnored
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils = __webpack_require__(594);
-function generate(patterns, settings) {
-    const positivePatterns = getPositivePatterns(patterns);
-    const negativePatterns = getNegativePatternsAsPositive(patterns, settings.ignore);
-    /**
-     * When the `caseSensitiveMatch` option is disabled, all patterns must be marked as dynamic, because we cannot check
-     * filepath directly (without read directory).
-     */
-    const staticPatterns = !settings.caseSensitiveMatch ? [] : positivePatterns.filter(utils.pattern.isStaticPattern);
-    const dynamicPatterns = !settings.caseSensitiveMatch ? positivePatterns : positivePatterns.filter(utils.pattern.isDynamicPattern);
-    const staticTasks = convertPatternsToTasks(staticPatterns, negativePatterns, /* dynamic */ false);
-    const dynamicTasks = convertPatternsToTasks(dynamicPatterns, negativePatterns, /* dynamic */ true);
-    return staticTasks.concat(dynamicTasks);
-}
-exports.generate = generate;
-function convertPatternsToTasks(positive, negative, dynamic) {
-    const positivePatternsGroup = groupPatternsByBaseDirectory(positive);
-    // When we have a global group – there is no reason to divide the patterns into independent tasks.
-    // In this case, the global task covers the rest.
-    if ('.' in positivePatternsGroup) {
-        const task = convertPatternGroupToTask('.', positive, negative, dynamic);
-        return [task];
-    }
-    return convertPatternGroupsToTasks(positivePatternsGroup, negative, dynamic);
-}
-exports.convertPatternsToTasks = convertPatternsToTasks;
-function getPositivePatterns(patterns) {
-    return utils.pattern.getPositivePatterns(patterns);
-}
-exports.getPositivePatterns = getPositivePatterns;
-function getNegativePatternsAsPositive(patterns, ignore) {
-    const negative = utils.pattern.getNegativePatterns(patterns).concat(ignore);
-    const positive = negative.map(utils.pattern.convertToPositivePattern);
-    return positive;
-}
-exports.getNegativePatternsAsPositive = getNegativePatternsAsPositive;
-function groupPatternsByBaseDirectory(patterns) {
-    return patterns.reduce((collection, pattern) => {
-        const base = utils.pattern.getBaseDirectory(pattern);
-        if (base in collection) {
-            collection[base].push(pattern);
-        }
-        else {
-            collection[base] = [pattern];
-        }
-        return collection;
-    }, {});
-}
-exports.groupPatternsByBaseDirectory = groupPatternsByBaseDirectory;
-function convertPatternGroupsToTasks(positive, negative, dynamic) {
-    return Object.keys(positive).map((base) => {
-        return convertPatternGroupToTask(base, positive[base], negative, dynamic);
-    });
-}
-exports.convertPatternGroupsToTasks = convertPatternGroupsToTasks;
-function convertPatternGroupToTask(base, positive, negative, dynamic) {
-    return {
-        dynamic,
-        positive,
-        negative,
-        base,
-        patterns: [].concat(positive, negative.map(utils.pattern.convertToNegativePattern))
-    };
-}
-exports.convertPatternGroupToTask = convertPatternGroupToTask;
+var once = __webpack_require__(385)
 
+function glob (pattern, options, cb) {
+  if (typeof options === 'function') cb = options, options = {}
+  if (!options) options = {}
 
-/***/ }),
-/* 594 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (options.sync) {
+    if (cb)
+      throw new TypeError('callback provided to sync glob')
+    return globSync(pattern, options)
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const array = __webpack_require__(595);
-exports.array = array;
-const errno = __webpack_require__(596);
-exports.errno = errno;
-const fs = __webpack_require__(597);
-exports.fs = fs;
-const path = __webpack_require__(598);
-exports.path = path;
-const pattern = __webpack_require__(599);
-exports.pattern = pattern;
-const stream = __webpack_require__(620);
-exports.stream = stream;
+  return new Glob(pattern, options, cb)
+}
 
+glob.sync = globSync
+var GlobSync = glob.GlobSync = globSync.GlobSync
 
-/***/ }),
-/* 595 */
-/***/ (function(module, exports, __webpack_require__) {
+// old api surface
+glob.glob = glob
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-function flatten(items) {
-    return items.reduce((collection, item) => [].concat(collection, item), []);
-}
-exports.flatten = flatten;
+function extend (origin, add) {
+  if (add === null || typeof add !== 'object') {
+    return origin
+  }
 
+  var keys = Object.keys(add)
+  var i = keys.length
+  while (i--) {
+    origin[keys[i]] = add[keys[i]]
+  }
+  return origin
+}
 
-/***/ }),
-/* 596 */
-/***/ (function(module, exports, __webpack_require__) {
+glob.hasMagic = function (pattern, options_) {
+  var options = extend({}, options_)
+  options.noprocess = true
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-function isEnoentCodeError(error) {
-    return error.code === 'ENOENT';
-}
-exports.isEnoentCodeError = isEnoentCodeError;
+  var g = new Glob(pattern, options)
+  var set = g.minimatch.set
 
+  if (!pattern)
+    return false
 
-/***/ }),
-/* 597 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (set.length > 1)
+    return true
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-class DirentFromStats {
-    constructor(name, stats) {
-        this.name = name;
-        this.isBlockDevice = stats.isBlockDevice.bind(stats);
-        this.isCharacterDevice = stats.isCharacterDevice.bind(stats);
-        this.isDirectory = stats.isDirectory.bind(stats);
-        this.isFIFO = stats.isFIFO.bind(stats);
-        this.isFile = stats.isFile.bind(stats);
-        this.isSocket = stats.isSocket.bind(stats);
-        this.isSymbolicLink = stats.isSymbolicLink.bind(stats);
-    }
-}
-function createDirentFromStats(name, stats) {
-    return new DirentFromStats(name, stats);
-}
-exports.createDirentFromStats = createDirentFromStats;
+  for (var j = 0; j < set[0].length; j++) {
+    if (typeof set[0][j] !== 'string')
+      return true
+  }
 
+  return false
+}
 
-/***/ }),
-/* 598 */
-/***/ (function(module, exports, __webpack_require__) {
+glob.Glob = Glob
+inherits(Glob, EE)
+function Glob (pattern, options, cb) {
+  if (typeof options === 'function') {
+    cb = options
+    options = null
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-/**
- * Designed to work only with simple paths: `dir\\file`.
- */
-function unixify(filepath) {
-    return filepath.replace(/\\/g, '/');
-}
-exports.unixify = unixify;
-function makeAbsolute(cwd, filepath) {
-    return path.resolve(cwd, filepath);
-}
-exports.makeAbsolute = makeAbsolute;
+  if (options && options.sync) {
+    if (cb)
+      throw new TypeError('callback provided to sync glob')
+    return new GlobSync(pattern, options)
+  }
 
+  if (!(this instanceof Glob))
+    return new Glob(pattern, options, cb)
 
-/***/ }),
-/* 599 */
-/***/ (function(module, exports, __webpack_require__) {
+  setopts(this, pattern, options)
+  this._didRealPath = false
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-const globParent = __webpack_require__(600);
-const isGlob = __webpack_require__(601);
-const micromatch = __webpack_require__(603);
-const GLOBSTAR = '**';
-function isStaticPattern(pattern) {
-    return !isDynamicPattern(pattern);
-}
-exports.isStaticPattern = isStaticPattern;
-function isDynamicPattern(pattern) {
-    return isGlob(pattern, { strict: false });
-}
-exports.isDynamicPattern = isDynamicPattern;
-function convertToPositivePattern(pattern) {
-    return isNegativePattern(pattern) ? pattern.slice(1) : pattern;
-}
-exports.convertToPositivePattern = convertToPositivePattern;
-function convertToNegativePattern(pattern) {
-    return '!' + pattern;
-}
-exports.convertToNegativePattern = convertToNegativePattern;
-function isNegativePattern(pattern) {
-    return pattern.startsWith('!') && pattern[1] !== '(';
-}
-exports.isNegativePattern = isNegativePattern;
-function isPositivePattern(pattern) {
-    return !isNegativePattern(pattern);
-}
-exports.isPositivePattern = isPositivePattern;
-function getNegativePatterns(patterns) {
-    return patterns.filter(isNegativePattern);
-}
-exports.getNegativePatterns = getNegativePatterns;
-function getPositivePatterns(patterns) {
-    return patterns.filter(isPositivePattern);
-}
-exports.getPositivePatterns = getPositivePatterns;
-function getBaseDirectory(pattern) {
-    return globParent(pattern);
-}
-exports.getBaseDirectory = getBaseDirectory;
-function hasGlobStar(pattern) {
-    return pattern.indexOf(GLOBSTAR) !== -1;
-}
-exports.hasGlobStar = hasGlobStar;
-function endsWithSlashGlobStar(pattern) {
-    return pattern.endsWith('/' + GLOBSTAR);
-}
-exports.endsWithSlashGlobStar = endsWithSlashGlobStar;
-function isAffectDepthOfReadingPattern(pattern) {
-    const basename = path.basename(pattern);
-    return endsWithSlashGlobStar(pattern) || isStaticPattern(basename);
-}
-exports.isAffectDepthOfReadingPattern = isAffectDepthOfReadingPattern;
-function getNaiveDepth(pattern) {
-    const base = getBaseDirectory(pattern);
-    const patternDepth = pattern.split('/').length;
-    const patternBaseDepth = base.split('/').length;
-    /**
-     * This is a hack for pattern that has no base directory.
-     *
-     * This is related to the `*\something\*` pattern.
-     */
-    if (base === '.') {
-        return patternDepth - patternBaseDepth;
-    }
-    return patternDepth - patternBaseDepth - 1;
-}
-exports.getNaiveDepth = getNaiveDepth;
-function getMaxNaivePatternsDepth(patterns) {
-    return patterns.reduce((max, pattern) => {
-        const depth = getNaiveDepth(pattern);
-        return depth > max ? depth : max;
-    }, 0);
-}
-exports.getMaxNaivePatternsDepth = getMaxNaivePatternsDepth;
-function makeRe(pattern, options) {
-    return micromatch.makeRe(pattern, options);
-}
-exports.makeRe = makeRe;
-function convertPatternsToRe(patterns, options) {
-    return patterns.map((pattern) => makeRe(pattern, options));
-}
-exports.convertPatternsToRe = convertPatternsToRe;
-function matchAny(entry, patternsRe) {
-    const filepath = entry.replace(/^\.[\\\/]/, '');
-    return patternsRe.some((patternRe) => patternRe.test(filepath));
-}
-exports.matchAny = matchAny;
+  // process each pattern in the minimatch set
+  var n = this.minimatch.set.length
 
+  // The matches are stored as {<filename>: true,...} so that
+  // duplicates are automagically pruned.
+  // Later, we do an Object.keys() on these.
+  // Keep them as a list so we can fill in when nonull is set.
+  this.matches = new Array(n)
 
-/***/ }),
-/* 600 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (typeof cb === 'function') {
+    cb = once(cb)
+    this.on('error', cb)
+    this.on('end', function (matches) {
+      cb(null, matches)
+    })
+  }
 
-"use strict";
+  var self = this
+  this._processing = 0
 
+  this._emitQueue = []
+  this._processQueue = []
+  this.paused = false
 
-var isGlob = __webpack_require__(601);
-var pathPosixDirname = __webpack_require__(16).posix.dirname;
-var isWin32 = __webpack_require__(11).platform() === 'win32';
+  if (this.noprocess)
+    return this
 
-var slash = '/';
-var backslash = /\\/g;
-var enclosure = /[\{\[].*[\/]*.*[\}\]]$/;
-var globby = /(^|[^\\])([\{\[]|\([^\)]+$)/;
-var escaped = /\\([\*\?\|\[\]\(\)\{\}])/g;
+  if (n === 0)
+    return done()
 
-module.exports = function globParent(str) {
-  // flip windows path separators
-  if (isWin32 && str.indexOf(slash) < 0) {
-    str = str.replace(backslash, slash);
+  var sync = true
+  for (var i = 0; i < n; i ++) {
+    this._process(this.minimatch.set[i], i, false, done)
   }
+  sync = false
 
-  // special case for strings ending in enclosure containing path separator
-  if (enclosure.test(str)) {
-    str += slash;
+  function done () {
+    --self._processing
+    if (self._processing <= 0) {
+      if (sync) {
+        process.nextTick(function () {
+          self._finish()
+        })
+      } else {
+        self._finish()
+      }
+    }
   }
+}
 
-  // preserves full path in case of trailing path separator
-  str += 'a';
+Glob.prototype._finish = function () {
+  assert(this instanceof Glob)
+  if (this.aborted)
+    return
 
-  // remove path parts that are globby
-  do {
-    str = pathPosixDirname(str);
-  } while (isGlob(str) || globby.test(str));
+  if (this.realpath && !this._didRealpath)
+    return this._realpath()
 
-  // remove escape chars and return result
-  return str.replace(escaped, '$1');
-};
+  common.finish(this)
+  this.emit('end', this.found)
+}
 
+Glob.prototype._realpath = function () {
+  if (this._didRealpath)
+    return
 
-/***/ }),
-/* 601 */
-/***/ (function(module, exports, __webpack_require__) {
+  this._didRealpath = true
 
-/*!
- * is-glob <https://github.com/jonschlinkert/is-glob>
- *
- * Copyright (c) 2014-2017, Jon Schlinkert.
- * Released under the MIT License.
- */
+  var n = this.matches.length
+  if (n === 0)
+    return this._finish()
 
-var isExtglob = __webpack_require__(602);
-var chars = { '{': '}', '(': ')', '[': ']'};
-var strictRegex = /\\(.)|(^!|\*|[\].+)]\?|\[[^\\\]]+\]|\{[^\\}]+\}|\(\?[:!=][^\\)]+\)|\([^|]+\|[^\\)]+\))/;
-var relaxedRegex = /\\(.)|(^!|[*?{}()[\]]|\(\?)/;
+  var self = this
+  for (var i = 0; i < this.matches.length; i++)
+    this._realpathSet(i, next)
 
-module.exports = function isGlob(str, options) {
-  if (typeof str !== 'string' || str === '') {
-    return false;
+  function next () {
+    if (--n === 0)
+      self._finish()
   }
+}
 
-  if (isExtglob(str)) {
-    return true;
-  }
+Glob.prototype._realpathSet = function (index, cb) {
+  var matchset = this.matches[index]
+  if (!matchset)
+    return cb()
 
-  var regex = strictRegex;
-  var match;
+  var found = Object.keys(matchset)
+  var self = this
+  var n = found.length
 
-  // optionally relax regex
-  if (options && options.strict === false) {
-    regex = relaxedRegex;
-  }
+  if (n === 0)
+    return cb()
 
-  while ((match = regex.exec(str))) {
-    if (match[2]) return true;
-    var idx = match.index + match[0].length;
+  var set = this.matches[index] = Object.create(null)
+  found.forEach(function (p, i) {
+    // If there's a problem with the stat, then it means that
+    // one or more of the links in the realpath couldn't be
+    // resolved.  just return the abs value in that case.
+    p = self._makeAbs(p)
+    rp.realpath(p, self.realpathCache, function (er, real) {
+      if (!er)
+        set[real] = true
+      else if (er.syscall === 'stat')
+        set[p] = true
+      else
+        self.emit('error', er) // srsly wtf right here
 
-    // if an open bracket/brace/paren is escaped,
-    // set the index to the next closing character
-    var open = match[1];
-    var close = open ? chars[open] : null;
-    if (open && close) {
-      var n = str.indexOf(close, idx);
-      if (n !== -1) {
-        idx = n + 1;
+      if (--n === 0) {
+        self.matches[index] = set
+        cb()
       }
-    }
+    })
+  })
+}
 
-    str = str.slice(idx);
-  }
-  return false;
-};
+Glob.prototype._mark = function (p) {
+  return common.mark(this, p)
+}
 
+Glob.prototype._makeAbs = function (f) {
+  return common.makeAbs(this, f)
+}
 
-/***/ }),
-/* 602 */
-/***/ (function(module, exports) {
+Glob.prototype.abort = function () {
+  this.aborted = true
+  this.emit('abort')
+}
 
-/*!
- * is-extglob <https://github.com/jonschlinkert/is-extglob>
- *
- * Copyright (c) 2014-2016, Jon Schlinkert.
- * Licensed under the MIT License.
- */
+Glob.prototype.pause = function () {
+  if (!this.paused) {
+    this.paused = true
+    this.emit('pause')
+  }
+}
 
-module.exports = function isExtglob(str) {
-  if (typeof str !== 'string' || str === '') {
-    return false;
+Glob.prototype.resume = function () {
+  if (this.paused) {
+    this.emit('resume')
+    this.paused = false
+    if (this._emitQueue.length) {
+      var eq = this._emitQueue.slice(0)
+      this._emitQueue.length = 0
+      for (var i = 0; i < eq.length; i ++) {
+        var e = eq[i]
+        this._emitMatch(e[0], e[1])
+      }
+    }
+    if (this._processQueue.length) {
+      var pq = this._processQueue.slice(0)
+      this._processQueue.length = 0
+      for (var i = 0; i < pq.length; i ++) {
+        var p = pq[i]
+        this._processing--
+        this._process(p[0], p[1], p[2], p[3])
+      }
+    }
   }
+}
 
-  var match;
-  while ((match = /(\\).|([@?!+*]\(.*\))/g.exec(str))) {
-    if (match[2]) return true;
-    str = str.slice(match.index + match[0].length);
+Glob.prototype._process = function (pattern, index, inGlobStar, cb) {
+  assert(this instanceof Glob)
+  assert(typeof cb === 'function')
+
+  if (this.aborted)
+    return
+
+  this._processing++
+  if (this.paused) {
+    this._processQueue.push([pattern, index, inGlobStar, cb])
+    return
   }
 
-  return false;
-};
+  //console.error('PROCESS %d', this._processing, pattern)
 
+  // Get the first [n] parts of pattern that are all strings.
+  var n = 0
+  while (typeof pattern[n] === 'string') {
+    n ++
+  }
+  // now n is the index of the first one that is *not* a string.
 
-/***/ }),
-/* 603 */
-/***/ (function(module, exports, __webpack_require__) {
+  // see if there's anything else
+  var prefix
+  switch (n) {
+    // if not, then this is rather simple
+    case pattern.length:
+      this._processSimple(pattern.join('/'), index, cb)
+      return
 
-"use strict";
+    case 0:
+      // pattern *starts* with some non-trivial item.
+      // going to readdir(cwd), but not include the prefix in matches.
+      prefix = null
+      break
 
+    default:
+      // pattern has some string bits in the front.
+      // whatever it starts with, whether that's 'absolute' like /foo/bar,
+      // or 'relative' like '../baz'
+      prefix = pattern.slice(0, n).join('/')
+      break
+  }
 
-const util = __webpack_require__(29);
-const braces = __webpack_require__(604);
-const picomatch = __webpack_require__(614);
-const utils = __webpack_require__(617);
-const isEmptyString = val => typeof val === 'string' && (val === '' || val === './');
+  var remain = pattern.slice(n)
 
-/**
- * Returns an array of strings that match one or more glob patterns.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm(list, patterns[, options]);
- *
- * console.log(mm(['a.js', 'a.txt'], ['*.js']));
- * //=> [ 'a.js' ]
- * ```
- * @param {String|Array<string>} list List of strings to match.
- * @param {String|Array<string>} patterns One or more glob patterns to use for matching.
- * @param {Object} options See available [options](#options)
- * @return {Array} Returns an array of matches
- * @summary false
- * @api public
- */
+  // get the list of entries.
+  var read
+  if (prefix === null)
+    read = '.'
+  else if (isAbsolute(prefix) || isAbsolute(pattern.join('/'))) {
+    if (!prefix || !isAbsolute(prefix))
+      prefix = '/' + prefix
+    read = prefix
+  } else
+    read = prefix
 
-const micromatch = (list, patterns, options) => {
-  patterns = [].concat(patterns);
-  list = [].concat(list);
+  var abs = this._makeAbs(read)
 
-  let omit = new Set();
-  let keep = new Set();
-  let items = new Set();
-  let negatives = 0;
+  //if ignored, skip _processing
+  if (childrenIgnored(this, read))
+    return cb()
 
-  let onResult = state => {
-    items.add(state.output);
-    if (options && options.onResult) {
-      options.onResult(state);
-    }
-  };
+  var isGlobStar = remain[0] === minimatch.GLOBSTAR
+  if (isGlobStar)
+    this._processGlobStar(prefix, read, abs, remain, index, inGlobStar, cb)
+  else
+    this._processReaddir(prefix, read, abs, remain, index, inGlobStar, cb)
+}
 
-  for (let i = 0; i < patterns.length; i++) {
-    let isMatch = picomatch(String(patterns[i]), { ...options, onResult }, true);
-    let negated = isMatch.state.negated || isMatch.state.negatedExtglob;
-    if (negated) negatives++;
+Glob.prototype._processReaddir = function (prefix, read, abs, remain, index, inGlobStar, cb) {
+  var self = this
+  this._readdir(abs, inGlobStar, function (er, entries) {
+    return self._processReaddir2(prefix, read, abs, remain, index, inGlobStar, entries, cb)
+  })
+}
 
-    for (let item of list) {
-      let matched = isMatch(item, true);
+Glob.prototype._processReaddir2 = function (prefix, read, abs, remain, index, inGlobStar, entries, cb) {
 
-      let match = negated ? !matched.isMatch : matched.isMatch;
-      if (!match) continue;
+  // if the abs isn't a dir, then nothing can match!
+  if (!entries)
+    return cb()
 
-      if (negated) {
-        omit.add(matched.output);
+  // It will only match dot entries if it starts with a dot, or if
+  // dot is set.  Stuff like @(.foo|.bar) isn't allowed.
+  var pn = remain[0]
+  var negate = !!this.minimatch.negate
+  var rawGlob = pn._glob
+  var dotOk = this.dot || rawGlob.charAt(0) === '.'
+
+  var matchedEntries = []
+  for (var i = 0; i < entries.length; i++) {
+    var e = entries[i]
+    if (e.charAt(0) !== '.' || dotOk) {
+      var m
+      if (negate && !prefix) {
+        m = !e.match(pn)
       } else {
-        omit.delete(matched.output);
-        keep.add(matched.output);
+        m = e.match(pn)
       }
+      if (m)
+        matchedEntries.push(e)
     }
   }
 
-  let result = negatives === patterns.length ? [...items] : [...keep];
-  let matches = result.filter(item => !omit.has(item));
+  //console.error('prd2', prefix, entries, remain[0]._glob, matchedEntries)
 
-  if (options && matches.length === 0) {
-    if (options.failglob === true) {
-      throw new Error(`No matches found for "${patterns.join(', ')}"`);
+  var len = matchedEntries.length
+  // If there are no matched entries, then nothing matches.
+  if (len === 0)
+    return cb()
+
+  // if this is the last remaining pattern bit, then no need for
+  // an additional stat *unless* the user has specified mark or
+  // stat explicitly.  We know they exist, since readdir returned
+  // them.
+
+  if (remain.length === 1 && !this.mark && !this.stat) {
+    if (!this.matches[index])
+      this.matches[index] = Object.create(null)
+
+    for (var i = 0; i < len; i ++) {
+      var e = matchedEntries[i]
+      if (prefix) {
+        if (prefix !== '/')
+          e = prefix + '/' + e
+        else
+          e = prefix + e
+      }
+
+      if (e.charAt(0) === '/' && !this.nomount) {
+        e = path.join(this.root, e)
+      }
+      this._emitMatch(index, e)
     }
+    // This was the last one, and no stats were needed
+    return cb()
+  }
 
-    if (options.nonull === true || options.nullglob === true) {
-      return options.unescape ? patterns.map(p => p.replace(/\\/g, '')) : patterns;
+  // now test all matched entries as stand-ins for that part
+  // of the pattern.
+  remain.shift()
+  for (var i = 0; i < len; i ++) {
+    var e = matchedEntries[i]
+    var newPattern
+    if (prefix) {
+      if (prefix !== '/')
+        e = prefix + '/' + e
+      else
+        e = prefix + e
     }
+    this._process([e].concat(remain), index, inGlobStar, cb)
   }
+  cb()
+}
 
-  return matches;
-};
+Glob.prototype._emitMatch = function (index, e) {
+  if (this.aborted)
+    return
 
-/**
- * Backwards compatibility
- */
+  if (isIgnored(this, e))
+    return
 
-micromatch.match = micromatch;
+  if (this.paused) {
+    this._emitQueue.push([index, e])
+    return
+  }
 
-/**
- * Returns a matcher function from the given glob `pattern` and `options`.
- * The returned function takes a string to match as its only argument and returns
- * true if the string is a match.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.matcher(pattern[, options]);
- *
- * const isMatch = mm.matcher('*.!(*a)');
- * console.log(isMatch('a.a')); //=> false
- * console.log(isMatch('a.b')); //=> true
- * ```
- * @param {String} `pattern` Glob pattern
- * @param {Object} `options`
- * @return {Function} Returns a matcher function.
- * @api public
- */
+  var abs = isAbsolute(e) ? e : this._makeAbs(e)
 
-micromatch.matcher = (pattern, options) => picomatch(pattern, options);
+  if (this.mark)
+    e = this._mark(e)
 
-/**
- * Returns true if **any** of the given glob `patterns` match the specified `string`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.isMatch(string, patterns[, options]);
- *
- * console.log(mm.isMatch('a.a', ['b.*', '*.a'])); //=> true
- * console.log(mm.isMatch('a.a', 'b.*')); //=> false
- * ```
- * @param {String} str The string to test.
- * @param {String|Array} patterns One or more glob patterns to use for matching.
- * @param {Object} [options] See available [options](#options).
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
+  if (this.absolute)
+    e = abs
 
-micromatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
+  if (this.matches[index][e])
+    return
 
-/**
- * Backwards compatibility
- */
+  if (this.nodir) {
+    var c = this.cache[abs]
+    if (c === 'DIR' || Array.isArray(c))
+      return
+  }
 
-micromatch.any = micromatch.isMatch;
+  this.matches[index][e] = true
 
-/**
- * Returns a list of strings that _**do not match any**_ of the given `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.not(list, patterns[, options]);
- *
- * console.log(mm.not(['a.a', 'b.b', 'c.c'], '*.a'));
- * //=> ['b.b', 'c.c']
- * ```
- * @param {Array} `list` Array of strings to match.
- * @param {String|Array} `patterns` One or more glob pattern to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Array} Returns an array of strings that **do not match** the given patterns.
- * @api public
- */
+  var st = this.statCache[abs]
+  if (st)
+    this.emit('stat', e, st)
 
-micromatch.not = (list, patterns, options = {}) => {
-  patterns = [].concat(patterns).map(String);
-  let result = new Set();
-  let items = [];
+  this.emit('match', e)
+}
 
-  let onResult = state => {
-    if (options.onResult) options.onResult(state);
-    items.push(state.output);
-  };
+Glob.prototype._readdirInGlobStar = function (abs, cb) {
+  if (this.aborted)
+    return
 
-  let matches = micromatch(list, patterns, { ...options, onResult });
+  // follow all symlinked directories forever
+  // just proceed as if this is a non-globstar situation
+  if (this.follow)
+    return this._readdir(abs, false, cb)
 
-  for (let item of items) {
-    if (!matches.includes(item)) {
-      result.add(item);
-    }
-  }
-  return [...result];
-};
+  var lstatkey = 'lstat\0' + abs
+  var self = this
+  var lstatcb = inflight(lstatkey, lstatcb_)
 
-/**
- * Returns true if the given `string` contains the given pattern. Similar
- * to [.isMatch](#isMatch) but the pattern can match any part of the string.
- *
- * ```js
- * var mm = require('micromatch');
- * // mm.contains(string, pattern[, options]);
- *
- * console.log(mm.contains('aa/bb/cc', '*b'));
- * //=> true
- * console.log(mm.contains('aa/bb/cc', '*d'));
- * //=> false
- * ```
- * @param {String} `str` The string to match.
- * @param {String|Array} `patterns` Glob pattern to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if the patter matches any part of `str`.
- * @api public
- */
+  if (lstatcb)
+    fs.lstat(abs, lstatcb)
 
-micromatch.contains = (str, pattern, options) => {
-  if (typeof str !== 'string') {
-    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
-  }
+  function lstatcb_ (er, lstat) {
+    if (er && er.code === 'ENOENT')
+      return cb()
 
-  if (Array.isArray(pattern)) {
-    return pattern.some(p => micromatch.contains(str, p, options));
+    var isSym = lstat && lstat.isSymbolicLink()
+    self.symlinks[abs] = isSym
+
+    // If it's not a symlink or a dir, then it's definitely a regular file.
+    // don't bother doing a readdir in that case.
+    if (!isSym && lstat && !lstat.isDirectory()) {
+      self.cache[abs] = 'FILE'
+      cb()
+    } else
+      self._readdir(abs, false, cb)
   }
+}
 
-  if (typeof pattern === 'string') {
-    if (isEmptyString(str) || isEmptyString(pattern)) {
-      return false;
-    }
+Glob.prototype._readdir = function (abs, inGlobStar, cb) {
+  if (this.aborted)
+    return
 
-    if (str.includes(pattern) || (str.startsWith('./') && str.slice(2).includes(pattern))) {
-      return true;
-    }
+  cb = inflight('readdir\0'+abs+'\0'+inGlobStar, cb)
+  if (!cb)
+    return
+
+  //console.error('RD %j %j', +inGlobStar, abs)
+  if (inGlobStar && !ownProp(this.symlinks, abs))
+    return this._readdirInGlobStar(abs, cb)
+
+  if (ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
+    if (!c || c === 'FILE')
+      return cb()
+
+    if (Array.isArray(c))
+      return cb(null, c)
   }
 
-  return micromatch.isMatch(str, pattern, { ...options, contains: true });
-};
+  var self = this
+  fs.readdir(abs, readdirCb(this, abs, cb))
+}
 
-/**
- * Filter the keys of the given object with the given `glob` pattern
- * and `options`. Does not attempt to match nested keys. If you need this feature,
- * use [glob-object][] instead.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.matchKeys(object, patterns[, options]);
- *
- * const obj = { aa: 'a', ab: 'b', ac: 'c' };
- * console.log(mm.matchKeys(obj, '*b'));
- * //=> { ab: 'b' }
- * ```
- * @param {Object} `object` The object with keys to filter.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Object} Returns an object with only keys that match the given patterns.
- * @api public
- */
-
-micromatch.matchKeys = (obj, patterns, options) => {
-  if (!utils.isObject(obj)) {
-    throw new TypeError('Expected the first argument to be an object');
+function readdirCb (self, abs, cb) {
+  return function (er, entries) {
+    if (er)
+      self._readdirError(abs, er, cb)
+    else
+      self._readdirEntries(abs, entries, cb)
   }
-  let keys = micromatch(Object.keys(obj), patterns, options);
-  let res = {};
-  for (let key of keys) res[key] = obj[key];
-  return res;
-};
-
-/**
- * Returns true if some of the strings in the given `list` match any of the given glob `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.some(list, patterns[, options]);
- *
- * console.log(mm.some(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
- * // true
- * console.log(mm.some(['foo.js'], ['*.js', '!foo.js']));
- * // false
- * ```
- * @param {String|Array} `list` The string or array of strings to test. Returns as soon as the first match is found.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
+}
 
-micromatch.some = (list, patterns, options) => {
-  let items = [].concat(list);
+Glob.prototype._readdirEntries = function (abs, entries, cb) {
+  if (this.aborted)
+    return
 
-  for (let pattern of [].concat(patterns)) {
-    let isMatch = picomatch(String(pattern), options);
-    if (items.some(item => isMatch(item))) {
-      return true;
+  // if we haven't asked to stat everything, then just
+  // assume that everything in there exists, so we can avoid
+  // having to stat it a second time.
+  if (!this.mark && !this.stat) {
+    for (var i = 0; i < entries.length; i ++) {
+      var e = entries[i]
+      if (abs === '/')
+        e = abs + e
+      else
+        e = abs + '/' + e
+      this.cache[e] = true
     }
   }
-  return false;
-};
 
-/**
- * Returns true if every string in the given `list` matches
- * any of the given glob `patterns`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.every(list, patterns[, options]);
- *
- * console.log(mm.every('foo.js', ['foo.js']));
- * // true
- * console.log(mm.every(['foo.js', 'bar.js'], ['*.js']));
- * // true
- * console.log(mm.every(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
- * // false
- * console.log(mm.every(['foo.js'], ['*.js', '!foo.js']));
- * // false
- * ```
- * @param {String|Array} `list` The string or array of strings to test.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
+  this.cache[abs] = entries
+  return cb(null, entries)
+}
 
-micromatch.every = (list, patterns, options) => {
-  let items = [].concat(list);
+Glob.prototype._readdirError = function (f, er, cb) {
+  if (this.aborted)
+    return
 
-  for (let pattern of [].concat(patterns)) {
-    let isMatch = picomatch(String(pattern), options);
-    if (!items.every(item => isMatch(item))) {
-      return false;
-    }
-  }
-  return true;
-};
+  // handle errors, and cache the information
+  switch (er.code) {
+    case 'ENOTSUP': // https://github.com/isaacs/node-glob/issues/205
+    case 'ENOTDIR': // totally normal. means it *does* exist.
+      var abs = this._makeAbs(f)
+      this.cache[abs] = 'FILE'
+      if (abs === this.cwdAbs) {
+        var error = new Error(er.code + ' invalid cwd ' + this.cwd)
+        error.path = this.cwd
+        error.code = er.code
+        this.emit('error', error)
+        this.abort()
+      }
+      break
 
-/**
- * Returns true if **all** of the given `patterns` match
- * the specified string.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.all(string, patterns[, options]);
- *
- * console.log(mm.all('foo.js', ['foo.js']));
- * // true
- *
- * console.log(mm.all('foo.js', ['*.js', '!foo.js']));
- * // false
- *
- * console.log(mm.all('foo.js', ['*.js', 'foo.js']));
- * // true
- *
- * console.log(mm.all('foo.js', ['*.js', 'f*', '*o*', '*o.js']));
- * // true
- * ```
- * @param {String|Array} `str` The string to test.
- * @param {String|Array} `patterns` One or more glob patterns to use for matching.
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns true if any patterns match `str`
- * @api public
- */
+    case 'ENOENT': // not terribly unusual
+    case 'ELOOP':
+    case 'ENAMETOOLONG':
+    case 'UNKNOWN':
+      this.cache[this._makeAbs(f)] = false
+      break
 
-micromatch.all = (str, patterns, options) => {
-  if (typeof str !== 'string') {
-    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
+    default: // some unusual error.  Treat as failure.
+      this.cache[this._makeAbs(f)] = false
+      if (this.strict) {
+        this.emit('error', er)
+        // If the error is handled, then we abort
+        // if not, we threw out of here
+        this.abort()
+      }
+      if (!this.silent)
+        console.error('glob error', er)
+      break
   }
 
-  return [].concat(patterns).every(p => picomatch(p, options)(str));
-};
+  return cb()
+}
 
-/**
- * Returns an array of matches captured by `pattern` in `string, or `null` if the pattern did not match.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.capture(pattern, string[, options]);
- *
- * console.log(mm.capture('test/*.js', 'test/foo.js'));
- * //=> ['foo']
- * console.log(mm.capture('test/*.js', 'foo/bar.css'));
- * //=> null
- * ```
- * @param {String} `glob` Glob pattern to use for matching.
- * @param {String} `input` String to match
- * @param {Object} `options` See available [options](#options) for changing how matches are performed
- * @return {Boolean} Returns an array of captures if the input matches the glob pattern, otherwise `null`.
- * @api public
- */
+Glob.prototype._processGlobStar = function (prefix, read, abs, remain, index, inGlobStar, cb) {
+  var self = this
+  this._readdir(abs, inGlobStar, function (er, entries) {
+    self._processGlobStar2(prefix, read, abs, remain, index, inGlobStar, entries, cb)
+  })
+}
 
-micromatch.capture = (glob, input, options) => {
-  let posix = utils.isWindows(options);
-  let regex = picomatch.makeRe(String(glob), { ...options, capture: true });
-  let match = regex.exec(posix ? utils.toPosixSlashes(input) : input);
 
-  if (match) {
-    return match.slice(1).map(v => v === void 0 ? '' : v);
-  }
-};
+Glob.prototype._processGlobStar2 = function (prefix, read, abs, remain, index, inGlobStar, entries, cb) {
+  //console.error('pgs2', prefix, remain[0], entries)
 
-/**
- * Create a regular expression from the given glob `pattern`.
- *
- * ```js
- * const mm = require('micromatch');
- * // mm.makeRe(pattern[, options]);
- *
- * console.log(mm.makeRe('*.js'));
- * //=> /^(?:(\.[\\\/])?(?!\.)(?=.)[^\/]*?\.js)$/
- * ```
- * @param {String} `pattern` A glob pattern to convert to regex.
- * @param {Object} `options`
- * @return {RegExp} Returns a regex created from the given pattern.
- * @api public
- */
+  // no entries means not a dir, so it can never have matches
+  // foo.txt/** doesn't match foo.txt
+  if (!entries)
+    return cb()
 
-micromatch.makeRe = (...args) => picomatch.makeRe(...args);
+  // test without the globstar, and with every child both below
+  // and replacing the globstar.
+  var remainWithoutGlobStar = remain.slice(1)
+  var gspref = prefix ? [ prefix ] : []
+  var noGlobStar = gspref.concat(remainWithoutGlobStar)
 
-/**
- * Scan a glob pattern to separate the pattern into segments. Used
- * by the [split](#split) method.
- *
- * ```js
- * const mm = require('micromatch');
- * const state = mm.scan(pattern[, options]);
- * ```
- * @param {String} `pattern`
- * @param {Object} `options`
- * @return {Object} Returns an object with
- * @api public
- */
+  // the noGlobStar pattern exits the inGlobStar state
+  this._process(noGlobStar, index, false, cb)
 
-micromatch.scan = (...args) => picomatch.scan(...args);
+  var isSym = this.symlinks[abs]
+  var len = entries.length
 
-/**
- * Parse a glob pattern to create the source string for a regular
- * expression.
- *
- * ```js
- * const mm = require('micromatch');
- * const state = mm(pattern[, options]);
- * ```
- * @param {String} `glob`
- * @param {Object} `options`
- * @return {Object} Returns an object with useful properties and output to be used as regex source string.
- * @api public
- */
+  // If it's a symlink, and we're in a globstar, then stop
+  if (isSym && inGlobStar)
+    return cb()
 
-micromatch.parse = (patterns, options) => {
-  let res = [];
-  for (let pattern of [].concat(patterns || [])) {
-    for (let str of braces(String(pattern), options)) {
-      res.push(picomatch.parse(str, options));
-    }
+  for (var i = 0; i < len; i++) {
+    var e = entries[i]
+    if (e.charAt(0) === '.' && !this.dot)
+      continue
+
+    // these two cases enter the inGlobStar state
+    var instead = gspref.concat(entries[i], remainWithoutGlobStar)
+    this._process(instead, index, true, cb)
+
+    var below = gspref.concat(entries[i], remain)
+    this._process(below, index, true, cb)
   }
-  return res;
-};
 
-/**
- * Process the given brace `pattern`.
- *
- * ```js
- * const { braces } = require('micromatch');
- * console.log(braces('foo/{a,b,c}/bar'));
- * //=> [ 'foo/(a|b|c)/bar' ]
- *
- * console.log(braces('foo/{a,b,c}/bar', { expand: true }));
- * //=> [ 'foo/a/bar', 'foo/b/bar', 'foo/c/bar' ]
- * ```
- * @param {String} `pattern` String with brace pattern to process.
- * @param {Object} `options` Any [options](#options) to change how expansion is performed. See the [braces][] library for all available options.
- * @return {Array}
- * @api public
- */
+  cb()
+}
 
-micromatch.braces = (pattern, options) => {
-  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
-  if ((options && options.nobrace === true) || !/\{.*\}/.test(pattern)) {
-    return [pattern];
+Glob.prototype._processSimple = function (prefix, index, cb) {
+  // XXX review this.  Shouldn't it be doing the mounting etc
+  // before doing stat?  kinda weird?
+  var self = this
+  this._stat(prefix, function (er, exists) {
+    self._processSimple2(prefix, index, er, exists, cb)
+  })
+}
+Glob.prototype._processSimple2 = function (prefix, index, er, exists, cb) {
+
+  //console.error('ps2', prefix, exists)
+
+  if (!this.matches[index])
+    this.matches[index] = Object.create(null)
+
+  // If it doesn't exist, then just mark the lack of results
+  if (!exists)
+    return cb()
+
+  if (prefix && isAbsolute(prefix) && !this.nomount) {
+    var trail = /[\/\\]$/.test(prefix)
+    if (prefix.charAt(0) === '/') {
+      prefix = path.join(this.root, prefix)
+    } else {
+      prefix = path.resolve(this.root, prefix)
+      if (trail)
+        prefix += '/'
+    }
   }
-  return braces(pattern, options);
-};
 
-/**
- * Expand braces
- */
+  if (process.platform === 'win32')
+    prefix = prefix.replace(/\\/g, '/')
 
-micromatch.braceExpand = (pattern, options) => {
-  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
-  return micromatch.braces(pattern, { ...options, expand: true });
-};
+  // Mark this as a match
+  this._emitMatch(index, prefix)
+  cb()
+}
 
-/**
- * Expose micromatch
- */
+// Returns either 'DIR', 'FILE', or false
+Glob.prototype._stat = function (f, cb) {
+  var abs = this._makeAbs(f)
+  var needDir = f.slice(-1) === '/'
 
-module.exports = micromatch;
+  if (f.length > this.maxLength)
+    return cb()
 
+  if (!this.stat && ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
 
-/***/ }),
-/* 604 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (Array.isArray(c))
+      c = 'DIR'
 
-"use strict";
+    // It exists, but maybe not how we need it
+    if (!needDir || c === 'DIR')
+      return cb(null, c)
 
+    if (needDir && c === 'FILE')
+      return cb()
 
-const stringify = __webpack_require__(605);
-const compile = __webpack_require__(607);
-const expand = __webpack_require__(611);
-const parse = __webpack_require__(612);
+    // otherwise we have to stat, because maybe c=true
+    // if we know it exists, but not what it is.
+  }
 
-/**
- * Expand the given pattern or create a regex-compatible string.
- *
- * ```js
- * const braces = require('braces');
- * console.log(braces('{a,b,c}', { compile: true })); //=> ['(a|b|c)']
- * console.log(braces('{a,b,c}')); //=> ['a', 'b', 'c']
- * ```
- * @param {String} `str`
- * @param {Object} `options`
- * @return {String}
- * @api public
- */
+  var exists
+  var stat = this.statCache[abs]
+  if (stat !== undefined) {
+    if (stat === false)
+      return cb(null, stat)
+    else {
+      var type = stat.isDirectory() ? 'DIR' : 'FILE'
+      if (needDir && type === 'FILE')
+        return cb()
+      else
+        return cb(null, type, stat)
+    }
+  }
 
-const braces = (input, options = {}) => {
-  let output = [];
+  var self = this
+  var statcb = inflight('stat\0' + abs, lstatcb_)
+  if (statcb)
+    fs.lstat(abs, statcb)
 
-  if (Array.isArray(input)) {
-    for (let pattern of input) {
-      let result = braces.create(pattern, options);
-      if (Array.isArray(result)) {
-        output.push(...result);
-      } else {
-        output.push(result);
-      }
+  function lstatcb_ (er, lstat) {
+    if (lstat && lstat.isSymbolicLink()) {
+      // If it's a symlink, then treat it as the target, unless
+      // the target does not exist, then treat it as a file.
+      return fs.stat(abs, function (er, stat) {
+        if (er)
+          self._stat2(f, abs, null, lstat, cb)
+        else
+          self._stat2(f, abs, er, stat, cb)
+      })
+    } else {
+      self._stat2(f, abs, er, lstat, cb)
     }
-  } else {
-    output = [].concat(braces.create(input, options));
   }
+}
 
-  if (options && options.expand === true && options.nodupes === true) {
-    output = [...new Set(output)];
+Glob.prototype._stat2 = function (f, abs, er, stat, cb) {
+  if (er && (er.code === 'ENOENT' || er.code === 'ENOTDIR')) {
+    this.statCache[abs] = false
+    return cb()
   }
-  return output;
-};
 
-/**
- * Parse the given `str` with the given `options`.
- *
- * ```js
- * // braces.parse(pattern, [, options]);
- * const ast = braces.parse('a/{b,c}/d');
- * console.log(ast);
- * ```
- * @param {String} pattern Brace pattern to parse
- * @param {Object} options
- * @return {Object} Returns an AST
- * @api public
- */
+  var needDir = f.slice(-1) === '/'
+  this.statCache[abs] = stat
 
-braces.parse = (input, options = {}) => parse(input, options);
+  if (abs.slice(-1) === '/' && stat && !stat.isDirectory())
+    return cb(null, false, stat)
 
-/**
- * Creates a braces string from an AST, or an AST node.
- *
- * ```js
- * const braces = require('braces');
- * let ast = braces.parse('foo/{a,b}/bar');
- * console.log(stringify(ast.nodes[2])); //=> '{a,b}'
- * ```
- * @param {String} `input` Brace pattern or AST.
- * @param {Object} `options`
- * @return {Array} Returns an array of expanded values.
- * @api public
- */
+  var c = true
+  if (stat)
+    c = stat.isDirectory() ? 'DIR' : 'FILE'
+  this.cache[abs] = this.cache[abs] || c
 
-braces.stringify = (input, options = {}) => {
-  if (typeof input === 'string') {
-    return stringify(braces.parse(input, options), options);
-  }
-  return stringify(input, options);
-};
+  if (needDir && c === 'FILE')
+    return cb()
 
-/**
- * Compiles a brace pattern into a regex-compatible, optimized string.
- * This method is called by the main [braces](#braces) function by default.
- *
- * ```js
- * const braces = require('braces');
- * console.log(braces.compile('a/{b,c}/d'));
- * //=> ['a/(b|c)/d']
- * ```
- * @param {String} `input` Brace pattern or AST.
- * @param {Object} `options`
- * @return {Array} Returns an array of expanded values.
- * @api public
- */
+  return cb(null, c, stat)
+}
 
-braces.compile = (input, options = {}) => {
-  if (typeof input === 'string') {
-    input = braces.parse(input, options);
-  }
-  return compile(input, options);
-};
 
-/**
- * Expands a brace pattern into an array. This method is called by the
- * main [braces](#braces) function when `options.expand` is true. Before
- * using this method it's recommended that you read the [performance notes](#performance))
- * and advantages of using [.compile](#compile) instead.
- *
- * ```js
- * const braces = require('braces');
- * console.log(braces.expand('a/{b,c}/d'));
- * //=> ['a/b/d', 'a/c/d'];
- * ```
- * @param {String} `pattern` Brace pattern
- * @param {Object} `options`
- * @return {Array} Returns an array of expanded values.
- * @api public
- */
+/***/ }),
+/* 593 */
+/***/ (function(module, exports, __webpack_require__) {
 
-braces.expand = (input, options = {}) => {
-  if (typeof input === 'string') {
-    input = braces.parse(input, options);
-  }
+try {
+  var util = __webpack_require__(29);
+  /* istanbul ignore next */
+  if (typeof util.inherits !== 'function') throw '';
+  module.exports = util.inherits;
+} catch (e) {
+  /* istanbul ignore next */
+  module.exports = __webpack_require__(594);
+}
 
-  let result = expand(input, options);
 
-  // filter out empty strings if specified
-  if (options.noempty === true) {
-    result = result.filter(Boolean);
-  }
+/***/ }),
+/* 594 */
+/***/ (function(module, exports) {
 
-  // filter out duplicates if specified
-  if (options.nodupes === true) {
-    result = [...new Set(result)];
+if (typeof Object.create === 'function') {
+  // implementation from standard node.js 'util' module
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor
+      ctor.prototype = Object.create(superCtor.prototype, {
+        constructor: {
+          value: ctor,
+          enumerable: false,
+          writable: true,
+          configurable: true
+        }
+      })
+    }
+  };
+} else {
+  // old school shim for old browsers
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor
+      var TempCtor = function () {}
+      TempCtor.prototype = superCtor.prototype
+      ctor.prototype = new TempCtor()
+      ctor.prototype.constructor = ctor
+    }
   }
+}
 
-  return result;
-};
 
-/**
- * Processes a brace pattern and returns either an expanded array
- * (if `options.expand` is true), a highly optimized regex-compatible string.
- * This method is called by the main [braces](#braces) function.
- *
- * ```js
- * const braces = require('braces');
- * console.log(braces.create('user-{200..300}/project-{a,b,c}-{1..10}'))
- * //=> 'user-(20[0-9]|2[1-9][0-9]|300)/project-(a|b|c)-([1-9]|10)'
- * ```
- * @param {String} `pattern` Brace pattern
- * @param {Object} `options`
- * @return {Array} Returns an array of expanded values.
- * @api public
- */
+/***/ }),
+/* 595 */
+/***/ (function(module, exports, __webpack_require__) {
 
-braces.create = (input, options = {}) => {
-  if (input === '' || input.length < 3) {
-    return [input];
-  }
+module.exports = globSync
+globSync.GlobSync = GlobSync
 
- return options.expand !== true
-    ? braces.compile(input, options)
-    : braces.expand(input, options);
-};
+var fs = __webpack_require__(23)
+var rp = __webpack_require__(503)
+var minimatch = __webpack_require__(505)
+var Minimatch = minimatch.Minimatch
+var Glob = __webpack_require__(592).Glob
+var util = __webpack_require__(29)
+var path = __webpack_require__(16)
+var assert = __webpack_require__(30)
+var isAbsolute = __webpack_require__(511)
+var common = __webpack_require__(596)
+var alphasort = common.alphasort
+var alphasorti = common.alphasorti
+var setopts = common.setopts
+var ownProp = common.ownProp
+var childrenIgnored = common.childrenIgnored
+var isIgnored = common.isIgnored
 
-/**
- * Expose "braces"
- */
+function globSync (pattern, options) {
+  if (typeof options === 'function' || arguments.length === 3)
+    throw new TypeError('callback provided to sync glob\n'+
+                        'See: https://github.com/isaacs/node-glob/issues/167')
 
-module.exports = braces;
+  return new GlobSync(pattern, options).found
+}
 
+function GlobSync (pattern, options) {
+  if (!pattern)
+    throw new Error('must provide pattern')
 
-/***/ }),
-/* 605 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (typeof options === 'function' || arguments.length === 3)
+    throw new TypeError('callback provided to sync glob\n'+
+                        'See: https://github.com/isaacs/node-glob/issues/167')
 
-"use strict";
+  if (!(this instanceof GlobSync))
+    return new GlobSync(pattern, options)
 
+  setopts(this, pattern, options)
 
-const utils = __webpack_require__(606);
+  if (this.noprocess)
+    return this
 
-module.exports = (ast, options = {}) => {
-  let stringify = (node, parent = {}) => {
-    let invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
-    let invalidNode = node.invalid === true && options.escapeInvalid === true;
-    let output = '';
+  var n = this.minimatch.set.length
+  this.matches = new Array(n)
+  for (var i = 0; i < n; i ++) {
+    this._process(this.minimatch.set[i], i, false)
+  }
+  this._finish()
+}
 
-    if (node.value) {
-      if ((invalidBlock || invalidNode) && utils.isOpenOrClose(node)) {
-        return '\\' + node.value;
+GlobSync.prototype._finish = function () {
+  assert(this instanceof GlobSync)
+  if (this.realpath) {
+    var self = this
+    this.matches.forEach(function (matchset, index) {
+      var set = self.matches[index] = Object.create(null)
+      for (var p in matchset) {
+        try {
+          p = self._makeAbs(p)
+          var real = rp.realpathSync(p, self.realpathCache)
+          set[real] = true
+        } catch (er) {
+          if (er.syscall === 'stat')
+            set[self._makeAbs(p)] = true
+          else
+            throw er
+        }
       }
-      return node.value;
-    }
+    })
+  }
+  common.finish(this)
+}
 
-    if (node.value) {
-      return node.value;
-    }
 
-    if (node.nodes) {
-      for (let child of node.nodes) {
-        output += stringify(child);
-      }
-    }
-    return output;
-  };
+GlobSync.prototype._process = function (pattern, index, inGlobStar) {
+  assert(this instanceof GlobSync)
 
-  return stringify(ast);
-};
+  // Get the first [n] parts of pattern that are all strings.
+  var n = 0
+  while (typeof pattern[n] === 'string') {
+    n ++
+  }
+  // now n is the index of the first one that is *not* a string.
 
+  // See if there's anything else
+  var prefix
+  switch (n) {
+    // if not, then this is rather simple
+    case pattern.length:
+      this._processSimple(pattern.join('/'), index)
+      return
 
+    case 0:
+      // pattern *starts* with some non-trivial item.
+      // going to readdir(cwd), but not include the prefix in matches.
+      prefix = null
+      break
 
-/***/ }),
-/* 606 */
-/***/ (function(module, exports, __webpack_require__) {
+    default:
+      // pattern has some string bits in the front.
+      // whatever it starts with, whether that's 'absolute' like /foo/bar,
+      // or 'relative' like '../baz'
+      prefix = pattern.slice(0, n).join('/')
+      break
+  }
 
-"use strict";
+  var remain = pattern.slice(n)
 
+  // get the list of entries.
+  var read
+  if (prefix === null)
+    read = '.'
+  else if (isAbsolute(prefix) || isAbsolute(pattern.join('/'))) {
+    if (!prefix || !isAbsolute(prefix))
+      prefix = '/' + prefix
+    read = prefix
+  } else
+    read = prefix
 
-exports.isInteger = num => {
-  if (typeof num === 'number') {
-    return Number.isInteger(num);
-  }
-  if (typeof num === 'string' && num.trim() !== '') {
-    return Number.isInteger(Number(num));
-  }
-  return false;
-};
+  var abs = this._makeAbs(read)
 
-/**
- * Find a node of the given type
- */
+  //if ignored, skip processing
+  if (childrenIgnored(this, read))
+    return
 
-exports.find = (node, type) => node.nodes.find(node => node.type === type);
+  var isGlobStar = remain[0] === minimatch.GLOBSTAR
+  if (isGlobStar)
+    this._processGlobStar(prefix, read, abs, remain, index, inGlobStar)
+  else
+    this._processReaddir(prefix, read, abs, remain, index, inGlobStar)
+}
 
-/**
- * Find a node of the given type
- */
 
-exports.exceedsLimit = (min, max, step = 1, limit) => {
-  if (limit === false) return false;
-  if (!exports.isInteger(min) || !exports.isInteger(max)) return false;
-  return ((Number(max) - Number(min)) / Number(step)) >= limit;
-};
+GlobSync.prototype._processReaddir = function (prefix, read, abs, remain, index, inGlobStar) {
+  var entries = this._readdir(abs, inGlobStar)
 
-/**
- * Escape the given node with '\\' before node.value
- */
+  // if the abs isn't a dir, then nothing can match!
+  if (!entries)
+    return
 
-exports.escapeNode = (block, n = 0, type) => {
-  let node = block.nodes[n];
-  if (!node) return;
+  // It will only match dot entries if it starts with a dot, or if
+  // dot is set.  Stuff like @(.foo|.bar) isn't allowed.
+  var pn = remain[0]
+  var negate = !!this.minimatch.negate
+  var rawGlob = pn._glob
+  var dotOk = this.dot || rawGlob.charAt(0) === '.'
 
-  if ((type && node.type === type) || node.type === 'open' || node.type === 'close') {
-    if (node.escaped !== true) {
-      node.value = '\\' + node.value;
-      node.escaped = true;
+  var matchedEntries = []
+  for (var i = 0; i < entries.length; i++) {
+    var e = entries[i]
+    if (e.charAt(0) !== '.' || dotOk) {
+      var m
+      if (negate && !prefix) {
+        m = !e.match(pn)
+      } else {
+        m = e.match(pn)
+      }
+      if (m)
+        matchedEntries.push(e)
     }
   }
-};
-
-/**
- * Returns true if the given brace node should be enclosed in literal braces
- */
 
-exports.encloseBrace = node => {
-  if (node.type !== 'brace') return false;
-  if ((node.commas >> 0 + node.ranges >> 0) === 0) {
-    node.invalid = true;
-    return true;
-  }
-  return false;
-};
+  var len = matchedEntries.length
+  // If there are no matched entries, then nothing matches.
+  if (len === 0)
+    return
 
-/**
- * Returns true if a brace node is invalid.
- */
+  // if this is the last remaining pattern bit, then no need for
+  // an additional stat *unless* the user has specified mark or
+  // stat explicitly.  We know they exist, since readdir returned
+  // them.
 
-exports.isInvalidBrace = block => {
-  if (block.type !== 'brace') return false;
-  if (block.invalid === true || block.dollar) return true;
-  if ((block.commas >> 0 + block.ranges >> 0) === 0) {
-    block.invalid = true;
-    return true;
-  }
-  if (block.open !== true || block.close !== true) {
-    block.invalid = true;
-    return true;
-  }
-  return false;
-};
+  if (remain.length === 1 && !this.mark && !this.stat) {
+    if (!this.matches[index])
+      this.matches[index] = Object.create(null)
 
-/**
- * Returns true if a node is an open or close node
- */
+    for (var i = 0; i < len; i ++) {
+      var e = matchedEntries[i]
+      if (prefix) {
+        if (prefix.slice(-1) !== '/')
+          e = prefix + '/' + e
+        else
+          e = prefix + e
+      }
 
-exports.isOpenOrClose = node => {
-  if (node.type === 'open' || node.type === 'close') {
-    return true;
+      if (e.charAt(0) === '/' && !this.nomount) {
+        e = path.join(this.root, e)
+      }
+      this._emitMatch(index, e)
+    }
+    // This was the last one, and no stats were needed
+    return
   }
-  return node.open === true || node.close === true;
-};
 
-/**
- * Reduce an array of text nodes.
- */
+  // now test all matched entries as stand-ins for that part
+  // of the pattern.
+  remain.shift()
+  for (var i = 0; i < len; i ++) {
+    var e = matchedEntries[i]
+    var newPattern
+    if (prefix)
+      newPattern = [prefix, e]
+    else
+      newPattern = [e]
+    this._process(newPattern.concat(remain), index, inGlobStar)
+  }
+}
 
-exports.reduce = nodes => nodes.reduce((acc, node) => {
-  if (node.type === 'text') acc.push(node.value);
-  if (node.type === 'range') node.type = 'text';
-  return acc;
-}, []);
 
-/**
- * Flatten an array
- */
+GlobSync.prototype._emitMatch = function (index, e) {
+  if (isIgnored(this, e))
+    return
 
-exports.flatten = (...args) => {
-  const result = [];
-  const flat = arr => {
-    for (let i = 0; i < arr.length; i++) {
-      let ele = arr[i];
-      Array.isArray(ele) ? flat(ele, result) : ele !== void 0 && result.push(ele);
-    }
-    return result;
-  };
-  flat(args);
-  return result;
-};
+  var abs = this._makeAbs(e)
 
+  if (this.mark)
+    e = this._mark(e)
 
-/***/ }),
-/* 607 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (this.absolute) {
+    e = abs
+  }
 
-"use strict";
+  if (this.matches[index][e])
+    return
 
+  if (this.nodir) {
+    var c = this.cache[abs]
+    if (c === 'DIR' || Array.isArray(c))
+      return
+  }
 
-const fill = __webpack_require__(608);
-const utils = __webpack_require__(606);
+  this.matches[index][e] = true
 
-const compile = (ast, options = {}) => {
-  let walk = (node, parent = {}) => {
-    let invalidBlock = utils.isInvalidBrace(parent);
-    let invalidNode = node.invalid === true && options.escapeInvalid === true;
-    let invalid = invalidBlock === true || invalidNode === true;
-    let prefix = options.escapeInvalid === true ? '\\' : '';
-    let output = '';
+  if (this.stat)
+    this._stat(e)
+}
 
-    if (node.isOpen === true) {
-      return prefix + node.value;
-    }
-    if (node.isClose === true) {
-      return prefix + node.value;
-    }
 
-    if (node.type === 'open') {
-      return invalid ? (prefix + node.value) : '(';
-    }
+GlobSync.prototype._readdirInGlobStar = function (abs) {
+  // follow all symlinked directories forever
+  // just proceed as if this is a non-globstar situation
+  if (this.follow)
+    return this._readdir(abs, false)
 
-    if (node.type === 'close') {
-      return invalid ? (prefix + node.value) : ')';
+  var entries
+  var lstat
+  var stat
+  try {
+    lstat = fs.lstatSync(abs)
+  } catch (er) {
+    if (er.code === 'ENOENT') {
+      // lstat failed, doesn't exist
+      return null
     }
+  }
 
-    if (node.type === 'comma') {
-      return node.prev.type === 'comma' ? '' : (invalid ? node.value : '|');
-    }
+  var isSym = lstat && lstat.isSymbolicLink()
+  this.symlinks[abs] = isSym
 
-    if (node.value) {
-      return node.value;
-    }
+  // If it's not a symlink or a dir, then it's definitely a regular file.
+  // don't bother doing a readdir in that case.
+  if (!isSym && lstat && !lstat.isDirectory())
+    this.cache[abs] = 'FILE'
+  else
+    entries = this._readdir(abs, false)
 
-    if (node.nodes && node.ranges > 0) {
-      let args = utils.reduce(node.nodes);
-      let range = fill(...args, { ...options, wrap: false, toRegex: true });
+  return entries
+}
 
-      if (range.length !== 0) {
-        return args.length > 1 && range.length > 1 ? `(${range})` : range;
-      }
-    }
+GlobSync.prototype._readdir = function (abs, inGlobStar) {
+  var entries
 
-    if (node.nodes) {
-      for (let child of node.nodes) {
-        output += walk(child, node);
-      }
-    }
-    return output;
-  };
+  if (inGlobStar && !ownProp(this.symlinks, abs))
+    return this._readdirInGlobStar(abs)
 
-  return walk(ast);
-};
+  if (ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
+    if (!c || c === 'FILE')
+      return null
 
-module.exports = compile;
+    if (Array.isArray(c))
+      return c
+  }
 
+  try {
+    return this._readdirEntries(abs, fs.readdirSync(abs))
+  } catch (er) {
+    this._readdirError(abs, er)
+    return null
+  }
+}
 
-/***/ }),
-/* 608 */
-/***/ (function(module, exports, __webpack_require__) {
+GlobSync.prototype._readdirEntries = function (abs, entries) {
+  // if we haven't asked to stat everything, then just
+  // assume that everything in there exists, so we can avoid
+  // having to stat it a second time.
+  if (!this.mark && !this.stat) {
+    for (var i = 0; i < entries.length; i ++) {
+      var e = entries[i]
+      if (abs === '/')
+        e = abs + e
+      else
+        e = abs + '/' + e
+      this.cache[e] = true
+    }
+  }
 
-"use strict";
-/*!
- * fill-range <https://github.com/jonschlinkert/fill-range>
- *
- * Copyright (c) 2014-present, Jon Schlinkert.
- * Licensed under the MIT License.
- */
+  this.cache[abs] = entries
 
+  // mark and cache dir-ness
+  return entries
+}
 
+GlobSync.prototype._readdirError = function (f, er) {
+  // handle errors, and cache the information
+  switch (er.code) {
+    case 'ENOTSUP': // https://github.com/isaacs/node-glob/issues/205
+    case 'ENOTDIR': // totally normal. means it *does* exist.
+      var abs = this._makeAbs(f)
+      this.cache[abs] = 'FILE'
+      if (abs === this.cwdAbs) {
+        var error = new Error(er.code + ' invalid cwd ' + this.cwd)
+        error.path = this.cwd
+        error.code = er.code
+        throw error
+      }
+      break
 
-const util = __webpack_require__(29);
-const toRegexRange = __webpack_require__(609);
-
-const isObject = val => val !== null && typeof val === 'object' && !Array.isArray(val);
-
-const transform = toNumber => {
-  return value => toNumber === true ? Number(value) : String(value);
-};
-
-const isValidValue = value => {
-  return typeof value === 'number' || (typeof value === 'string' && value !== '');
-};
-
-const isNumber = num => Number.isInteger(+num);
-
-const zeros = input => {
-  let value = `${input}`;
-  let index = -1;
-  if (value[0] === '-') value = value.slice(1);
-  if (value === '0') return false;
-  while (value[++index] === '0');
-  return index > 0;
-};
+    case 'ENOENT': // not terribly unusual
+    case 'ELOOP':
+    case 'ENAMETOOLONG':
+    case 'UNKNOWN':
+      this.cache[this._makeAbs(f)] = false
+      break
 
-const stringify = (start, end, options) => {
-  if (typeof start === 'string' || typeof end === 'string') {
-    return true;
+    default: // some unusual error.  Treat as failure.
+      this.cache[this._makeAbs(f)] = false
+      if (this.strict)
+        throw er
+      if (!this.silent)
+        console.error('glob error', er)
+      break
   }
-  return options.stringify === true;
-};
+}
 
-const pad = (input, maxLength, toNumber) => {
-  if (maxLength > 0) {
-    let dash = input[0] === '-' ? '-' : '';
-    if (dash) input = input.slice(1);
-    input = (dash + input.padStart(dash ? maxLength - 1 : maxLength, '0'));
-  }
-  if (toNumber === false) {
-    return String(input);
-  }
-  return input;
-};
+GlobSync.prototype._processGlobStar = function (prefix, read, abs, remain, index, inGlobStar) {
 
-const toMaxLen = (input, maxLength) => {
-  let negative = input[0] === '-' ? '-' : '';
-  if (negative) {
-    input = input.slice(1);
-    maxLength--;
-  }
-  while (input.length < maxLength) input = '0' + input;
-  return negative ? ('-' + input) : input;
-};
+  var entries = this._readdir(abs, inGlobStar)
 
-const toSequence = (parts, options) => {
-  parts.negatives.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-  parts.positives.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  // no entries means not a dir, so it can never have matches
+  // foo.txt/** doesn't match foo.txt
+  if (!entries)
+    return
 
-  let prefix = options.capture ? '' : '?:';
-  let positives = '';
-  let negatives = '';
-  let result;
+  // test without the globstar, and with every child both below
+  // and replacing the globstar.
+  var remainWithoutGlobStar = remain.slice(1)
+  var gspref = prefix ? [ prefix ] : []
+  var noGlobStar = gspref.concat(remainWithoutGlobStar)
 
-  if (parts.positives.length) {
-    positives = parts.positives.join('|');
-  }
+  // the noGlobStar pattern exits the inGlobStar state
+  this._process(noGlobStar, index, false)
 
-  if (parts.negatives.length) {
-    negatives = `-(${prefix}${parts.negatives.join('|')})`;
-  }
+  var len = entries.length
+  var isSym = this.symlinks[abs]
 
-  if (positives && negatives) {
-    result = `${positives}|${negatives}`;
-  } else {
-    result = positives || negatives;
-  }
+  // If it's a symlink, and we're in a globstar, then stop
+  if (isSym && inGlobStar)
+    return
 
-  if (options.wrap) {
-    return `(${prefix}${result})`;
-  }
+  for (var i = 0; i < len; i++) {
+    var e = entries[i]
+    if (e.charAt(0) === '.' && !this.dot)
+      continue
 
-  return result;
-};
+    // these two cases enter the inGlobStar state
+    var instead = gspref.concat(entries[i], remainWithoutGlobStar)
+    this._process(instead, index, true)
 
-const toRange = (a, b, isNumbers, options) => {
-  if (isNumbers) {
-    return toRegexRange(a, b, { wrap: false, ...options });
+    var below = gspref.concat(entries[i], remain)
+    this._process(below, index, true)
   }
+}
 
-  let start = String.fromCharCode(a);
-  if (a === b) return start;
+GlobSync.prototype._processSimple = function (prefix, index) {
+  // XXX review this.  Shouldn't it be doing the mounting etc
+  // before doing stat?  kinda weird?
+  var exists = this._stat(prefix)
 
-  let stop = String.fromCharCode(b);
-  return `[${start}-${stop}]`;
-};
+  if (!this.matches[index])
+    this.matches[index] = Object.create(null)
 
-const toRegex = (start, end, options) => {
-  if (Array.isArray(start)) {
-    let wrap = options.wrap === true;
-    let prefix = options.capture ? '' : '?:';
-    return wrap ? `(${prefix}${start.join('|')})` : start.join('|');
+  // If it doesn't exist, then just mark the lack of results
+  if (!exists)
+    return
+
+  if (prefix && isAbsolute(prefix) && !this.nomount) {
+    var trail = /[\/\\]$/.test(prefix)
+    if (prefix.charAt(0) === '/') {
+      prefix = path.join(this.root, prefix)
+    } else {
+      prefix = path.resolve(this.root, prefix)
+      if (trail)
+        prefix += '/'
+    }
   }
-  return toRegexRange(start, end, options);
-};
 
-const rangeError = (...args) => {
-  return new RangeError('Invalid range arguments: ' + util.inspect(...args));
-};
+  if (process.platform === 'win32')
+    prefix = prefix.replace(/\\/g, '/')
 
-const invalidRange = (start, end, options) => {
-  if (options.strictRanges === true) throw rangeError([start, end]);
-  return [];
-};
+  // Mark this as a match
+  this._emitMatch(index, prefix)
+}
 
-const invalidStep = (step, options) => {
-  if (options.strictRanges === true) {
-    throw new TypeError(`Expected step "${step}" to be a number`);
-  }
-  return [];
-};
+// Returns either 'DIR', 'FILE', or false
+GlobSync.prototype._stat = function (f) {
+  var abs = this._makeAbs(f)
+  var needDir = f.slice(-1) === '/'
 
-const fillNumbers = (start, end, step = 1, options = {}) => {
-  let a = Number(start);
-  let b = Number(end);
+  if (f.length > this.maxLength)
+    return false
 
-  if (!Number.isInteger(a) || !Number.isInteger(b)) {
-    if (options.strictRanges === true) throw rangeError([start, end]);
-    return [];
-  }
+  if (!this.stat && ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
 
-  // fix negative zero
-  if (a === 0) a = 0;
-  if (b === 0) b = 0;
+    if (Array.isArray(c))
+      c = 'DIR'
 
-  let descending = a > b;
-  let startString = String(start);
-  let endString = String(end);
-  let stepString = String(step);
-  step = Math.max(Math.abs(step), 1);
+    // It exists, but maybe not how we need it
+    if (!needDir || c === 'DIR')
+      return c
 
-  let padded = zeros(startString) || zeros(endString) || zeros(stepString);
-  let maxLen = padded ? Math.max(startString.length, endString.length, stepString.length) : 0;
-  let toNumber = padded === false && stringify(start, end, options) === false;
-  let format = options.transform || transform(toNumber);
+    if (needDir && c === 'FILE')
+      return false
 
-  if (options.toRegex && step === 1) {
-    return toRange(toMaxLen(start, maxLen), toMaxLen(end, maxLen), true, options);
+    // otherwise we have to stat, because maybe c=true
+    // if we know it exists, but not what it is.
   }
 
-  let parts = { negatives: [], positives: [] };
-  let push = num => parts[num < 0 ? 'negatives' : 'positives'].push(Math.abs(num));
-  let range = [];
-  let index = 0;
+  var exists
+  var stat = this.statCache[abs]
+  if (!stat) {
+    var lstat
+    try {
+      lstat = fs.lstatSync(abs)
+    } catch (er) {
+      if (er && (er.code === 'ENOENT' || er.code === 'ENOTDIR')) {
+        this.statCache[abs] = false
+        return false
+      }
+    }
 
-  while (descending ? a >= b : a <= b) {
-    if (options.toRegex === true && step > 1) {
-      push(a);
+    if (lstat && lstat.isSymbolicLink()) {
+      try {
+        stat = fs.statSync(abs)
+      } catch (er) {
+        stat = lstat
+      }
     } else {
-      range.push(pad(format(a, index), maxLen, toNumber));
+      stat = lstat
     }
-    a = descending ? a - step : a + step;
-    index++;
   }
 
-  if (options.toRegex === true) {
-    return step > 1
-      ? toSequence(parts, options)
-      : toRegex(range, null, { wrap: false, ...options });
-  }
+  this.statCache[abs] = stat
 
-  return range;
-};
+  var c = true
+  if (stat)
+    c = stat.isDirectory() ? 'DIR' : 'FILE'
 
-const fillLetters = (start, end, step = 1, options = {}) => {
-  if ((!isNumber(start) && start.length > 1) || (!isNumber(end) && end.length > 1)) {
-    return invalidRange(start, end, options);
-  }
+  this.cache[abs] = this.cache[abs] || c
 
+  if (needDir && c === 'FILE')
+    return false
 
-  let format = options.transform || (val => String.fromCharCode(val));
-  let a = `${start}`.charCodeAt(0);
-  let b = `${end}`.charCodeAt(0);
+  return c
+}
 
-  let descending = a > b;
-  let min = Math.min(a, b);
-  let max = Math.max(a, b);
+GlobSync.prototype._mark = function (p) {
+  return common.mark(this, p)
+}
 
-  if (options.toRegex && step === 1) {
-    return toRange(min, max, false, options);
-  }
+GlobSync.prototype._makeAbs = function (f) {
+  return common.makeAbs(this, f)
+}
 
-  let range = [];
-  let index = 0;
 
-  while (descending ? a >= b : a <= b) {
-    range.push(format(a, index));
-    a = descending ? a - step : a + step;
-    index++;
-  }
+/***/ }),
+/* 596 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  if (options.toRegex === true) {
-    return toRegex(range, null, { wrap: false, options });
-  }
+exports.alphasort = alphasort
+exports.alphasorti = alphasorti
+exports.setopts = setopts
+exports.ownProp = ownProp
+exports.makeAbs = makeAbs
+exports.finish = finish
+exports.mark = mark
+exports.isIgnored = isIgnored
+exports.childrenIgnored = childrenIgnored
 
-  return range;
-};
+function ownProp (obj, field) {
+  return Object.prototype.hasOwnProperty.call(obj, field)
+}
 
-const fill = (start, end, step, options = {}) => {
-  if (end == null && isValidValue(start)) {
-    return [start];
-  }
+var path = __webpack_require__(16)
+var minimatch = __webpack_require__(505)
+var isAbsolute = __webpack_require__(511)
+var Minimatch = minimatch.Minimatch
 
-  if (!isValidValue(start) || !isValidValue(end)) {
-    return invalidRange(start, end, options);
-  }
+function alphasorti (a, b) {
+  return a.toLowerCase().localeCompare(b.toLowerCase())
+}
 
-  if (typeof step === 'function') {
-    return fill(start, end, 1, { transform: step });
-  }
+function alphasort (a, b) {
+  return a.localeCompare(b)
+}
 
-  if (isObject(step)) {
-    return fill(start, end, 0, step);
-  }
+function setupIgnores (self, options) {
+  self.ignore = options.ignore || []
 
-  let opts = { ...options };
-  if (opts.capture === true) opts.wrap = true;
-  step = step || opts.step || 1;
+  if (!Array.isArray(self.ignore))
+    self.ignore = [self.ignore]
 
-  if (!isNumber(step)) {
-    if (step != null && !isObject(step)) return invalidStep(step, opts);
-    return fill(start, end, 1, step);
+  if (self.ignore.length) {
+    self.ignore = self.ignore.map(ignoreMap)
   }
+}
 
-  if (isNumber(start) && isNumber(end)) {
-    return fillNumbers(start, end, step, opts);
+// ignore patterns are always in dot:true mode.
+function ignoreMap (pattern) {
+  var gmatcher = null
+  if (pattern.slice(-3) === '/**') {
+    var gpattern = pattern.replace(/(\/\*\*)+$/, '')
+    gmatcher = new Minimatch(gpattern, { dot: true })
   }
 
-  return fillLetters(start, end, Math.max(Math.abs(step), 1), opts);
-};
-
-module.exports = fill;
-
+  return {
+    matcher: new Minimatch(pattern, { dot: true }),
+    gmatcher: gmatcher
+  }
+}
 
-/***/ }),
-/* 609 */
-/***/ (function(module, exports, __webpack_require__) {
+function setopts (self, pattern, options) {
+  if (!options)
+    options = {}
 
-"use strict";
-/*!
- * to-regex-range <https://github.com/micromatch/to-regex-range>
- *
- * Copyright (c) 2015-present, Jon Schlinkert.
- * Released under the MIT License.
- */
+  // base-matching: just use globstar for that.
+  if (options.matchBase && -1 === pattern.indexOf("/")) {
+    if (options.noglobstar) {
+      throw new Error("base matching requires globstar")
+    }
+    pattern = "**/" + pattern
+  }
 
+  self.silent = !!options.silent
+  self.pattern = pattern
+  self.strict = options.strict !== false
+  self.realpath = !!options.realpath
+  self.realpathCache = options.realpathCache || Object.create(null)
+  self.follow = !!options.follow
+  self.dot = !!options.dot
+  self.mark = !!options.mark
+  self.nodir = !!options.nodir
+  if (self.nodir)
+    self.mark = true
+  self.sync = !!options.sync
+  self.nounique = !!options.nounique
+  self.nonull = !!options.nonull
+  self.nosort = !!options.nosort
+  self.nocase = !!options.nocase
+  self.stat = !!options.stat
+  self.noprocess = !!options.noprocess
+  self.absolute = !!options.absolute
 
+  self.maxLength = options.maxLength || Infinity
+  self.cache = options.cache || Object.create(null)
+  self.statCache = options.statCache || Object.create(null)
+  self.symlinks = options.symlinks || Object.create(null)
 
-const isNumber = __webpack_require__(610);
+  setupIgnores(self, options)
 
-const toRegexRange = (min, max, options) => {
-  if (isNumber(min) === false) {
-    throw new TypeError('toRegexRange: expected the first argument to be a number');
+  self.changedCwd = false
+  var cwd = process.cwd()
+  if (!ownProp(options, "cwd"))
+    self.cwd = cwd
+  else {
+    self.cwd = path.resolve(options.cwd)
+    self.changedCwd = self.cwd !== cwd
   }
 
-  if (max === void 0 || min === max) {
-    return String(min);
-  }
+  self.root = options.root || path.resolve(self.cwd, "/")
+  self.root = path.resolve(self.root)
+  if (process.platform === "win32")
+    self.root = self.root.replace(/\\/g, "/")
 
-  if (isNumber(max) === false) {
-    throw new TypeError('toRegexRange: expected the second argument to be a number.');
-  }
+  // TODO: is an absolute `cwd` supposed to be resolved against `root`?
+  // e.g. { cwd: '/test', root: __dirname } === path.join(__dirname, '/test')
+  self.cwdAbs = isAbsolute(self.cwd) ? self.cwd : makeAbs(self, self.cwd)
+  if (process.platform === "win32")
+    self.cwdAbs = self.cwdAbs.replace(/\\/g, "/")
+  self.nomount = !!options.nomount
 
-  let opts = { relaxZeros: true, ...options };
-  if (typeof opts.strictZeros === 'boolean') {
-    opts.relaxZeros = opts.strictZeros === false;
-  }
+  // disable comments and negation in Minimatch.
+  // Note that they are not supported in Glob itself anyway.
+  options.nonegate = true
+  options.nocomment = true
 
-  let relax = String(opts.relaxZeros);
-  let shorthand = String(opts.shorthand);
-  let capture = String(opts.capture);
-  let wrap = String(opts.wrap);
-  let cacheKey = min + ':' + max + '=' + relax + shorthand + capture + wrap;
+  self.minimatch = new Minimatch(pattern, options)
+  self.options = self.minimatch.options
+}
 
-  if (toRegexRange.cache.hasOwnProperty(cacheKey)) {
-    return toRegexRange.cache[cacheKey].result;
+function finish (self) {
+  var nou = self.nounique
+  var all = nou ? [] : Object.create(null)
+
+  for (var i = 0, l = self.matches.length; i < l; i ++) {
+    var matches = self.matches[i]
+    if (!matches || Object.keys(matches).length === 0) {
+      if (self.nonull) {
+        // do like the shell, and spit out the literal glob
+        var literal = self.minimatch.globSet[i]
+        if (nou)
+          all.push(literal)
+        else
+          all[literal] = true
+      }
+    } else {
+      // had matches
+      var m = Object.keys(matches)
+      if (nou)
+        all.push.apply(all, m)
+      else
+        m.forEach(function (m) {
+          all[m] = true
+        })
+    }
   }
 
-  let a = Math.min(min, max);
-  let b = Math.max(min, max);
+  if (!nou)
+    all = Object.keys(all)
 
-  if (Math.abs(a - b) === 1) {
-    let result = min + '|' + max;
-    if (opts.capture) {
-      return `(${result})`;
+  if (!self.nosort)
+    all = all.sort(self.nocase ? alphasorti : alphasort)
+
+  // at *some* point we statted all of these
+  if (self.mark) {
+    for (var i = 0; i < all.length; i++) {
+      all[i] = self._mark(all[i])
     }
-    if (opts.wrap === false) {
-      return result;
+    if (self.nodir) {
+      all = all.filter(function (e) {
+        var notDir = !(/\/$/.test(e))
+        var c = self.cache[e] || self.cache[makeAbs(self, e)]
+        if (notDir && c)
+          notDir = c !== 'DIR' && !Array.isArray(c)
+        return notDir
+      })
     }
-    return `(?:${result})`;
   }
 
-  let isPadded = hasPadding(min) || hasPadding(max);
-  let state = { min, max, a, b };
-  let positives = [];
-  let negatives = [];
+  if (self.ignore.length)
+    all = all.filter(function(m) {
+      return !isIgnored(self, m)
+    })
 
-  if (isPadded) {
-    state.isPadded = isPadded;
-    state.maxLen = String(state.max).length;
-  }
-
-  if (a < 0) {
-    let newMin = b < 0 ? Math.abs(b) : 1;
-    negatives = splitToPatterns(newMin, Math.abs(a), state, opts);
-    a = state.a = 0;
-  }
-
-  if (b >= 0) {
-    positives = splitToPatterns(a, b, state, opts);
-  }
-
-  state.negatives = negatives;
-  state.positives = positives;
-  state.result = collatePatterns(negatives, positives, opts);
-
-  if (opts.capture === true) {
-    state.result = `(${state.result})`;
-  } else if (opts.wrap !== false && (positives.length + negatives.length) > 1) {
-    state.result = `(?:${state.result})`;
-  }
-
-  toRegexRange.cache[cacheKey] = state;
-  return state.result;
-};
-
-function collatePatterns(neg, pos, options) {
-  let onlyNegative = filterPatterns(neg, pos, '-', false, options) || [];
-  let onlyPositive = filterPatterns(pos, neg, '', false, options) || [];
-  let intersected = filterPatterns(neg, pos, '-?', true, options) || [];
-  let subpatterns = onlyNegative.concat(intersected).concat(onlyPositive);
-  return subpatterns.join('|');
-}
-
-function splitToRanges(min, max) {
-  let nines = 1;
-  let zeros = 1;
-
-  let stop = countNines(min, nines);
-  let stops = new Set([max]);
-
-  while (min <= stop && stop <= max) {
-    stops.add(stop);
-    nines += 1;
-    stop = countNines(min, nines);
-  }
-
-  stop = countZeros(max + 1, zeros) - 1;
-
-  while (min < stop && stop <= max) {
-    stops.add(stop);
-    zeros += 1;
-    stop = countZeros(max + 1, zeros) - 1;
-  }
-
-  stops = [...stops];
-  stops.sort(compare);
-  return stops;
-}
-
-/**
- * Convert a range to a regex pattern
- * @param {Number} `start`
- * @param {Number} `stop`
- * @return {String}
- */
-
-function rangeToPattern(start, stop, options) {
-  if (start === stop) {
-    return { pattern: start, count: [], digits: 0 };
-  }
-
-  let zipped = zip(start, stop);
-  let digits = zipped.length;
-  let pattern = '';
-  let count = 0;
-
-  for (let i = 0; i < digits; i++) {
-    let [startDigit, stopDigit] = zipped[i];
-
-    if (startDigit === stopDigit) {
-      pattern += startDigit;
-
-    } else if (startDigit !== '0' || stopDigit !== '9') {
-      pattern += toCharacterClass(startDigit, stopDigit, options);
-
-    } else {
-      count++;
-    }
-  }
-
-  if (count) {
-    pattern += options.shorthand === true ? '\\d' : '[0-9]';
-  }
-
-  return { pattern, count: [count], digits };
+  self.found = all
 }
 
-function splitToPatterns(min, max, tok, options) {
-  let ranges = splitToRanges(min, max);
-  let tokens = [];
-  let start = min;
-  let prev;
-
-  for (let i = 0; i < ranges.length; i++) {
-    let max = ranges[i];
-    let obj = rangeToPattern(String(start), String(max), options);
-    let zeros = '';
-
-    if (!tok.isPadded && prev && prev.pattern === obj.pattern) {
-      if (prev.count.length > 1) {
-        prev.count.pop();
-      }
+function mark (self, p) {
+  var abs = makeAbs(self, p)
+  var c = self.cache[abs]
+  var m = p
+  if (c) {
+    var isDir = c === 'DIR' || Array.isArray(c)
+    var slash = p.slice(-1) === '/'
 
-      prev.count.push(obj.count[0]);
-      prev.string = prev.pattern + toQuantifier(prev.count);
-      start = max + 1;
-      continue;
-    }
+    if (isDir && !slash)
+      m += '/'
+    else if (!isDir && slash)
+      m = m.slice(0, -1)
 
-    if (tok.isPadded) {
-      zeros = padZeros(max, tok, options);
+    if (m !== p) {
+      var mabs = makeAbs(self, m)
+      self.statCache[mabs] = self.statCache[abs]
+      self.cache[mabs] = self.cache[abs]
     }
-
-    obj.string = zeros + obj.pattern + toQuantifier(obj.count);
-    tokens.push(obj);
-    start = max + 1;
-    prev = obj;
   }
 
-  return tokens;
+  return m
 }
 
-function filterPatterns(arr, comparison, prefix, intersection, options) {
-  let result = [];
-
-  for (let ele of arr) {
-    let { string } = ele;
-
-    // only push if _both_ are negative...
-    if (!intersection && !contains(comparison, 'string', string)) {
-      result.push(prefix + string);
-    }
-
-    // or _both_ are positive
-    if (intersection && contains(comparison, 'string', string)) {
-      result.push(prefix + string);
-    }
+// lotta situps...
+function makeAbs (self, f) {
+  var abs = f
+  if (f.charAt(0) === '/') {
+    abs = path.join(self.root, f)
+  } else if (isAbsolute(f) || f === '') {
+    abs = f
+  } else if (self.changedCwd) {
+    abs = path.resolve(self.cwd, f)
+  } else {
+    abs = path.resolve(f)
   }
-  return result;
-}
-
-/**
- * Zip strings
- */
-
-function zip(a, b) {
-  let arr = [];
-  for (let i = 0; i < a.length; i++) arr.push([a[i], b[i]]);
-  return arr;
-}
-
-function compare(a, b) {
-  return a > b ? 1 : b > a ? -1 : 0;
-}
-
-function contains(arr, key, val) {
-  return arr.some(ele => ele[key] === val);
-}
 
-function countNines(min, len) {
-  return Number(String(min).slice(0, -len) + '9'.repeat(len));
-}
+  if (process.platform === 'win32')
+    abs = abs.replace(/\\/g, '/')
 
-function countZeros(integer, zeros) {
-  return integer - (integer % Math.pow(10, zeros));
+  return abs
 }
 
-function toQuantifier(digits) {
-  let [start = 0, stop = ''] = digits;
-  if (stop || start > 1) {
-    return `{${start + (stop ? ',' + stop : '')}}`;
-  }
-  return '';
-}
 
-function toCharacterClass(a, b, options) {
-  return `[${a}${(b - a === 1) ? '' : '-'}${b}]`;
-}
+// Return true, if pattern ends with globstar '**', for the accompanying parent directory.
+// Ex:- If node_modules/** is the pattern, add 'node_modules' to ignore list along with it's contents
+function isIgnored (self, path) {
+  if (!self.ignore.length)
+    return false
 
-function hasPadding(str) {
-  return /^-?(0+)\d/.test(str);
+  return self.ignore.some(function(item) {
+    return item.matcher.match(path) || !!(item.gmatcher && item.gmatcher.match(path))
+  })
 }
 
-function padZeros(value, tok, options) {
-  if (!tok.isPadded) {
-    return value;
-  }
-
-  let diff = Math.abs(tok.maxLen - String(value).length);
-  let relax = options.relaxZeros !== false;
+function childrenIgnored (self, path) {
+  if (!self.ignore.length)
+    return false
 
-  switch (diff) {
-    case 0:
-      return '';
-    case 1:
-      return relax ? '0?' : '0';
-    case 2:
-      return relax ? '0{0,2}' : '00';
-    default: {
-      return relax ? `0{0,${diff}}` : `0{${diff}}`;
-    }
-  }
+  return self.ignore.some(function(item) {
+    return !!(item.gmatcher && item.gmatcher.match(path))
+  })
 }
 
-/**
- * Cache
- */
-
-toRegexRange.cache = {};
-toRegexRange.clearCache = () => (toRegexRange.cache = {});
-
-/**
- * Expose `toRegexRange`
- */
-
-module.exports = toRegexRange;
-
 
 /***/ }),
-/* 610 */
+/* 597 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-/*!
- * is-number <https://github.com/jonschlinkert/is-number>
- *
- * Copyright (c) 2014-present, Jon Schlinkert.
- * Released under the MIT License.
- */
+
+const taskManager = __webpack_require__(598);
+const async_1 = __webpack_require__(626);
+const stream_1 = __webpack_require__(659);
+const sync_1 = __webpack_require__(660);
+const settings_1 = __webpack_require__(662);
+const utils = __webpack_require__(599);
+function FastGlob(source, options) {
+    try {
+        assertPatternsInput(source);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    const works = getWorks(source, async_1.default, options);
+    return Promise.all(works).then(utils.array.flatten);
+}
+(function (FastGlob) {
+    function sync(source, options) {
+        assertPatternsInput(source);
+        const works = getWorks(source, sync_1.default, options);
+        return utils.array.flatten(works);
+    }
+    FastGlob.sync = sync;
+    function stream(source, options) {
+        assertPatternsInput(source);
+        const works = getWorks(source, stream_1.default, options);
+        /**
+         * The stream returned by the provider cannot work with an asynchronous iterator.
+         * To support asynchronous iterators, regardless of the number of tasks, we always multiplex streams.
+         * This affects performance (+25%). I don't see best solution right now.
+         */
+        return utils.stream.merge(works);
+    }
+    FastGlob.stream = stream;
+    function generateTasks(source, options) {
+        assertPatternsInput(source);
+        const patterns = [].concat(source);
+        const settings = new settings_1.default(options);
+        return taskManager.generate(patterns, settings);
+    }
+    FastGlob.generateTasks = generateTasks;
+})(FastGlob || (FastGlob = {}));
+function getWorks(source, _Provider, options) {
+    const patterns = [].concat(source);
+    const settings = new settings_1.default(options);
+    const tasks = taskManager.generate(patterns, settings);
+    const provider = new _Provider(settings);
+    return tasks.map(provider.read, provider);
+}
+function assertPatternsInput(source) {
+    if ([].concat(source).every(isString)) {
+        return;
+    }
+    throw new TypeError('Patterns must be a string or an array of strings');
+}
+function isString(source) {
+    /* tslint:disable-next-line strict-type-predicates */
+    return typeof source === 'string';
+}
+module.exports = FastGlob;
 
 
+/***/ }),
+/* 598 */
+/***/ (function(module, exports, __webpack_require__) {
 
-module.exports = function(num) {
-  if (typeof num === 'number') {
-    return num - num === 0;
-  }
-  if (typeof num === 'string' && num.trim() !== '') {
-    return Number.isFinite ? Number.isFinite(+num) : isFinite(+num);
-  }
-  return false;
-};
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __webpack_require__(599);
+function generate(patterns, settings) {
+    const positivePatterns = getPositivePatterns(patterns);
+    const negativePatterns = getNegativePatternsAsPositive(patterns, settings.ignore);
+    /**
+     * When the `caseSensitiveMatch` option is disabled, all patterns must be marked as dynamic, because we cannot check
+     * filepath directly (without read directory).
+     */
+    const staticPatterns = !settings.caseSensitiveMatch ? [] : positivePatterns.filter(utils.pattern.isStaticPattern);
+    const dynamicPatterns = !settings.caseSensitiveMatch ? positivePatterns : positivePatterns.filter(utils.pattern.isDynamicPattern);
+    const staticTasks = convertPatternsToTasks(staticPatterns, negativePatterns, /* dynamic */ false);
+    const dynamicTasks = convertPatternsToTasks(dynamicPatterns, negativePatterns, /* dynamic */ true);
+    return staticTasks.concat(dynamicTasks);
+}
+exports.generate = generate;
+function convertPatternsToTasks(positive, negative, dynamic) {
+    const positivePatternsGroup = groupPatternsByBaseDirectory(positive);
+    // When we have a global group – there is no reason to divide the patterns into independent tasks.
+    // In this case, the global task covers the rest.
+    if ('.' in positivePatternsGroup) {
+        const task = convertPatternGroupToTask('.', positive, negative, dynamic);
+        return [task];
+    }
+    return convertPatternGroupsToTasks(positivePatternsGroup, negative, dynamic);
+}
+exports.convertPatternsToTasks = convertPatternsToTasks;
+function getPositivePatterns(patterns) {
+    return utils.pattern.getPositivePatterns(patterns);
+}
+exports.getPositivePatterns = getPositivePatterns;
+function getNegativePatternsAsPositive(patterns, ignore) {
+    const negative = utils.pattern.getNegativePatterns(patterns).concat(ignore);
+    const positive = negative.map(utils.pattern.convertToPositivePattern);
+    return positive;
+}
+exports.getNegativePatternsAsPositive = getNegativePatternsAsPositive;
+function groupPatternsByBaseDirectory(patterns) {
+    return patterns.reduce((collection, pattern) => {
+        const base = utils.pattern.getBaseDirectory(pattern);
+        if (base in collection) {
+            collection[base].push(pattern);
+        }
+        else {
+            collection[base] = [pattern];
+        }
+        return collection;
+    }, {});
+}
+exports.groupPatternsByBaseDirectory = groupPatternsByBaseDirectory;
+function convertPatternGroupsToTasks(positive, negative, dynamic) {
+    return Object.keys(positive).map((base) => {
+        return convertPatternGroupToTask(base, positive[base], negative, dynamic);
+    });
+}
+exports.convertPatternGroupsToTasks = convertPatternGroupsToTasks;
+function convertPatternGroupToTask(base, positive, negative, dynamic) {
+    return {
+        dynamic,
+        positive,
+        negative,
+        base,
+        patterns: [].concat(positive, negative.map(utils.pattern.convertToNegativePattern))
+    };
+}
+exports.convertPatternGroupToTask = convertPatternGroupToTask;
 
 
 /***/ }),
-/* 611 */
+/* 599 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const array = __webpack_require__(600);
+exports.array = array;
+const errno = __webpack_require__(601);
+exports.errno = errno;
+const fs = __webpack_require__(602);
+exports.fs = fs;
+const path = __webpack_require__(603);
+exports.path = path;
+const pattern = __webpack_require__(604);
+exports.pattern = pattern;
+const stream = __webpack_require__(625);
+exports.stream = stream;
 
 
-const fill = __webpack_require__(608);
-const stringify = __webpack_require__(605);
-const utils = __webpack_require__(606);
+/***/ }),
+/* 600 */
+/***/ (function(module, exports, __webpack_require__) {
 
-const append = (queue = '', stash = '', enclose = false) => {
-  let result = [];
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+function flatten(items) {
+    return items.reduce((collection, item) => [].concat(collection, item), []);
+}
+exports.flatten = flatten;
 
-  queue = [].concat(queue);
-  stash = [].concat(stash);
 
-  if (!stash.length) return queue;
-  if (!queue.length) {
-    return enclose ? utils.flatten(stash).map(ele => `{${ele}}`) : stash;
-  }
+/***/ }),
+/* 601 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  for (let item of queue) {
-    if (Array.isArray(item)) {
-      for (let value of item) {
-        result.push(append(value, stash, enclose));
-      }
-    } else {
-      for (let ele of stash) {
-        if (enclose === true && typeof ele === 'string') ele = `{${ele}}`;
-        result.push(Array.isArray(ele) ? append(item, ele, enclose) : (item + ele));
-      }
-    }
-  }
-  return utils.flatten(result);
-};
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+function isEnoentCodeError(error) {
+    return error.code === 'ENOENT';
+}
+exports.isEnoentCodeError = isEnoentCodeError;
 
-const expand = (ast, options = {}) => {
-  let rangeLimit = options.rangeLimit === void 0 ? 1000 : options.rangeLimit;
 
-  let walk = (node, parent = {}) => {
-    node.queue = [];
+/***/ }),
+/* 602 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    let p = parent;
-    let q = parent.queue;
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+class DirentFromStats {
+    constructor(name, stats) {
+        this.name = name;
+        this.isBlockDevice = stats.isBlockDevice.bind(stats);
+        this.isCharacterDevice = stats.isCharacterDevice.bind(stats);
+        this.isDirectory = stats.isDirectory.bind(stats);
+        this.isFIFO = stats.isFIFO.bind(stats);
+        this.isFile = stats.isFile.bind(stats);
+        this.isSocket = stats.isSocket.bind(stats);
+        this.isSymbolicLink = stats.isSymbolicLink.bind(stats);
+    }
+}
+function createDirentFromStats(name, stats) {
+    return new DirentFromStats(name, stats);
+}
+exports.createDirentFromStats = createDirentFromStats;
 
-    while (p.type !== 'brace' && p.type !== 'root' && p.parent) {
-      p = p.parent;
-      q = p.queue;
-    }
 
-    if (node.invalid || node.dollar) {
-      q.push(append(q.pop(), stringify(node, options)));
-      return;
-    }
+/***/ }),
+/* 603 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    if (node.type === 'brace' && node.invalid !== true && node.nodes.length === 2) {
-      q.push(append(q.pop(), ['{}']));
-      return;
-    }
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __webpack_require__(16);
+/**
+ * Designed to work only with simple paths: `dir\\file`.
+ */
+function unixify(filepath) {
+    return filepath.replace(/\\/g, '/');
+}
+exports.unixify = unixify;
+function makeAbsolute(cwd, filepath) {
+    return path.resolve(cwd, filepath);
+}
+exports.makeAbsolute = makeAbsolute;
 
-    if (node.nodes && node.ranges > 0) {
-      let args = utils.reduce(node.nodes);
 
-      if (utils.exceedsLimit(...args, options.step, rangeLimit)) {
-        throw new RangeError('expanded array length exceeds range limit. Use options.rangeLimit to increase or disable the limit.');
-      }
+/***/ }),
+/* 604 */
+/***/ (function(module, exports, __webpack_require__) {
 
-      let range = fill(...args, options);
-      if (range.length === 0) {
-        range = stringify(node, options);
-      }
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __webpack_require__(16);
+const globParent = __webpack_require__(605);
+const isGlob = __webpack_require__(606);
+const micromatch = __webpack_require__(608);
+const GLOBSTAR = '**';
+function isStaticPattern(pattern) {
+    return !isDynamicPattern(pattern);
+}
+exports.isStaticPattern = isStaticPattern;
+function isDynamicPattern(pattern) {
+    return isGlob(pattern, { strict: false });
+}
+exports.isDynamicPattern = isDynamicPattern;
+function convertToPositivePattern(pattern) {
+    return isNegativePattern(pattern) ? pattern.slice(1) : pattern;
+}
+exports.convertToPositivePattern = convertToPositivePattern;
+function convertToNegativePattern(pattern) {
+    return '!' + pattern;
+}
+exports.convertToNegativePattern = convertToNegativePattern;
+function isNegativePattern(pattern) {
+    return pattern.startsWith('!') && pattern[1] !== '(';
+}
+exports.isNegativePattern = isNegativePattern;
+function isPositivePattern(pattern) {
+    return !isNegativePattern(pattern);
+}
+exports.isPositivePattern = isPositivePattern;
+function getNegativePatterns(patterns) {
+    return patterns.filter(isNegativePattern);
+}
+exports.getNegativePatterns = getNegativePatterns;
+function getPositivePatterns(patterns) {
+    return patterns.filter(isPositivePattern);
+}
+exports.getPositivePatterns = getPositivePatterns;
+function getBaseDirectory(pattern) {
+    return globParent(pattern);
+}
+exports.getBaseDirectory = getBaseDirectory;
+function hasGlobStar(pattern) {
+    return pattern.indexOf(GLOBSTAR) !== -1;
+}
+exports.hasGlobStar = hasGlobStar;
+function endsWithSlashGlobStar(pattern) {
+    return pattern.endsWith('/' + GLOBSTAR);
+}
+exports.endsWithSlashGlobStar = endsWithSlashGlobStar;
+function isAffectDepthOfReadingPattern(pattern) {
+    const basename = path.basename(pattern);
+    return endsWithSlashGlobStar(pattern) || isStaticPattern(basename);
+}
+exports.isAffectDepthOfReadingPattern = isAffectDepthOfReadingPattern;
+function getNaiveDepth(pattern) {
+    const base = getBaseDirectory(pattern);
+    const patternDepth = pattern.split('/').length;
+    const patternBaseDepth = base.split('/').length;
+    /**
+     * This is a hack for pattern that has no base directory.
+     *
+     * This is related to the `*\something\*` pattern.
+     */
+    if (base === '.') {
+        return patternDepth - patternBaseDepth;
+    }
+    return patternDepth - patternBaseDepth - 1;
+}
+exports.getNaiveDepth = getNaiveDepth;
+function getMaxNaivePatternsDepth(patterns) {
+    return patterns.reduce((max, pattern) => {
+        const depth = getNaiveDepth(pattern);
+        return depth > max ? depth : max;
+    }, 0);
+}
+exports.getMaxNaivePatternsDepth = getMaxNaivePatternsDepth;
+function makeRe(pattern, options) {
+    return micromatch.makeRe(pattern, options);
+}
+exports.makeRe = makeRe;
+function convertPatternsToRe(patterns, options) {
+    return patterns.map((pattern) => makeRe(pattern, options));
+}
+exports.convertPatternsToRe = convertPatternsToRe;
+function matchAny(entry, patternsRe) {
+    const filepath = entry.replace(/^\.[\\\/]/, '');
+    return patternsRe.some((patternRe) => patternRe.test(filepath));
+}
+exports.matchAny = matchAny;
 
-      q.push(append(q.pop(), range));
-      node.nodes = [];
-      return;
-    }
 
-    let enclose = utils.encloseBrace(node);
-    let queue = node.queue;
-    let block = node;
+/***/ }),
+/* 605 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    while (block.type !== 'brace' && block.type !== 'root' && block.parent) {
-      block = block.parent;
-      queue = block.queue;
-    }
+"use strict";
 
-    for (let i = 0; i < node.nodes.length; i++) {
-      let child = node.nodes[i];
 
-      if (child.type === 'comma' && node.type === 'brace') {
-        if (i === 1) queue.push('');
-        queue.push('');
-        continue;
-      }
+var isGlob = __webpack_require__(606);
+var pathPosixDirname = __webpack_require__(16).posix.dirname;
+var isWin32 = __webpack_require__(11).platform() === 'win32';
 
-      if (child.type === 'close') {
-        q.push(append(q.pop(), queue, enclose));
-        continue;
-      }
+var slash = '/';
+var backslash = /\\/g;
+var enclosure = /[\{\[].*[\/]*.*[\}\]]$/;
+var globby = /(^|[^\\])([\{\[]|\([^\)]+$)/;
+var escaped = /\\([\*\?\|\[\]\(\)\{\}])/g;
 
-      if (child.value && child.type !== 'open') {
-        queue.push(append(queue.pop(), child.value));
-        continue;
-      }
+module.exports = function globParent(str) {
+  // flip windows path separators
+  if (isWin32 && str.indexOf(slash) < 0) {
+    str = str.replace(backslash, slash);
+  }
 
-      if (child.nodes) {
-        walk(child, node);
-      }
-    }
+  // special case for strings ending in enclosure containing path separator
+  if (enclosure.test(str)) {
+    str += slash;
+  }
 
-    return queue;
-  };
+  // preserves full path in case of trailing path separator
+  str += 'a';
 
-  return utils.flatten(walk(ast));
-};
+  // remove path parts that are globby
+  do {
+    str = pathPosixDirname(str);
+  } while (isGlob(str) || globby.test(str));
 
-module.exports = expand;
+  // remove escape chars and return result
+  return str.replace(escaped, '$1');
+};
 
 
 /***/ }),
-/* 612 */
+/* 606 */
 /***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
-
-
-const stringify = __webpack_require__(605);
-
-/**
- * Constants
+/*!
+ * is-glob <https://github.com/jonschlinkert/is-glob>
+ *
+ * Copyright (c) 2014-2017, Jon Schlinkert.
+ * Released under the MIT License.
  */
 
-const {
-  MAX_LENGTH,
-  CHAR_BACKSLASH, /* \ */
-  CHAR_BACKTICK, /* ` */
-  CHAR_COMMA, /* , */
-  CHAR_DOT, /* . */
-  CHAR_LEFT_PARENTHESES, /* ( */
-  CHAR_RIGHT_PARENTHESES, /* ) */
-  CHAR_LEFT_CURLY_BRACE, /* { */
-  CHAR_RIGHT_CURLY_BRACE, /* } */
-  CHAR_LEFT_SQUARE_BRACKET, /* [ */
-  CHAR_RIGHT_SQUARE_BRACKET, /* ] */
-  CHAR_DOUBLE_QUOTE, /* " */
-  CHAR_SINGLE_QUOTE, /* ' */
-  CHAR_NO_BREAK_SPACE,
-  CHAR_ZERO_WIDTH_NOBREAK_SPACE
-} = __webpack_require__(613);
-
-/**
- * parse
- */
+var isExtglob = __webpack_require__(607);
+var chars = { '{': '}', '(': ')', '[': ']'};
+var strictRegex = /\\(.)|(^!|\*|[\].+)]\?|\[[^\\\]]+\]|\{[^\\}]+\}|\(\?[:!=][^\\)]+\)|\([^|]+\|[^\\)]+\))/;
+var relaxedRegex = /\\(.)|(^!|[*?{}()[\]]|\(\?)/;
 
-const parse = (input, options = {}) => {
-  if (typeof input !== 'string') {
-    throw new TypeError('Expected a string');
+module.exports = function isGlob(str, options) {
+  if (typeof str !== 'string' || str === '') {
+    return false;
   }
 
-  let opts = options || {};
-  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
-  if (input.length > max) {
-    throw new SyntaxError(`Input length (${input.length}), exceeds max characters (${max})`);
+  if (isExtglob(str)) {
+    return true;
   }
 
-  let ast = { type: 'root', input, nodes: [] };
-  let stack = [ast];
-  let block = ast;
-  let prev = ast;
-  let brackets = 0;
-  let length = input.length;
-  let index = 0;
-  let depth = 0;
-  let value;
-  let memo = {};
+  var regex = strictRegex;
+  var match;
 
-  /**
-   * Helpers
-   */
+  // optionally relax regex
+  if (options && options.strict === false) {
+    regex = relaxedRegex;
+  }
 
-  const advance = () => input[index++];
-  const push = node => {
-    if (node.type === 'text' && prev.type === 'dot') {
-      prev.type = 'text';
-    }
+  while ((match = regex.exec(str))) {
+    if (match[2]) return true;
+    var idx = match.index + match[0].length;
 
-    if (prev && prev.type === 'text' && node.type === 'text') {
-      prev.value += node.value;
-      return;
+    // if an open bracket/brace/paren is escaped,
+    // set the index to the next closing character
+    var open = match[1];
+    var close = open ? chars[open] : null;
+    if (open && close) {
+      var n = str.indexOf(close, idx);
+      if (n !== -1) {
+        idx = n + 1;
+      }
     }
 
-    block.nodes.push(node);
-    node.parent = block;
-    node.prev = prev;
-    prev = node;
-    return node;
-  };
-
-  push({ type: 'bos' });
-
-  while (index < length) {
-    block = stack[stack.length - 1];
-    value = advance();
-
-    /**
-     * Invalid chars
-     */
-
-    if (value === CHAR_ZERO_WIDTH_NOBREAK_SPACE || value === CHAR_NO_BREAK_SPACE) {
-      continue;
-    }
+    str = str.slice(idx);
+  }
+  return false;
+};
 
-    /**
-     * Escaped chars
-     */
 
-    if (value === CHAR_BACKSLASH) {
-      push({ type: 'text', value: (options.keepEscaping ? value : '') + advance() });
-      continue;
-    }
+/***/ }),
+/* 607 */
+/***/ (function(module, exports) {
 
-    /**
-     * Right square bracket (literal): ']'
-     */
+/*!
+ * is-extglob <https://github.com/jonschlinkert/is-extglob>
+ *
+ * Copyright (c) 2014-2016, Jon Schlinkert.
+ * Licensed under the MIT License.
+ */
 
-    if (value === CHAR_RIGHT_SQUARE_BRACKET) {
-      push({ type: 'text', value: '\\' + value });
-      continue;
-    }
+module.exports = function isExtglob(str) {
+  if (typeof str !== 'string' || str === '') {
+    return false;
+  }
 
-    /**
-     * Left square bracket: '['
-     */
+  var match;
+  while ((match = /(\\).|([@?!+*]\(.*\))/g.exec(str))) {
+    if (match[2]) return true;
+    str = str.slice(match.index + match[0].length);
+  }
 
-    if (value === CHAR_LEFT_SQUARE_BRACKET) {
-      brackets++;
+  return false;
+};
 
-      let closed = true;
-      let next;
 
-      while (index < length && (next = advance())) {
-        value += next;
+/***/ }),
+/* 608 */
+/***/ (function(module, exports, __webpack_require__) {
 
-        if (next === CHAR_LEFT_SQUARE_BRACKET) {
-          brackets++;
-          continue;
-        }
+"use strict";
 
-        if (next === CHAR_BACKSLASH) {
-          value += advance();
-          continue;
-        }
 
-        if (next === CHAR_RIGHT_SQUARE_BRACKET) {
-          brackets--;
+const util = __webpack_require__(29);
+const braces = __webpack_require__(609);
+const picomatch = __webpack_require__(619);
+const utils = __webpack_require__(622);
+const isEmptyString = val => typeof val === 'string' && (val === '' || val === './');
 
-          if (brackets === 0) {
-            break;
-          }
-        }
-      }
+/**
+ * Returns an array of strings that match one or more glob patterns.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm(list, patterns[, options]);
+ *
+ * console.log(mm(['a.js', 'a.txt'], ['*.js']));
+ * //=> [ 'a.js' ]
+ * ```
+ * @param {String|Array<string>} list List of strings to match.
+ * @param {String|Array<string>} patterns One or more glob patterns to use for matching.
+ * @param {Object} options See available [options](#options)
+ * @return {Array} Returns an array of matches
+ * @summary false
+ * @api public
+ */
 
-      push({ type: 'text', value });
-      continue;
-    }
+const micromatch = (list, patterns, options) => {
+  patterns = [].concat(patterns);
+  list = [].concat(list);
 
-    /**
-     * Parentheses
-     */
+  let omit = new Set();
+  let keep = new Set();
+  let items = new Set();
+  let negatives = 0;
 
-    if (value === CHAR_LEFT_PARENTHESES) {
-      block = push({ type: 'paren', nodes: [] });
-      stack.push(block);
-      push({ type: 'text', value });
-      continue;
+  let onResult = state => {
+    items.add(state.output);
+    if (options && options.onResult) {
+      options.onResult(state);
     }
+  };
 
-    if (value === CHAR_RIGHT_PARENTHESES) {
-      if (block.type !== 'paren') {
-        push({ type: 'text', value });
-        continue;
-      }
-      block = stack.pop();
-      push({ type: 'text', value });
-      block = stack[stack.length - 1];
-      continue;
-    }
+  for (let i = 0; i < patterns.length; i++) {
+    let isMatch = picomatch(String(patterns[i]), { ...options, onResult }, true);
+    let negated = isMatch.state.negated || isMatch.state.negatedExtglob;
+    if (negated) negatives++;
 
-    /**
-     * Quotes: '|"|`
-     */
+    for (let item of list) {
+      let matched = isMatch(item, true);
 
-    if (value === CHAR_DOUBLE_QUOTE || value === CHAR_SINGLE_QUOTE || value === CHAR_BACKTICK) {
-      let open = value;
-      let next;
+      let match = negated ? !matched.isMatch : matched.isMatch;
+      if (!match) continue;
 
-      if (options.keepQuotes !== true) {
-        value = '';
+      if (negated) {
+        omit.add(matched.output);
+      } else {
+        omit.delete(matched.output);
+        keep.add(matched.output);
       }
+    }
+  }
 
-      while (index < length && (next = advance())) {
-        if (next === CHAR_BACKSLASH) {
-          value += next + advance();
-          continue;
-        }
-
-        if (next === open) {
-          if (options.keepQuotes === true) value += next;
-          break;
-        }
+  let result = negatives === patterns.length ? [...items] : [...keep];
+  let matches = result.filter(item => !omit.has(item));
 
-        value += next;
-      }
+  if (options && matches.length === 0) {
+    if (options.failglob === true) {
+      throw new Error(`No matches found for "${patterns.join(', ')}"`);
+    }
 
-      push({ type: 'text', value });
-      continue;
+    if (options.nonull === true || options.nullglob === true) {
+      return options.unescape ? patterns.map(p => p.replace(/\\/g, '')) : patterns;
     }
+  }
 
-    /**
-     * Left curly brace: '{'
-     */
+  return matches;
+};
 
-    if (value === CHAR_LEFT_CURLY_BRACE) {
-      depth++;
+/**
+ * Backwards compatibility
+ */
 
-      let dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
-      let brace = {
-        type: 'brace',
-        open: true,
-        close: false,
-        dollar,
-        depth,
-        commas: 0,
-        ranges: 0,
-        nodes: []
-      };
+micromatch.match = micromatch;
 
-      block = push(brace);
-      stack.push(block);
-      push({ type: 'open', value });
-      continue;
-    }
+/**
+ * Returns a matcher function from the given glob `pattern` and `options`.
+ * The returned function takes a string to match as its only argument and returns
+ * true if the string is a match.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm.matcher(pattern[, options]);
+ *
+ * const isMatch = mm.matcher('*.!(*a)');
+ * console.log(isMatch('a.a')); //=> false
+ * console.log(isMatch('a.b')); //=> true
+ * ```
+ * @param {String} `pattern` Glob pattern
+ * @param {Object} `options`
+ * @return {Function} Returns a matcher function.
+ * @api public
+ */
 
-    /**
-     * Right curly brace: '}'
-     */
+micromatch.matcher = (pattern, options) => picomatch(pattern, options);
 
-    if (value === CHAR_RIGHT_CURLY_BRACE) {
-      if (block.type !== 'brace') {
-        push({ type: 'text', value });
-        continue;
-      }
+/**
+ * Returns true if **any** of the given glob `patterns` match the specified `string`.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm.isMatch(string, patterns[, options]);
+ *
+ * console.log(mm.isMatch('a.a', ['b.*', '*.a'])); //=> true
+ * console.log(mm.isMatch('a.a', 'b.*')); //=> false
+ * ```
+ * @param {String} str The string to test.
+ * @param {String|Array} patterns One or more glob patterns to use for matching.
+ * @param {Object} [options] See available [options](#options).
+ * @return {Boolean} Returns true if any patterns match `str`
+ * @api public
+ */
 
-      let type = 'close';
-      block = stack.pop();
-      block.close = true;
+micromatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
 
-      push({ type, value });
-      depth--;
+/**
+ * Backwards compatibility
+ */
 
-      block = stack[stack.length - 1];
-      continue;
-    }
+micromatch.any = micromatch.isMatch;
 
-    /**
-     * Comma: ','
-     */
-
-    if (value === CHAR_COMMA && depth > 0) {
-      if (block.ranges > 0) {
-        block.ranges = 0;
-        let open = block.nodes.shift();
-        block.nodes = [open, { type: 'text', value: stringify(block) }];
-      }
-
-      push({ type: 'comma', value });
-      block.commas++;
-      continue;
-    }
-
-    /**
-     * Dot: '.'
-     */
-
-    if (value === CHAR_DOT && depth > 0 && block.commas === 0) {
-      let siblings = block.nodes;
-
-      if (depth === 0 || siblings.length === 0) {
-        push({ type: 'text', value });
-        continue;
-      }
-
-      if (prev.type === 'dot') {
-        block.range = [];
-        prev.value += value;
-        prev.type = 'range';
-
-        if (block.nodes.length !== 3 && block.nodes.length !== 5) {
-          block.invalid = true;
-          block.ranges = 0;
-          prev.type = 'text';
-          continue;
-        }
+/**
+ * Returns a list of strings that _**do not match any**_ of the given `patterns`.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm.not(list, patterns[, options]);
+ *
+ * console.log(mm.not(['a.a', 'b.b', 'c.c'], '*.a'));
+ * //=> ['b.b', 'c.c']
+ * ```
+ * @param {Array} `list` Array of strings to match.
+ * @param {String|Array} `patterns` One or more glob pattern to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Array} Returns an array of strings that **do not match** the given patterns.
+ * @api public
+ */
 
-        block.ranges++;
-        block.args = [];
-        continue;
-      }
+micromatch.not = (list, patterns, options = {}) => {
+  patterns = [].concat(patterns).map(String);
+  let result = new Set();
+  let items = [];
 
-      if (prev.type === 'range') {
-        siblings.pop();
+  let onResult = state => {
+    if (options.onResult) options.onResult(state);
+    items.push(state.output);
+  };
 
-        let before = siblings[siblings.length - 1];
-        before.value += prev.value + value;
-        prev = before;
-        block.ranges--;
-        continue;
-      }
+  let matches = micromatch(list, patterns, { ...options, onResult });
 
-      push({ type: 'dot', value });
-      continue;
+  for (let item of items) {
+    if (!matches.includes(item)) {
+      result.add(item);
     }
-
-    /**
-     * Text
-     */
-
-    push({ type: 'text', value });
   }
-
-  // Mark imbalanced braces and brackets as invalid
-  do {
-    block = stack.pop();
-
-    if (block.type !== 'root') {
-      block.nodes.forEach(node => {
-        if (!node.nodes) {
-          if (node.type === 'open') node.isOpen = true;
-          if (node.type === 'close') node.isClose = true;
-          if (!node.nodes) node.type = 'text';
-          node.invalid = true;
-        }
-      });
-
-      // get the location of the block on parent.nodes (block's siblings)
-      let parent = stack[stack.length - 1];
-      let index = parent.nodes.indexOf(block);
-      // replace the (invalid) block with it's nodes
-      parent.nodes.splice(index, 1, ...block.nodes);
-    }
-  } while (stack.length > 0);
-
-  push({ type: 'eos' });
-  return ast;
-};
-
-module.exports = parse;
-
-
-/***/ }),
-/* 613 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-
-module.exports = {
-  MAX_LENGTH: 1024 * 64,
-
-  // Digits
-  CHAR_0: '0', /* 0 */
-  CHAR_9: '9', /* 9 */
-
-  // Alphabet chars.
-  CHAR_UPPERCASE_A: 'A', /* A */
-  CHAR_LOWERCASE_A: 'a', /* a */
-  CHAR_UPPERCASE_Z: 'Z', /* Z */
-  CHAR_LOWERCASE_Z: 'z', /* z */
-
-  CHAR_LEFT_PARENTHESES: '(', /* ( */
-  CHAR_RIGHT_PARENTHESES: ')', /* ) */
-
-  CHAR_ASTERISK: '*', /* * */
-
-  // Non-alphabetic chars.
-  CHAR_AMPERSAND: '&', /* & */
-  CHAR_AT: '@', /* @ */
-  CHAR_BACKSLASH: '\\', /* \ */
-  CHAR_BACKTICK: '`', /* ` */
-  CHAR_CARRIAGE_RETURN: '\r', /* \r */
-  CHAR_CIRCUMFLEX_ACCENT: '^', /* ^ */
-  CHAR_COLON: ':', /* : */
-  CHAR_COMMA: ',', /* , */
-  CHAR_DOLLAR: '$', /* . */
-  CHAR_DOT: '.', /* . */
-  CHAR_DOUBLE_QUOTE: '"', /* " */
-  CHAR_EQUAL: '=', /* = */
-  CHAR_EXCLAMATION_MARK: '!', /* ! */
-  CHAR_FORM_FEED: '\f', /* \f */
-  CHAR_FORWARD_SLASH: '/', /* / */
-  CHAR_HASH: '#', /* # */
-  CHAR_HYPHEN_MINUS: '-', /* - */
-  CHAR_LEFT_ANGLE_BRACKET: '<', /* < */
-  CHAR_LEFT_CURLY_BRACE: '{', /* { */
-  CHAR_LEFT_SQUARE_BRACKET: '[', /* [ */
-  CHAR_LINE_FEED: '\n', /* \n */
-  CHAR_NO_BREAK_SPACE: '\u00A0', /* \u00A0 */
-  CHAR_PERCENT: '%', /* % */
-  CHAR_PLUS: '+', /* + */
-  CHAR_QUESTION_MARK: '?', /* ? */
-  CHAR_RIGHT_ANGLE_BRACKET: '>', /* > */
-  CHAR_RIGHT_CURLY_BRACE: '}', /* } */
-  CHAR_RIGHT_SQUARE_BRACKET: ']', /* ] */
-  CHAR_SEMICOLON: ';', /* ; */
-  CHAR_SINGLE_QUOTE: '\'', /* ' */
-  CHAR_SPACE: ' ', /*   */
-  CHAR_TAB: '\t', /* \t */
-  CHAR_UNDERSCORE: '_', /* _ */
-  CHAR_VERTICAL_LINE: '|', /* | */
-  CHAR_ZERO_WIDTH_NOBREAK_SPACE: '\uFEFF' /* \uFEFF */
+  return [...result];
 };
 
-
-/***/ }),
-/* 614 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-
-module.exports = __webpack_require__(615);
-
-
-/***/ }),
-/* 615 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-
-const path = __webpack_require__(16);
-const scan = __webpack_require__(616);
-const parse = __webpack_require__(619);
-const utils = __webpack_require__(617);
-
 /**
- * Creates a matcher function from one or more glob patterns. The
- * returned function takes a string to match as its first argument,
- * and returns true if the string is a match. The returned matcher
- * function also takes a boolean as the second argument that, when true,
- * returns an object with additional information.
+ * Returns true if the given `string` contains the given pattern. Similar
+ * to [.isMatch](#isMatch) but the pattern can match any part of the string.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch(glob[, options]);
+ * var mm = require('micromatch');
+ * // mm.contains(string, pattern[, options]);
  *
- * const isMatch = picomatch('*.!(*a)');
- * console.log(isMatch('a.a')); //=> false
- * console.log(isMatch('a.b')); //=> true
+ * console.log(mm.contains('aa/bb/cc', '*b'));
+ * //=> true
+ * console.log(mm.contains('aa/bb/cc', '*d'));
+ * //=> false
  * ```
- * @name picomatch
- * @param {String|Array} `globs` One or more glob patterns.
- * @param {Object=} `options`
- * @return {Function=} Returns a matcher function.
+ * @param {String} `str` The string to match.
+ * @param {String|Array} `patterns` Glob pattern to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Boolean} Returns true if the patter matches any part of `str`.
  * @api public
  */
 
-const picomatch = (glob, options, returnState = false) => {
-  if (Array.isArray(glob)) {
-    let fns = glob.map(input => picomatch(input, options, returnState));
-    return str => {
-      for (let isMatch of fns) {
-        let state = isMatch(str);
-        if (state) return state;
-      }
-      return false;
-    };
-  }
-
-  if (typeof glob !== 'string' || glob === '') {
-    throw new TypeError('Expected pattern to be a non-empty string');
+micromatch.contains = (str, pattern, options) => {
+  if (typeof str !== 'string') {
+    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
   }
 
-  let opts = options || {};
-  let posix = utils.isWindows(options);
-  let regex = picomatch.makeRe(glob, options, false, true);
-  let state = regex.state;
-  delete regex.state;
-
-  let isIgnored = () => false;
-  if (opts.ignore) {
-    let ignoreOpts = { ...options, ignore: null, onMatch: null, onResult: null };
-    isIgnored = picomatch(opts.ignore, ignoreOpts, returnState);
+  if (Array.isArray(pattern)) {
+    return pattern.some(p => micromatch.contains(str, p, options));
   }
 
-  const matcher = (input, returnObject = false) => {
-    let { isMatch, match, output } = picomatch.test(input, regex, options, { glob, posix });
-    let result = { glob, state, regex, posix, input, output, match, isMatch };
-
-    if (typeof opts.onResult === 'function') {
-      opts.onResult(result);
+  if (typeof pattern === 'string') {
+    if (isEmptyString(str) || isEmptyString(pattern)) {
+      return false;
     }
 
-    if (isMatch === false) {
-      result.isMatch = false;
-      return returnObject ? result : false;
+    if (str.includes(pattern) || (str.startsWith('./') && str.slice(2).includes(pattern))) {
+      return true;
     }
+  }
 
-    if (isIgnored(input)) {
-      if (typeof opts.onIgnore === 'function') {
-        opts.onIgnore(result);
-      }
-      result.isMatch = false;
-      return returnObject ? result : false;
-    }
+  return micromatch.isMatch(str, pattern, { ...options, contains: true });
+};
 
-    if (typeof opts.onMatch === 'function') {
-      opts.onMatch(result);
-    }
-    return returnObject ? result : true;
-  };
+/**
+ * Filter the keys of the given object with the given `glob` pattern
+ * and `options`. Does not attempt to match nested keys. If you need this feature,
+ * use [glob-object][] instead.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm.matchKeys(object, patterns[, options]);
+ *
+ * const obj = { aa: 'a', ab: 'b', ac: 'c' };
+ * console.log(mm.matchKeys(obj, '*b'));
+ * //=> { ab: 'b' }
+ * ```
+ * @param {Object} `object` The object with keys to filter.
+ * @param {String|Array} `patterns` One or more glob patterns to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Object} Returns an object with only keys that match the given patterns.
+ * @api public
+ */
 
-  if (returnState) {
-    matcher.state = state;
+micromatch.matchKeys = (obj, patterns, options) => {
+  if (!utils.isObject(obj)) {
+    throw new TypeError('Expected the first argument to be an object');
   }
-
-  return matcher;
+  let keys = micromatch(Object.keys(obj), patterns, options);
+  let res = {};
+  for (let key of keys) res[key] = obj[key];
+  return res;
 };
 
 /**
- * Test `input` with the given `regex`. This is used by the main
- * `picomatch()` function to test the input string.
+ * Returns true if some of the strings in the given `list` match any of the given glob `patterns`.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.test(input, regex[, options]);
+ * const mm = require('micromatch');
+ * // mm.some(list, patterns[, options]);
  *
- * console.log(picomatch.test('foo/bar', /^(?:([^/]*?)\/([^/]*?))$/));
- * // { isMatch: true, match: [ 'foo/', 'foo', 'bar' ], output: 'foo/bar' }
+ * console.log(mm.some(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
+ * // true
+ * console.log(mm.some(['foo.js'], ['*.js', '!foo.js']));
+ * // false
  * ```
- * @param {String} `input` String to test.
- * @param {RegExp} `regex`
- * @return {Object} Returns an object with matching info.
+ * @param {String|Array} `list` The string or array of strings to test. Returns as soon as the first match is found.
+ * @param {String|Array} `patterns` One or more glob patterns to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Boolean} Returns true if any patterns match `str`
  * @api public
  */
 
-picomatch.test = (input, regex, options, { glob, posix } = {}) => {
-  if (typeof input !== 'string') {
-    throw new TypeError('Expected input to be a string');
-  }
+micromatch.some = (list, patterns, options) => {
+  let items = [].concat(list);
 
-  if (input === '') {
-    return { isMatch: false, output: '' };
+  for (let pattern of [].concat(patterns)) {
+    let isMatch = picomatch(String(pattern), options);
+    if (items.some(item => isMatch(item))) {
+      return true;
+    }
   }
+  return false;
+};
 
-  let opts = options || {};
-  let format = opts.format || (posix ? utils.toPosixSlashes : null);
-  let match = input === glob;
-  let output = (match && format) ? format(input) : input;
+/**
+ * Returns true if every string in the given `list` matches
+ * any of the given glob `patterns`.
+ *
+ * ```js
+ * const mm = require('micromatch');
+ * // mm.every(list, patterns[, options]);
+ *
+ * console.log(mm.every('foo.js', ['foo.js']));
+ * // true
+ * console.log(mm.every(['foo.js', 'bar.js'], ['*.js']));
+ * // true
+ * console.log(mm.every(['foo.js', 'bar.js'], ['*.js', '!foo.js']));
+ * // false
+ * console.log(mm.every(['foo.js'], ['*.js', '!foo.js']));
+ * // false
+ * ```
+ * @param {String|Array} `list` The string or array of strings to test.
+ * @param {String|Array} `patterns` One or more glob patterns to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Boolean} Returns true if any patterns match `str`
+ * @api public
+ */
 
-  if (match === false) {
-    output = format ? format(input) : input;
-    match = output === glob;
-  }
+micromatch.every = (list, patterns, options) => {
+  let items = [].concat(list);
 
-  if (match === false || opts.capture === true) {
-    if (opts.matchBase === true || opts.basename === true) {
-      match = picomatch.matchBase(input, regex, options, posix);
-    } else {
-      match = regex.exec(output);
+  for (let pattern of [].concat(patterns)) {
+    let isMatch = picomatch(String(pattern), options);
+    if (!items.every(item => isMatch(item))) {
+      return false;
     }
   }
-
-  return { isMatch: !!match, match, output };
+  return true;
 };
 
 /**
- * Match the basename of a filepath.
+ * Returns true if **all** of the given `patterns` match
+ * the specified string.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.matchBase(input, glob[, options]);
- * console.log(picomatch.matchBase('foo/bar.js', '*.js'); // true
+ * const mm = require('micromatch');
+ * // mm.all(string, patterns[, options]);
+ *
+ * console.log(mm.all('foo.js', ['foo.js']));
+ * // true
+ *
+ * console.log(mm.all('foo.js', ['*.js', '!foo.js']));
+ * // false
+ *
+ * console.log(mm.all('foo.js', ['*.js', 'foo.js']));
+ * // true
+ *
+ * console.log(mm.all('foo.js', ['*.js', 'f*', '*o*', '*o.js']));
+ * // true
  * ```
- * @param {String} `input` String to test.
- * @param {RegExp|String} `glob` Glob pattern or regex created by [.makeRe](#makeRe).
- * @return {Boolean}
+ * @param {String|Array} `str` The string to test.
+ * @param {String|Array} `patterns` One or more glob patterns to use for matching.
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Boolean} Returns true if any patterns match `str`
  * @api public
  */
 
-picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
-  let regex = glob instanceof RegExp ? glob : picomatch.makeRe(glob, options);
-  return regex.test(path.basename(input));
+micromatch.all = (str, patterns, options) => {
+  if (typeof str !== 'string') {
+    throw new TypeError(`Expected a string: "${util.inspect(str)}"`);
+  }
+
+  return [].concat(patterns).every(p => picomatch(p, options)(str));
 };
 
 /**
- * Returns true if **any** of the given glob `patterns` match the specified `string`.
+ * Returns an array of matches captured by `pattern` in `string, or `null` if the pattern did not match.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.isMatch(string, patterns[, options]);
+ * const mm = require('micromatch');
+ * // mm.capture(pattern, string[, options]);
  *
- * console.log(picomatch.isMatch('a.a', ['b.*', '*.a'])); //=> true
- * console.log(picomatch.isMatch('a.a', 'b.*')); //=> false
+ * console.log(mm.capture('test/*.js', 'test/foo.js'));
+ * //=> ['foo']
+ * console.log(mm.capture('test/*.js', 'foo/bar.css'));
+ * //=> null
  * ```
- * @param {String|Array} str The string to test.
- * @param {String|Array} patterns One or more glob patterns to use for matching.
- * @param {Object} [options] See available [options](#options).
- * @return {Boolean} Returns true if any patterns match `str`
+ * @param {String} `glob` Glob pattern to use for matching.
+ * @param {String} `input` String to match
+ * @param {Object} `options` See available [options](#options) for changing how matches are performed
+ * @return {Boolean} Returns an array of captures if the input matches the glob pattern, otherwise `null`.
  * @api public
  */
 
-picomatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
+micromatch.capture = (glob, input, options) => {
+  let posix = utils.isWindows(options);
+  let regex = picomatch.makeRe(String(glob), { ...options, capture: true });
+  let match = regex.exec(posix ? utils.toPosixSlashes(input) : input);
+
+  if (match) {
+    return match.slice(1).map(v => v === void 0 ? '' : v);
+  }
+};
 
 /**
- * Parse a glob pattern to create the source string for a regular
- * expression.
+ * Create a regular expression from the given glob `pattern`.
  *
  * ```js
- * const picomatch = require('picomatch');
- * const result = picomatch.parse(glob[, options]);
+ * const mm = require('micromatch');
+ * // mm.makeRe(pattern[, options]);
+ *
+ * console.log(mm.makeRe('*.js'));
+ * //=> /^(?:(\.[\\\/])?(?!\.)(?=.)[^\/]*?\.js)$/
  * ```
- * @param {String} `glob`
+ * @param {String} `pattern` A glob pattern to convert to regex.
  * @param {Object} `options`
- * @return {Object} Returns an object with useful properties and output to be used as a regex source string.
+ * @return {RegExp} Returns a regex created from the given pattern.
  * @api public
  */
 
-picomatch.parse = (glob, options) => parse(glob, options);
+micromatch.makeRe = (...args) => picomatch.makeRe(...args);
 
 /**
- * Scan a glob pattern to separate the pattern into segments.
+ * Scan a glob pattern to separate the pattern into segments. Used
+ * by the [split](#split) method.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.scan(input[, options]);
- *
- * const result = picomatch.scan('!./foo/*.js');
- * console.log(result);
- * // { prefix: '!./',
- * //   input: '!./foo/*.js',
- * //   base: 'foo',
- * //   glob: '*.js',
- * //   negated: true,
- * //   isGlob: true }
+ * const mm = require('micromatch');
+ * const state = mm.scan(pattern[, options]);
  * ```
- * @param {String} `input` Glob pattern to scan.
+ * @param {String} `pattern`
  * @param {Object} `options`
  * @return {Object} Returns an object with
  * @api public
  */
 
-picomatch.scan = (input, options) => scan(input, options);
+micromatch.scan = (...args) => picomatch.scan(...args);
 
 /**
- * Create a regular expression from a glob pattern.
+ * Parse a glob pattern to create the source string for a regular
+ * expression.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.makeRe(input[, options]);
- *
- * console.log(picomatch.makeRe('*.js'));
- * //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+ * const mm = require('micromatch');
+ * const state = mm(pattern[, options]);
  * ```
- * @param {String} `input` A glob pattern to convert to regex.
+ * @param {String} `glob`
  * @param {Object} `options`
- * @return {RegExp} Returns a regex created from the given pattern.
+ * @return {Object} Returns an object with useful properties and output to be used as regex source string.
  * @api public
  */
 
-picomatch.makeRe = (input, options, returnOutput = false, returnState = false) => {
-  if (!input || typeof input !== 'string') {
-    throw new TypeError('Expected a non-empty string');
-  }
-
-  let opts = options || {};
-  let prepend = opts.contains ? '' : '^';
-  let append = opts.contains ? '' : '$';
-  let state = { negated: false, fastpaths: true };
-  let prefix = '';
-  let output;
-
-  if (input.startsWith('./')) {
-    input = input.slice(2);
-    prefix = state.prefix = './';
-  }
-
-  if (opts.fastpaths !== false && (input[0] === '.' || input[0] === '*')) {
-    output = parse.fastpaths(input, options);
-  }
-
-  if (output === void 0) {
-    state = picomatch.parse(input, options);
-    state.prefix = prefix + (state.prefix || '');
-    output = state.output;
-  }
-
-  if (returnOutput === true) {
-    return output;
-  }
-
-  let source = `${prepend}(?:${output})${append}`;
-  if (state && state.negated === true) {
-    source = `^(?!${source}).*$`;
-  }
-
-  let regex = picomatch.toRegex(source, options);
-  if (returnState === true) {
-    regex.state = state;
+micromatch.parse = (patterns, options) => {
+  let res = [];
+  for (let pattern of [].concat(patterns || [])) {
+    for (let str of braces(String(pattern), options)) {
+      res.push(picomatch.parse(str, options));
+    }
   }
-
-  return regex;
+  return res;
 };
 
 /**
- * Create a regular expression from the given regex source string.
+ * Process the given brace `pattern`.
  *
  * ```js
- * const picomatch = require('picomatch');
- * // picomatch.toRegex(source[, options]);
+ * const { braces } = require('micromatch');
+ * console.log(braces('foo/{a,b,c}/bar'));
+ * //=> [ 'foo/(a|b|c)/bar' ]
  *
- * const { output } = picomatch.parse('*.js');
- * console.log(picomatch.toRegex(output));
- * //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+ * console.log(braces('foo/{a,b,c}/bar', { expand: true }));
+ * //=> [ 'foo/a/bar', 'foo/b/bar', 'foo/c/bar' ]
  * ```
- * @param {String} `source` Regular expression source string.
- * @param {Object} `options`
- * @return {RegExp}
+ * @param {String} `pattern` String with brace pattern to process.
+ * @param {Object} `options` Any [options](#options) to change how expansion is performed. See the [braces][] library for all available options.
+ * @return {Array}
  * @api public
  */
 
-picomatch.toRegex = (source, options) => {
-  try {
-    let opts = options || {};
-    return new RegExp(source, opts.flags || (opts.nocase ? 'i' : ''));
-  } catch (err) {
-    if (options && options.debug === true) throw err;
-    return /$^/;
+micromatch.braces = (pattern, options) => {
+  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
+  if ((options && options.nobrace === true) || !/\{.*\}/.test(pattern)) {
+    return [pattern];
   }
+  return braces(pattern, options);
 };
 
 /**
- * Picomatch constants.
- * @return {Object}
+ * Expand braces
  */
 
-picomatch.constants = __webpack_require__(618);
+micromatch.braceExpand = (pattern, options) => {
+  if (typeof pattern !== 'string') throw new TypeError('Expected a string');
+  return micromatch.braces(pattern, { ...options, expand: true });
+};
 
 /**
- * Expose "picomatch"
+ * Expose micromatch
  */
 
-module.exports = picomatch;
+module.exports = micromatch;
 
 
 /***/ }),
-/* 616 */
+/* 609 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-const utils = __webpack_require__(617);
-
-const {
-  CHAR_ASTERISK,             /* * */
-  CHAR_AT,                   /* @ */
-  CHAR_BACKWARD_SLASH,       /* \ */
-  CHAR_COMMA,                /* , */
-  CHAR_DOT,                  /* . */
-  CHAR_EXCLAMATION_MARK,     /* ! */
-  CHAR_FORWARD_SLASH,        /* / */
-  CHAR_LEFT_CURLY_BRACE,     /* { */
-  CHAR_LEFT_PARENTHESES,     /* ( */
-  CHAR_LEFT_SQUARE_BRACKET,  /* [ */
-  CHAR_PLUS,                 /* + */
-  CHAR_QUESTION_MARK,        /* ? */
-  CHAR_RIGHT_CURLY_BRACE,    /* } */
-  CHAR_RIGHT_PARENTHESES,    /* ) */
-  CHAR_RIGHT_SQUARE_BRACKET /* ] */
-} = __webpack_require__(618);
-
-const isPathSeparator = code => {
-  return code === CHAR_FORWARD_SLASH || code === CHAR_BACKWARD_SLASH;
-};
+const stringify = __webpack_require__(610);
+const compile = __webpack_require__(612);
+const expand = __webpack_require__(616);
+const parse = __webpack_require__(617);
 
 /**
- * Quickly scans a glob pattern and returns an object with a handful of
- * useful properties, like `isGlob`, `path` (the leading non-glob, if it exists),
- * `glob` (the actual pattern), and `negated` (true if the path starts with `!`).
+ * Expand the given pattern or create a regex-compatible string.
  *
  * ```js
- * const pm = require('picomatch');
- * console.log(pm.scan('foo/bar/*.js'));
- * { isGlob: true, input: 'foo/bar/*.js', base: 'foo/bar', glob: '*.js' }
+ * const braces = require('braces');
+ * console.log(braces('{a,b,c}', { compile: true })); //=> ['(a|b|c)']
+ * console.log(braces('{a,b,c}')); //=> ['a', 'b', 'c']
  * ```
  * @param {String} `str`
  * @param {Object} `options`
- * @return {Object} Returns an object with tokens and regex source string.
+ * @return {String}
  * @api public
  */
 
-module.exports = (input, options) => {
-  let opts = options || {};
-  let length = input.length - 1;
-  let index = -1;
-  let start = 0;
-  let lastIndex = 0;
-  let isGlob = false;
-  let backslashes = false;
-  let negated = false;
-  let braces = 0;
-  let prev;
-  let code;
-
-  let braceEscaped = false;
+const braces = (input, options = {}) => {
+  let output = [];
 
-  let eos = () => index >= length;
-  let advance = () => {
-    prev = code;
-    return input.charCodeAt(++index);
-  };
+  if (Array.isArray(input)) {
+    for (let pattern of input) {
+      let result = braces.create(pattern, options);
+      if (Array.isArray(result)) {
+        output.push(...result);
+      } else {
+        output.push(result);
+      }
+    }
+  } else {
+    output = [].concat(braces.create(input, options));
+  }
 
-  while (index < length) {
-    code = advance();
-    let next;
+  if (options && options.expand === true && options.nodupes === true) {
+    output = [...new Set(output)];
+  }
+  return output;
+};
 
-    if (code === CHAR_BACKWARD_SLASH) {
-      backslashes = true;
-      next = advance();
+/**
+ * Parse the given `str` with the given `options`.
+ *
+ * ```js
+ * // braces.parse(pattern, [, options]);
+ * const ast = braces.parse('a/{b,c}/d');
+ * console.log(ast);
+ * ```
+ * @param {String} pattern Brace pattern to parse
+ * @param {Object} options
+ * @return {Object} Returns an AST
+ * @api public
+ */
 
-      if (next === CHAR_LEFT_CURLY_BRACE) {
-        braceEscaped = true;
-      }
-      continue;
-    }
+braces.parse = (input, options = {}) => parse(input, options);
 
-    if (braceEscaped === true || code === CHAR_LEFT_CURLY_BRACE) {
-      braces++;
+/**
+ * Creates a braces string from an AST, or an AST node.
+ *
+ * ```js
+ * const braces = require('braces');
+ * let ast = braces.parse('foo/{a,b}/bar');
+ * console.log(stringify(ast.nodes[2])); //=> '{a,b}'
+ * ```
+ * @param {String} `input` Brace pattern or AST.
+ * @param {Object} `options`
+ * @return {Array} Returns an array of expanded values.
+ * @api public
+ */
 
-      while (!eos() && (next = advance())) {
-        if (next === CHAR_BACKWARD_SLASH) {
-          backslashes = true;
-          next = advance();
-          continue;
-        }
+braces.stringify = (input, options = {}) => {
+  if (typeof input === 'string') {
+    return stringify(braces.parse(input, options), options);
+  }
+  return stringify(input, options);
+};
 
-        if (next === CHAR_LEFT_CURLY_BRACE) {
-          braces++;
-          continue;
-        }
+/**
+ * Compiles a brace pattern into a regex-compatible, optimized string.
+ * This method is called by the main [braces](#braces) function by default.
+ *
+ * ```js
+ * const braces = require('braces');
+ * console.log(braces.compile('a/{b,c}/d'));
+ * //=> ['a/(b|c)/d']
+ * ```
+ * @param {String} `input` Brace pattern or AST.
+ * @param {Object} `options`
+ * @return {Array} Returns an array of expanded values.
+ * @api public
+ */
 
-        if (!braceEscaped && next === CHAR_DOT && (next = advance()) === CHAR_DOT) {
-          isGlob = true;
-          break;
-        }
+braces.compile = (input, options = {}) => {
+  if (typeof input === 'string') {
+    input = braces.parse(input, options);
+  }
+  return compile(input, options);
+};
 
-        if (!braceEscaped && next === CHAR_COMMA) {
-          isGlob = true;
-          break;
-        }
+/**
+ * Expands a brace pattern into an array. This method is called by the
+ * main [braces](#braces) function when `options.expand` is true. Before
+ * using this method it's recommended that you read the [performance notes](#performance))
+ * and advantages of using [.compile](#compile) instead.
+ *
+ * ```js
+ * const braces = require('braces');
+ * console.log(braces.expand('a/{b,c}/d'));
+ * //=> ['a/b/d', 'a/c/d'];
+ * ```
+ * @param {String} `pattern` Brace pattern
+ * @param {Object} `options`
+ * @return {Array} Returns an array of expanded values.
+ * @api public
+ */
 
-        if (next === CHAR_RIGHT_CURLY_BRACE) {
-          braces--;
-          if (braces === 0) {
-            braceEscaped = false;
-            break;
-          }
-        }
-      }
-    }
+braces.expand = (input, options = {}) => {
+  if (typeof input === 'string') {
+    input = braces.parse(input, options);
+  }
 
-    if (code === CHAR_FORWARD_SLASH) {
-      if (prev === CHAR_DOT && index === (start + 1)) {
-        start += 2;
-        continue;
-      }
+  let result = expand(input, options);
 
-      lastIndex = index + 1;
-      continue;
-    }
+  // filter out empty strings if specified
+  if (options.noempty === true) {
+    result = result.filter(Boolean);
+  }
 
-    if (code === CHAR_ASTERISK) {
-      isGlob = true;
-      break;
-    }
+  // filter out duplicates if specified
+  if (options.nodupes === true) {
+    result = [...new Set(result)];
+  }
 
-    if (code === CHAR_ASTERISK || code === CHAR_QUESTION_MARK) {
-      isGlob = true;
-      break;
-    }
+  return result;
+};
 
-    if (code === CHAR_LEFT_SQUARE_BRACKET) {
-      while (!eos() && (next = advance())) {
-        if (next === CHAR_BACKWARD_SLASH) {
-          backslashes = true;
-          next = advance();
-          continue;
-        }
+/**
+ * Processes a brace pattern and returns either an expanded array
+ * (if `options.expand` is true), a highly optimized regex-compatible string.
+ * This method is called by the main [braces](#braces) function.
+ *
+ * ```js
+ * const braces = require('braces');
+ * console.log(braces.create('user-{200..300}/project-{a,b,c}-{1..10}'))
+ * //=> 'user-(20[0-9]|2[1-9][0-9]|300)/project-(a|b|c)-([1-9]|10)'
+ * ```
+ * @param {String} `pattern` Brace pattern
+ * @param {Object} `options`
+ * @return {Array} Returns an array of expanded values.
+ * @api public
+ */
 
-        if (next === CHAR_RIGHT_SQUARE_BRACKET) {
-          isGlob = true;
-          break;
-        }
-      }
-    }
+braces.create = (input, options = {}) => {
+  if (input === '' || input.length < 3) {
+    return [input];
+  }
 
-    let isExtglobChar = code === CHAR_PLUS
-      || code === CHAR_AT
-      || code === CHAR_EXCLAMATION_MARK;
+ return options.expand !== true
+    ? braces.compile(input, options)
+    : braces.expand(input, options);
+};
 
-    if (isExtglobChar && input.charCodeAt(index + 1) === CHAR_LEFT_PARENTHESES) {
-      isGlob = true;
-      break;
-    }
+/**
+ * Expose "braces"
+ */
 
-    if (code === CHAR_EXCLAMATION_MARK && index === start) {
-      negated = true;
-      start++;
-      continue;
-    }
+module.exports = braces;
 
-    if (code === CHAR_LEFT_PARENTHESES) {
-      while (!eos() && (next = advance())) {
-        if (next === CHAR_BACKWARD_SLASH) {
-          backslashes = true;
-          next = advance();
-          continue;
-        }
 
-        if (next === CHAR_RIGHT_PARENTHESES) {
-          isGlob = true;
-          break;
-        }
-      }
-    }
+/***/ }),
+/* 610 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    if (isGlob) {
-      break;
-    }
-  }
+"use strict";
 
-  let prefix = '';
-  let orig = input;
-  let base = input;
-  let glob = '';
 
-  if (start > 0) {
-    prefix = input.slice(0, start);
-    input = input.slice(start);
-    lastIndex -= start;
-  }
+const utils = __webpack_require__(611);
 
-  if (base && isGlob === true && lastIndex > 0) {
-    base = input.slice(0, lastIndex);
-    glob = input.slice(lastIndex);
-  } else if (isGlob === true) {
-    base = '';
-    glob = input;
-  } else {
-    base = input;
-  }
+module.exports = (ast, options = {}) => {
+  let stringify = (node, parent = {}) => {
+    let invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+    let invalidNode = node.invalid === true && options.escapeInvalid === true;
+    let output = '';
 
-  if (base && base !== '' && base !== '/' && base !== input) {
-    if (isPathSeparator(base.charCodeAt(base.length - 1))) {
-      base = base.slice(0, -1);
+    if (node.value) {
+      if ((invalidBlock || invalidNode) && utils.isOpenOrClose(node)) {
+        return '\\' + node.value;
+      }
+      return node.value;
     }
-  }
 
-  if (opts.unescape === true) {
-    if (glob) glob = utils.removeBackslashes(glob);
+    if (node.value) {
+      return node.value;
+    }
 
-    if (base && backslashes === true) {
-      base = utils.removeBackslashes(base);
+    if (node.nodes) {
+      for (let child of node.nodes) {
+        output += stringify(child);
+      }
     }
-  }
+    return output;
+  };
 
-  return { prefix, input: orig, base, glob, negated, isGlob };
+  return stringify(ast);
 };
 
 
+
 /***/ }),
-/* 617 */
+/* 611 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-const path = __webpack_require__(16);
-const win32 = process.platform === 'win32';
-const {
-  REGEX_SPECIAL_CHARS,
-  REGEX_SPECIAL_CHARS_GLOBAL,
-  REGEX_REMOVE_BACKSLASH
-} = __webpack_require__(618);
-
-exports.isObject = val => val !== null && typeof val === 'object' && !Array.isArray(val);
-exports.hasRegexChars = str => REGEX_SPECIAL_CHARS.test(str);
-exports.isRegexChar = str => str.length === 1 && exports.hasRegexChars(str);
-exports.escapeRegex = str => str.replace(REGEX_SPECIAL_CHARS_GLOBAL, '\\$1');
-exports.toPosixSlashes = str => str.replace(/\\/g, '/');
-
-exports.removeBackslashes = str => {
-  return str.replace(REGEX_REMOVE_BACKSLASH, match => {
-    return match === '\\' ? '' : match;
-  });
-}
-
-exports.supportsLookbehinds = () => {
-  let segs = process.version.slice(1).split('.');
-  if (segs.length === 3 && +segs[0] >= 9 || (+segs[0] === 8 && +segs[1] >= 10)) {
-    return true;
+exports.isInteger = num => {
+  if (typeof num === 'number') {
+    return Number.isInteger(num);
+  }
+  if (typeof num === 'string' && num.trim() !== '') {
+    return Number.isInteger(Number(num));
   }
   return false;
 };
 
-exports.isWindows = options => {
-  if (options && typeof options.windows === 'boolean') {
-    return options.windows;
-  }
-  return win32 === true || path.sep === '\\';
-};
+/**
+ * Find a node of the given type
+ */
 
-exports.escapeLast = (input, char, lastIdx) => {
-  let idx = input.lastIndexOf(char, lastIdx);
-  if (idx === -1) return input;
-  if (input[idx - 1] === '\\') return exports.escapeLast(input, char, idx - 1);
-  return input.slice(0, idx) + '\\' + input.slice(idx);
+exports.find = (node, type) => node.nodes.find(node => node.type === type);
+
+/**
+ * Find a node of the given type
+ */
+
+exports.exceedsLimit = (min, max, step = 1, limit) => {
+  if (limit === false) return false;
+  if (!exports.isInteger(min) || !exports.isInteger(max)) return false;
+  return ((Number(max) - Number(min)) / Number(step)) >= limit;
 };
 
+/**
+ * Escape the given node with '\\' before node.value
+ */
 
-/***/ }),
-/* 618 */
-/***/ (function(module, exports, __webpack_require__) {
+exports.escapeNode = (block, n = 0, type) => {
+  let node = block.nodes[n];
+  if (!node) return;
 
-"use strict";
+  if ((type && node.type === type) || node.type === 'open' || node.type === 'close') {
+    if (node.escaped !== true) {
+      node.value = '\\' + node.value;
+      node.escaped = true;
+    }
+  }
+};
 
+/**
+ * Returns true if the given brace node should be enclosed in literal braces
+ */
 
-const path = __webpack_require__(16);
-const WIN_SLASH = '\\\\/';
-const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
+exports.encloseBrace = node => {
+  if (node.type !== 'brace') return false;
+  if ((node.commas >> 0 + node.ranges >> 0) === 0) {
+    node.invalid = true;
+    return true;
+  }
+  return false;
+};
 
 /**
- * Posix glob regex
+ * Returns true if a brace node is invalid.
  */
 
-const DOT_LITERAL = '\\.';
-const PLUS_LITERAL = '\\+';
-const QMARK_LITERAL = '\\?';
-const SLASH_LITERAL = '\\/';
-const ONE_CHAR = '(?=.)';
-const QMARK = '[^/]';
-const END_ANCHOR = `(?:${SLASH_LITERAL}|$)`;
-const START_ANCHOR = `(?:^|${SLASH_LITERAL})`;
-const DOTS_SLASH = `${DOT_LITERAL}{1,2}${END_ANCHOR}`;
-const NO_DOT = `(?!${DOT_LITERAL})`;
-const NO_DOTS = `(?!${START_ANCHOR}${DOTS_SLASH})`;
-const NO_DOT_SLASH = `(?!${DOT_LITERAL}{0,1}${END_ANCHOR})`;
-const NO_DOTS_SLASH = `(?!${DOTS_SLASH})`;
-const QMARK_NO_DOT = `[^.${SLASH_LITERAL}]`;
-const STAR = `${QMARK}*?`;
-
-const POSIX_CHARS = {
-  DOT_LITERAL,
-  PLUS_LITERAL,
-  QMARK_LITERAL,
-  SLASH_LITERAL,
-  ONE_CHAR,
-  QMARK,
-  END_ANCHOR,
-  DOTS_SLASH,
-  NO_DOT,
-  NO_DOTS,
-  NO_DOT_SLASH,
-  NO_DOTS_SLASH,
-  QMARK_NO_DOT,
-  STAR,
-  START_ANCHOR
+exports.isInvalidBrace = block => {
+  if (block.type !== 'brace') return false;
+  if (block.invalid === true || block.dollar) return true;
+  if ((block.commas >> 0 + block.ranges >> 0) === 0) {
+    block.invalid = true;
+    return true;
+  }
+  if (block.open !== true || block.close !== true) {
+    block.invalid = true;
+    return true;
+  }
+  return false;
 };
 
 /**
- * Windows glob regex
+ * Returns true if a node is an open or close node
  */
 
-const WINDOWS_CHARS = {
-  ...POSIX_CHARS,
-
-  SLASH_LITERAL: `[${WIN_SLASH}]`,
-  QMARK: WIN_NO_SLASH,
-  STAR: `${WIN_NO_SLASH}*?`,
-  DOTS_SLASH: `${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$)`,
-  NO_DOT: `(?!${DOT_LITERAL})`,
-  NO_DOTS: `(?!(?:^|[${WIN_SLASH}])${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
-  NO_DOT_SLASH: `(?!${DOT_LITERAL}{0,1}(?:[${WIN_SLASH}]|$))`,
-  NO_DOTS_SLASH: `(?!${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
-  QMARK_NO_DOT: `[^.${WIN_SLASH}]`,
-  START_ANCHOR: `(?:^|[${WIN_SLASH}])`,
-  END_ANCHOR: `(?:[${WIN_SLASH}]|$)`
+exports.isOpenOrClose = node => {
+  if (node.type === 'open' || node.type === 'close') {
+    return true;
+  }
+  return node.open === true || node.close === true;
 };
 
 /**
- * POSIX Bracket Regex
+ * Reduce an array of text nodes.
  */
 
-const POSIX_REGEX_SOURCE = {
-  alnum: 'a-zA-Z0-9',
-  alpha: 'a-zA-Z',
-  ascii: '\\x00-\\x7F',
-  blank: ' \\t',
-  cntrl: '\\x00-\\x1F\\x7F',
-  digit: '0-9',
-  graph: '\\x21-\\x7E',
-  lower: 'a-z',
-  print: '\\x20-\\x7E ',
-  punct: '\\-!"#$%&\'()\\*+,./:;<=>?@[\\]^_`{|}~',
-  space: ' \\t\\r\\n\\v\\f',
-  upper: 'A-Z',
-  word: 'A-Za-z0-9_',
-  xdigit: 'A-Fa-f0-9'
+exports.reduce = nodes => nodes.reduce((acc, node) => {
+  if (node.type === 'text') acc.push(node.value);
+  if (node.type === 'range') node.type = 'text';
+  return acc;
+}, []);
+
+/**
+ * Flatten an array
+ */
+
+exports.flatten = (...args) => {
+  const result = [];
+  const flat = arr => {
+    for (let i = 0; i < arr.length; i++) {
+      let ele = arr[i];
+      Array.isArray(ele) ? flat(ele, result) : ele !== void 0 && result.push(ele);
+    }
+    return result;
+  };
+  flat(args);
+  return result;
 };
 
-module.exports = {
-  MAX_LENGTH: 1024 * 64,
-  POSIX_REGEX_SOURCE,
 
-  // regular expressions
-  REGEX_BACKSLASH: /\\(?![*+?^${}(|)[\]])/g,
-  REGEX_NON_SPECIAL_CHAR: /^[^@![\].,$*+?^{}()|\\/]+/,
-  REGEX_SPECIAL_CHARS: /[-*+?.^${}(|)[\]]/,
-  REGEX_SPECIAL_CHARS_BACKREF: /(\\?)((\W)(\3*))/g,
-  REGEX_SPECIAL_CHARS_GLOBAL: /([-*+?.^${}(|)[\]])/g,
-  REGEX_REMOVE_BACKSLASH: /(?:\[.*?[^\\]\]|\\(?=.))/g,
+/***/ }),
+/* 612 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  // Replace globs with equivalent patterns to reduce parsing time.
-  REPLACEMENTS: {
-    '***': '*',
-    '**/**': '**',
-    '**/**/**': '**'
-  },
+"use strict";
 
-  // Digits
-  CHAR_0: 48, /* 0 */
-  CHAR_9: 57, /* 9 */
 
-  // Alphabet chars.
-  CHAR_UPPERCASE_A: 65, /* A */
-  CHAR_LOWERCASE_A: 97, /* a */
-  CHAR_UPPERCASE_Z: 90, /* Z */
-  CHAR_LOWERCASE_Z: 122, /* z */
+const fill = __webpack_require__(613);
+const utils = __webpack_require__(611);
 
-  CHAR_LEFT_PARENTHESES: 40, /* ( */
-  CHAR_RIGHT_PARENTHESES: 41, /* ) */
+const compile = (ast, options = {}) => {
+  let walk = (node, parent = {}) => {
+    let invalidBlock = utils.isInvalidBrace(parent);
+    let invalidNode = node.invalid === true && options.escapeInvalid === true;
+    let invalid = invalidBlock === true || invalidNode === true;
+    let prefix = options.escapeInvalid === true ? '\\' : '';
+    let output = '';
 
-  CHAR_ASTERISK: 42, /* * */
+    if (node.isOpen === true) {
+      return prefix + node.value;
+    }
+    if (node.isClose === true) {
+      return prefix + node.value;
+    }
 
-  // Non-alphabetic chars.
-  CHAR_AMPERSAND: 38, /* & */
-  CHAR_AT: 64, /* @ */
-  CHAR_BACKWARD_SLASH: 92, /* \ */
-  CHAR_CARRIAGE_RETURN: 13, /* \r */
-  CHAR_CIRCUMFLEX_ACCENT: 94, /* ^ */
-  CHAR_COLON: 58, /* : */
-  CHAR_COMMA: 44, /* , */
-  CHAR_DOT: 46, /* . */
-  CHAR_DOUBLE_QUOTE: 34, /* " */
-  CHAR_EQUAL: 61, /* = */
-  CHAR_EXCLAMATION_MARK: 33, /* ! */
-  CHAR_FORM_FEED: 12, /* \f */
-  CHAR_FORWARD_SLASH: 47, /* / */
-  CHAR_GRAVE_ACCENT: 96, /* ` */
-  CHAR_HASH: 35, /* # */
-  CHAR_HYPHEN_MINUS: 45, /* - */
-  CHAR_LEFT_ANGLE_BRACKET: 60, /* < */
-  CHAR_LEFT_CURLY_BRACE: 123, /* { */
-  CHAR_LEFT_SQUARE_BRACKET: 91, /* [ */
-  CHAR_LINE_FEED: 10, /* \n */
-  CHAR_NO_BREAK_SPACE: 160, /* \u00A0 */
-  CHAR_PERCENT: 37, /* % */
-  CHAR_PLUS: 43, /* + */
-  CHAR_QUESTION_MARK: 63, /* ? */
-  CHAR_RIGHT_ANGLE_BRACKET: 62, /* > */
-  CHAR_RIGHT_CURLY_BRACE: 125, /* } */
-  CHAR_RIGHT_SQUARE_BRACKET: 93, /* ] */
-  CHAR_SEMICOLON: 59, /* ; */
-  CHAR_SINGLE_QUOTE: 39, /* ' */
-  CHAR_SPACE: 32, /*   */
-  CHAR_TAB: 9, /* \t */
-  CHAR_UNDERSCORE: 95, /* _ */
-  CHAR_VERTICAL_LINE: 124, /* | */
-  CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279, /* \uFEFF */
+    if (node.type === 'open') {
+      return invalid ? (prefix + node.value) : '(';
+    }
 
-  SEP: path.sep,
+    if (node.type === 'close') {
+      return invalid ? (prefix + node.value) : ')';
+    }
 
-  /**
-   * Create EXTGLOB_CHARS
-   */
+    if (node.type === 'comma') {
+      return node.prev.type === 'comma' ? '' : (invalid ? node.value : '|');
+    }
 
-  extglobChars(chars) {
-    return {
-      '!': { type: 'negate', open: '(?:(?!(?:', close: `))${chars.STAR})` },
-      '?': { type: 'qmark', open: '(?:', close: ')?' },
-      '+': { type: 'plus', open: '(?:', close: ')+' },
-      '*': { type: 'star', open: '(?:', close: ')*' },
-      '@': { type: 'at', open: '(?:', close: ')' }
-    };
-  },
+    if (node.value) {
+      return node.value;
+    }
 
-  /**
-   * Create GLOB_CHARS
-   */
+    if (node.nodes && node.ranges > 0) {
+      let args = utils.reduce(node.nodes);
+      let range = fill(...args, { ...options, wrap: false, toRegex: true });
 
-  globChars(win32) {
-    return win32 === true ? WINDOWS_CHARS : POSIX_CHARS;
-  }
+      if (range.length !== 0) {
+        return args.length > 1 && range.length > 1 ? `(${range})` : range;
+      }
+    }
+
+    if (node.nodes) {
+      for (let child of node.nodes) {
+        output += walk(child, node);
+      }
+    }
+    return output;
+  };
+
+  return walk(ast);
 };
 
+module.exports = compile;
+
 
 /***/ }),
-/* 619 */
+/* 613 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-
-const utils = __webpack_require__(617);
-const constants = __webpack_require__(618);
-
-/**
- * Constants
+/*!
+ * fill-range <https://github.com/jonschlinkert/fill-range>
+ *
+ * Copyright (c) 2014-present, Jon Schlinkert.
+ * Licensed under the MIT License.
  */
 
-const {
-  MAX_LENGTH,
-  POSIX_REGEX_SOURCE,
-  REGEX_NON_SPECIAL_CHAR,
-  REGEX_SPECIAL_CHARS_BACKREF,
-  REPLACEMENTS
-} = constants;
 
-/**
- * Helpers
- */
 
-const expandRange = (args, options) => {
-  if (typeof options.expandRange === 'function') {
-    return options.expandRange(...args, options);
-  }
+const util = __webpack_require__(29);
+const toRegexRange = __webpack_require__(614);
 
-  args.sort();
-  let value = `[${args.join('-')}]`;
+const isObject = val => val !== null && typeof val === 'object' && !Array.isArray(val);
 
-  try {
-    /* eslint-disable no-new */
-    new RegExp(value);
-  } catch (ex) {
-    return args.map(v => utils.escapeRegex(v)).join('..');
-  }
+const transform = toNumber => {
+  return value => toNumber === true ? Number(value) : String(value);
+};
 
-  return value;
+const isValidValue = value => {
+  return typeof value === 'number' || (typeof value === 'string' && value !== '');
 };
 
-const negate = state => {
-  let count = 1;
+const isNumber = num => Number.isInteger(+num);
 
-  while (state.peek() === '!' && (state.peek(2) !== '(' || state.peek(3) === '?')) {
-    state.advance();
-    state.start++;
-    count++;
+const zeros = input => {
+  let value = `${input}`;
+  let index = -1;
+  if (value[0] === '-') value = value.slice(1);
+  if (value === '0') return false;
+  while (value[++index] === '0');
+  return index > 0;
+};
+
+const stringify = (start, end, options) => {
+  if (typeof start === 'string' || typeof end === 'string') {
+    return true;
   }
+  return options.stringify === true;
+};
 
-  if (count % 2 === 0) {
-    return false;
+const pad = (input, maxLength, toNumber) => {
+  if (maxLength > 0) {
+    let dash = input[0] === '-' ? '-' : '';
+    if (dash) input = input.slice(1);
+    input = (dash + input.padStart(dash ? maxLength - 1 : maxLength, '0'));
+  }
+  if (toNumber === false) {
+    return String(input);
   }
+  return input;
+};
 
-  state.negated = true;
-  state.start++;
-  return true;
+const toMaxLen = (input, maxLength) => {
+  let negative = input[0] === '-' ? '-' : '';
+  if (negative) {
+    input = input.slice(1);
+    maxLength--;
+  }
+  while (input.length < maxLength) input = '0' + input;
+  return negative ? ('-' + input) : input;
 };
 
-/**
- * Create the message for a syntax error
- */
+const toSequence = (parts, options) => {
+  parts.negatives.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  parts.positives.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
 
-const syntaxError = (type, char) => {
-  return `Missing ${type}: "${char}" - use "\\\\${char}" to match literal characters`;
-};
+  let prefix = options.capture ? '' : '?:';
+  let positives = '';
+  let negatives = '';
+  let result;
 
-/**
- * Parse the given input string.
- * @param {String} input
- * @param {Object} options
- * @return {Object}
- */
+  if (parts.positives.length) {
+    positives = parts.positives.join('|');
+  }
 
-const parse = (input, options) => {
-  if (typeof input !== 'string') {
-    throw new TypeError('Expected a string');
+  if (parts.negatives.length) {
+    negatives = `-(${prefix}${parts.negatives.join('|')})`;
   }
 
-  input = REPLACEMENTS[input] || input;
+  if (positives && negatives) {
+    result = `${positives}|${negatives}`;
+  } else {
+    result = positives || negatives;
+  }
 
-  let opts = { ...options };
-  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
-  let len = input.length;
-  if (len > max) {
-    throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
+  if (options.wrap) {
+    return `(${prefix}${result})`;
   }
 
-  let bos = { type: 'bos', value: '', output: opts.prepend || '' };
-  let tokens = [bos];
+  return result;
+};
 
-  let capture = opts.capture ? '' : '?:';
-  let win32 = utils.isWindows(options);
+const toRange = (a, b, isNumbers, options) => {
+  if (isNumbers) {
+    return toRegexRange(a, b, { wrap: false, ...options });
+  }
 
-  // create constants based on platform, for windows or posix
-  const PLATFORM_CHARS = constants.globChars(win32);
-  const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+  let start = String.fromCharCode(a);
+  if (a === b) return start;
 
-  const {
-    DOT_LITERAL,
-    PLUS_LITERAL,
-    SLASH_LITERAL,
-    ONE_CHAR,
-    DOTS_SLASH,
-    NO_DOT,
-    NO_DOT_SLASH,
-    NO_DOTS_SLASH,
-    QMARK,
-    QMARK_NO_DOT,
-    STAR,
-    START_ANCHOR
-  } = PLATFORM_CHARS;
+  let stop = String.fromCharCode(b);
+  return `[${start}-${stop}]`;
+};
 
-  const globstar = (opts) => {
-    return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
-  };
+const toRegex = (start, end, options) => {
+  if (Array.isArray(start)) {
+    let wrap = options.wrap === true;
+    let prefix = options.capture ? '' : '?:';
+    return wrap ? `(${prefix}${start.join('|')})` : start.join('|');
+  }
+  return toRegexRange(start, end, options);
+};
 
-  let nodot = opts.dot ? '' : NO_DOT;
-  let star = opts.bash === true ? globstar(opts) : STAR;
-  let qmarkNoDot = opts.dot ? QMARK : QMARK_NO_DOT;
+const rangeError = (...args) => {
+  return new RangeError('Invalid range arguments: ' + util.inspect(...args));
+};
 
-  if (opts.capture) {
-    star = `(${star})`;
-  }
+const invalidRange = (start, end, options) => {
+  if (options.strictRanges === true) throw rangeError([start, end]);
+  return [];
+};
 
-  // minimatch options support
-  if (typeof opts.noext === 'boolean') {
-    opts.noextglob = opts.noext;
+const invalidStep = (step, options) => {
+  if (options.strictRanges === true) {
+    throw new TypeError(`Expected step "${step}" to be a number`);
   }
+  return [];
+};
 
-  let state = {
-    index: -1,
-    start: 0,
-    consumed: '',
-    output: '',
-    backtrack: false,
-    brackets: 0,
-    braces: 0,
-    parens: 0,
-    quotes: 0,
-    tokens
-  };
+const fillNumbers = (start, end, step = 1, options = {}) => {
+  let a = Number(start);
+  let b = Number(end);
 
-  let extglobs = [];
-  let stack = [];
-  let prev = bos;
-  let value;
+  if (!Number.isInteger(a) || !Number.isInteger(b)) {
+    if (options.strictRanges === true) throw rangeError([start, end]);
+    return [];
+  }
 
-  /**
-   * Tokenizing helpers
-   */
+  // fix negative zero
+  if (a === 0) a = 0;
+  if (b === 0) b = 0;
 
-  const eos = () => state.index === len - 1;
-  const peek = state.peek = (n = 1) => input[state.index + n];
-  const advance = state.advance = () => input[++state.index];
-  const append = token => {
-    state.output += token.output != null ? token.output : token.value;
-    state.consumed += token.value || '';
-  };
+  let descending = a > b;
+  let startString = String(start);
+  let endString = String(end);
+  let stepString = String(step);
+  step = Math.max(Math.abs(step), 1);
 
-  const increment = type => {
-    state[type]++;
-    stack.push(type);
-  };
+  let padded = zeros(startString) || zeros(endString) || zeros(stepString);
+  let maxLen = padded ? Math.max(startString.length, endString.length, stepString.length) : 0;
+  let toNumber = padded === false && stringify(start, end, options) === false;
+  let format = options.transform || transform(toNumber);
 
-  const decrement = type => {
-    state[type]--;
-    stack.pop();
-  };
+  if (options.toRegex && step === 1) {
+    return toRange(toMaxLen(start, maxLen), toMaxLen(end, maxLen), true, options);
+  }
 
-  /**
-   * Push tokens onto the tokens array. This helper speeds up
-   * tokenizing by 1) helping us avoid backtracking as much as possible,
-   * and 2) helping us avoid creating extra tokens when consecutive
-   * characters are plain text. This improves performance and simplifies
-   * lookbehinds.
-   */
+  let parts = { negatives: [], positives: [] };
+  let push = num => parts[num < 0 ? 'negatives' : 'positives'].push(Math.abs(num));
+  let range = [];
+  let index = 0;
 
-  const push = tok => {
-    if (prev.type === 'globstar') {
-      let isBrace = state.braces > 0 && (tok.type === 'comma' || tok.type === 'brace');
-      let isExtglob = extglobs.length && (tok.type === 'pipe' || tok.type === 'paren');
-      if (tok.type !== 'slash' && tok.type !== 'paren' && !isBrace && !isExtglob) {
-        state.output = state.output.slice(0, -prev.output.length);
-        prev.type = 'star';
-        prev.value = '*';
-        prev.output = star;
-        state.output += prev.output;
-      }
+  while (descending ? a >= b : a <= b) {
+    if (options.toRegex === true && step > 1) {
+      push(a);
+    } else {
+      range.push(pad(format(a, index), maxLen, toNumber));
     }
+    a = descending ? a - step : a + step;
+    index++;
+  }
 
-    if (extglobs.length && tok.type !== 'paren' && !EXTGLOB_CHARS[tok.value]) {
-      extglobs[extglobs.length - 1].inner += tok.value;
-    }
+  if (options.toRegex === true) {
+    return step > 1
+      ? toSequence(parts, options)
+      : toRegex(range, null, { wrap: false, ...options });
+  }
 
-    if (tok.value || tok.output) append(tok);
-    if (prev && prev.type === 'text' && tok.type === 'text') {
-      prev.value += tok.value;
-      return;
-    }
-
-    tok.prev = prev;
-    tokens.push(tok);
-    prev = tok;
-  };
+  return range;
+};
 
-  const extglobOpen = (type, value) => {
-    let token = { ...EXTGLOB_CHARS[value], conditions: 1, inner: '' };
+const fillLetters = (start, end, step = 1, options = {}) => {
+  if ((!isNumber(start) && start.length > 1) || (!isNumber(end) && end.length > 1)) {
+    return invalidRange(start, end, options);
+  }
 
-    token.prev = prev;
-    token.parens = state.parens;
-    token.output = state.output;
-    let output = (opts.capture ? '(' : '') + token.open;
 
-    push({ type, value, output: state.output ? '' : ONE_CHAR });
-    push({ type: 'paren', extglob: true, value: advance(), output });
-    increment('parens');
-    extglobs.push(token);
-  };
+  let format = options.transform || (val => String.fromCharCode(val));
+  let a = `${start}`.charCodeAt(0);
+  let b = `${end}`.charCodeAt(0);
 
-  const extglobClose = token => {
-    let output = token.close + (opts.capture ? ')' : '');
+  let descending = a > b;
+  let min = Math.min(a, b);
+  let max = Math.max(a, b);
 
-    if (token.type === 'negate') {
-      let extglobStar = star;
+  if (options.toRegex && step === 1) {
+    return toRange(min, max, false, options);
+  }
 
-      if (token.inner && token.inner.length > 1 && token.inner.includes('/')) {
-        extglobStar = globstar(opts);
-      }
+  let range = [];
+  let index = 0;
 
-      if (extglobStar !== star || eos() || /^\)+$/.test(input.slice(state.index + 1))) {
-        output = token.close = ')$))' + extglobStar;
-      }
+  while (descending ? a >= b : a <= b) {
+    range.push(format(a, index));
+    a = descending ? a - step : a + step;
+    index++;
+  }
 
-      if (token.prev.type === 'bos' && eos()) {
-        state.negatedExtglob = true;
-      }
-    }
+  if (options.toRegex === true) {
+    return toRegex(range, null, { wrap: false, options });
+  }
 
-    push({ type: 'paren', extglob: true, value, output });
-    decrement('parens');
-  };
+  return range;
+};
 
-  if (opts.fastpaths !== false && !/(^[*!]|[/{[()\]}"])/.test(input)) {
-    let backslashes = false;
+const fill = (start, end, step, options = {}) => {
+  if (end == null && isValidValue(start)) {
+    return [start];
+  }
 
-    let output = input.replace(REGEX_SPECIAL_CHARS_BACKREF, (m, esc, chars, first, rest, index) => {
-      if (first === '\\') {
-        backslashes = true;
-        return m;
-      }
+  if (!isValidValue(start) || !isValidValue(end)) {
+    return invalidRange(start, end, options);
+  }
 
-      if (first === '?') {
-        if (esc) {
-          return esc + first + (rest ? QMARK.repeat(rest.length) : '');
-        }
-        if (index === 0) {
-          return qmarkNoDot + (rest ? QMARK.repeat(rest.length) : '');
-        }
-        return QMARK.repeat(chars.length);
-      }
+  if (typeof step === 'function') {
+    return fill(start, end, 1, { transform: step });
+  }
 
-      if (first === '.') {
-        return DOT_LITERAL.repeat(chars.length);
-      }
+  if (isObject(step)) {
+    return fill(start, end, 0, step);
+  }
 
-      if (first === '*') {
-        if (esc) {
-          return esc + first + (rest ? star : '');
-        }
-        return star;
-      }
-      return esc ? m : '\\' + m;
-    });
+  let opts = { ...options };
+  if (opts.capture === true) opts.wrap = true;
+  step = step || opts.step || 1;
 
-    if (backslashes === true) {
-      if (opts.unescape === true) {
-        output = output.replace(/\\/g, '');
-      } else {
-        output = output.replace(/\\+/g, m => {
-          return m.length % 2 === 0 ? '\\\\' : (m ? '\\' : '');
-        });
-      }
-    }
+  if (!isNumber(step)) {
+    if (step != null && !isObject(step)) return invalidStep(step, opts);
+    return fill(start, end, 1, step);
+  }
 
-    state.output = output;
-    return state;
+  if (isNumber(start) && isNumber(end)) {
+    return fillNumbers(start, end, step, opts);
   }
 
-  /**
-   * Tokenize input until we reach end-of-string
-   */
+  return fillLetters(start, end, Math.max(Math.abs(step), 1), opts);
+};
 
-  while (!eos()) {
-    value = advance();
+module.exports = fill;
 
-    if (value === '\u0000') {
-      continue;
-    }
 
-    /**
-     * Escaped characters
-     */
+/***/ }),
+/* 614 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    if (value === '\\') {
-      let next = peek();
+"use strict";
+/*!
+ * to-regex-range <https://github.com/micromatch/to-regex-range>
+ *
+ * Copyright (c) 2015-present, Jon Schlinkert.
+ * Released under the MIT License.
+ */
 
-      if (next === '/' && opts.bash !== true) {
-        continue;
-      }
 
-      if (next === '.' || next === ';') {
-        continue;
-      }
 
-      if (!next) {
-        value += '\\';
-        push({ type: 'text', value });
-        continue;
-      }
+const isNumber = __webpack_require__(615);
 
-      // collapse slashes to reduce potential for exploits
-      let match = /^\\+/.exec(input.slice(state.index + 1));
-      let slashes = 0;
+const toRegexRange = (min, max, options) => {
+  if (isNumber(min) === false) {
+    throw new TypeError('toRegexRange: expected the first argument to be a number');
+  }
 
-      if (match && match[0].length > 2) {
-        slashes = match[0].length;
-        state.index += slashes;
-        if (slashes % 2 !== 0) {
-          value += '\\';
-        }
-      }
+  if (max === void 0 || min === max) {
+    return String(min);
+  }
 
-      if (opts.unescape === true) {
-        value = advance() || '';
-      } else {
-        value += advance() || '';
-      }
+  if (isNumber(max) === false) {
+    throw new TypeError('toRegexRange: expected the second argument to be a number.');
+  }
 
-      if (state.brackets === 0) {
-        push({ type: 'text', value });
-        continue;
-      }
-    }
+  let opts = { relaxZeros: true, ...options };
+  if (typeof opts.strictZeros === 'boolean') {
+    opts.relaxZeros = opts.strictZeros === false;
+  }
 
-    /**
-     * If we're inside a regex character class, continue
-     * until we reach the closing bracket.
-     */
+  let relax = String(opts.relaxZeros);
+  let shorthand = String(opts.shorthand);
+  let capture = String(opts.capture);
+  let wrap = String(opts.wrap);
+  let cacheKey = min + ':' + max + '=' + relax + shorthand + capture + wrap;
 
-    if (state.brackets > 0 && (value !== ']' || prev.value === '[' || prev.value === '[^')) {
-      if (opts.posix !== false && value === ':') {
-        let inner = prev.value.slice(1);
-        if (inner.includes('[')) {
-          prev.posix = true;
+  if (toRegexRange.cache.hasOwnProperty(cacheKey)) {
+    return toRegexRange.cache[cacheKey].result;
+  }
 
-          if (inner.includes(':')) {
-            let idx = prev.value.lastIndexOf('[');
-            let pre = prev.value.slice(0, idx);
-            let rest = prev.value.slice(idx + 2);
-            let posix = POSIX_REGEX_SOURCE[rest];
-            if (posix) {
-              prev.value = pre + posix;
-              state.backtrack = true;
-              advance();
+  let a = Math.min(min, max);
+  let b = Math.max(min, max);
 
-              if (!bos.output && tokens.indexOf(prev) === 1) {
-                bos.output = ONE_CHAR;
-              }
-              continue;
-            }
-          }
-        }
-      }
+  if (Math.abs(a - b) === 1) {
+    let result = min + '|' + max;
+    if (opts.capture) {
+      return `(${result})`;
+    }
+    if (opts.wrap === false) {
+      return result;
+    }
+    return `(?:${result})`;
+  }
 
-      if ((value === '[' && peek() !== ':') || (value === '-' && peek() === ']')) {
-        value = '\\' + value;
-      }
+  let isPadded = hasPadding(min) || hasPadding(max);
+  let state = { min, max, a, b };
+  let positives = [];
+  let negatives = [];
 
-      if (value === ']' && (prev.value === '[' || prev.value === '[^')) {
-        value = '\\' + value;
-      }
+  if (isPadded) {
+    state.isPadded = isPadded;
+    state.maxLen = String(state.max).length;
+  }
 
-      if (opts.posix === true && value === '!' && prev.value === '[') {
-        value = '^';
-      }
+  if (a < 0) {
+    let newMin = b < 0 ? Math.abs(b) : 1;
+    negatives = splitToPatterns(newMin, Math.abs(a), state, opts);
+    a = state.a = 0;
+  }
 
-      prev.value += value;
-      append({ value });
-      continue;
-    }
+  if (b >= 0) {
+    positives = splitToPatterns(a, b, state, opts);
+  }
 
-    /**
-     * If we're inside a quoted string, continue
-     * until we reach the closing double quote.
-     */
+  state.negatives = negatives;
+  state.positives = positives;
+  state.result = collatePatterns(negatives, positives, opts);
 
-    if (state.quotes === 1 && value !== '"') {
-      value = utils.escapeRegex(value);
-      prev.value += value;
-      append({ value });
-      continue;
-    }
+  if (opts.capture === true) {
+    state.result = `(${state.result})`;
+  } else if (opts.wrap !== false && (positives.length + negatives.length) > 1) {
+    state.result = `(?:${state.result})`;
+  }
 
-    /**
-     * Double quotes
-     */
+  toRegexRange.cache[cacheKey] = state;
+  return state.result;
+};
 
-    if (value === '"') {
-      state.quotes = state.quotes === 1 ? 0 : 1;
-      if (opts.keepQuotes === true) {
-        push({ type: 'text', value });
-      }
-      continue;
-    }
+function collatePatterns(neg, pos, options) {
+  let onlyNegative = filterPatterns(neg, pos, '-', false, options) || [];
+  let onlyPositive = filterPatterns(pos, neg, '', false, options) || [];
+  let intersected = filterPatterns(neg, pos, '-?', true, options) || [];
+  let subpatterns = onlyNegative.concat(intersected).concat(onlyPositive);
+  return subpatterns.join('|');
+}
 
-    /**
-     * Parentheses
-     */
+function splitToRanges(min, max) {
+  let nines = 1;
+  let zeros = 1;
 
-    if (value === '(') {
-      push({ type: 'paren', value });
-      increment('parens');
-      continue;
-    }
+  let stop = countNines(min, nines);
+  let stops = new Set([max]);
 
-    if (value === ')') {
-      if (state.parens === 0 && opts.strictBrackets === true) {
-        throw new SyntaxError(syntaxError('opening', '('));
-      }
+  while (min <= stop && stop <= max) {
+    stops.add(stop);
+    nines += 1;
+    stop = countNines(min, nines);
+  }
 
-      let extglob = extglobs[extglobs.length - 1];
-      if (extglob && state.parens === extglob.parens + 1) {
-        extglobClose(extglobs.pop());
-        continue;
-      }
+  stop = countZeros(max + 1, zeros) - 1;
 
-      push({ type: 'paren', value, output: state.parens ? ')' : '\\)' });
-      decrement('parens');
-      continue;
-    }
+  while (min < stop && stop <= max) {
+    stops.add(stop);
+    zeros += 1;
+    stop = countZeros(max + 1, zeros) - 1;
+  }
 
-    /**
-     * Brackets
-     */
+  stops = [...stops];
+  stops.sort(compare);
+  return stops;
+}
 
-    if (value === '[') {
-      if (opts.nobracket === true || !input.slice(state.index + 1).includes(']')) {
-        if (opts.nobracket !== true && opts.strictBrackets === true) {
-          throw new SyntaxError(syntaxError('closing', ']'));
-        }
+/**
+ * Convert a range to a regex pattern
+ * @param {Number} `start`
+ * @param {Number} `stop`
+ * @return {String}
+ */
 
-        value = '\\' + value;
-      } else {
-        increment('brackets');
-      }
+function rangeToPattern(start, stop, options) {
+  if (start === stop) {
+    return { pattern: start, count: [], digits: 0 };
+  }
 
-      push({ type: 'bracket', value });
-      continue;
-    }
+  let zipped = zip(start, stop);
+  let digits = zipped.length;
+  let pattern = '';
+  let count = 0;
 
-    if (value === ']') {
-      if (opts.nobracket === true || (prev && prev.type === 'bracket' && prev.value.length === 1)) {
-        push({ type: 'text', value, output: '\\' + value });
-        continue;
-      }
+  for (let i = 0; i < digits; i++) {
+    let [startDigit, stopDigit] = zipped[i];
 
-      if (state.brackets === 0) {
-        if (opts.strictBrackets === true) {
-          throw new SyntaxError(syntaxError('opening', '['));
-        }
+    if (startDigit === stopDigit) {
+      pattern += startDigit;
 
-        push({ type: 'text', value, output: '\\' + value });
-        continue;
-      }
+    } else if (startDigit !== '0' || stopDigit !== '9') {
+      pattern += toCharacterClass(startDigit, stopDigit, options);
 
-      decrement('brackets');
+    } else {
+      count++;
+    }
+  }
 
-      let prevValue = prev.value.slice(1);
-      if (prev.posix !== true && prevValue[0] === '^' && !prevValue.includes('/')) {
-        value = '/' + value;
-      }
+  if (count) {
+    pattern += options.shorthand === true ? '\\d' : '[0-9]';
+  }
 
-      prev.value += value;
-      append({ value });
+  return { pattern, count: [count], digits };
+}
 
-      // when literal brackets are explicitly disabled
-      // assume we should match with a regex character class
-      if (opts.literalBrackets === false || utils.hasRegexChars(prevValue)) {
-        continue;
-      }
+function splitToPatterns(min, max, tok, options) {
+  let ranges = splitToRanges(min, max);
+  let tokens = [];
+  let start = min;
+  let prev;
 
-      let escaped = utils.escapeRegex(prev.value);
-      state.output = state.output.slice(0, -prev.value.length);
+  for (let i = 0; i < ranges.length; i++) {
+    let max = ranges[i];
+    let obj = rangeToPattern(String(start), String(max), options);
+    let zeros = '';
 
-      // when literal brackets are explicitly enabled
-      // assume we should escape the brackets to match literal characters
-      if (opts.literalBrackets === true) {
-        state.output += escaped;
-        prev.value = escaped;
-        continue;
+    if (!tok.isPadded && prev && prev.pattern === obj.pattern) {
+      if (prev.count.length > 1) {
+        prev.count.pop();
       }
 
-      // when the user specifies nothing, try to match both
-      prev.value = `(${capture}${escaped}|${prev.value})`;
-      state.output += prev.value;
+      prev.count.push(obj.count[0]);
+      prev.string = prev.pattern + toQuantifier(prev.count);
+      start = max + 1;
       continue;
     }
 
-    /**
-     * Braces
-     */
-
-    if (value === '{' && opts.nobrace !== true) {
-      push({ type: 'brace', value, output: '(' });
-      increment('braces');
-      continue;
+    if (tok.isPadded) {
+      zeros = padZeros(max, tok, options);
     }
 
-    if (value === '}') {
-      if (opts.nobrace === true || state.braces === 0) {
-        push({ type: 'text', value, output: '\\' + value });
-        continue;
-      }
-
-      let output = ')';
+    obj.string = zeros + obj.pattern + toQuantifier(obj.count);
+    tokens.push(obj);
+    start = max + 1;
+    prev = obj;
+  }
 
-      if (state.dots === true) {
-        let arr = tokens.slice();
-        let range = [];
+  return tokens;
+}
 
-        for (let i = arr.length - 1; i >= 0; i--) {
-          tokens.pop();
-          if (arr[i].type === 'brace') {
-            break;
-          }
-          if (arr[i].type !== 'dots') {
-            range.unshift(arr[i].value);
-          }
-        }
+function filterPatterns(arr, comparison, prefix, intersection, options) {
+  let result = [];
 
-        output = expandRange(range, opts);
-        state.backtrack = true;
-      }
+  for (let ele of arr) {
+    let { string } = ele;
 
-      push({ type: 'brace', value, output });
-      decrement('braces');
-      continue;
+    // only push if _both_ are negative...
+    if (!intersection && !contains(comparison, 'string', string)) {
+      result.push(prefix + string);
     }
 
-    /**
-     * Pipes
-     */
-
-    if (value === '|') {
-      if (extglobs.length > 0) {
-        extglobs[extglobs.length - 1].conditions++;
-      }
-      push({ type: 'text', value });
-      continue;
+    // or _both_ are positive
+    if (intersection && contains(comparison, 'string', string)) {
+      result.push(prefix + string);
     }
+  }
+  return result;
+}
 
-    /**
-     * Commas
-     */
+/**
+ * Zip strings
+ */
 
-    if (value === ',') {
-      let output = value;
+function zip(a, b) {
+  let arr = [];
+  for (let i = 0; i < a.length; i++) arr.push([a[i], b[i]]);
+  return arr;
+}
 
-      if (state.braces > 0 && stack[stack.length - 1] === 'braces') {
-        output = '|';
-      }
+function compare(a, b) {
+  return a > b ? 1 : b > a ? -1 : 0;
+}
 
-      push({ type: 'comma', value, output });
-      continue;
-    }
+function contains(arr, key, val) {
+  return arr.some(ele => ele[key] === val);
+}
 
-    /**
-     * Slashes
-     */
+function countNines(min, len) {
+  return Number(String(min).slice(0, -len) + '9'.repeat(len));
+}
 
-    if (value === '/') {
-      // if the beginning of the glob is "./", advance the start
-      // to the current index, and don't add the "./" characters
-      // to the state. This greatly simplifies lookbehinds when
-      // checking for BOS characters like "!" and "." (not "./")
-      if (prev.type === 'dot' && state.index === 1) {
-        state.start = state.index + 1;
-        state.consumed = '';
-        state.output = '';
-        tokens.pop();
-        prev = bos; // reset "prev" to the first token
-        continue;
-      }
+function countZeros(integer, zeros) {
+  return integer - (integer % Math.pow(10, zeros));
+}
 
-      push({ type: 'slash', value, output: SLASH_LITERAL });
-      continue;
-    }
+function toQuantifier(digits) {
+  let [start = 0, stop = ''] = digits;
+  if (stop || start > 1) {
+    return `{${start + (stop ? ',' + stop : '')}}`;
+  }
+  return '';
+}
 
-    /**
-     * Dots
-     */
+function toCharacterClass(a, b, options) {
+  return `[${a}${(b - a === 1) ? '' : '-'}${b}]`;
+}
 
-    if (value === '.') {
-      if (state.braces > 0 && prev.type === 'dot') {
-        if (prev.value === '.') prev.output = DOT_LITERAL;
-        prev.type = 'dots';
-        prev.output += value;
-        prev.value += value;
-        state.dots = true;
-        continue;
-      }
+function hasPadding(str) {
+  return /^-?(0+)\d/.test(str);
+}
 
-      push({ type: 'dot', value, output: DOT_LITERAL });
-      continue;
-    }
+function padZeros(value, tok, options) {
+  if (!tok.isPadded) {
+    return value;
+  }
 
-    /**
-     * Question marks
-     */
+  let diff = Math.abs(tok.maxLen - String(value).length);
+  let relax = options.relaxZeros !== false;
 
-    if (value === '?') {
-      if (prev && prev.type === 'paren') {
-        let next = peek();
-        let output = value;
+  switch (diff) {
+    case 0:
+      return '';
+    case 1:
+      return relax ? '0?' : '0';
+    case 2:
+      return relax ? '0{0,2}' : '00';
+    default: {
+      return relax ? `0{0,${diff}}` : `0{${diff}}`;
+    }
+  }
+}
 
-        if (next === '<' && !utils.supportsLookbehinds()) {
-          throw new Error('Node.js v10 or higher is required for regex lookbehinds');
-        }
+/**
+ * Cache
+ */
 
-        if (prev.value === '(' && !/[!=<:]/.test(next) || (next === '<' && !/[!=]/.test(peek(2)))) {
-          output = '\\' + value;
-        }
+toRegexRange.cache = {};
+toRegexRange.clearCache = () => (toRegexRange.cache = {});
 
-        push({ type: 'text', value, output });
-        continue;
-      }
+/**
+ * Expose `toRegexRange`
+ */
 
-      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
-        extglobOpen('qmark', value);
-        continue;
-      }
+module.exports = toRegexRange;
 
-      if (opts.dot !== true && (prev.type === 'slash' || prev.type === 'bos')) {
-        push({ type: 'qmark', value, output: QMARK_NO_DOT });
-        continue;
-      }
 
-      push({ type: 'qmark', value, output: QMARK });
-      continue;
-    }
+/***/ }),
+/* 615 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    /**
-     * Exclamation
-     */
+"use strict";
+/*!
+ * is-number <https://github.com/jonschlinkert/is-number>
+ *
+ * Copyright (c) 2014-present, Jon Schlinkert.
+ * Released under the MIT License.
+ */
 
-    if (value === '!') {
-      if (opts.noextglob !== true && peek() === '(') {
-        if (peek(2) !== '?' || !/[!=<:]/.test(peek(3))) {
-          extglobOpen('negate', value);
-          continue;
-        }
-      }
 
-      if (opts.nonegate !== true && state.index === 0) {
-        negate(state);
-        continue;
-      }
-    }
 
-    /**
-     * Plus
-     */
+module.exports = function(num) {
+  if (typeof num === 'number') {
+    return num - num === 0;
+  }
+  if (typeof num === 'string' && num.trim() !== '') {
+    return Number.isFinite ? Number.isFinite(+num) : isFinite(+num);
+  }
+  return false;
+};
 
-    if (value === '+') {
-      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
-        extglobOpen('plus', value);
-        continue;
-      }
 
-      if (prev && (prev.type === 'bracket' || prev.type === 'paren' || prev.type === 'brace')) {
-        let output = prev.extglob === true ? '\\' + value : value;
-        push({ type: 'plus', value, output });
-        continue;
-      }
+/***/ }),
+/* 616 */
+/***/ (function(module, exports, __webpack_require__) {
 
-      // use regex behavior inside parens
-      if (state.parens > 0 && opts.regex !== false) {
-        push({ type: 'plus', value });
-        continue;
-      }
+"use strict";
 
-      push({ type: 'plus', value: PLUS_LITERAL });
-      continue;
-    }
 
-    /**
-     * Plain text
-     */
+const fill = __webpack_require__(613);
+const stringify = __webpack_require__(610);
+const utils = __webpack_require__(611);
 
-    if (value === '@') {
-      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
-        push({ type: 'at', value, output: '' });
-        continue;
-      }
+const append = (queue = '', stash = '', enclose = false) => {
+  let result = [];
 
-      push({ type: 'text', value });
-      continue;
-    }
+  queue = [].concat(queue);
+  stash = [].concat(stash);
 
-    /**
-     * Plain text
-     */
+  if (!stash.length) return queue;
+  if (!queue.length) {
+    return enclose ? utils.flatten(stash).map(ele => `{${ele}}`) : stash;
+  }
 
-    if (value !== '*') {
-      if (value === '$' || value === '^') {
-        value = '\\' + value;
+  for (let item of queue) {
+    if (Array.isArray(item)) {
+      for (let value of item) {
+        result.push(append(value, stash, enclose));
       }
-
-      let match = REGEX_NON_SPECIAL_CHAR.exec(input.slice(state.index + 1));
-      if (match) {
-        value += match[0];
-        state.index += match[0].length;
+    } else {
+      for (let ele of stash) {
+        if (enclose === true && typeof ele === 'string') ele = `{${ele}}`;
+        result.push(Array.isArray(ele) ? append(item, ele, enclose) : (item + ele));
       }
-
-      push({ type: 'text', value });
-      continue;
     }
+  }
+  return utils.flatten(result);
+};
 
-    /**
-     * Stars
-     */
+const expand = (ast, options = {}) => {
+  let rangeLimit = options.rangeLimit === void 0 ? 1000 : options.rangeLimit;
 
-    if (prev && (prev.type === 'globstar' || prev.star === true)) {
-      prev.type = 'star';
-      prev.star = true;
-      prev.value += value;
-      prev.output = star;
-      state.backtrack = true;
-      state.consumed += value;
-      continue;
+  let walk = (node, parent = {}) => {
+    node.queue = [];
+
+    let p = parent;
+    let q = parent.queue;
+
+    while (p.type !== 'brace' && p.type !== 'root' && p.parent) {
+      p = p.parent;
+      q = p.queue;
     }
 
-    if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
-      extglobOpen('star', value);
-      continue;
+    if (node.invalid || node.dollar) {
+      q.push(append(q.pop(), stringify(node, options)));
+      return;
     }
 
-    if (prev.type === 'star') {
-      if (opts.noglobstar === true) {
-        state.consumed += value;
-        continue;
-      }
+    if (node.type === 'brace' && node.invalid !== true && node.nodes.length === 2) {
+      q.push(append(q.pop(), ['{}']));
+      return;
+    }
 
-      let prior = prev.prev;
-      let before = prior.prev;
-      let isStart = prior.type === 'slash' || prior.type === 'bos';
-      let afterStar = before && (before.type === 'star' || before.type === 'globstar');
+    if (node.nodes && node.ranges > 0) {
+      let args = utils.reduce(node.nodes);
 
-      if (opts.bash === true && (!isStart || (!eos() && peek() !== '/'))) {
-        push({ type: 'star', value, output: '' });
-        continue;
+      if (utils.exceedsLimit(...args, options.step, rangeLimit)) {
+        throw new RangeError('expanded array length exceeds range limit. Use options.rangeLimit to increase or disable the limit.');
       }
 
-      let isBrace = state.braces > 0 && (prior.type === 'comma' || prior.type === 'brace');
-      let isExtglob = extglobs.length && (prior.type === 'pipe' || prior.type === 'paren');
-      if (!isStart && prior.type !== 'paren' && !isBrace && !isExtglob) {
-        push({ type: 'star', value, output: '' });
-        continue;
+      let range = fill(...args, options);
+      if (range.length === 0) {
+        range = stringify(node, options);
       }
 
-      // strip consecutive `/**/`
-      while (input.slice(state.index + 1, state.index + 4) === '/**') {
-        let after = input[state.index + 4];
-        if (after && after !== '/') {
-          break;
-        }
-        state.consumed += '/**';
-        state.index += 3;
-      }
+      q.push(append(q.pop(), range));
+      node.nodes = [];
+      return;
+    }
 
-      if (prior.type === 'bos' && eos()) {
-        prev.type = 'globstar';
-        prev.value += value;
-        prev.output = globstar(opts);
-        state.output = prev.output;
-        state.consumed += value;
-        continue;
-      }
+    let enclose = utils.encloseBrace(node);
+    let queue = node.queue;
+    let block = node;
 
-      if (prior.type === 'slash' && prior.prev.type !== 'bos' && !afterStar && eos()) {
-        state.output = state.output.slice(0, -(prior.output + prev.output).length);
-        prior.output = '(?:' + prior.output;
+    while (block.type !== 'brace' && block.type !== 'root' && block.parent) {
+      block = block.parent;
+      queue = block.queue;
+    }
 
-        prev.type = 'globstar';
-        prev.output = globstar(opts) + '|$)';
-        prev.value += value;
+    for (let i = 0; i < node.nodes.length; i++) {
+      let child = node.nodes[i];
 
-        state.output += prior.output + prev.output;
-        state.consumed += value;
+      if (child.type === 'comma' && node.type === 'brace') {
+        if (i === 1) queue.push('');
+        queue.push('');
         continue;
       }
 
-      let next = peek();
-      if (prior.type === 'slash' && prior.prev.type !== 'bos' && next === '/') {
-        let end = peek(2) !== void 0 ? '|$' : '';
-
-        state.output = state.output.slice(0, -(prior.output + prev.output).length);
-        prior.output = '(?:' + prior.output;
-
-        prev.type = 'globstar';
-        prev.output = `${globstar(opts)}${SLASH_LITERAL}|${SLASH_LITERAL}${end})`;
-        prev.value += value;
-
-        state.output += prior.output + prev.output;
-        state.consumed += value + advance();
-
-        push({ type: 'slash', value, output: '' });
+      if (child.type === 'close') {
+        q.push(append(q.pop(), queue, enclose));
         continue;
       }
 
-      if (prior.type === 'bos' && next === '/') {
-        prev.type = 'globstar';
-        prev.value += value;
-        prev.output = `(?:^|${SLASH_LITERAL}|${globstar(opts)}${SLASH_LITERAL})`;
-        state.output = prev.output;
-        state.consumed += value + advance();
-        push({ type: 'slash', value, output: '' });
+      if (child.value && child.type !== 'open') {
+        queue.push(append(queue.pop(), child.value));
         continue;
       }
 
-      // remove single star from output
-      state.output = state.output.slice(0, -prev.output.length);
+      if (child.nodes) {
+        walk(child, node);
+      }
+    }
 
-      // reset previous token to globstar
-      prev.type = 'globstar';
-      prev.output = globstar(opts);
-      prev.value += value;
+    return queue;
+  };
 
-      // reset output with globstar
-      state.output += prev.output;
-      state.consumed += value;
-      continue;
-    }
+  return utils.flatten(walk(ast));
+};
 
-    let token = { type: 'star', value, output: star };
+module.exports = expand;
 
-    if (opts.bash === true) {
-      token.output = '.*?';
-      if (prev.type === 'bos' || prev.type === 'slash') {
-        token.output = nodot + token.output;
-      }
-      push(token);
-      continue;
-    }
 
-    if (prev && (prev.type === 'bracket' || prev.type === 'paren') && opts.regex === true) {
-      token.output = value;
-      push(token);
-      continue;
-    }
+/***/ }),
+/* 617 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    if (state.index === state.start || prev.type === 'slash' || prev.type === 'dot') {
-      if (prev.type === 'dot') {
-        state.output += NO_DOT_SLASH;
-        prev.output += NO_DOT_SLASH;
+"use strict";
 
-      } else if (opts.dot === true) {
-        state.output += NO_DOTS_SLASH;
-        prev.output += NO_DOTS_SLASH;
 
-      } else {
-        state.output += nodot;
-        prev.output += nodot;
-      }
+const stringify = __webpack_require__(610);
 
-      if (peek() !== '*') {
-        state.output += ONE_CHAR;
-        prev.output += ONE_CHAR;
-      }
-    }
+/**
+ * Constants
+ */
 
-    push(token);
-  }
+const {
+  MAX_LENGTH,
+  CHAR_BACKSLASH, /* \ */
+  CHAR_BACKTICK, /* ` */
+  CHAR_COMMA, /* , */
+  CHAR_DOT, /* . */
+  CHAR_LEFT_PARENTHESES, /* ( */
+  CHAR_RIGHT_PARENTHESES, /* ) */
+  CHAR_LEFT_CURLY_BRACE, /* { */
+  CHAR_RIGHT_CURLY_BRACE, /* } */
+  CHAR_LEFT_SQUARE_BRACKET, /* [ */
+  CHAR_RIGHT_SQUARE_BRACKET, /* ] */
+  CHAR_DOUBLE_QUOTE, /* " */
+  CHAR_SINGLE_QUOTE, /* ' */
+  CHAR_NO_BREAK_SPACE,
+  CHAR_ZERO_WIDTH_NOBREAK_SPACE
+} = __webpack_require__(618);
 
-  while (state.brackets > 0) {
-    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', ']'));
-    state.output = utils.escapeLast(state.output, '[');
-    decrement('brackets');
-  }
+/**
+ * parse
+ */
 
-  while (state.parens > 0) {
-    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', ')'));
-    state.output = utils.escapeLast(state.output, '(');
-    decrement('parens');
+const parse = (input, options = {}) => {
+  if (typeof input !== 'string') {
+    throw new TypeError('Expected a string');
   }
 
-  while (state.braces > 0) {
-    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', '}'));
-    state.output = utils.escapeLast(state.output, '{');
-    decrement('braces');
+  let opts = options || {};
+  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
+  if (input.length > max) {
+    throw new SyntaxError(`Input length (${input.length}), exceeds max characters (${max})`);
   }
 
-  if (opts.strictSlashes !== true && (prev.type === 'star' || prev.type === 'bracket')) {
-    push({ type: 'maybe_slash', value: '', output: `${SLASH_LITERAL}?` });
-  }
+  let ast = { type: 'root', input, nodes: [] };
+  let stack = [ast];
+  let block = ast;
+  let prev = ast;
+  let brackets = 0;
+  let length = input.length;
+  let index = 0;
+  let depth = 0;
+  let value;
+  let memo = {};
 
-  // rebuild the output if we had to backtrack at any point
-  if (state.backtrack === true) {
-    state.output = '';
+  /**
+   * Helpers
+   */
 
-    for (let token of state.tokens) {
-      state.output += token.output != null ? token.output : token.value;
+  const advance = () => input[index++];
+  const push = node => {
+    if (node.type === 'text' && prev.type === 'dot') {
+      prev.type = 'text';
+    }
 
-      if (token.suffix) {
-        state.output += token.suffix;
-      }
+    if (prev && prev.type === 'text' && node.type === 'text') {
+      prev.value += node.value;
+      return;
     }
-  }
 
-  return state;
-};
+    block.nodes.push(node);
+    node.parent = block;
+    node.prev = prev;
+    prev = node;
+    return node;
+  };
 
-/**
- * Fast paths for creating regular expressions for common glob patterns.
- * This can significantly speed up processing and has very little downside
- * impact when none of the fast paths match.
- */
+  push({ type: 'bos' });
 
-parse.fastpaths = (input, options) => {
-  let opts = { ...options };
-  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
-  let len = input.length;
-  if (len > max) {
-    throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
-  }
+  while (index < length) {
+    block = stack[stack.length - 1];
+    value = advance();
 
-  input = REPLACEMENTS[input] || input;
-  let win32 = utils.isWindows(options);
+    /**
+     * Invalid chars
+     */
 
-  // create constants based on platform, for windows or posix
-  const {
-    DOT_LITERAL,
-    SLASH_LITERAL,
-    ONE_CHAR,
-    DOTS_SLASH,
-    NO_DOT,
-    NO_DOTS,
-    NO_DOTS_SLASH,
-    STAR,
-    START_ANCHOR
-  } = constants.globChars(win32);
+    if (value === CHAR_ZERO_WIDTH_NOBREAK_SPACE || value === CHAR_NO_BREAK_SPACE) {
+      continue;
+    }
 
-  let capture = opts.capture ? '' : '?:';
-  let star = opts.bash === true ? '.*?' : STAR;
-  let nodot = opts.dot ? NO_DOTS : NO_DOT;
-  let slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
+    /**
+     * Escaped chars
+     */
 
-  if (opts.capture) {
-    star = `(${star})`;
-  }
+    if (value === CHAR_BACKSLASH) {
+      push({ type: 'text', value: (options.keepEscaping ? value : '') + advance() });
+      continue;
+    }
 
-  const globstar = (opts) => {
-    return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
-  };
+    /**
+     * Right square bracket (literal): ']'
+     */
 
-  const create = str => {
-    switch (str) {
-      case '*':
-        return `${nodot}${ONE_CHAR}${star}`;
+    if (value === CHAR_RIGHT_SQUARE_BRACKET) {
+      push({ type: 'text', value: '\\' + value });
+      continue;
+    }
 
-      case '.*':
-        return `${DOT_LITERAL}${ONE_CHAR}${star}`;
+    /**
+     * Left square bracket: '['
+     */
 
-      case '*.*':
-        return `${nodot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+    if (value === CHAR_LEFT_SQUARE_BRACKET) {
+      brackets++;
 
-      case '*/*':
-        return `${nodot}${star}${SLASH_LITERAL}${ONE_CHAR}${slashDot}${star}`;
+      let closed = true;
+      let next;
 
-      case '**':
-        return nodot + globstar(opts);
+      while (index < length && (next = advance())) {
+        value += next;
 
-      case '**/*':
-        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${ONE_CHAR}${star}`;
+        if (next === CHAR_LEFT_SQUARE_BRACKET) {
+          brackets++;
+          continue;
+        }
 
-      case '**/*.*':
-        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+        if (next === CHAR_BACKSLASH) {
+          value += advance();
+          continue;
+        }
 
-      case '**/.*':
-        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${DOT_LITERAL}${ONE_CHAR}${star}`;
+        if (next === CHAR_RIGHT_SQUARE_BRACKET) {
+          brackets--;
 
-      default: {
-        let match = /^(.*?)\.(\w+)$/.exec(str);
-        if (!match) return;
+          if (brackets === 0) {
+            break;
+          }
+        }
+      }
 
-        let source = create(match[1], options);
-        if (!source) return;
+      push({ type: 'text', value });
+      continue;
+    }
 
-        return source + DOT_LITERAL + match[2];
+    /**
+     * Parentheses
+     */
+
+    if (value === CHAR_LEFT_PARENTHESES) {
+      block = push({ type: 'paren', nodes: [] });
+      stack.push(block);
+      push({ type: 'text', value });
+      continue;
+    }
+
+    if (value === CHAR_RIGHT_PARENTHESES) {
+      if (block.type !== 'paren') {
+        push({ type: 'text', value });
+        continue;
       }
+      block = stack.pop();
+      push({ type: 'text', value });
+      block = stack[stack.length - 1];
+      continue;
     }
-  };
 
-  let output = create(input);
-  if (output && opts.strictSlashes !== true) {
-    output += `${SLASH_LITERAL}?`;
-  }
+    /**
+     * Quotes: '|"|`
+     */
 
-  return output;
-};
+    if (value === CHAR_DOUBLE_QUOTE || value === CHAR_SINGLE_QUOTE || value === CHAR_BACKTICK) {
+      let open = value;
+      let next;
 
-module.exports = parse;
+      if (options.keepQuotes !== true) {
+        value = '';
+      }
 
+      while (index < length && (next = advance())) {
+        if (next === CHAR_BACKSLASH) {
+          value += next + advance();
+          continue;
+        }
 
-/***/ }),
-/* 620 */
-/***/ (function(module, exports, __webpack_require__) {
+        if (next === open) {
+          if (options.keepQuotes === true) value += next;
+          break;
+        }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const merge2 = __webpack_require__(591);
-function merge(streams) {
-    const mergedStream = merge2(streams);
-    streams.forEach((stream) => {
-        stream.once('error', (err) => mergedStream.emit('error', err));
-    });
-    return mergedStream;
-}
-exports.merge = merge;
+        value += next;
+      }
 
+      push({ type: 'text', value });
+      continue;
+    }
 
-/***/ }),
-/* 621 */
-/***/ (function(module, exports, __webpack_require__) {
+    /**
+     * Left curly brace: '{'
+     */
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const stream_1 = __webpack_require__(622);
-const provider_1 = __webpack_require__(649);
-class ProviderAsync extends provider_1.default {
-    constructor() {
-        super(...arguments);
-        this._reader = new stream_1.default(this._settings);
-    }
-    read(task) {
-        const root = this._getRootDirectory(task);
-        const options = this._getReaderOptions(task);
-        const entries = [];
-        return new Promise((resolve, reject) => {
-            const stream = this.api(root, task, options);
-            stream.once('error', reject);
-            stream.on('data', (entry) => entries.push(options.transform(entry)));
-            stream.once('end', () => resolve(entries));
-        });
-    }
-    api(root, task, options) {
-        if (task.dynamic) {
-            return this._reader.dynamic(root, options);
-        }
-        return this._reader.static(task.patterns, options);
-    }
-}
-exports.default = ProviderAsync;
+    if (value === CHAR_LEFT_CURLY_BRACE) {
+      depth++;
 
+      let dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+      let brace = {
+        type: 'brace',
+        open: true,
+        close: false,
+        dollar,
+        depth,
+        commas: 0,
+        ranges: 0,
+        nodes: []
+      };
 
-/***/ }),
-/* 622 */
-/***/ (function(module, exports, __webpack_require__) {
+      block = push(brace);
+      stack.push(block);
+      push({ type: 'open', value });
+      continue;
+    }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const stream_1 = __webpack_require__(27);
-const fsStat = __webpack_require__(623);
-const fsWalk = __webpack_require__(628);
-const reader_1 = __webpack_require__(648);
-class ReaderStream extends reader_1.default {
-    constructor() {
-        super(...arguments);
-        this._walkStream = fsWalk.walkStream;
-        this._stat = fsStat.stat;
-    }
-    dynamic(root, options) {
-        return this._walkStream(root, options);
-    }
-    static(patterns, options) {
-        const filepaths = patterns.map(this._getFullEntryPath, this);
-        const stream = new stream_1.PassThrough({ objectMode: true });
-        stream._write = (index, _enc, done) => {
-            return this._getEntry(filepaths[index], patterns[index], options)
-                .then((entry) => {
-                if (entry !== null && options.entryFilter(entry)) {
-                    stream.push(entry);
-                }
-                if (index === filepaths.length - 1) {
-                    stream.end();
-                }
-                done();
-            })
-                .catch(done);
-        };
-        for (let i = 0; i < filepaths.length; i++) {
-            stream.write(i);
-        }
-        return stream;
-    }
-    _getEntry(filepath, pattern, options) {
-        return this._getStat(filepath)
-            .then((stats) => this._makeEntry(stats, pattern))
-            .catch((error) => {
-            if (options.errorFilter(error)) {
-                return null;
-            }
-            throw error;
-        });
-    }
-    _getStat(filepath) {
-        return new Promise((resolve, reject) => {
-            this._stat(filepath, this._fsStatSettings, (error, stats) => {
-                error ? reject(error) : resolve(stats);
-            });
-        });
-    }
-}
-exports.default = ReaderStream;
+    /**
+     * Right curly brace: '}'
+     */
 
+    if (value === CHAR_RIGHT_CURLY_BRACE) {
+      if (block.type !== 'brace') {
+        push({ type: 'text', value });
+        continue;
+      }
 
-/***/ }),
-/* 623 */
-/***/ (function(module, exports, __webpack_require__) {
+      let type = 'close';
+      block = stack.pop();
+      block.close = true;
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const async = __webpack_require__(624);
-const sync = __webpack_require__(625);
-const settings_1 = __webpack_require__(626);
-exports.Settings = settings_1.default;
-function stat(path, optionsOrSettingsOrCallback, callback) {
-    if (typeof optionsOrSettingsOrCallback === 'function') {
-        return async.read(path, getSettings(), optionsOrSettingsOrCallback);
-    }
-    async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
-}
-exports.stat = stat;
-function statSync(path, optionsOrSettings) {
-    const settings = getSettings(optionsOrSettings);
-    return sync.read(path, settings);
-}
-exports.statSync = statSync;
-function getSettings(settingsOrOptions = {}) {
-    if (settingsOrOptions instanceof settings_1.default) {
-        return settingsOrOptions;
-    }
-    return new settings_1.default(settingsOrOptions);
-}
+      push({ type, value });
+      depth--;
 
+      block = stack[stack.length - 1];
+      continue;
+    }
 
-/***/ }),
-/* 624 */
-/***/ (function(module, exports, __webpack_require__) {
+    /**
+     * Comma: ','
+     */
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-function read(path, settings, callback) {
-    settings.fs.lstat(path, (lstatError, lstat) => {
-        if (lstatError) {
-            return callFailureCallback(callback, lstatError);
-        }
-        if (!lstat.isSymbolicLink() || !settings.followSymbolicLink) {
-            return callSuccessCallback(callback, lstat);
-        }
-        settings.fs.stat(path, (statError, stat) => {
-            if (statError) {
-                if (settings.throwErrorOnBrokenSymbolicLink) {
-                    return callFailureCallback(callback, statError);
-                }
-                return callSuccessCallback(callback, lstat);
-            }
-            if (settings.markSymbolicLink) {
-                stat.isSymbolicLink = () => true;
-            }
-            callSuccessCallback(callback, stat);
-        });
-    });
-}
-exports.read = read;
-function callFailureCallback(callback, error) {
-    callback(error);
-}
-function callSuccessCallback(callback, result) {
-    callback(null, result);
-}
+    if (value === CHAR_COMMA && depth > 0) {
+      if (block.ranges > 0) {
+        block.ranges = 0;
+        let open = block.nodes.shift();
+        block.nodes = [open, { type: 'text', value: stringify(block) }];
+      }
 
+      push({ type: 'comma', value });
+      block.commas++;
+      continue;
+    }
 
-/***/ }),
-/* 625 */
-/***/ (function(module, exports, __webpack_require__) {
+    /**
+     * Dot: '.'
+     */
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-function read(path, settings) {
-    const lstat = settings.fs.lstatSync(path);
-    if (!lstat.isSymbolicLink() || !settings.followSymbolicLink) {
-        return lstat;
-    }
-    try {
-        const stat = settings.fs.statSync(path);
-        if (settings.markSymbolicLink) {
-            stat.isSymbolicLink = () => true;
-        }
-        return stat;
-    }
-    catch (error) {
-        if (!settings.throwErrorOnBrokenSymbolicLink) {
-            return lstat;
-        }
-        throw error;
-    }
-}
-exports.read = read;
+    if (value === CHAR_DOT && depth > 0 && block.commas === 0) {
+      let siblings = block.nodes;
 
+      if (depth === 0 || siblings.length === 0) {
+        push({ type: 'text', value });
+        continue;
+      }
 
-/***/ }),
-/* 626 */
-/***/ (function(module, exports, __webpack_require__) {
+      if (prev.type === 'dot') {
+        block.range = [];
+        prev.value += value;
+        prev.type = 'range';
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __webpack_require__(627);
-class Settings {
-    constructor(_options = {}) {
-        this._options = _options;
-        this.followSymbolicLink = this._getValue(this._options.followSymbolicLink, true);
-        this.fs = fs.createFileSystemAdapter(this._options.fs);
-        this.markSymbolicLink = this._getValue(this._options.markSymbolicLink, false);
-        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
-    }
-    _getValue(option, value) {
-        return option === undefined ? value : option;
-    }
-}
-exports.default = Settings;
+        if (block.nodes.length !== 3 && block.nodes.length !== 5) {
+          block.invalid = true;
+          block.ranges = 0;
+          prev.type = 'text';
+          continue;
+        }
 
+        block.ranges++;
+        block.args = [];
+        continue;
+      }
 
-/***/ }),
-/* 627 */
-/***/ (function(module, exports, __webpack_require__) {
+      if (prev.type === 'range') {
+        siblings.pop();
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __webpack_require__(23);
-exports.FILE_SYSTEM_ADAPTER = {
-    lstat: fs.lstat,
-    stat: fs.stat,
-    lstatSync: fs.lstatSync,
-    statSync: fs.statSync
-};
-function createFileSystemAdapter(fsMethods) {
-    if (!fsMethods) {
-        return exports.FILE_SYSTEM_ADAPTER;
-    }
-    return Object.assign({}, exports.FILE_SYSTEM_ADAPTER, fsMethods);
-}
-exports.createFileSystemAdapter = createFileSystemAdapter;
+        let before = siblings[siblings.length - 1];
+        before.value += prev.value + value;
+        prev = before;
+        block.ranges--;
+        continue;
+      }
 
+      push({ type: 'dot', value });
+      continue;
+    }
 
-/***/ }),
-/* 628 */
-/***/ (function(module, exports, __webpack_require__) {
+    /**
+     * Text
+     */
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const async_1 = __webpack_require__(629);
-const stream_1 = __webpack_require__(644);
-const sync_1 = __webpack_require__(645);
-const settings_1 = __webpack_require__(647);
-exports.Settings = settings_1.default;
-function walk(dir, optionsOrSettingsOrCallback, callback) {
-    if (typeof optionsOrSettingsOrCallback === 'function') {
-        return new async_1.default(dir, getSettings()).read(optionsOrSettingsOrCallback);
-    }
-    new async_1.default(dir, getSettings(optionsOrSettingsOrCallback)).read(callback);
-}
-exports.walk = walk;
-function walkSync(dir, optionsOrSettings) {
-    const settings = getSettings(optionsOrSettings);
-    const provider = new sync_1.default(dir, settings);
-    return provider.read();
-}
-exports.walkSync = walkSync;
-function walkStream(dir, optionsOrSettings) {
-    const settings = getSettings(optionsOrSettings);
-    const provider = new stream_1.default(dir, settings);
-    return provider.read();
-}
-exports.walkStream = walkStream;
-function getSettings(settingsOrOptions = {}) {
-    if (settingsOrOptions instanceof settings_1.default) {
-        return settingsOrOptions;
-    }
-    return new settings_1.default(settingsOrOptions);
-}
+    push({ type: 'text', value });
+  }
 
+  // Mark imbalanced braces and brackets as invalid
+  do {
+    block = stack.pop();
 
-/***/ }),
-/* 629 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (block.type !== 'root') {
+      block.nodes.forEach(node => {
+        if (!node.nodes) {
+          if (node.type === 'open') node.isOpen = true;
+          if (node.type === 'close') node.isClose = true;
+          if (!node.nodes) node.type = 'text';
+          node.invalid = true;
+        }
+      });
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const async_1 = __webpack_require__(630);
-class AsyncProvider {
-    constructor(_root, _settings) {
-        this._root = _root;
-        this._settings = _settings;
-        this._reader = new async_1.default(this._root, this._settings);
-        this._storage = new Set();
-    }
-    read(callback) {
-        this._reader.onError((error) => {
-            callFailureCallback(callback, error);
-        });
-        this._reader.onEntry((entry) => {
-            this._storage.add(entry);
-        });
-        this._reader.onEnd(() => {
-            callSuccessCallback(callback, Array.from(this._storage));
-        });
-        this._reader.read();
-    }
-}
-exports.default = AsyncProvider;
-function callFailureCallback(callback, error) {
-    callback(error);
-}
-function callSuccessCallback(callback, entries) {
-    callback(null, entries);
-}
+      // get the location of the block on parent.nodes (block's siblings)
+      let parent = stack[stack.length - 1];
+      let index = parent.nodes.indexOf(block);
+      // replace the (invalid) block with it's nodes
+      parent.nodes.splice(index, 1, ...block.nodes);
+    }
+  } while (stack.length > 0);
+
+  push({ type: 'eos' });
+  return ast;
+};
+
+module.exports = parse;
 
 
 /***/ }),
-/* 630 */
+/* 618 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const events_1 = __webpack_require__(379);
-const fsScandir = __webpack_require__(631);
-const fastq = __webpack_require__(640);
-const common = __webpack_require__(642);
-const reader_1 = __webpack_require__(643);
-class AsyncReader extends reader_1.default {
-    constructor(_root, _settings) {
-        super(_root, _settings);
-        this._settings = _settings;
-        this._scandir = fsScandir.scandir;
-        this._emitter = new events_1.EventEmitter();
-        this._queue = fastq(this._worker.bind(this), this._settings.concurrency);
-        this._isFatalError = false;
-        this._isDestroyed = false;
-        this._queue.drain = () => {
-            if (!this._isFatalError) {
-                this._emitter.emit('end');
-            }
-        };
-    }
-    read() {
-        this._isFatalError = false;
-        this._isDestroyed = false;
-        setImmediate(() => {
-            this._pushToQueue(this._root, this._settings.basePath);
-        });
-        return this._emitter;
-    }
-    destroy() {
-        if (this._isDestroyed) {
-            throw new Error('The reader is already destroyed');
-        }
-        this._isDestroyed = true;
-        this._queue.killAndDrain();
-    }
-    onEntry(callback) {
-        this._emitter.on('entry', callback);
-    }
-    onError(callback) {
-        this._emitter.once('error', callback);
-    }
-    onEnd(callback) {
-        this._emitter.once('end', callback);
-    }
-    _pushToQueue(dir, base) {
-        const queueItem = { dir, base };
-        this._queue.push(queueItem, (error) => {
-            if (error) {
-                this._handleError(error);
-            }
-        });
-    }
-    _worker(item, done) {
-        this._scandir(item.dir, this._settings.fsScandirSettings, (error, entries) => {
-            if (error) {
-                return done(error, undefined);
-            }
-            for (const entry of entries) {
-                this._handleEntry(entry, item.base);
-            }
-            done(null, undefined);
-        });
-    }
-    _handleError(error) {
-        if (!common.isFatalError(this._settings, error)) {
-            return;
-        }
-        this._isFatalError = true;
-        this._isDestroyed = true;
-        this._emitter.emit('error', error);
-    }
-    _handleEntry(entry, base) {
-        if (this._isDestroyed || this._isFatalError) {
-            return;
-        }
-        const fullpath = entry.path;
-        if (base !== undefined) {
-            entry.path = common.joinPathSegments(base, entry.name, this._settings.pathSegmentSeparator);
-        }
-        if (common.isAppliedFilter(this._settings.entryFilter, entry)) {
-            this._emitEntry(entry);
-        }
-        if (entry.dirent.isDirectory() && common.isAppliedFilter(this._settings.deepFilter, entry)) {
-            this._pushToQueue(fullpath, entry.path);
-        }
-    }
-    _emitEntry(entry) {
-        this._emitter.emit('entry', entry);
-    }
-}
-exports.default = AsyncReader;
+
+
+module.exports = {
+  MAX_LENGTH: 1024 * 64,
+
+  // Digits
+  CHAR_0: '0', /* 0 */
+  CHAR_9: '9', /* 9 */
+
+  // Alphabet chars.
+  CHAR_UPPERCASE_A: 'A', /* A */
+  CHAR_LOWERCASE_A: 'a', /* a */
+  CHAR_UPPERCASE_Z: 'Z', /* Z */
+  CHAR_LOWERCASE_Z: 'z', /* z */
+
+  CHAR_LEFT_PARENTHESES: '(', /* ( */
+  CHAR_RIGHT_PARENTHESES: ')', /* ) */
+
+  CHAR_ASTERISK: '*', /* * */
+
+  // Non-alphabetic chars.
+  CHAR_AMPERSAND: '&', /* & */
+  CHAR_AT: '@', /* @ */
+  CHAR_BACKSLASH: '\\', /* \ */
+  CHAR_BACKTICK: '`', /* ` */
+  CHAR_CARRIAGE_RETURN: '\r', /* \r */
+  CHAR_CIRCUMFLEX_ACCENT: '^', /* ^ */
+  CHAR_COLON: ':', /* : */
+  CHAR_COMMA: ',', /* , */
+  CHAR_DOLLAR: '$', /* . */
+  CHAR_DOT: '.', /* . */
+  CHAR_DOUBLE_QUOTE: '"', /* " */
+  CHAR_EQUAL: '=', /* = */
+  CHAR_EXCLAMATION_MARK: '!', /* ! */
+  CHAR_FORM_FEED: '\f', /* \f */
+  CHAR_FORWARD_SLASH: '/', /* / */
+  CHAR_HASH: '#', /* # */
+  CHAR_HYPHEN_MINUS: '-', /* - */
+  CHAR_LEFT_ANGLE_BRACKET: '<', /* < */
+  CHAR_LEFT_CURLY_BRACE: '{', /* { */
+  CHAR_LEFT_SQUARE_BRACKET: '[', /* [ */
+  CHAR_LINE_FEED: '\n', /* \n */
+  CHAR_NO_BREAK_SPACE: '\u00A0', /* \u00A0 */
+  CHAR_PERCENT: '%', /* % */
+  CHAR_PLUS: '+', /* + */
+  CHAR_QUESTION_MARK: '?', /* ? */
+  CHAR_RIGHT_ANGLE_BRACKET: '>', /* > */
+  CHAR_RIGHT_CURLY_BRACE: '}', /* } */
+  CHAR_RIGHT_SQUARE_BRACKET: ']', /* ] */
+  CHAR_SEMICOLON: ';', /* ; */
+  CHAR_SINGLE_QUOTE: '\'', /* ' */
+  CHAR_SPACE: ' ', /*   */
+  CHAR_TAB: '\t', /* \t */
+  CHAR_UNDERSCORE: '_', /* _ */
+  CHAR_VERTICAL_LINE: '|', /* | */
+  CHAR_ZERO_WIDTH_NOBREAK_SPACE: '\uFEFF' /* \uFEFF */
+};
 
 
 /***/ }),
-/* 631 */
+/* 619 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const async = __webpack_require__(632);
-const sync = __webpack_require__(637);
-const settings_1 = __webpack_require__(638);
-exports.Settings = settings_1.default;
-function scandir(path, optionsOrSettingsOrCallback, callback) {
-    if (typeof optionsOrSettingsOrCallback === 'function') {
-        return async.read(path, getSettings(), optionsOrSettingsOrCallback);
-    }
-    async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
-}
-exports.scandir = scandir;
-function scandirSync(path, optionsOrSettings) {
-    const settings = getSettings(optionsOrSettings);
-    return sync.read(path, settings);
-}
-exports.scandirSync = scandirSync;
-function getSettings(settingsOrOptions = {}) {
-    if (settingsOrOptions instanceof settings_1.default) {
-        return settingsOrOptions;
-    }
-    return new settings_1.default(settingsOrOptions);
-}
+
+
+module.exports = __webpack_require__(620);
 
 
 /***/ }),
-/* 632 */
+/* 620 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fsStat = __webpack_require__(623);
-const rpl = __webpack_require__(633);
-const constants_1 = __webpack_require__(634);
-const utils = __webpack_require__(635);
-function read(dir, settings, callback) {
-    if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
-        return readdirWithFileTypes(dir, settings, callback);
-    }
-    return readdir(dir, settings, callback);
-}
-exports.read = read;
-function readdirWithFileTypes(dir, settings, callback) {
-    settings.fs.readdir(dir, { withFileTypes: true }, (readdirError, dirents) => {
-        if (readdirError) {
-            return callFailureCallback(callback, readdirError);
-        }
-        const entries = dirents.map((dirent) => ({
-            dirent,
-            name: dirent.name,
-            path: `${dir}${settings.pathSegmentSeparator}${dirent.name}`
-        }));
-        if (!settings.followSymbolicLinks) {
-            return callSuccessCallback(callback, entries);
-        }
-        const tasks = entries.map((entry) => makeRplTaskEntry(entry, settings));
-        rpl(tasks, (rplError, rplEntries) => {
-            if (rplError) {
-                return callFailureCallback(callback, rplError);
-            }
-            callSuccessCallback(callback, rplEntries);
-        });
-    });
-}
-exports.readdirWithFileTypes = readdirWithFileTypes;
-function makeRplTaskEntry(entry, settings) {
-    return (done) => {
-        if (!entry.dirent.isSymbolicLink()) {
-            return done(null, entry);
-        }
-        settings.fs.stat(entry.path, (statError, stats) => {
-            if (statError) {
-                if (settings.throwErrorOnBrokenSymbolicLink) {
-                    return done(statError);
-                }
-                return done(null, entry);
-            }
-            entry.dirent = utils.fs.createDirentFromStats(entry.name, stats);
-            return done(null, entry);
-        });
-    };
-}
-function readdir(dir, settings, callback) {
-    settings.fs.readdir(dir, (readdirError, names) => {
-        if (readdirError) {
-            return callFailureCallback(callback, readdirError);
-        }
-        const filepaths = names.map((name) => `${dir}${settings.pathSegmentSeparator}${name}`);
-        const tasks = filepaths.map((filepath) => {
-            return (done) => fsStat.stat(filepath, settings.fsStatSettings, done);
-        });
-        rpl(tasks, (rplError, results) => {
-            if (rplError) {
-                return callFailureCallback(callback, rplError);
-            }
-            const entries = [];
-            for (let index = 0; index < names.length; index++) {
-                const name = names[index];
-                const stats = results[index];
-                const entry = {
-                    name,
-                    path: filepaths[index],
-                    dirent: utils.fs.createDirentFromStats(name, stats)
-                };
-                if (settings.stats) {
-                    entry.stats = stats;
-                }
-                entries.push(entry);
-            }
-            callSuccessCallback(callback, entries);
-        });
-    });
-}
-exports.readdir = readdir;
-function callFailureCallback(callback, error) {
-    callback(error);
-}
-function callSuccessCallback(callback, result) {
-    callback(null, result);
-}
 
 
-/***/ }),
-/* 633 */
-/***/ (function(module, exports) {
+const path = __webpack_require__(16);
+const scan = __webpack_require__(621);
+const parse = __webpack_require__(624);
+const utils = __webpack_require__(622);
 
-module.exports = runParallel
+/**
+ * Creates a matcher function from one or more glob patterns. The
+ * returned function takes a string to match as its first argument,
+ * and returns true if the string is a match. The returned matcher
+ * function also takes a boolean as the second argument that, when true,
+ * returns an object with additional information.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch(glob[, options]);
+ *
+ * const isMatch = picomatch('*.!(*a)');
+ * console.log(isMatch('a.a')); //=> false
+ * console.log(isMatch('a.b')); //=> true
+ * ```
+ * @name picomatch
+ * @param {String|Array} `globs` One or more glob patterns.
+ * @param {Object=} `options`
+ * @return {Function=} Returns a matcher function.
+ * @api public
+ */
 
-function runParallel (tasks, cb) {
-  var results, pending, keys
-  var isSync = true
+const picomatch = (glob, options, returnState = false) => {
+  if (Array.isArray(glob)) {
+    let fns = glob.map(input => picomatch(input, options, returnState));
+    return str => {
+      for (let isMatch of fns) {
+        let state = isMatch(str);
+        if (state) return state;
+      }
+      return false;
+    };
+  }
 
-  if (Array.isArray(tasks)) {
-    results = []
-    pending = tasks.length
-  } else {
-    keys = Object.keys(tasks)
-    results = {}
-    pending = keys.length
+  if (typeof glob !== 'string' || glob === '') {
+    throw new TypeError('Expected pattern to be a non-empty string');
   }
 
-  function done (err) {
-    function end () {
-      if (cb) cb(err, results)
-      cb = null
-    }
-    if (isSync) process.nextTick(end)
-    else end()
+  let opts = options || {};
+  let posix = utils.isWindows(options);
+  let regex = picomatch.makeRe(glob, options, false, true);
+  let state = regex.state;
+  delete regex.state;
+
+  let isIgnored = () => false;
+  if (opts.ignore) {
+    let ignoreOpts = { ...options, ignore: null, onMatch: null, onResult: null };
+    isIgnored = picomatch(opts.ignore, ignoreOpts, returnState);
   }
 
-  function each (i, err, result) {
-    results[i] = result
-    if (--pending === 0 || err) {
-      done(err)
+  const matcher = (input, returnObject = false) => {
+    let { isMatch, match, output } = picomatch.test(input, regex, options, { glob, posix });
+    let result = { glob, state, regex, posix, input, output, match, isMatch };
+
+    if (typeof opts.onResult === 'function') {
+      opts.onResult(result);
     }
-  }
 
-  if (!pending) {
-    // empty
-    done(null)
-  } else if (keys) {
-    // object
-    keys.forEach(function (key) {
-      tasks[key](function (err, result) { each(key, err, result) })
-    })
-  } else {
-    // array
-    tasks.forEach(function (task, i) {
-      task(function (err, result) { each(i, err, result) })
-    })
-  }
+    if (isMatch === false) {
+      result.isMatch = false;
+      return returnObject ? result : false;
+    }
 
-  isSync = false
-}
+    if (isIgnored(input)) {
+      if (typeof opts.onIgnore === 'function') {
+        opts.onIgnore(result);
+      }
+      result.isMatch = false;
+      return returnObject ? result : false;
+    }
 
+    if (typeof opts.onMatch === 'function') {
+      opts.onMatch(result);
+    }
+    return returnObject ? result : true;
+  };
 
-/***/ }),
-/* 634 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (returnState) {
+    matcher.state = state;
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const NODE_PROCESS_VERSION_PARTS = process.versions.node.split('.');
-const MAJOR_VERSION = parseInt(NODE_PROCESS_VERSION_PARTS[0], 10);
-const MINOR_VERSION = parseInt(NODE_PROCESS_VERSION_PARTS[1], 10);
-/**
- * IS `true` for Node.js 10.10 and greater.
- */
-exports.IS_SUPPORT_READDIR_WITH_FILE_TYPES = MAJOR_VERSION > 10 || (MAJOR_VERSION === 10 && MINOR_VERSION >= 10);
+  return matcher;
+};
 
+/**
+ * Test `input` with the given `regex`. This is used by the main
+ * `picomatch()` function to test the input string.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.test(input, regex[, options]);
+ *
+ * console.log(picomatch.test('foo/bar', /^(?:([^/]*?)\/([^/]*?))$/));
+ * // { isMatch: true, match: [ 'foo/', 'foo', 'bar' ], output: 'foo/bar' }
+ * ```
+ * @param {String} `input` String to test.
+ * @param {RegExp} `regex`
+ * @return {Object} Returns an object with matching info.
+ * @api public
+ */
 
-/***/ }),
-/* 635 */
-/***/ (function(module, exports, __webpack_require__) {
+picomatch.test = (input, regex, options, { glob, posix } = {}) => {
+  if (typeof input !== 'string') {
+    throw new TypeError('Expected input to be a string');
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __webpack_require__(636);
-exports.fs = fs;
+  if (input === '') {
+    return { isMatch: false, output: '' };
+  }
 
+  let opts = options || {};
+  let format = opts.format || (posix ? utils.toPosixSlashes : null);
+  let match = input === glob;
+  let output = (match && format) ? format(input) : input;
 
-/***/ }),
-/* 636 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (match === false) {
+    output = format ? format(input) : input;
+    match = output === glob;
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-class DirentFromStats {
-    constructor(name, stats) {
-        this.name = name;
-        this.isBlockDevice = stats.isBlockDevice.bind(stats);
-        this.isCharacterDevice = stats.isCharacterDevice.bind(stats);
-        this.isDirectory = stats.isDirectory.bind(stats);
-        this.isFIFO = stats.isFIFO.bind(stats);
-        this.isFile = stats.isFile.bind(stats);
-        this.isSocket = stats.isSocket.bind(stats);
-        this.isSymbolicLink = stats.isSymbolicLink.bind(stats);
-    }
-}
-function createDirentFromStats(name, stats) {
-    return new DirentFromStats(name, stats);
-}
-exports.createDirentFromStats = createDirentFromStats;
+  if (match === false || opts.capture === true) {
+    if (opts.matchBase === true || opts.basename === true) {
+      match = picomatch.matchBase(input, regex, options, posix);
+    } else {
+      match = regex.exec(output);
+    }
+  }
 
+  return { isMatch: !!match, match, output };
+};
 
-/***/ }),
-/* 637 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fsStat = __webpack_require__(623);
-const constants_1 = __webpack_require__(634);
-const utils = __webpack_require__(635);
-function read(dir, settings) {
-    if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
-        return readdirWithFileTypes(dir, settings);
-    }
-    return readdir(dir, settings);
-}
-exports.read = read;
-function readdirWithFileTypes(dir, settings) {
-    const dirents = settings.fs.readdirSync(dir, { withFileTypes: true });
-    return dirents.map((dirent) => {
-        const entry = {
-            dirent,
-            name: dirent.name,
-            path: `${dir}${settings.pathSegmentSeparator}${dirent.name}`
-        };
-        if (entry.dirent.isSymbolicLink() && settings.followSymbolicLinks) {
-            try {
-                const stats = settings.fs.statSync(entry.path);
-                entry.dirent = utils.fs.createDirentFromStats(entry.name, stats);
-            }
-            catch (error) {
-                if (settings.throwErrorOnBrokenSymbolicLink) {
-                    throw error;
-                }
-            }
-        }
-        return entry;
-    });
-}
-exports.readdirWithFileTypes = readdirWithFileTypes;
-function readdir(dir, settings) {
-    const names = settings.fs.readdirSync(dir);
-    return names.map((name) => {
-        const entryPath = `${dir}${settings.pathSegmentSeparator}${name}`;
-        const stats = fsStat.statSync(entryPath, settings.fsStatSettings);
-        const entry = {
-            name,
-            path: entryPath,
-            dirent: utils.fs.createDirentFromStats(name, stats)
-        };
-        if (settings.stats) {
-            entry.stats = stats;
-        }
-        return entry;
-    });
-}
-exports.readdir = readdir;
-
-
-/***/ }),
-/* 638 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-const fsStat = __webpack_require__(623);
-const fs = __webpack_require__(639);
-class Settings {
-    constructor(_options = {}) {
-        this._options = _options;
-        this.followSymbolicLinks = this._getValue(this._options.followSymbolicLinks, false);
-        this.fs = fs.createFileSystemAdapter(this._options.fs);
-        this.pathSegmentSeparator = this._getValue(this._options.pathSegmentSeparator, path.sep);
-        this.stats = this._getValue(this._options.stats, false);
-        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
-        this.fsStatSettings = new fsStat.Settings({
-            followSymbolicLink: this.followSymbolicLinks,
-            fs: this.fs,
-            throwErrorOnBrokenSymbolicLink: this.throwErrorOnBrokenSymbolicLink
-        });
-    }
-    _getValue(option, value) {
-        return option === undefined ? value : option;
-    }
-}
-exports.default = Settings;
+/**
+ * Match the basename of a filepath.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.matchBase(input, glob[, options]);
+ * console.log(picomatch.matchBase('foo/bar.js', '*.js'); // true
+ * ```
+ * @param {String} `input` String to test.
+ * @param {RegExp|String} `glob` Glob pattern or regex created by [.makeRe](#makeRe).
+ * @return {Boolean}
+ * @api public
+ */
 
+picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
+  let regex = glob instanceof RegExp ? glob : picomatch.makeRe(glob, options);
+  return regex.test(path.basename(input));
+};
 
-/***/ }),
-/* 639 */
-/***/ (function(module, exports, __webpack_require__) {
+/**
+ * Returns true if **any** of the given glob `patterns` match the specified `string`.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.isMatch(string, patterns[, options]);
+ *
+ * console.log(picomatch.isMatch('a.a', ['b.*', '*.a'])); //=> true
+ * console.log(picomatch.isMatch('a.a', 'b.*')); //=> false
+ * ```
+ * @param {String|Array} str The string to test.
+ * @param {String|Array} patterns One or more glob patterns to use for matching.
+ * @param {Object} [options] See available [options](#options).
+ * @return {Boolean} Returns true if any patterns match `str`
+ * @api public
+ */
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __webpack_require__(23);
-exports.FILE_SYSTEM_ADAPTER = {
-    lstat: fs.lstat,
-    stat: fs.stat,
-    lstatSync: fs.lstatSync,
-    statSync: fs.statSync,
-    readdir: fs.readdir,
-    readdirSync: fs.readdirSync
-};
-function createFileSystemAdapter(fsMethods) {
-    if (!fsMethods) {
-        return exports.FILE_SYSTEM_ADAPTER;
-    }
-    return Object.assign({}, exports.FILE_SYSTEM_ADAPTER, fsMethods);
-}
-exports.createFileSystemAdapter = createFileSystemAdapter;
+picomatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
 
+/**
+ * Parse a glob pattern to create the source string for a regular
+ * expression.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * const result = picomatch.parse(glob[, options]);
+ * ```
+ * @param {String} `glob`
+ * @param {Object} `options`
+ * @return {Object} Returns an object with useful properties and output to be used as a regex source string.
+ * @api public
+ */
 
-/***/ }),
-/* 640 */
-/***/ (function(module, exports, __webpack_require__) {
+picomatch.parse = (glob, options) => parse(glob, options);
 
-"use strict";
+/**
+ * Scan a glob pattern to separate the pattern into segments.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.scan(input[, options]);
+ *
+ * const result = picomatch.scan('!./foo/*.js');
+ * console.log(result);
+ * // { prefix: '!./',
+ * //   input: '!./foo/*.js',
+ * //   base: 'foo',
+ * //   glob: '*.js',
+ * //   negated: true,
+ * //   isGlob: true }
+ * ```
+ * @param {String} `input` Glob pattern to scan.
+ * @param {Object} `options`
+ * @return {Object} Returns an object with
+ * @api public
+ */
 
+picomatch.scan = (input, options) => scan(input, options);
 
-var reusify = __webpack_require__(641)
+/**
+ * Create a regular expression from a glob pattern.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.makeRe(input[, options]);
+ *
+ * console.log(picomatch.makeRe('*.js'));
+ * //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+ * ```
+ * @param {String} `input` A glob pattern to convert to regex.
+ * @param {Object} `options`
+ * @return {RegExp} Returns a regex created from the given pattern.
+ * @api public
+ */
 
-function fastqueue (context, worker, concurrency) {
-  if (typeof context === 'function') {
-    concurrency = worker
-    worker = context
-    context = null
+picomatch.makeRe = (input, options, returnOutput = false, returnState = false) => {
+  if (!input || typeof input !== 'string') {
+    throw new TypeError('Expected a non-empty string');
   }
 
-  var cache = reusify(Task)
-  var queueHead = null
-  var queueTail = null
-  var _running = 0
+  let opts = options || {};
+  let prepend = opts.contains ? '' : '^';
+  let append = opts.contains ? '' : '$';
+  let state = { negated: false, fastpaths: true };
+  let prefix = '';
+  let output;
 
-  var self = {
-    push: push,
-    drain: noop,
-    saturated: noop,
-    pause: pause,
-    paused: false,
-    concurrency: concurrency,
-    running: running,
-    resume: resume,
-    idle: idle,
-    length: length,
-    unshift: unshift,
-    empty: noop,
-    kill: kill,
-    killAndDrain: killAndDrain
+  if (input.startsWith('./')) {
+    input = input.slice(2);
+    prefix = state.prefix = './';
   }
 
-  return self
-
-  function running () {
-    return _running
+  if (opts.fastpaths !== false && (input[0] === '.' || input[0] === '*')) {
+    output = parse.fastpaths(input, options);
   }
 
-  function pause () {
-    self.paused = true
+  if (output === void 0) {
+    state = picomatch.parse(input, options);
+    state.prefix = prefix + (state.prefix || '');
+    output = state.output;
   }
 
-  function length () {
-    var current = queueHead
-    var counter = 0
-
-    while (current) {
-      current = current.next
-      counter++
-    }
-
-    return counter
+  if (returnOutput === true) {
+    return output;
   }
 
-  function resume () {
-    if (!self.paused) return
-    self.paused = false
-    for (var i = 0; i < self.concurrency; i++) {
-      _running++
-      release()
-    }
+  let source = `${prepend}(?:${output})${append}`;
+  if (state && state.negated === true) {
+    source = `^(?!${source}).*$`;
   }
 
-  function idle () {
-    return _running === 0 && self.length() === 0
+  let regex = picomatch.toRegex(source, options);
+  if (returnState === true) {
+    regex.state = state;
   }
 
-  function push (value, done) {
-    var current = cache.get()
+  return regex;
+};
 
-    current.context = context
-    current.release = release
-    current.value = value
-    current.callback = done || noop
+/**
+ * Create a regular expression from the given regex source string.
+ *
+ * ```js
+ * const picomatch = require('picomatch');
+ * // picomatch.toRegex(source[, options]);
+ *
+ * const { output } = picomatch.parse('*.js');
+ * console.log(picomatch.toRegex(output));
+ * //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+ * ```
+ * @param {String} `source` Regular expression source string.
+ * @param {Object} `options`
+ * @return {RegExp}
+ * @api public
+ */
 
-    if (_running === self.concurrency || self.paused) {
-      if (queueTail) {
-        queueTail.next = current
-        queueTail = current
-      } else {
-        queueHead = current
-        queueTail = current
-        self.saturated()
-      }
-    } else {
-      _running++
-      worker.call(context, current.value, current.worked)
-    }
+picomatch.toRegex = (source, options) => {
+  try {
+    let opts = options || {};
+    return new RegExp(source, opts.flags || (opts.nocase ? 'i' : ''));
+  } catch (err) {
+    if (options && options.debug === true) throw err;
+    return /$^/;
   }
+};
 
-  function unshift (value, done) {
-    var current = cache.get()
+/**
+ * Picomatch constants.
+ * @return {Object}
+ */
 
-    current.context = context
-    current.release = release
-    current.value = value
-    current.callback = done || noop
+picomatch.constants = __webpack_require__(623);
 
-    if (_running === self.concurrency || self.paused) {
-      if (queueHead) {
-        current.next = queueHead
-        queueHead = current
-      } else {
-        queueHead = current
-        queueTail = current
-        self.saturated()
-      }
-    } else {
-      _running++
-      worker.call(context, current.value, current.worked)
-    }
-  }
+/**
+ * Expose "picomatch"
+ */
 
-  function release (holder) {
-    if (holder) {
-      cache.release(holder)
-    }
-    var next = queueHead
-    if (next) {
-      if (!self.paused) {
-        if (queueTail === queueHead) {
-          queueTail = null
-        }
-        queueHead = next.next
-        next.next = null
-        worker.call(context, next.value, next.worked)
-        if (queueTail === null) {
-          self.empty()
-        }
-      } else {
-        _running--
-      }
-    } else if (--_running === 0) {
-      self.drain()
-    }
-  }
+module.exports = picomatch;
 
-  function kill () {
-    queueHead = null
-    queueTail = null
-    self.drain = noop
-  }
 
-  function killAndDrain () {
-    queueHead = null
-    queueTail = null
-    self.drain()
-    self.drain = noop
-  }
-}
+/***/ }),
+/* 621 */
+/***/ (function(module, exports, __webpack_require__) {
 
-function noop () {}
+"use strict";
 
-function Task () {
-  this.value = null
-  this.callback = noop
-  this.next = null
-  this.release = noop
-  this.context = null
 
-  var self = this
+const utils = __webpack_require__(622);
 
-  this.worked = function worked (err, result) {
-    var callback = self.callback
-    self.value = null
-    self.callback = noop
-    callback.call(self.context, err, result)
-    self.release(self)
-  }
-}
+const {
+  CHAR_ASTERISK,             /* * */
+  CHAR_AT,                   /* @ */
+  CHAR_BACKWARD_SLASH,       /* \ */
+  CHAR_COMMA,                /* , */
+  CHAR_DOT,                  /* . */
+  CHAR_EXCLAMATION_MARK,     /* ! */
+  CHAR_FORWARD_SLASH,        /* / */
+  CHAR_LEFT_CURLY_BRACE,     /* { */
+  CHAR_LEFT_PARENTHESES,     /* ( */
+  CHAR_LEFT_SQUARE_BRACKET,  /* [ */
+  CHAR_PLUS,                 /* + */
+  CHAR_QUESTION_MARK,        /* ? */
+  CHAR_RIGHT_CURLY_BRACE,    /* } */
+  CHAR_RIGHT_PARENTHESES,    /* ) */
+  CHAR_RIGHT_SQUARE_BRACKET /* ] */
+} = __webpack_require__(623);
 
-module.exports = fastqueue
+const isPathSeparator = code => {
+  return code === CHAR_FORWARD_SLASH || code === CHAR_BACKWARD_SLASH;
+};
 
+/**
+ * Quickly scans a glob pattern and returns an object with a handful of
+ * useful properties, like `isGlob`, `path` (the leading non-glob, if it exists),
+ * `glob` (the actual pattern), and `negated` (true if the path starts with `!`).
+ *
+ * ```js
+ * const pm = require('picomatch');
+ * console.log(pm.scan('foo/bar/*.js'));
+ * { isGlob: true, input: 'foo/bar/*.js', base: 'foo/bar', glob: '*.js' }
+ * ```
+ * @param {String} `str`
+ * @param {Object} `options`
+ * @return {Object} Returns an object with tokens and regex source string.
+ * @api public
+ */
 
-/***/ }),
-/* 641 */
-/***/ (function(module, exports, __webpack_require__) {
+module.exports = (input, options) => {
+  let opts = options || {};
+  let length = input.length - 1;
+  let index = -1;
+  let start = 0;
+  let lastIndex = 0;
+  let isGlob = false;
+  let backslashes = false;
+  let negated = false;
+  let braces = 0;
+  let prev;
+  let code;
 
-"use strict";
+  let braceEscaped = false;
 
+  let eos = () => index >= length;
+  let advance = () => {
+    prev = code;
+    return input.charCodeAt(++index);
+  };
 
-function reusify (Constructor) {
-  var head = new Constructor()
-  var tail = head
+  while (index < length) {
+    code = advance();
+    let next;
 
-  function get () {
-    var current = head
+    if (code === CHAR_BACKWARD_SLASH) {
+      backslashes = true;
+      next = advance();
 
-    if (current.next) {
-      head = current.next
-    } else {
-      head = new Constructor()
-      tail = head
+      if (next === CHAR_LEFT_CURLY_BRACE) {
+        braceEscaped = true;
+      }
+      continue;
     }
 
-    current.next = null
+    if (braceEscaped === true || code === CHAR_LEFT_CURLY_BRACE) {
+      braces++;
 
-    return current
-  }
+      while (!eos() && (next = advance())) {
+        if (next === CHAR_BACKWARD_SLASH) {
+          backslashes = true;
+          next = advance();
+          continue;
+        }
 
-  function release (obj) {
-    tail.next = obj
-    tail = obj
-  }
+        if (next === CHAR_LEFT_CURLY_BRACE) {
+          braces++;
+          continue;
+        }
 
-  return {
-    get: get,
-    release: release
-  }
-}
+        if (!braceEscaped && next === CHAR_DOT && (next = advance()) === CHAR_DOT) {
+          isGlob = true;
+          break;
+        }
 
-module.exports = reusify
+        if (!braceEscaped && next === CHAR_COMMA) {
+          isGlob = true;
+          break;
+        }
 
+        if (next === CHAR_RIGHT_CURLY_BRACE) {
+          braces--;
+          if (braces === 0) {
+            braceEscaped = false;
+            break;
+          }
+        }
+      }
+    }
 
-/***/ }),
-/* 642 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-function isFatalError(settings, error) {
-    if (settings.errorFilter === null) {
-        return true;
-    }
-    return !settings.errorFilter(error);
-}
-exports.isFatalError = isFatalError;
-function isAppliedFilter(filter, value) {
-    return filter === null || filter(value);
-}
-exports.isAppliedFilter = isAppliedFilter;
-function replacePathSegmentSeparator(filepath, separator) {
-    return filepath.split(/[\\\/]/).join(separator);
-}
-exports.replacePathSegmentSeparator = replacePathSegmentSeparator;
-function joinPathSegments(a, b, separator) {
-    if (a === '') {
-        return b;
-    }
-    return a + separator + b;
-}
-exports.joinPathSegments = joinPathSegments;
+    if (code === CHAR_FORWARD_SLASH) {
+      if (prev === CHAR_DOT && index === (start + 1)) {
+        start += 2;
+        continue;
+      }
 
+      lastIndex = index + 1;
+      continue;
+    }
 
-/***/ }),
-/* 643 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (code === CHAR_ASTERISK) {
+      isGlob = true;
+      break;
+    }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const common = __webpack_require__(642);
-class Reader {
-    constructor(_root, _settings) {
-        this._root = _root;
-        this._settings = _settings;
-        this._root = common.replacePathSegmentSeparator(_root, _settings.pathSegmentSeparator);
-    }
-}
-exports.default = Reader;
+    if (code === CHAR_ASTERISK || code === CHAR_QUESTION_MARK) {
+      isGlob = true;
+      break;
+    }
 
+    if (code === CHAR_LEFT_SQUARE_BRACKET) {
+      while (!eos() && (next = advance())) {
+        if (next === CHAR_BACKWARD_SLASH) {
+          backslashes = true;
+          next = advance();
+          continue;
+        }
 
-/***/ }),
-/* 644 */
-/***/ (function(module, exports, __webpack_require__) {
+        if (next === CHAR_RIGHT_SQUARE_BRACKET) {
+          isGlob = true;
+          break;
+        }
+      }
+    }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const stream_1 = __webpack_require__(27);
-const async_1 = __webpack_require__(630);
-class StreamProvider {
-    constructor(_root, _settings) {
-        this._root = _root;
-        this._settings = _settings;
-        this._reader = new async_1.default(this._root, this._settings);
-        this._stream = new stream_1.Readable({
-            objectMode: true,
-            read: () => { },
-            destroy: this._reader.destroy.bind(this._reader)
-        });
-    }
-    read() {
-        this._reader.onError((error) => {
-            this._stream.emit('error', error);
-        });
-        this._reader.onEntry((entry) => {
-            this._stream.push(entry);
-        });
-        this._reader.onEnd(() => {
-            this._stream.push(null);
-        });
-        this._reader.read();
-        return this._stream;
-    }
-}
-exports.default = StreamProvider;
+    let isExtglobChar = code === CHAR_PLUS
+      || code === CHAR_AT
+      || code === CHAR_EXCLAMATION_MARK;
 
+    if (isExtglobChar && input.charCodeAt(index + 1) === CHAR_LEFT_PARENTHESES) {
+      isGlob = true;
+      break;
+    }
 
-/***/ }),
-/* 645 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (code === CHAR_EXCLAMATION_MARK && index === start) {
+      negated = true;
+      start++;
+      continue;
+    }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const sync_1 = __webpack_require__(646);
-class SyncProvider {
-    constructor(_root, _settings) {
-        this._root = _root;
-        this._settings = _settings;
-        this._reader = new sync_1.default(this._root, this._settings);
-    }
-    read() {
-        return this._reader.read();
-    }
-}
-exports.default = SyncProvider;
+    if (code === CHAR_LEFT_PARENTHESES) {
+      while (!eos() && (next = advance())) {
+        if (next === CHAR_BACKWARD_SLASH) {
+          backslashes = true;
+          next = advance();
+          continue;
+        }
 
+        if (next === CHAR_RIGHT_PARENTHESES) {
+          isGlob = true;
+          break;
+        }
+      }
+    }
 
-/***/ }),
-/* 646 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (isGlob) {
+      break;
+    }
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fsScandir = __webpack_require__(631);
-const common = __webpack_require__(642);
-const reader_1 = __webpack_require__(643);
-class SyncReader extends reader_1.default {
-    constructor() {
-        super(...arguments);
-        this._scandir = fsScandir.scandirSync;
-        this._storage = new Set();
-        this._queue = new Set();
-    }
-    read() {
-        this._pushToQueue(this._root, this._settings.basePath);
-        this._handleQueue();
-        return Array.from(this._storage);
-    }
-    _pushToQueue(dir, base) {
-        this._queue.add({ dir, base });
-    }
-    _handleQueue() {
-        for (const item of this._queue.values()) {
-            this._handleDirectory(item.dir, item.base);
-        }
-    }
-    _handleDirectory(dir, base) {
-        try {
-            const entries = this._scandir(dir, this._settings.fsScandirSettings);
-            for (const entry of entries) {
-                this._handleEntry(entry, base);
-            }
-        }
-        catch (error) {
-            this._handleError(error);
-        }
-    }
-    _handleError(error) {
-        if (!common.isFatalError(this._settings, error)) {
-            return;
-        }
-        throw error;
-    }
-    _handleEntry(entry, base) {
-        const fullpath = entry.path;
-        if (base !== undefined) {
-            entry.path = common.joinPathSegments(base, entry.name, this._settings.pathSegmentSeparator);
-        }
-        if (common.isAppliedFilter(this._settings.entryFilter, entry)) {
-            this._pushToStorage(entry);
-        }
-        if (entry.dirent.isDirectory() && common.isAppliedFilter(this._settings.deepFilter, entry)) {
-            this._pushToQueue(fullpath, entry.path);
-        }
-    }
-    _pushToStorage(entry) {
-        this._storage.add(entry);
-    }
-}
-exports.default = SyncReader;
+  let prefix = '';
+  let orig = input;
+  let base = input;
+  let glob = '';
 
+  if (start > 0) {
+    prefix = input.slice(0, start);
+    input = input.slice(start);
+    lastIndex -= start;
+  }
 
-/***/ }),
-/* 647 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (base && isGlob === true && lastIndex > 0) {
+    base = input.slice(0, lastIndex);
+    glob = input.slice(lastIndex);
+  } else if (isGlob === true) {
+    base = '';
+    glob = input;
+  } else {
+    base = input;
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-const fsScandir = __webpack_require__(631);
-class Settings {
-    constructor(_options = {}) {
-        this._options = _options;
-        this.basePath = this._getValue(this._options.basePath, undefined);
-        this.concurrency = this._getValue(this._options.concurrency, Infinity);
-        this.deepFilter = this._getValue(this._options.deepFilter, null);
-        this.entryFilter = this._getValue(this._options.entryFilter, null);
-        this.errorFilter = this._getValue(this._options.errorFilter, null);
-        this.pathSegmentSeparator = this._getValue(this._options.pathSegmentSeparator, path.sep);
-        this.fsScandirSettings = new fsScandir.Settings({
-            followSymbolicLinks: this._options.followSymbolicLinks,
-            fs: this._options.fs,
-            pathSegmentSeparator: this._options.pathSegmentSeparator,
-            stats: this._options.stats,
-            throwErrorOnBrokenSymbolicLink: this._options.throwErrorOnBrokenSymbolicLink
-        });
-    }
-    _getValue(option, value) {
-        return option === undefined ? value : option;
-    }
-}
-exports.default = Settings;
+  if (base && base !== '' && base !== '/' && base !== input) {
+    if (isPathSeparator(base.charCodeAt(base.length - 1))) {
+      base = base.slice(0, -1);
+    }
+  }
 
+  if (opts.unescape === true) {
+    if (glob) glob = utils.removeBackslashes(glob);
 
-/***/ }),
-/* 648 */
-/***/ (function(module, exports, __webpack_require__) {
+    if (base && backslashes === true) {
+      base = utils.removeBackslashes(base);
+    }
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-const fsStat = __webpack_require__(623);
-const utils = __webpack_require__(594);
-class Reader {
-    constructor(_settings) {
-        this._settings = _settings;
-        this._fsStatSettings = new fsStat.Settings({
-            followSymbolicLink: this._settings.followSymbolicLinks,
-            fs: this._settings.fs,
-            throwErrorOnBrokenSymbolicLink: this._settings.followSymbolicLinks
-        });
-    }
-    _getFullEntryPath(filepath) {
-        return path.resolve(this._settings.cwd, filepath);
-    }
-    _makeEntry(stats, pattern) {
-        const entry = {
-            name: pattern,
-            path: pattern,
-            dirent: utils.fs.createDirentFromStats(pattern, stats)
-        };
-        if (this._settings.stats) {
-            entry.stats = stats;
-        }
-        return entry;
-    }
-    _isFatalError(error) {
-        return !utils.errno.isEnoentCodeError(error) && !this._settings.suppressErrors;
-    }
-}
-exports.default = Reader;
+  return { prefix, input: orig, base, glob, negated, isGlob };
+};
 
 
 /***/ }),
-/* 649 */
+/* 622 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const path = __webpack_require__(16);
-const deep_1 = __webpack_require__(650);
-const entry_1 = __webpack_require__(651);
-const error_1 = __webpack_require__(652);
-const entry_2 = __webpack_require__(653);
-class Provider {
-    constructor(_settings) {
-        this._settings = _settings;
-        this.errorFilter = new error_1.default(this._settings);
-        this.entryFilter = new entry_1.default(this._settings, this._getMicromatchOptions());
-        this.deepFilter = new deep_1.default(this._settings, this._getMicromatchOptions());
-        this.entryTransformer = new entry_2.default(this._settings);
-    }
-    _getRootDirectory(task) {
-        return path.resolve(this._settings.cwd, task.base);
-    }
-    _getReaderOptions(task) {
-        const basePath = task.base === '.' ? '' : task.base;
-        return {
-            basePath,
-            pathSegmentSeparator: '/',
-            concurrency: this._settings.concurrency,
-            deepFilter: this.deepFilter.getFilter(basePath, task.positive, task.negative),
-            entryFilter: this.entryFilter.getFilter(task.positive, task.negative),
-            errorFilter: this.errorFilter.getFilter(),
-            followSymbolicLinks: this._settings.followSymbolicLinks,
-            fs: this._settings.fs,
-            stats: this._settings.stats,
-            throwErrorOnBrokenSymbolicLink: this._settings.throwErrorOnBrokenSymbolicLink,
-            transform: this.entryTransformer.getTransformer()
-        };
-    }
-    _getMicromatchOptions() {
-        return {
-            dot: this._settings.dot,
-            matchBase: this._settings.baseNameMatch,
-            nobrace: !this._settings.braceExpansion,
-            nocase: !this._settings.caseSensitiveMatch,
-            noext: !this._settings.extglob,
-            noglobstar: !this._settings.globstar,
-            posix: true,
-            strictSlashes: false
-        };
-    }
-}
-exports.default = Provider;
 
 
-/***/ }),
-/* 650 */
-/***/ (function(module, exports, __webpack_require__) {
+const path = __webpack_require__(16);
+const win32 = process.platform === 'win32';
+const {
+  REGEX_SPECIAL_CHARS,
+  REGEX_SPECIAL_CHARS_GLOBAL,
+  REGEX_REMOVE_BACKSLASH
+} = __webpack_require__(623);
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils = __webpack_require__(594);
-class DeepFilter {
-    constructor(_settings, _micromatchOptions) {
-        this._settings = _settings;
-        this._micromatchOptions = _micromatchOptions;
-    }
-    getFilter(basePath, positive, negative) {
-        const maxPatternDepth = this._getMaxPatternDepth(positive);
-        const negativeRe = this._getNegativePatternsRe(negative);
-        return (entry) => this._filter(basePath, entry, negativeRe, maxPatternDepth);
-    }
-    _getMaxPatternDepth(patterns) {
-        const globstar = patterns.some(utils.pattern.hasGlobStar);
-        return globstar ? Infinity : utils.pattern.getMaxNaivePatternsDepth(patterns);
-    }
-    _getNegativePatternsRe(patterns) {
-        const affectDepthOfReadingPatterns = patterns.filter(utils.pattern.isAffectDepthOfReadingPattern);
-        return utils.pattern.convertPatternsToRe(affectDepthOfReadingPatterns, this._micromatchOptions);
-    }
-    _filter(basePath, entry, negativeRe, maxPatternDepth) {
-        const depth = this._getEntryDepth(basePath, entry.path);
-        if (this._isSkippedByDeep(depth)) {
-            return false;
-        }
-        if (this._isSkippedByMaxPatternDepth(depth, maxPatternDepth)) {
-            return false;
-        }
-        if (this._isSkippedSymbolicLink(entry)) {
-            return false;
-        }
-        if (this._isSkippedDotDirectory(entry)) {
-            return false;
-        }
-        return this._isSkippedByNegativePatterns(entry, negativeRe);
-    }
-    _getEntryDepth(basePath, entryPath) {
-        const basePathDepth = basePath.split('/').length;
-        const entryPathDepth = entryPath.split('/').length;
-        return entryPathDepth - (basePath === '' ? 0 : basePathDepth);
-    }
-    _isSkippedByDeep(entryDepth) {
-        return entryDepth >= this._settings.deep;
-    }
-    _isSkippedByMaxPatternDepth(entryDepth, maxPatternDepth) {
-        return !this._settings.baseNameMatch && maxPatternDepth !== Infinity && entryDepth > maxPatternDepth;
-    }
-    _isSkippedSymbolicLink(entry) {
-        return !this._settings.followSymbolicLinks && entry.dirent.isSymbolicLink();
-    }
-    _isSkippedDotDirectory(entry) {
-        return !this._settings.dot && entry.name.startsWith('.');
-    }
-    _isSkippedByNegativePatterns(entry, negativeRe) {
-        return !utils.pattern.matchAny(entry.path, negativeRe);
-    }
-}
-exports.default = DeepFilter;
+exports.isObject = val => val !== null && typeof val === 'object' && !Array.isArray(val);
+exports.hasRegexChars = str => REGEX_SPECIAL_CHARS.test(str);
+exports.isRegexChar = str => str.length === 1 && exports.hasRegexChars(str);
+exports.escapeRegex = str => str.replace(REGEX_SPECIAL_CHARS_GLOBAL, '\\$1');
+exports.toPosixSlashes = str => str.replace(/\\/g, '/');
 
+exports.removeBackslashes = str => {
+  return str.replace(REGEX_REMOVE_BACKSLASH, match => {
+    return match === '\\' ? '' : match;
+  });
+}
 
-/***/ }),
-/* 651 */
-/***/ (function(module, exports, __webpack_require__) {
+exports.supportsLookbehinds = () => {
+  let segs = process.version.slice(1).split('.');
+  if (segs.length === 3 && +segs[0] >= 9 || (+segs[0] === 8 && +segs[1] >= 10)) {
+    return true;
+  }
+  return false;
+};
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils = __webpack_require__(594);
-class EntryFilter {
-    constructor(_settings, _micromatchOptions) {
-        this._settings = _settings;
-        this._micromatchOptions = _micromatchOptions;
-        this.index = new Map();
-    }
-    getFilter(positive, negative) {
-        const positiveRe = utils.pattern.convertPatternsToRe(positive, this._micromatchOptions);
-        const negativeRe = utils.pattern.convertPatternsToRe(negative, this._micromatchOptions);
-        return (entry) => this._filter(entry, positiveRe, negativeRe);
-    }
-    _filter(entry, positiveRe, negativeRe) {
-        if (this._settings.unique) {
-            if (this._isDuplicateEntry(entry)) {
-                return false;
-            }
-            this._createIndexRecord(entry);
-        }
-        if (this._onlyFileFilter(entry) || this._onlyDirectoryFilter(entry)) {
-            return false;
-        }
-        if (this._isSkippedByAbsoluteNegativePatterns(entry, negativeRe)) {
-            return false;
-        }
-        const filepath = this._settings.baseNameMatch ? entry.name : entry.path;
-        return this._isMatchToPatterns(filepath, positiveRe) && !this._isMatchToPatterns(entry.path, negativeRe);
-    }
-    _isDuplicateEntry(entry) {
-        return this.index.has(entry.path);
-    }
-    _createIndexRecord(entry) {
-        this.index.set(entry.path, undefined);
-    }
-    _onlyFileFilter(entry) {
-        return this._settings.onlyFiles && !entry.dirent.isFile();
-    }
-    _onlyDirectoryFilter(entry) {
-        return this._settings.onlyDirectories && !entry.dirent.isDirectory();
-    }
-    _isSkippedByAbsoluteNegativePatterns(entry, negativeRe) {
-        if (!this._settings.absolute) {
-            return false;
-        }
-        const fullpath = utils.path.makeAbsolute(this._settings.cwd, entry.path);
-        return this._isMatchToPatterns(fullpath, negativeRe);
-    }
-    _isMatchToPatterns(filepath, patternsRe) {
-        return utils.pattern.matchAny(filepath, patternsRe);
-    }
-}
-exports.default = EntryFilter;
+exports.isWindows = options => {
+  if (options && typeof options.windows === 'boolean') {
+    return options.windows;
+  }
+  return win32 === true || path.sep === '\\';
+};
+
+exports.escapeLast = (input, char, lastIdx) => {
+  let idx = input.lastIndexOf(char, lastIdx);
+  if (idx === -1) return input;
+  if (input[idx - 1] === '\\') return exports.escapeLast(input, char, idx - 1);
+  return input.slice(0, idx) + '\\' + input.slice(idx);
+};
 
 
 /***/ }),
-/* 652 */
+/* 623 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const utils = __webpack_require__(594);
-class ErrorFilter {
-    constructor(_settings) {
-        this._settings = _settings;
-    }
-    getFilter() {
-        return (error) => this._isNonFatalError(error);
-    }
-    _isNonFatalError(error) {
-        return utils.errno.isEnoentCodeError(error) || this._settings.suppressErrors;
-    }
-}
-exports.default = ErrorFilter;
 
 
-/***/ }),
+const path = __webpack_require__(16);
+const WIN_SLASH = '\\\\/';
+const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
+
+/**
+ * Posix glob regex
+ */
+
+const DOT_LITERAL = '\\.';
+const PLUS_LITERAL = '\\+';
+const QMARK_LITERAL = '\\?';
+const SLASH_LITERAL = '\\/';
+const ONE_CHAR = '(?=.)';
+const QMARK = '[^/]';
+const END_ANCHOR = `(?:${SLASH_LITERAL}|$)`;
+const START_ANCHOR = `(?:^|${SLASH_LITERAL})`;
+const DOTS_SLASH = `${DOT_LITERAL}{1,2}${END_ANCHOR}`;
+const NO_DOT = `(?!${DOT_LITERAL})`;
+const NO_DOTS = `(?!${START_ANCHOR}${DOTS_SLASH})`;
+const NO_DOT_SLASH = `(?!${DOT_LITERAL}{0,1}${END_ANCHOR})`;
+const NO_DOTS_SLASH = `(?!${DOTS_SLASH})`;
+const QMARK_NO_DOT = `[^.${SLASH_LITERAL}]`;
+const STAR = `${QMARK}*?`;
+
+const POSIX_CHARS = {
+  DOT_LITERAL,
+  PLUS_LITERAL,
+  QMARK_LITERAL,
+  SLASH_LITERAL,
+  ONE_CHAR,
+  QMARK,
+  END_ANCHOR,
+  DOTS_SLASH,
+  NO_DOT,
+  NO_DOTS,
+  NO_DOT_SLASH,
+  NO_DOTS_SLASH,
+  QMARK_NO_DOT,
+  STAR,
+  START_ANCHOR
+};
+
+/**
+ * Windows glob regex
+ */
+
+const WINDOWS_CHARS = {
+  ...POSIX_CHARS,
+
+  SLASH_LITERAL: `[${WIN_SLASH}]`,
+  QMARK: WIN_NO_SLASH,
+  STAR: `${WIN_NO_SLASH}*?`,
+  DOTS_SLASH: `${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$)`,
+  NO_DOT: `(?!${DOT_LITERAL})`,
+  NO_DOTS: `(?!(?:^|[${WIN_SLASH}])${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
+  NO_DOT_SLASH: `(?!${DOT_LITERAL}{0,1}(?:[${WIN_SLASH}]|$))`,
+  NO_DOTS_SLASH: `(?!${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
+  QMARK_NO_DOT: `[^.${WIN_SLASH}]`,
+  START_ANCHOR: `(?:^|[${WIN_SLASH}])`,
+  END_ANCHOR: `(?:[${WIN_SLASH}]|$)`
+};
+
+/**
+ * POSIX Bracket Regex
+ */
+
+const POSIX_REGEX_SOURCE = {
+  alnum: 'a-zA-Z0-9',
+  alpha: 'a-zA-Z',
+  ascii: '\\x00-\\x7F',
+  blank: ' \\t',
+  cntrl: '\\x00-\\x1F\\x7F',
+  digit: '0-9',
+  graph: '\\x21-\\x7E',
+  lower: 'a-z',
+  print: '\\x20-\\x7E ',
+  punct: '\\-!"#$%&\'()\\*+,./:;<=>?@[\\]^_`{|}~',
+  space: ' \\t\\r\\n\\v\\f',
+  upper: 'A-Z',
+  word: 'A-Za-z0-9_',
+  xdigit: 'A-Fa-f0-9'
+};
+
+module.exports = {
+  MAX_LENGTH: 1024 * 64,
+  POSIX_REGEX_SOURCE,
+
+  // regular expressions
+  REGEX_BACKSLASH: /\\(?![*+?^${}(|)[\]])/g,
+  REGEX_NON_SPECIAL_CHAR: /^[^@![\].,$*+?^{}()|\\/]+/,
+  REGEX_SPECIAL_CHARS: /[-*+?.^${}(|)[\]]/,
+  REGEX_SPECIAL_CHARS_BACKREF: /(\\?)((\W)(\3*))/g,
+  REGEX_SPECIAL_CHARS_GLOBAL: /([-*+?.^${}(|)[\]])/g,
+  REGEX_REMOVE_BACKSLASH: /(?:\[.*?[^\\]\]|\\(?=.))/g,
+
+  // Replace globs with equivalent patterns to reduce parsing time.
+  REPLACEMENTS: {
+    '***': '*',
+    '**/**': '**',
+    '**/**/**': '**'
+  },
+
+  // Digits
+  CHAR_0: 48, /* 0 */
+  CHAR_9: 57, /* 9 */
+
+  // Alphabet chars.
+  CHAR_UPPERCASE_A: 65, /* A */
+  CHAR_LOWERCASE_A: 97, /* a */
+  CHAR_UPPERCASE_Z: 90, /* Z */
+  CHAR_LOWERCASE_Z: 122, /* z */
+
+  CHAR_LEFT_PARENTHESES: 40, /* ( */
+  CHAR_RIGHT_PARENTHESES: 41, /* ) */
+
+  CHAR_ASTERISK: 42, /* * */
+
+  // Non-alphabetic chars.
+  CHAR_AMPERSAND: 38, /* & */
+  CHAR_AT: 64, /* @ */
+  CHAR_BACKWARD_SLASH: 92, /* \ */
+  CHAR_CARRIAGE_RETURN: 13, /* \r */
+  CHAR_CIRCUMFLEX_ACCENT: 94, /* ^ */
+  CHAR_COLON: 58, /* : */
+  CHAR_COMMA: 44, /* , */
+  CHAR_DOT: 46, /* . */
+  CHAR_DOUBLE_QUOTE: 34, /* " */
+  CHAR_EQUAL: 61, /* = */
+  CHAR_EXCLAMATION_MARK: 33, /* ! */
+  CHAR_FORM_FEED: 12, /* \f */
+  CHAR_FORWARD_SLASH: 47, /* / */
+  CHAR_GRAVE_ACCENT: 96, /* ` */
+  CHAR_HASH: 35, /* # */
+  CHAR_HYPHEN_MINUS: 45, /* - */
+  CHAR_LEFT_ANGLE_BRACKET: 60, /* < */
+  CHAR_LEFT_CURLY_BRACE: 123, /* { */
+  CHAR_LEFT_SQUARE_BRACKET: 91, /* [ */
+  CHAR_LINE_FEED: 10, /* \n */
+  CHAR_NO_BREAK_SPACE: 160, /* \u00A0 */
+  CHAR_PERCENT: 37, /* % */
+  CHAR_PLUS: 43, /* + */
+  CHAR_QUESTION_MARK: 63, /* ? */
+  CHAR_RIGHT_ANGLE_BRACKET: 62, /* > */
+  CHAR_RIGHT_CURLY_BRACE: 125, /* } */
+  CHAR_RIGHT_SQUARE_BRACKET: 93, /* ] */
+  CHAR_SEMICOLON: 59, /* ; */
+  CHAR_SINGLE_QUOTE: 39, /* ' */
+  CHAR_SPACE: 32, /*   */
+  CHAR_TAB: 9, /* \t */
+  CHAR_UNDERSCORE: 95, /* _ */
+  CHAR_VERTICAL_LINE: 124, /* | */
+  CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279, /* \uFEFF */
+
+  SEP: path.sep,
+
+  /**
+   * Create EXTGLOB_CHARS
+   */
+
+  extglobChars(chars) {
+    return {
+      '!': { type: 'negate', open: '(?:(?!(?:', close: `))${chars.STAR})` },
+      '?': { type: 'qmark', open: '(?:', close: ')?' },
+      '+': { type: 'plus', open: '(?:', close: ')+' },
+      '*': { type: 'star', open: '(?:', close: ')*' },
+      '@': { type: 'at', open: '(?:', close: ')' }
+    };
+  },
+
+  /**
+   * Create GLOB_CHARS
+   */
+
+  globChars(win32) {
+    return win32 === true ? WINDOWS_CHARS : POSIX_CHARS;
+  }
+};
+
+
+/***/ }),
+/* 624 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+
+const utils = __webpack_require__(622);
+const constants = __webpack_require__(623);
+
+/**
+ * Constants
+ */
+
+const {
+  MAX_LENGTH,
+  POSIX_REGEX_SOURCE,
+  REGEX_NON_SPECIAL_CHAR,
+  REGEX_SPECIAL_CHARS_BACKREF,
+  REPLACEMENTS
+} = constants;
+
+/**
+ * Helpers
+ */
+
+const expandRange = (args, options) => {
+  if (typeof options.expandRange === 'function') {
+    return options.expandRange(...args, options);
+  }
+
+  args.sort();
+  let value = `[${args.join('-')}]`;
+
+  try {
+    /* eslint-disable no-new */
+    new RegExp(value);
+  } catch (ex) {
+    return args.map(v => utils.escapeRegex(v)).join('..');
+  }
+
+  return value;
+};
+
+const negate = state => {
+  let count = 1;
+
+  while (state.peek() === '!' && (state.peek(2) !== '(' || state.peek(3) === '?')) {
+    state.advance();
+    state.start++;
+    count++;
+  }
+
+  if (count % 2 === 0) {
+    return false;
+  }
+
+  state.negated = true;
+  state.start++;
+  return true;
+};
+
+/**
+ * Create the message for a syntax error
+ */
+
+const syntaxError = (type, char) => {
+  return `Missing ${type}: "${char}" - use "\\\\${char}" to match literal characters`;
+};
+
+/**
+ * Parse the given input string.
+ * @param {String} input
+ * @param {Object} options
+ * @return {Object}
+ */
+
+const parse = (input, options) => {
+  if (typeof input !== 'string') {
+    throw new TypeError('Expected a string');
+  }
+
+  input = REPLACEMENTS[input] || input;
+
+  let opts = { ...options };
+  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
+  let len = input.length;
+  if (len > max) {
+    throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
+  }
+
+  let bos = { type: 'bos', value: '', output: opts.prepend || '' };
+  let tokens = [bos];
+
+  let capture = opts.capture ? '' : '?:';
+  let win32 = utils.isWindows(options);
+
+  // create constants based on platform, for windows or posix
+  const PLATFORM_CHARS = constants.globChars(win32);
+  const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+
+  const {
+    DOT_LITERAL,
+    PLUS_LITERAL,
+    SLASH_LITERAL,
+    ONE_CHAR,
+    DOTS_SLASH,
+    NO_DOT,
+    NO_DOT_SLASH,
+    NO_DOTS_SLASH,
+    QMARK,
+    QMARK_NO_DOT,
+    STAR,
+    START_ANCHOR
+  } = PLATFORM_CHARS;
+
+  const globstar = (opts) => {
+    return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
+  };
+
+  let nodot = opts.dot ? '' : NO_DOT;
+  let star = opts.bash === true ? globstar(opts) : STAR;
+  let qmarkNoDot = opts.dot ? QMARK : QMARK_NO_DOT;
+
+  if (opts.capture) {
+    star = `(${star})`;
+  }
+
+  // minimatch options support
+  if (typeof opts.noext === 'boolean') {
+    opts.noextglob = opts.noext;
+  }
+
+  let state = {
+    index: -1,
+    start: 0,
+    consumed: '',
+    output: '',
+    backtrack: false,
+    brackets: 0,
+    braces: 0,
+    parens: 0,
+    quotes: 0,
+    tokens
+  };
+
+  let extglobs = [];
+  let stack = [];
+  let prev = bos;
+  let value;
+
+  /**
+   * Tokenizing helpers
+   */
+
+  const eos = () => state.index === len - 1;
+  const peek = state.peek = (n = 1) => input[state.index + n];
+  const advance = state.advance = () => input[++state.index];
+  const append = token => {
+    state.output += token.output != null ? token.output : token.value;
+    state.consumed += token.value || '';
+  };
+
+  const increment = type => {
+    state[type]++;
+    stack.push(type);
+  };
+
+  const decrement = type => {
+    state[type]--;
+    stack.pop();
+  };
+
+  /**
+   * Push tokens onto the tokens array. This helper speeds up
+   * tokenizing by 1) helping us avoid backtracking as much as possible,
+   * and 2) helping us avoid creating extra tokens when consecutive
+   * characters are plain text. This improves performance and simplifies
+   * lookbehinds.
+   */
+
+  const push = tok => {
+    if (prev.type === 'globstar') {
+      let isBrace = state.braces > 0 && (tok.type === 'comma' || tok.type === 'brace');
+      let isExtglob = extglobs.length && (tok.type === 'pipe' || tok.type === 'paren');
+      if (tok.type !== 'slash' && tok.type !== 'paren' && !isBrace && !isExtglob) {
+        state.output = state.output.slice(0, -prev.output.length);
+        prev.type = 'star';
+        prev.value = '*';
+        prev.output = star;
+        state.output += prev.output;
+      }
+    }
+
+    if (extglobs.length && tok.type !== 'paren' && !EXTGLOB_CHARS[tok.value]) {
+      extglobs[extglobs.length - 1].inner += tok.value;
+    }
+
+    if (tok.value || tok.output) append(tok);
+    if (prev && prev.type === 'text' && tok.type === 'text') {
+      prev.value += tok.value;
+      return;
+    }
+
+    tok.prev = prev;
+    tokens.push(tok);
+    prev = tok;
+  };
+
+  const extglobOpen = (type, value) => {
+    let token = { ...EXTGLOB_CHARS[value], conditions: 1, inner: '' };
+
+    token.prev = prev;
+    token.parens = state.parens;
+    token.output = state.output;
+    let output = (opts.capture ? '(' : '') + token.open;
+
+    push({ type, value, output: state.output ? '' : ONE_CHAR });
+    push({ type: 'paren', extglob: true, value: advance(), output });
+    increment('parens');
+    extglobs.push(token);
+  };
+
+  const extglobClose = token => {
+    let output = token.close + (opts.capture ? ')' : '');
+
+    if (token.type === 'negate') {
+      let extglobStar = star;
+
+      if (token.inner && token.inner.length > 1 && token.inner.includes('/')) {
+        extglobStar = globstar(opts);
+      }
+
+      if (extglobStar !== star || eos() || /^\)+$/.test(input.slice(state.index + 1))) {
+        output = token.close = ')$))' + extglobStar;
+      }
+
+      if (token.prev.type === 'bos' && eos()) {
+        state.negatedExtglob = true;
+      }
+    }
+
+    push({ type: 'paren', extglob: true, value, output });
+    decrement('parens');
+  };
+
+  if (opts.fastpaths !== false && !/(^[*!]|[/{[()\]}"])/.test(input)) {
+    let backslashes = false;
+
+    let output = input.replace(REGEX_SPECIAL_CHARS_BACKREF, (m, esc, chars, first, rest, index) => {
+      if (first === '\\') {
+        backslashes = true;
+        return m;
+      }
+
+      if (first === '?') {
+        if (esc) {
+          return esc + first + (rest ? QMARK.repeat(rest.length) : '');
+        }
+        if (index === 0) {
+          return qmarkNoDot + (rest ? QMARK.repeat(rest.length) : '');
+        }
+        return QMARK.repeat(chars.length);
+      }
+
+      if (first === '.') {
+        return DOT_LITERAL.repeat(chars.length);
+      }
+
+      if (first === '*') {
+        if (esc) {
+          return esc + first + (rest ? star : '');
+        }
+        return star;
+      }
+      return esc ? m : '\\' + m;
+    });
+
+    if (backslashes === true) {
+      if (opts.unescape === true) {
+        output = output.replace(/\\/g, '');
+      } else {
+        output = output.replace(/\\+/g, m => {
+          return m.length % 2 === 0 ? '\\\\' : (m ? '\\' : '');
+        });
+      }
+    }
+
+    state.output = output;
+    return state;
+  }
+
+  /**
+   * Tokenize input until we reach end-of-string
+   */
+
+  while (!eos()) {
+    value = advance();
+
+    if (value === '\u0000') {
+      continue;
+    }
+
+    /**
+     * Escaped characters
+     */
+
+    if (value === '\\') {
+      let next = peek();
+
+      if (next === '/' && opts.bash !== true) {
+        continue;
+      }
+
+      if (next === '.' || next === ';') {
+        continue;
+      }
+
+      if (!next) {
+        value += '\\';
+        push({ type: 'text', value });
+        continue;
+      }
+
+      // collapse slashes to reduce potential for exploits
+      let match = /^\\+/.exec(input.slice(state.index + 1));
+      let slashes = 0;
+
+      if (match && match[0].length > 2) {
+        slashes = match[0].length;
+        state.index += slashes;
+        if (slashes % 2 !== 0) {
+          value += '\\';
+        }
+      }
+
+      if (opts.unescape === true) {
+        value = advance() || '';
+      } else {
+        value += advance() || '';
+      }
+
+      if (state.brackets === 0) {
+        push({ type: 'text', value });
+        continue;
+      }
+    }
+
+    /**
+     * If we're inside a regex character class, continue
+     * until we reach the closing bracket.
+     */
+
+    if (state.brackets > 0 && (value !== ']' || prev.value === '[' || prev.value === '[^')) {
+      if (opts.posix !== false && value === ':') {
+        let inner = prev.value.slice(1);
+        if (inner.includes('[')) {
+          prev.posix = true;
+
+          if (inner.includes(':')) {
+            let idx = prev.value.lastIndexOf('[');
+            let pre = prev.value.slice(0, idx);
+            let rest = prev.value.slice(idx + 2);
+            let posix = POSIX_REGEX_SOURCE[rest];
+            if (posix) {
+              prev.value = pre + posix;
+              state.backtrack = true;
+              advance();
+
+              if (!bos.output && tokens.indexOf(prev) === 1) {
+                bos.output = ONE_CHAR;
+              }
+              continue;
+            }
+          }
+        }
+      }
+
+      if ((value === '[' && peek() !== ':') || (value === '-' && peek() === ']')) {
+        value = '\\' + value;
+      }
+
+      if (value === ']' && (prev.value === '[' || prev.value === '[^')) {
+        value = '\\' + value;
+      }
+
+      if (opts.posix === true && value === '!' && prev.value === '[') {
+        value = '^';
+      }
+
+      prev.value += value;
+      append({ value });
+      continue;
+    }
+
+    /**
+     * If we're inside a quoted string, continue
+     * until we reach the closing double quote.
+     */
+
+    if (state.quotes === 1 && value !== '"') {
+      value = utils.escapeRegex(value);
+      prev.value += value;
+      append({ value });
+      continue;
+    }
+
+    /**
+     * Double quotes
+     */
+
+    if (value === '"') {
+      state.quotes = state.quotes === 1 ? 0 : 1;
+      if (opts.keepQuotes === true) {
+        push({ type: 'text', value });
+      }
+      continue;
+    }
+
+    /**
+     * Parentheses
+     */
+
+    if (value === '(') {
+      push({ type: 'paren', value });
+      increment('parens');
+      continue;
+    }
+
+    if (value === ')') {
+      if (state.parens === 0 && opts.strictBrackets === true) {
+        throw new SyntaxError(syntaxError('opening', '('));
+      }
+
+      let extglob = extglobs[extglobs.length - 1];
+      if (extglob && state.parens === extglob.parens + 1) {
+        extglobClose(extglobs.pop());
+        continue;
+      }
+
+      push({ type: 'paren', value, output: state.parens ? ')' : '\\)' });
+      decrement('parens');
+      continue;
+    }
+
+    /**
+     * Brackets
+     */
+
+    if (value === '[') {
+      if (opts.nobracket === true || !input.slice(state.index + 1).includes(']')) {
+        if (opts.nobracket !== true && opts.strictBrackets === true) {
+          throw new SyntaxError(syntaxError('closing', ']'));
+        }
+
+        value = '\\' + value;
+      } else {
+        increment('brackets');
+      }
+
+      push({ type: 'bracket', value });
+      continue;
+    }
+
+    if (value === ']') {
+      if (opts.nobracket === true || (prev && prev.type === 'bracket' && prev.value.length === 1)) {
+        push({ type: 'text', value, output: '\\' + value });
+        continue;
+      }
+
+      if (state.brackets === 0) {
+        if (opts.strictBrackets === true) {
+          throw new SyntaxError(syntaxError('opening', '['));
+        }
+
+        push({ type: 'text', value, output: '\\' + value });
+        continue;
+      }
+
+      decrement('brackets');
+
+      let prevValue = prev.value.slice(1);
+      if (prev.posix !== true && prevValue[0] === '^' && !prevValue.includes('/')) {
+        value = '/' + value;
+      }
+
+      prev.value += value;
+      append({ value });
+
+      // when literal brackets are explicitly disabled
+      // assume we should match with a regex character class
+      if (opts.literalBrackets === false || utils.hasRegexChars(prevValue)) {
+        continue;
+      }
+
+      let escaped = utils.escapeRegex(prev.value);
+      state.output = state.output.slice(0, -prev.value.length);
+
+      // when literal brackets are explicitly enabled
+      // assume we should escape the brackets to match literal characters
+      if (opts.literalBrackets === true) {
+        state.output += escaped;
+        prev.value = escaped;
+        continue;
+      }
+
+      // when the user specifies nothing, try to match both
+      prev.value = `(${capture}${escaped}|${prev.value})`;
+      state.output += prev.value;
+      continue;
+    }
+
+    /**
+     * Braces
+     */
+
+    if (value === '{' && opts.nobrace !== true) {
+      push({ type: 'brace', value, output: '(' });
+      increment('braces');
+      continue;
+    }
+
+    if (value === '}') {
+      if (opts.nobrace === true || state.braces === 0) {
+        push({ type: 'text', value, output: '\\' + value });
+        continue;
+      }
+
+      let output = ')';
+
+      if (state.dots === true) {
+        let arr = tokens.slice();
+        let range = [];
+
+        for (let i = arr.length - 1; i >= 0; i--) {
+          tokens.pop();
+          if (arr[i].type === 'brace') {
+            break;
+          }
+          if (arr[i].type !== 'dots') {
+            range.unshift(arr[i].value);
+          }
+        }
+
+        output = expandRange(range, opts);
+        state.backtrack = true;
+      }
+
+      push({ type: 'brace', value, output });
+      decrement('braces');
+      continue;
+    }
+
+    /**
+     * Pipes
+     */
+
+    if (value === '|') {
+      if (extglobs.length > 0) {
+        extglobs[extglobs.length - 1].conditions++;
+      }
+      push({ type: 'text', value });
+      continue;
+    }
+
+    /**
+     * Commas
+     */
+
+    if (value === ',') {
+      let output = value;
+
+      if (state.braces > 0 && stack[stack.length - 1] === 'braces') {
+        output = '|';
+      }
+
+      push({ type: 'comma', value, output });
+      continue;
+    }
+
+    /**
+     * Slashes
+     */
+
+    if (value === '/') {
+      // if the beginning of the glob is "./", advance the start
+      // to the current index, and don't add the "./" characters
+      // to the state. This greatly simplifies lookbehinds when
+      // checking for BOS characters like "!" and "." (not "./")
+      if (prev.type === 'dot' && state.index === 1) {
+        state.start = state.index + 1;
+        state.consumed = '';
+        state.output = '';
+        tokens.pop();
+        prev = bos; // reset "prev" to the first token
+        continue;
+      }
+
+      push({ type: 'slash', value, output: SLASH_LITERAL });
+      continue;
+    }
+
+    /**
+     * Dots
+     */
+
+    if (value === '.') {
+      if (state.braces > 0 && prev.type === 'dot') {
+        if (prev.value === '.') prev.output = DOT_LITERAL;
+        prev.type = 'dots';
+        prev.output += value;
+        prev.value += value;
+        state.dots = true;
+        continue;
+      }
+
+      push({ type: 'dot', value, output: DOT_LITERAL });
+      continue;
+    }
+
+    /**
+     * Question marks
+     */
+
+    if (value === '?') {
+      if (prev && prev.type === 'paren') {
+        let next = peek();
+        let output = value;
+
+        if (next === '<' && !utils.supportsLookbehinds()) {
+          throw new Error('Node.js v10 or higher is required for regex lookbehinds');
+        }
+
+        if (prev.value === '(' && !/[!=<:]/.test(next) || (next === '<' && !/[!=]/.test(peek(2)))) {
+          output = '\\' + value;
+        }
+
+        push({ type: 'text', value, output });
+        continue;
+      }
+
+      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
+        extglobOpen('qmark', value);
+        continue;
+      }
+
+      if (opts.dot !== true && (prev.type === 'slash' || prev.type === 'bos')) {
+        push({ type: 'qmark', value, output: QMARK_NO_DOT });
+        continue;
+      }
+
+      push({ type: 'qmark', value, output: QMARK });
+      continue;
+    }
+
+    /**
+     * Exclamation
+     */
+
+    if (value === '!') {
+      if (opts.noextglob !== true && peek() === '(') {
+        if (peek(2) !== '?' || !/[!=<:]/.test(peek(3))) {
+          extglobOpen('negate', value);
+          continue;
+        }
+      }
+
+      if (opts.nonegate !== true && state.index === 0) {
+        negate(state);
+        continue;
+      }
+    }
+
+    /**
+     * Plus
+     */
+
+    if (value === '+') {
+      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
+        extglobOpen('plus', value);
+        continue;
+      }
+
+      if (prev && (prev.type === 'bracket' || prev.type === 'paren' || prev.type === 'brace')) {
+        let output = prev.extglob === true ? '\\' + value : value;
+        push({ type: 'plus', value, output });
+        continue;
+      }
+
+      // use regex behavior inside parens
+      if (state.parens > 0 && opts.regex !== false) {
+        push({ type: 'plus', value });
+        continue;
+      }
+
+      push({ type: 'plus', value: PLUS_LITERAL });
+      continue;
+    }
+
+    /**
+     * Plain text
+     */
+
+    if (value === '@') {
+      if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
+        push({ type: 'at', value, output: '' });
+        continue;
+      }
+
+      push({ type: 'text', value });
+      continue;
+    }
+
+    /**
+     * Plain text
+     */
+
+    if (value !== '*') {
+      if (value === '$' || value === '^') {
+        value = '\\' + value;
+      }
+
+      let match = REGEX_NON_SPECIAL_CHAR.exec(input.slice(state.index + 1));
+      if (match) {
+        value += match[0];
+        state.index += match[0].length;
+      }
+
+      push({ type: 'text', value });
+      continue;
+    }
+
+    /**
+     * Stars
+     */
+
+    if (prev && (prev.type === 'globstar' || prev.star === true)) {
+      prev.type = 'star';
+      prev.star = true;
+      prev.value += value;
+      prev.output = star;
+      state.backtrack = true;
+      state.consumed += value;
+      continue;
+    }
+
+    if (opts.noextglob !== true && peek() === '(' && peek(2) !== '?') {
+      extglobOpen('star', value);
+      continue;
+    }
+
+    if (prev.type === 'star') {
+      if (opts.noglobstar === true) {
+        state.consumed += value;
+        continue;
+      }
+
+      let prior = prev.prev;
+      let before = prior.prev;
+      let isStart = prior.type === 'slash' || prior.type === 'bos';
+      let afterStar = before && (before.type === 'star' || before.type === 'globstar');
+
+      if (opts.bash === true && (!isStart || (!eos() && peek() !== '/'))) {
+        push({ type: 'star', value, output: '' });
+        continue;
+      }
+
+      let isBrace = state.braces > 0 && (prior.type === 'comma' || prior.type === 'brace');
+      let isExtglob = extglobs.length && (prior.type === 'pipe' || prior.type === 'paren');
+      if (!isStart && prior.type !== 'paren' && !isBrace && !isExtglob) {
+        push({ type: 'star', value, output: '' });
+        continue;
+      }
+
+      // strip consecutive `/**/`
+      while (input.slice(state.index + 1, state.index + 4) === '/**') {
+        let after = input[state.index + 4];
+        if (after && after !== '/') {
+          break;
+        }
+        state.consumed += '/**';
+        state.index += 3;
+      }
+
+      if (prior.type === 'bos' && eos()) {
+        prev.type = 'globstar';
+        prev.value += value;
+        prev.output = globstar(opts);
+        state.output = prev.output;
+        state.consumed += value;
+        continue;
+      }
+
+      if (prior.type === 'slash' && prior.prev.type !== 'bos' && !afterStar && eos()) {
+        state.output = state.output.slice(0, -(prior.output + prev.output).length);
+        prior.output = '(?:' + prior.output;
+
+        prev.type = 'globstar';
+        prev.output = globstar(opts) + '|$)';
+        prev.value += value;
+
+        state.output += prior.output + prev.output;
+        state.consumed += value;
+        continue;
+      }
+
+      let next = peek();
+      if (prior.type === 'slash' && prior.prev.type !== 'bos' && next === '/') {
+        let end = peek(2) !== void 0 ? '|$' : '';
+
+        state.output = state.output.slice(0, -(prior.output + prev.output).length);
+        prior.output = '(?:' + prior.output;
+
+        prev.type = 'globstar';
+        prev.output = `${globstar(opts)}${SLASH_LITERAL}|${SLASH_LITERAL}${end})`;
+        prev.value += value;
+
+        state.output += prior.output + prev.output;
+        state.consumed += value + advance();
+
+        push({ type: 'slash', value, output: '' });
+        continue;
+      }
+
+      if (prior.type === 'bos' && next === '/') {
+        prev.type = 'globstar';
+        prev.value += value;
+        prev.output = `(?:^|${SLASH_LITERAL}|${globstar(opts)}${SLASH_LITERAL})`;
+        state.output = prev.output;
+        state.consumed += value + advance();
+        push({ type: 'slash', value, output: '' });
+        continue;
+      }
+
+      // remove single star from output
+      state.output = state.output.slice(0, -prev.output.length);
+
+      // reset previous token to globstar
+      prev.type = 'globstar';
+      prev.output = globstar(opts);
+      prev.value += value;
+
+      // reset output with globstar
+      state.output += prev.output;
+      state.consumed += value;
+      continue;
+    }
+
+    let token = { type: 'star', value, output: star };
+
+    if (opts.bash === true) {
+      token.output = '.*?';
+      if (prev.type === 'bos' || prev.type === 'slash') {
+        token.output = nodot + token.output;
+      }
+      push(token);
+      continue;
+    }
+
+    if (prev && (prev.type === 'bracket' || prev.type === 'paren') && opts.regex === true) {
+      token.output = value;
+      push(token);
+      continue;
+    }
+
+    if (state.index === state.start || prev.type === 'slash' || prev.type === 'dot') {
+      if (prev.type === 'dot') {
+        state.output += NO_DOT_SLASH;
+        prev.output += NO_DOT_SLASH;
+
+      } else if (opts.dot === true) {
+        state.output += NO_DOTS_SLASH;
+        prev.output += NO_DOTS_SLASH;
+
+      } else {
+        state.output += nodot;
+        prev.output += nodot;
+      }
+
+      if (peek() !== '*') {
+        state.output += ONE_CHAR;
+        prev.output += ONE_CHAR;
+      }
+    }
+
+    push(token);
+  }
+
+  while (state.brackets > 0) {
+    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', ']'));
+    state.output = utils.escapeLast(state.output, '[');
+    decrement('brackets');
+  }
+
+  while (state.parens > 0) {
+    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', ')'));
+    state.output = utils.escapeLast(state.output, '(');
+    decrement('parens');
+  }
+
+  while (state.braces > 0) {
+    if (opts.strictBrackets === true) throw new SyntaxError(syntaxError('closing', '}'));
+    state.output = utils.escapeLast(state.output, '{');
+    decrement('braces');
+  }
+
+  if (opts.strictSlashes !== true && (prev.type === 'star' || prev.type === 'bracket')) {
+    push({ type: 'maybe_slash', value: '', output: `${SLASH_LITERAL}?` });
+  }
+
+  // rebuild the output if we had to backtrack at any point
+  if (state.backtrack === true) {
+    state.output = '';
+
+    for (let token of state.tokens) {
+      state.output += token.output != null ? token.output : token.value;
+
+      if (token.suffix) {
+        state.output += token.suffix;
+      }
+    }
+  }
+
+  return state;
+};
+
+/**
+ * Fast paths for creating regular expressions for common glob patterns.
+ * This can significantly speed up processing and has very little downside
+ * impact when none of the fast paths match.
+ */
+
+parse.fastpaths = (input, options) => {
+  let opts = { ...options };
+  let max = typeof opts.maxLength === 'number' ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
+  let len = input.length;
+  if (len > max) {
+    throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
+  }
+
+  input = REPLACEMENTS[input] || input;
+  let win32 = utils.isWindows(options);
+
+  // create constants based on platform, for windows or posix
+  const {
+    DOT_LITERAL,
+    SLASH_LITERAL,
+    ONE_CHAR,
+    DOTS_SLASH,
+    NO_DOT,
+    NO_DOTS,
+    NO_DOTS_SLASH,
+    STAR,
+    START_ANCHOR
+  } = constants.globChars(win32);
+
+  let capture = opts.capture ? '' : '?:';
+  let star = opts.bash === true ? '.*?' : STAR;
+  let nodot = opts.dot ? NO_DOTS : NO_DOT;
+  let slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
+
+  if (opts.capture) {
+    star = `(${star})`;
+  }
+
+  const globstar = (opts) => {
+    return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
+  };
+
+  const create = str => {
+    switch (str) {
+      case '*':
+        return `${nodot}${ONE_CHAR}${star}`;
+
+      case '.*':
+        return `${DOT_LITERAL}${ONE_CHAR}${star}`;
+
+      case '*.*':
+        return `${nodot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+
+      case '*/*':
+        return `${nodot}${star}${SLASH_LITERAL}${ONE_CHAR}${slashDot}${star}`;
+
+      case '**':
+        return nodot + globstar(opts);
+
+      case '**/*':
+        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${ONE_CHAR}${star}`;
+
+      case '**/*.*':
+        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+
+      case '**/.*':
+        return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${DOT_LITERAL}${ONE_CHAR}${star}`;
+
+      default: {
+        let match = /^(.*?)\.(\w+)$/.exec(str);
+        if (!match) return;
+
+        let source = create(match[1], options);
+        if (!source) return;
+
+        return source + DOT_LITERAL + match[2];
+      }
+    }
+  };
+
+  let output = create(input);
+  if (output && opts.strictSlashes !== true) {
+    output += `${SLASH_LITERAL}?`;
+  }
+
+  return output;
+};
+
+module.exports = parse;
+
+
+/***/ }),
+/* 625 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const merge2 = __webpack_require__(591);
+function merge(streams) {
+    const mergedStream = merge2(streams);
+    streams.forEach((stream) => {
+        stream.once('error', (err) => mergedStream.emit('error', err));
+    });
+    return mergedStream;
+}
+exports.merge = merge;
+
+
+/***/ }),
+/* 626 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = __webpack_require__(627);
+const provider_1 = __webpack_require__(654);
+class ProviderAsync extends provider_1.default {
+    constructor() {
+        super(...arguments);
+        this._reader = new stream_1.default(this._settings);
+    }
+    read(task) {
+        const root = this._getRootDirectory(task);
+        const options = this._getReaderOptions(task);
+        const entries = [];
+        return new Promise((resolve, reject) => {
+            const stream = this.api(root, task, options);
+            stream.once('error', reject);
+            stream.on('data', (entry) => entries.push(options.transform(entry)));
+            stream.once('end', () => resolve(entries));
+        });
+    }
+    api(root, task, options) {
+        if (task.dynamic) {
+            return this._reader.dynamic(root, options);
+        }
+        return this._reader.static(task.patterns, options);
+    }
+}
+exports.default = ProviderAsync;
+
+
+/***/ }),
+/* 627 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = __webpack_require__(27);
+const fsStat = __webpack_require__(628);
+const fsWalk = __webpack_require__(633);
+const reader_1 = __webpack_require__(653);
+class ReaderStream extends reader_1.default {
+    constructor() {
+        super(...arguments);
+        this._walkStream = fsWalk.walkStream;
+        this._stat = fsStat.stat;
+    }
+    dynamic(root, options) {
+        return this._walkStream(root, options);
+    }
+    static(patterns, options) {
+        const filepaths = patterns.map(this._getFullEntryPath, this);
+        const stream = new stream_1.PassThrough({ objectMode: true });
+        stream._write = (index, _enc, done) => {
+            return this._getEntry(filepaths[index], patterns[index], options)
+                .then((entry) => {
+                if (entry !== null && options.entryFilter(entry)) {
+                    stream.push(entry);
+                }
+                if (index === filepaths.length - 1) {
+                    stream.end();
+                }
+                done();
+            })
+                .catch(done);
+        };
+        for (let i = 0; i < filepaths.length; i++) {
+            stream.write(i);
+        }
+        return stream;
+    }
+    _getEntry(filepath, pattern, options) {
+        return this._getStat(filepath)
+            .then((stats) => this._makeEntry(stats, pattern))
+            .catch((error) => {
+            if (options.errorFilter(error)) {
+                return null;
+            }
+            throw error;
+        });
+    }
+    _getStat(filepath) {
+        return new Promise((resolve, reject) => {
+            this._stat(filepath, this._fsStatSettings, (error, stats) => {
+                error ? reject(error) : resolve(stats);
+            });
+        });
+    }
+}
+exports.default = ReaderStream;
+
+
+/***/ }),
+/* 628 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const async = __webpack_require__(629);
+const sync = __webpack_require__(630);
+const settings_1 = __webpack_require__(631);
+exports.Settings = settings_1.default;
+function stat(path, optionsOrSettingsOrCallback, callback) {
+    if (typeof optionsOrSettingsOrCallback === 'function') {
+        return async.read(path, getSettings(), optionsOrSettingsOrCallback);
+    }
+    async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
+}
+exports.stat = stat;
+function statSync(path, optionsOrSettings) {
+    const settings = getSettings(optionsOrSettings);
+    return sync.read(path, settings);
+}
+exports.statSync = statSync;
+function getSettings(settingsOrOptions = {}) {
+    if (settingsOrOptions instanceof settings_1.default) {
+        return settingsOrOptions;
+    }
+    return new settings_1.default(settingsOrOptions);
+}
+
+
+/***/ }),
+/* 629 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+function read(path, settings, callback) {
+    settings.fs.lstat(path, (lstatError, lstat) => {
+        if (lstatError) {
+            return callFailureCallback(callback, lstatError);
+        }
+        if (!lstat.isSymbolicLink() || !settings.followSymbolicLink) {
+            return callSuccessCallback(callback, lstat);
+        }
+        settings.fs.stat(path, (statError, stat) => {
+            if (statError) {
+                if (settings.throwErrorOnBrokenSymbolicLink) {
+                    return callFailureCallback(callback, statError);
+                }
+                return callSuccessCallback(callback, lstat);
+            }
+            if (settings.markSymbolicLink) {
+                stat.isSymbolicLink = () => true;
+            }
+            callSuccessCallback(callback, stat);
+        });
+    });
+}
+exports.read = read;
+function callFailureCallback(callback, error) {
+    callback(error);
+}
+function callSuccessCallback(callback, result) {
+    callback(null, result);
+}
+
+
+/***/ }),
+/* 630 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+function read(path, settings) {
+    const lstat = settings.fs.lstatSync(path);
+    if (!lstat.isSymbolicLink() || !settings.followSymbolicLink) {
+        return lstat;
+    }
+    try {
+        const stat = settings.fs.statSync(path);
+        if (settings.markSymbolicLink) {
+            stat.isSymbolicLink = () => true;
+        }
+        return stat;
+    }
+    catch (error) {
+        if (!settings.throwErrorOnBrokenSymbolicLink) {
+            return lstat;
+        }
+        throw error;
+    }
+}
+exports.read = read;
+
+
+/***/ }),
+/* 631 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __webpack_require__(632);
+class Settings {
+    constructor(_options = {}) {
+        this._options = _options;
+        this.followSymbolicLink = this._getValue(this._options.followSymbolicLink, true);
+        this.fs = fs.createFileSystemAdapter(this._options.fs);
+        this.markSymbolicLink = this._getValue(this._options.markSymbolicLink, false);
+        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
+    }
+    _getValue(option, value) {
+        return option === undefined ? value : option;
+    }
+}
+exports.default = Settings;
+
+
+/***/ }),
+/* 632 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __webpack_require__(23);
+exports.FILE_SYSTEM_ADAPTER = {
+    lstat: fs.lstat,
+    stat: fs.stat,
+    lstatSync: fs.lstatSync,
+    statSync: fs.statSync
+};
+function createFileSystemAdapter(fsMethods) {
+    if (!fsMethods) {
+        return exports.FILE_SYSTEM_ADAPTER;
+    }
+    return Object.assign({}, exports.FILE_SYSTEM_ADAPTER, fsMethods);
+}
+exports.createFileSystemAdapter = createFileSystemAdapter;
+
+
+/***/ }),
+/* 633 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const async_1 = __webpack_require__(634);
+const stream_1 = __webpack_require__(649);
+const sync_1 = __webpack_require__(650);
+const settings_1 = __webpack_require__(652);
+exports.Settings = settings_1.default;
+function walk(dir, optionsOrSettingsOrCallback, callback) {
+    if (typeof optionsOrSettingsOrCallback === 'function') {
+        return new async_1.default(dir, getSettings()).read(optionsOrSettingsOrCallback);
+    }
+    new async_1.default(dir, getSettings(optionsOrSettingsOrCallback)).read(callback);
+}
+exports.walk = walk;
+function walkSync(dir, optionsOrSettings) {
+    const settings = getSettings(optionsOrSettings);
+    const provider = new sync_1.default(dir, settings);
+    return provider.read();
+}
+exports.walkSync = walkSync;
+function walkStream(dir, optionsOrSettings) {
+    const settings = getSettings(optionsOrSettings);
+    const provider = new stream_1.default(dir, settings);
+    return provider.read();
+}
+exports.walkStream = walkStream;
+function getSettings(settingsOrOptions = {}) {
+    if (settingsOrOptions instanceof settings_1.default) {
+        return settingsOrOptions;
+    }
+    return new settings_1.default(settingsOrOptions);
+}
+
+
+/***/ }),
+/* 634 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const async_1 = __webpack_require__(635);
+class AsyncProvider {
+    constructor(_root, _settings) {
+        this._root = _root;
+        this._settings = _settings;
+        this._reader = new async_1.default(this._root, this._settings);
+        this._storage = new Set();
+    }
+    read(callback) {
+        this._reader.onError((error) => {
+            callFailureCallback(callback, error);
+        });
+        this._reader.onEntry((entry) => {
+            this._storage.add(entry);
+        });
+        this._reader.onEnd(() => {
+            callSuccessCallback(callback, Array.from(this._storage));
+        });
+        this._reader.read();
+    }
+}
+exports.default = AsyncProvider;
+function callFailureCallback(callback, error) {
+    callback(error);
+}
+function callSuccessCallback(callback, entries) {
+    callback(null, entries);
+}
+
+
+/***/ }),
+/* 635 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const events_1 = __webpack_require__(379);
+const fsScandir = __webpack_require__(636);
+const fastq = __webpack_require__(645);
+const common = __webpack_require__(647);
+const reader_1 = __webpack_require__(648);
+class AsyncReader extends reader_1.default {
+    constructor(_root, _settings) {
+        super(_root, _settings);
+        this._settings = _settings;
+        this._scandir = fsScandir.scandir;
+        this._emitter = new events_1.EventEmitter();
+        this._queue = fastq(this._worker.bind(this), this._settings.concurrency);
+        this._isFatalError = false;
+        this._isDestroyed = false;
+        this._queue.drain = () => {
+            if (!this._isFatalError) {
+                this._emitter.emit('end');
+            }
+        };
+    }
+    read() {
+        this._isFatalError = false;
+        this._isDestroyed = false;
+        setImmediate(() => {
+            this._pushToQueue(this._root, this._settings.basePath);
+        });
+        return this._emitter;
+    }
+    destroy() {
+        if (this._isDestroyed) {
+            throw new Error('The reader is already destroyed');
+        }
+        this._isDestroyed = true;
+        this._queue.killAndDrain();
+    }
+    onEntry(callback) {
+        this._emitter.on('entry', callback);
+    }
+    onError(callback) {
+        this._emitter.once('error', callback);
+    }
+    onEnd(callback) {
+        this._emitter.once('end', callback);
+    }
+    _pushToQueue(dir, base) {
+        const queueItem = { dir, base };
+        this._queue.push(queueItem, (error) => {
+            if (error) {
+                this._handleError(error);
+            }
+        });
+    }
+    _worker(item, done) {
+        this._scandir(item.dir, this._settings.fsScandirSettings, (error, entries) => {
+            if (error) {
+                return done(error, undefined);
+            }
+            for (const entry of entries) {
+                this._handleEntry(entry, item.base);
+            }
+            done(null, undefined);
+        });
+    }
+    _handleError(error) {
+        if (!common.isFatalError(this._settings, error)) {
+            return;
+        }
+        this._isFatalError = true;
+        this._isDestroyed = true;
+        this._emitter.emit('error', error);
+    }
+    _handleEntry(entry, base) {
+        if (this._isDestroyed || this._isFatalError) {
+            return;
+        }
+        const fullpath = entry.path;
+        if (base !== undefined) {
+            entry.path = common.joinPathSegments(base, entry.name, this._settings.pathSegmentSeparator);
+        }
+        if (common.isAppliedFilter(this._settings.entryFilter, entry)) {
+            this._emitEntry(entry);
+        }
+        if (entry.dirent.isDirectory() && common.isAppliedFilter(this._settings.deepFilter, entry)) {
+            this._pushToQueue(fullpath, entry.path);
+        }
+    }
+    _emitEntry(entry) {
+        this._emitter.emit('entry', entry);
+    }
+}
+exports.default = AsyncReader;
+
+
+/***/ }),
+/* 636 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const async = __webpack_require__(637);
+const sync = __webpack_require__(642);
+const settings_1 = __webpack_require__(643);
+exports.Settings = settings_1.default;
+function scandir(path, optionsOrSettingsOrCallback, callback) {
+    if (typeof optionsOrSettingsOrCallback === 'function') {
+        return async.read(path, getSettings(), optionsOrSettingsOrCallback);
+    }
+    async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
+}
+exports.scandir = scandir;
+function scandirSync(path, optionsOrSettings) {
+    const settings = getSettings(optionsOrSettings);
+    return sync.read(path, settings);
+}
+exports.scandirSync = scandirSync;
+function getSettings(settingsOrOptions = {}) {
+    if (settingsOrOptions instanceof settings_1.default) {
+        return settingsOrOptions;
+    }
+    return new settings_1.default(settingsOrOptions);
+}
+
+
+/***/ }),
+/* 637 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fsStat = __webpack_require__(628);
+const rpl = __webpack_require__(638);
+const constants_1 = __webpack_require__(639);
+const utils = __webpack_require__(640);
+function read(dir, settings, callback) {
+    if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
+        return readdirWithFileTypes(dir, settings, callback);
+    }
+    return readdir(dir, settings, callback);
+}
+exports.read = read;
+function readdirWithFileTypes(dir, settings, callback) {
+    settings.fs.readdir(dir, { withFileTypes: true }, (readdirError, dirents) => {
+        if (readdirError) {
+            return callFailureCallback(callback, readdirError);
+        }
+        const entries = dirents.map((dirent) => ({
+            dirent,
+            name: dirent.name,
+            path: `${dir}${settings.pathSegmentSeparator}${dirent.name}`
+        }));
+        if (!settings.followSymbolicLinks) {
+            return callSuccessCallback(callback, entries);
+        }
+        const tasks = entries.map((entry) => makeRplTaskEntry(entry, settings));
+        rpl(tasks, (rplError, rplEntries) => {
+            if (rplError) {
+                return callFailureCallback(callback, rplError);
+            }
+            callSuccessCallback(callback, rplEntries);
+        });
+    });
+}
+exports.readdirWithFileTypes = readdirWithFileTypes;
+function makeRplTaskEntry(entry, settings) {
+    return (done) => {
+        if (!entry.dirent.isSymbolicLink()) {
+            return done(null, entry);
+        }
+        settings.fs.stat(entry.path, (statError, stats) => {
+            if (statError) {
+                if (settings.throwErrorOnBrokenSymbolicLink) {
+                    return done(statError);
+                }
+                return done(null, entry);
+            }
+            entry.dirent = utils.fs.createDirentFromStats(entry.name, stats);
+            return done(null, entry);
+        });
+    };
+}
+function readdir(dir, settings, callback) {
+    settings.fs.readdir(dir, (readdirError, names) => {
+        if (readdirError) {
+            return callFailureCallback(callback, readdirError);
+        }
+        const filepaths = names.map((name) => `${dir}${settings.pathSegmentSeparator}${name}`);
+        const tasks = filepaths.map((filepath) => {
+            return (done) => fsStat.stat(filepath, settings.fsStatSettings, done);
+        });
+        rpl(tasks, (rplError, results) => {
+            if (rplError) {
+                return callFailureCallback(callback, rplError);
+            }
+            const entries = [];
+            for (let index = 0; index < names.length; index++) {
+                const name = names[index];
+                const stats = results[index];
+                const entry = {
+                    name,
+                    path: filepaths[index],
+                    dirent: utils.fs.createDirentFromStats(name, stats)
+                };
+                if (settings.stats) {
+                    entry.stats = stats;
+                }
+                entries.push(entry);
+            }
+            callSuccessCallback(callback, entries);
+        });
+    });
+}
+exports.readdir = readdir;
+function callFailureCallback(callback, error) {
+    callback(error);
+}
+function callSuccessCallback(callback, result) {
+    callback(null, result);
+}
+
+
+/***/ }),
+/* 638 */
+/***/ (function(module, exports) {
+
+module.exports = runParallel
+
+function runParallel (tasks, cb) {
+  var results, pending, keys
+  var isSync = true
+
+  if (Array.isArray(tasks)) {
+    results = []
+    pending = tasks.length
+  } else {
+    keys = Object.keys(tasks)
+    results = {}
+    pending = keys.length
+  }
+
+  function done (err) {
+    function end () {
+      if (cb) cb(err, results)
+      cb = null
+    }
+    if (isSync) process.nextTick(end)
+    else end()
+  }
+
+  function each (i, err, result) {
+    results[i] = result
+    if (--pending === 0 || err) {
+      done(err)
+    }
+  }
+
+  if (!pending) {
+    // empty
+    done(null)
+  } else if (keys) {
+    // object
+    keys.forEach(function (key) {
+      tasks[key](function (err, result) { each(key, err, result) })
+    })
+  } else {
+    // array
+    tasks.forEach(function (task, i) {
+      task(function (err, result) { each(i, err, result) })
+    })
+  }
+
+  isSync = false
+}
+
+
+/***/ }),
+/* 639 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const NODE_PROCESS_VERSION_PARTS = process.versions.node.split('.');
+const MAJOR_VERSION = parseInt(NODE_PROCESS_VERSION_PARTS[0], 10);
+const MINOR_VERSION = parseInt(NODE_PROCESS_VERSION_PARTS[1], 10);
+/**
+ * IS `true` for Node.js 10.10 and greater.
+ */
+exports.IS_SUPPORT_READDIR_WITH_FILE_TYPES = MAJOR_VERSION > 10 || (MAJOR_VERSION === 10 && MINOR_VERSION >= 10);
+
+
+/***/ }),
+/* 640 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __webpack_require__(641);
+exports.fs = fs;
+
+
+/***/ }),
+/* 641 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+class DirentFromStats {
+    constructor(name, stats) {
+        this.name = name;
+        this.isBlockDevice = stats.isBlockDevice.bind(stats);
+        this.isCharacterDevice = stats.isCharacterDevice.bind(stats);
+        this.isDirectory = stats.isDirectory.bind(stats);
+        this.isFIFO = stats.isFIFO.bind(stats);
+        this.isFile = stats.isFile.bind(stats);
+        this.isSocket = stats.isSocket.bind(stats);
+        this.isSymbolicLink = stats.isSymbolicLink.bind(stats);
+    }
+}
+function createDirentFromStats(name, stats) {
+    return new DirentFromStats(name, stats);
+}
+exports.createDirentFromStats = createDirentFromStats;
+
+
+/***/ }),
+/* 642 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fsStat = __webpack_require__(628);
+const constants_1 = __webpack_require__(639);
+const utils = __webpack_require__(640);
+function read(dir, settings) {
+    if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
+        return readdirWithFileTypes(dir, settings);
+    }
+    return readdir(dir, settings);
+}
+exports.read = read;
+function readdirWithFileTypes(dir, settings) {
+    const dirents = settings.fs.readdirSync(dir, { withFileTypes: true });
+    return dirents.map((dirent) => {
+        const entry = {
+            dirent,
+            name: dirent.name,
+            path: `${dir}${settings.pathSegmentSeparator}${dirent.name}`
+        };
+        if (entry.dirent.isSymbolicLink() && settings.followSymbolicLinks) {
+            try {
+                const stats = settings.fs.statSync(entry.path);
+                entry.dirent = utils.fs.createDirentFromStats(entry.name, stats);
+            }
+            catch (error) {
+                if (settings.throwErrorOnBrokenSymbolicLink) {
+                    throw error;
+                }
+            }
+        }
+        return entry;
+    });
+}
+exports.readdirWithFileTypes = readdirWithFileTypes;
+function readdir(dir, settings) {
+    const names = settings.fs.readdirSync(dir);
+    return names.map((name) => {
+        const entryPath = `${dir}${settings.pathSegmentSeparator}${name}`;
+        const stats = fsStat.statSync(entryPath, settings.fsStatSettings);
+        const entry = {
+            name,
+            path: entryPath,
+            dirent: utils.fs.createDirentFromStats(name, stats)
+        };
+        if (settings.stats) {
+            entry.stats = stats;
+        }
+        return entry;
+    });
+}
+exports.readdir = readdir;
+
+
+/***/ }),
+/* 643 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __webpack_require__(16);
+const fsStat = __webpack_require__(628);
+const fs = __webpack_require__(644);
+class Settings {
+    constructor(_options = {}) {
+        this._options = _options;
+        this.followSymbolicLinks = this._getValue(this._options.followSymbolicLinks, false);
+        this.fs = fs.createFileSystemAdapter(this._options.fs);
+        this.pathSegmentSeparator = this._getValue(this._options.pathSegmentSeparator, path.sep);
+        this.stats = this._getValue(this._options.stats, false);
+        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, true);
+        this.fsStatSettings = new fsStat.Settings({
+            followSymbolicLink: this.followSymbolicLinks,
+            fs: this.fs,
+            throwErrorOnBrokenSymbolicLink: this.throwErrorOnBrokenSymbolicLink
+        });
+    }
+    _getValue(option, value) {
+        return option === undefined ? value : option;
+    }
+}
+exports.default = Settings;
+
+
+/***/ }),
+/* 644 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __webpack_require__(23);
+exports.FILE_SYSTEM_ADAPTER = {
+    lstat: fs.lstat,
+    stat: fs.stat,
+    lstatSync: fs.lstatSync,
+    statSync: fs.statSync,
+    readdir: fs.readdir,
+    readdirSync: fs.readdirSync
+};
+function createFileSystemAdapter(fsMethods) {
+    if (!fsMethods) {
+        return exports.FILE_SYSTEM_ADAPTER;
+    }
+    return Object.assign({}, exports.FILE_SYSTEM_ADAPTER, fsMethods);
+}
+exports.createFileSystemAdapter = createFileSystemAdapter;
+
+
+/***/ }),
+/* 645 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+
+var reusify = __webpack_require__(646)
+
+function fastqueue (context, worker, concurrency) {
+  if (typeof context === 'function') {
+    concurrency = worker
+    worker = context
+    context = null
+  }
+
+  var cache = reusify(Task)
+  var queueHead = null
+  var queueTail = null
+  var _running = 0
+
+  var self = {
+    push: push,
+    drain: noop,
+    saturated: noop,
+    pause: pause,
+    paused: false,
+    concurrency: concurrency,
+    running: running,
+    resume: resume,
+    idle: idle,
+    length: length,
+    unshift: unshift,
+    empty: noop,
+    kill: kill,
+    killAndDrain: killAndDrain
+  }
+
+  return self
+
+  function running () {
+    return _running
+  }
+
+  function pause () {
+    self.paused = true
+  }
+
+  function length () {
+    var current = queueHead
+    var counter = 0
+
+    while (current) {
+      current = current.next
+      counter++
+    }
+
+    return counter
+  }
+
+  function resume () {
+    if (!self.paused) return
+    self.paused = false
+    for (var i = 0; i < self.concurrency; i++) {
+      _running++
+      release()
+    }
+  }
+
+  function idle () {
+    return _running === 0 && self.length() === 0
+  }
+
+  function push (value, done) {
+    var current = cache.get()
+
+    current.context = context
+    current.release = release
+    current.value = value
+    current.callback = done || noop
+
+    if (_running === self.concurrency || self.paused) {
+      if (queueTail) {
+        queueTail.next = current
+        queueTail = current
+      } else {
+        queueHead = current
+        queueTail = current
+        self.saturated()
+      }
+    } else {
+      _running++
+      worker.call(context, current.value, current.worked)
+    }
+  }
+
+  function unshift (value, done) {
+    var current = cache.get()
+
+    current.context = context
+    current.release = release
+    current.value = value
+    current.callback = done || noop
+
+    if (_running === self.concurrency || self.paused) {
+      if (queueHead) {
+        current.next = queueHead
+        queueHead = current
+      } else {
+        queueHead = current
+        queueTail = current
+        self.saturated()
+      }
+    } else {
+      _running++
+      worker.call(context, current.value, current.worked)
+    }
+  }
+
+  function release (holder) {
+    if (holder) {
+      cache.release(holder)
+    }
+    var next = queueHead
+    if (next) {
+      if (!self.paused) {
+        if (queueTail === queueHead) {
+          queueTail = null
+        }
+        queueHead = next.next
+        next.next = null
+        worker.call(context, next.value, next.worked)
+        if (queueTail === null) {
+          self.empty()
+        }
+      } else {
+        _running--
+      }
+    } else if (--_running === 0) {
+      self.drain()
+    }
+  }
+
+  function kill () {
+    queueHead = null
+    queueTail = null
+    self.drain = noop
+  }
+
+  function killAndDrain () {
+    queueHead = null
+    queueTail = null
+    self.drain()
+    self.drain = noop
+  }
+}
+
+function noop () {}
+
+function Task () {
+  this.value = null
+  this.callback = noop
+  this.next = null
+  this.release = noop
+  this.context = null
+
+  var self = this
+
+  this.worked = function worked (err, result) {
+    var callback = self.callback
+    self.value = null
+    self.callback = noop
+    callback.call(self.context, err, result)
+    self.release(self)
+  }
+}
+
+module.exports = fastqueue
+
+
+/***/ }),
+/* 646 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+
+function reusify (Constructor) {
+  var head = new Constructor()
+  var tail = head
+
+  function get () {
+    var current = head
+
+    if (current.next) {
+      head = current.next
+    } else {
+      head = new Constructor()
+      tail = head
+    }
+
+    current.next = null
+
+    return current
+  }
+
+  function release (obj) {
+    tail.next = obj
+    tail = obj
+  }
+
+  return {
+    get: get,
+    release: release
+  }
+}
+
+module.exports = reusify
+
+
+/***/ }),
+/* 647 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+function isFatalError(settings, error) {
+    if (settings.errorFilter === null) {
+        return true;
+    }
+    return !settings.errorFilter(error);
+}
+exports.isFatalError = isFatalError;
+function isAppliedFilter(filter, value) {
+    return filter === null || filter(value);
+}
+exports.isAppliedFilter = isAppliedFilter;
+function replacePathSegmentSeparator(filepath, separator) {
+    return filepath.split(/[\\\/]/).join(separator);
+}
+exports.replacePathSegmentSeparator = replacePathSegmentSeparator;
+function joinPathSegments(a, b, separator) {
+    if (a === '') {
+        return b;
+    }
+    return a + separator + b;
+}
+exports.joinPathSegments = joinPathSegments;
+
+
+/***/ }),
+/* 648 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const common = __webpack_require__(647);
+class Reader {
+    constructor(_root, _settings) {
+        this._root = _root;
+        this._settings = _settings;
+        this._root = common.replacePathSegmentSeparator(_root, _settings.pathSegmentSeparator);
+    }
+}
+exports.default = Reader;
+
+
+/***/ }),
+/* 649 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = __webpack_require__(27);
+const async_1 = __webpack_require__(635);
+class StreamProvider {
+    constructor(_root, _settings) {
+        this._root = _root;
+        this._settings = _settings;
+        this._reader = new async_1.default(this._root, this._settings);
+        this._stream = new stream_1.Readable({
+            objectMode: true,
+            read: () => { },
+            destroy: this._reader.destroy.bind(this._reader)
+        });
+    }
+    read() {
+        this._reader.onError((error) => {
+            this._stream.emit('error', error);
+        });
+        this._reader.onEntry((entry) => {
+            this._stream.push(entry);
+        });
+        this._reader.onEnd(() => {
+            this._stream.push(null);
+        });
+        this._reader.read();
+        return this._stream;
+    }
+}
+exports.default = StreamProvider;
+
+
+/***/ }),
+/* 650 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const sync_1 = __webpack_require__(651);
+class SyncProvider {
+    constructor(_root, _settings) {
+        this._root = _root;
+        this._settings = _settings;
+        this._reader = new sync_1.default(this._root, this._settings);
+    }
+    read() {
+        return this._reader.read();
+    }
+}
+exports.default = SyncProvider;
+
+
+/***/ }),
+/* 651 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fsScandir = __webpack_require__(636);
+const common = __webpack_require__(647);
+const reader_1 = __webpack_require__(648);
+class SyncReader extends reader_1.default {
+    constructor() {
+        super(...arguments);
+        this._scandir = fsScandir.scandirSync;
+        this._storage = new Set();
+        this._queue = new Set();
+    }
+    read() {
+        this._pushToQueue(this._root, this._settings.basePath);
+        this._handleQueue();
+        return Array.from(this._storage);
+    }
+    _pushToQueue(dir, base) {
+        this._queue.add({ dir, base });
+    }
+    _handleQueue() {
+        for (const item of this._queue.values()) {
+            this._handleDirectory(item.dir, item.base);
+        }
+    }
+    _handleDirectory(dir, base) {
+        try {
+            const entries = this._scandir(dir, this._settings.fsScandirSettings);
+            for (const entry of entries) {
+                this._handleEntry(entry, base);
+            }
+        }
+        catch (error) {
+            this._handleError(error);
+        }
+    }
+    _handleError(error) {
+        if (!common.isFatalError(this._settings, error)) {
+            return;
+        }
+        throw error;
+    }
+    _handleEntry(entry, base) {
+        const fullpath = entry.path;
+        if (base !== undefined) {
+            entry.path = common.joinPathSegments(base, entry.name, this._settings.pathSegmentSeparator);
+        }
+        if (common.isAppliedFilter(this._settings.entryFilter, entry)) {
+            this._pushToStorage(entry);
+        }
+        if (entry.dirent.isDirectory() && common.isAppliedFilter(this._settings.deepFilter, entry)) {
+            this._pushToQueue(fullpath, entry.path);
+        }
+    }
+    _pushToStorage(entry) {
+        this._storage.add(entry);
+    }
+}
+exports.default = SyncReader;
+
+
+/***/ }),
+/* 652 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __webpack_require__(16);
+const fsScandir = __webpack_require__(636);
+class Settings {
+    constructor(_options = {}) {
+        this._options = _options;
+        this.basePath = this._getValue(this._options.basePath, undefined);
+        this.concurrency = this._getValue(this._options.concurrency, Infinity);
+        this.deepFilter = this._getValue(this._options.deepFilter, null);
+        this.entryFilter = this._getValue(this._options.entryFilter, null);
+        this.errorFilter = this._getValue(this._options.errorFilter, null);
+        this.pathSegmentSeparator = this._getValue(this._options.pathSegmentSeparator, path.sep);
+        this.fsScandirSettings = new fsScandir.Settings({
+            followSymbolicLinks: this._options.followSymbolicLinks,
+            fs: this._options.fs,
+            pathSegmentSeparator: this._options.pathSegmentSeparator,
+            stats: this._options.stats,
+            throwErrorOnBrokenSymbolicLink: this._options.throwErrorOnBrokenSymbolicLink
+        });
+    }
+    _getValue(option, value) {
+        return option === undefined ? value : option;
+    }
+}
+exports.default = Settings;
+
+
+/***/ }),
 /* 653 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-const utils = __webpack_require__(594);
+const path = __webpack_require__(16);
+const fsStat = __webpack_require__(628);
+const utils = __webpack_require__(599);
+class Reader {
+    constructor(_settings) {
+        this._settings = _settings;
+        this._fsStatSettings = new fsStat.Settings({
+            followSymbolicLink: this._settings.followSymbolicLinks,
+            fs: this._settings.fs,
+            throwErrorOnBrokenSymbolicLink: this._settings.followSymbolicLinks
+        });
+    }
+    _getFullEntryPath(filepath) {
+        return path.resolve(this._settings.cwd, filepath);
+    }
+    _makeEntry(stats, pattern) {
+        const entry = {
+            name: pattern,
+            path: pattern,
+            dirent: utils.fs.createDirentFromStats(pattern, stats)
+        };
+        if (this._settings.stats) {
+            entry.stats = stats;
+        }
+        return entry;
+    }
+    _isFatalError(error) {
+        return !utils.errno.isEnoentCodeError(error) && !this._settings.suppressErrors;
+    }
+}
+exports.default = Reader;
+
+
+/***/ }),
+/* 654 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __webpack_require__(16);
+const deep_1 = __webpack_require__(655);
+const entry_1 = __webpack_require__(656);
+const error_1 = __webpack_require__(657);
+const entry_2 = __webpack_require__(658);
+class Provider {
+    constructor(_settings) {
+        this._settings = _settings;
+        this.errorFilter = new error_1.default(this._settings);
+        this.entryFilter = new entry_1.default(this._settings, this._getMicromatchOptions());
+        this.deepFilter = new deep_1.default(this._settings, this._getMicromatchOptions());
+        this.entryTransformer = new entry_2.default(this._settings);
+    }
+    _getRootDirectory(task) {
+        return path.resolve(this._settings.cwd, task.base);
+    }
+    _getReaderOptions(task) {
+        const basePath = task.base === '.' ? '' : task.base;
+        return {
+            basePath,
+            pathSegmentSeparator: '/',
+            concurrency: this._settings.concurrency,
+            deepFilter: this.deepFilter.getFilter(basePath, task.positive, task.negative),
+            entryFilter: this.entryFilter.getFilter(task.positive, task.negative),
+            errorFilter: this.errorFilter.getFilter(),
+            followSymbolicLinks: this._settings.followSymbolicLinks,
+            fs: this._settings.fs,
+            stats: this._settings.stats,
+            throwErrorOnBrokenSymbolicLink: this._settings.throwErrorOnBrokenSymbolicLink,
+            transform: this.entryTransformer.getTransformer()
+        };
+    }
+    _getMicromatchOptions() {
+        return {
+            dot: this._settings.dot,
+            matchBase: this._settings.baseNameMatch,
+            nobrace: !this._settings.braceExpansion,
+            nocase: !this._settings.caseSensitiveMatch,
+            noext: !this._settings.extglob,
+            noglobstar: !this._settings.globstar,
+            posix: true,
+            strictSlashes: false
+        };
+    }
+}
+exports.default = Provider;
+
+
+/***/ }),
+/* 655 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __webpack_require__(599);
+class DeepFilter {
+    constructor(_settings, _micromatchOptions) {
+        this._settings = _settings;
+        this._micromatchOptions = _micromatchOptions;
+    }
+    getFilter(basePath, positive, negative) {
+        const maxPatternDepth = this._getMaxPatternDepth(positive);
+        const negativeRe = this._getNegativePatternsRe(negative);
+        return (entry) => this._filter(basePath, entry, negativeRe, maxPatternDepth);
+    }
+    _getMaxPatternDepth(patterns) {
+        const globstar = patterns.some(utils.pattern.hasGlobStar);
+        return globstar ? Infinity : utils.pattern.getMaxNaivePatternsDepth(patterns);
+    }
+    _getNegativePatternsRe(patterns) {
+        const affectDepthOfReadingPatterns = patterns.filter(utils.pattern.isAffectDepthOfReadingPattern);
+        return utils.pattern.convertPatternsToRe(affectDepthOfReadingPatterns, this._micromatchOptions);
+    }
+    _filter(basePath, entry, negativeRe, maxPatternDepth) {
+        const depth = this._getEntryDepth(basePath, entry.path);
+        if (this._isSkippedByDeep(depth)) {
+            return false;
+        }
+        if (this._isSkippedByMaxPatternDepth(depth, maxPatternDepth)) {
+            return false;
+        }
+        if (this._isSkippedSymbolicLink(entry)) {
+            return false;
+        }
+        if (this._isSkippedDotDirectory(entry)) {
+            return false;
+        }
+        return this._isSkippedByNegativePatterns(entry, negativeRe);
+    }
+    _getEntryDepth(basePath, entryPath) {
+        const basePathDepth = basePath.split('/').length;
+        const entryPathDepth = entryPath.split('/').length;
+        return entryPathDepth - (basePath === '' ? 0 : basePathDepth);
+    }
+    _isSkippedByDeep(entryDepth) {
+        return entryDepth >= this._settings.deep;
+    }
+    _isSkippedByMaxPatternDepth(entryDepth, maxPatternDepth) {
+        return !this._settings.baseNameMatch && maxPatternDepth !== Infinity && entryDepth > maxPatternDepth;
+    }
+    _isSkippedSymbolicLink(entry) {
+        return !this._settings.followSymbolicLinks && entry.dirent.isSymbolicLink();
+    }
+    _isSkippedDotDirectory(entry) {
+        return !this._settings.dot && entry.name.startsWith('.');
+    }
+    _isSkippedByNegativePatterns(entry, negativeRe) {
+        return !utils.pattern.matchAny(entry.path, negativeRe);
+    }
+}
+exports.default = DeepFilter;
+
+
+/***/ }),
+/* 656 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __webpack_require__(599);
+class EntryFilter {
+    constructor(_settings, _micromatchOptions) {
+        this._settings = _settings;
+        this._micromatchOptions = _micromatchOptions;
+        this.index = new Map();
+    }
+    getFilter(positive, negative) {
+        const positiveRe = utils.pattern.convertPatternsToRe(positive, this._micromatchOptions);
+        const negativeRe = utils.pattern.convertPatternsToRe(negative, this._micromatchOptions);
+        return (entry) => this._filter(entry, positiveRe, negativeRe);
+    }
+    _filter(entry, positiveRe, negativeRe) {
+        if (this._settings.unique) {
+            if (this._isDuplicateEntry(entry)) {
+                return false;
+            }
+            this._createIndexRecord(entry);
+        }
+        if (this._onlyFileFilter(entry) || this._onlyDirectoryFilter(entry)) {
+            return false;
+        }
+        if (this._isSkippedByAbsoluteNegativePatterns(entry, negativeRe)) {
+            return false;
+        }
+        const filepath = this._settings.baseNameMatch ? entry.name : entry.path;
+        return this._isMatchToPatterns(filepath, positiveRe) && !this._isMatchToPatterns(entry.path, negativeRe);
+    }
+    _isDuplicateEntry(entry) {
+        return this.index.has(entry.path);
+    }
+    _createIndexRecord(entry) {
+        this.index.set(entry.path, undefined);
+    }
+    _onlyFileFilter(entry) {
+        return this._settings.onlyFiles && !entry.dirent.isFile();
+    }
+    _onlyDirectoryFilter(entry) {
+        return this._settings.onlyDirectories && !entry.dirent.isDirectory();
+    }
+    _isSkippedByAbsoluteNegativePatterns(entry, negativeRe) {
+        if (!this._settings.absolute) {
+            return false;
+        }
+        const fullpath = utils.path.makeAbsolute(this._settings.cwd, entry.path);
+        return this._isMatchToPatterns(fullpath, negativeRe);
+    }
+    _isMatchToPatterns(filepath, patternsRe) {
+        return utils.pattern.matchAny(filepath, patternsRe);
+    }
+}
+exports.default = EntryFilter;
+
+
+/***/ }),
+/* 657 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __webpack_require__(599);
+class ErrorFilter {
+    constructor(_settings) {
+        this._settings = _settings;
+    }
+    getFilter() {
+        return (error) => this._isNonFatalError(error);
+    }
+    _isNonFatalError(error) {
+        return utils.errno.isEnoentCodeError(error) || this._settings.suppressErrors;
+    }
+}
+exports.default = ErrorFilter;
+
+
+/***/ }),
+/* 658 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils = __webpack_require__(599);
 class EntryTransformer {
     constructor(_settings) {
         this._settings = _settings;
@@ -75236,2515 +76839,3068 @@ exports.default = EntryTransformer;
 
 
 /***/ }),
-/* 654 */
+/* 659 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = __webpack_require__(27);
+const stream_2 = __webpack_require__(627);
+const provider_1 = __webpack_require__(654);
+class ProviderStream extends provider_1.default {
+    constructor() {
+        super(...arguments);
+        this._reader = new stream_2.default(this._settings);
+    }
+    read(task) {
+        const root = this._getRootDirectory(task);
+        const options = this._getReaderOptions(task);
+        const source = this.api(root, task, options);
+        const dest = new stream_1.Readable({ objectMode: true, read: () => { } });
+        source
+            .once('error', (error) => dest.emit('error', error))
+            .on('data', (entry) => dest.emit('data', options.transform(entry)))
+            .once('end', () => dest.emit('end'));
+        return dest;
+    }
+    api(root, task, options) {
+        if (task.dynamic) {
+            return this._reader.dynamic(root, options);
+        }
+        return this._reader.static(task.patterns, options);
+    }
+}
+exports.default = ProviderStream;
+
+
+/***/ }),
+/* 660 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const sync_1 = __webpack_require__(661);
+const provider_1 = __webpack_require__(654);
+class ProviderSync extends provider_1.default {
+    constructor() {
+        super(...arguments);
+        this._reader = new sync_1.default(this._settings);
+    }
+    read(task) {
+        const root = this._getRootDirectory(task);
+        const options = this._getReaderOptions(task);
+        const entries = this.api(root, task, options);
+        return entries.map(options.transform);
+    }
+    api(root, task, options) {
+        if (task.dynamic) {
+            return this._reader.dynamic(root, options);
+        }
+        return this._reader.static(task.patterns, options);
+    }
+}
+exports.default = ProviderSync;
+
+
+/***/ }),
+/* 661 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fsStat = __webpack_require__(628);
+const fsWalk = __webpack_require__(633);
+const reader_1 = __webpack_require__(653);
+class ReaderSync extends reader_1.default {
+    constructor() {
+        super(...arguments);
+        this._walkSync = fsWalk.walkSync;
+        this._statSync = fsStat.statSync;
+    }
+    dynamic(root, options) {
+        return this._walkSync(root, options);
+    }
+    static(patterns, options) {
+        const entries = [];
+        for (const pattern of patterns) {
+            const filepath = this._getFullEntryPath(pattern);
+            const entry = this._getEntry(filepath, pattern, options);
+            if (entry === null || !options.entryFilter(entry)) {
+                continue;
+            }
+            entries.push(entry);
+        }
+        return entries;
+    }
+    _getEntry(filepath, pattern, options) {
+        try {
+            const stats = this._getStat(filepath);
+            return this._makeEntry(stats, pattern);
+        }
+        catch (error) {
+            if (options.errorFilter(error)) {
+                return null;
+            }
+            throw error;
+        }
+    }
+    _getStat(filepath) {
+        return this._statSync(filepath, this._fsStatSettings);
+    }
+}
+exports.default = ReaderSync;
+
+
+/***/ }),
+/* 662 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __webpack_require__(23);
+const os = __webpack_require__(11);
+const CPU_COUNT = os.cpus().length;
+exports.DEFAULT_FILE_SYSTEM_ADAPTER = {
+    lstat: fs.lstat,
+    lstatSync: fs.lstatSync,
+    stat: fs.stat,
+    statSync: fs.statSync,
+    readdir: fs.readdir,
+    readdirSync: fs.readdirSync
+};
+// tslint:enable no-redundant-jsdoc
+class Settings {
+    constructor(_options = {}) {
+        this._options = _options;
+        this.absolute = this._getValue(this._options.absolute, false);
+        this.baseNameMatch = this._getValue(this._options.baseNameMatch, false);
+        this.braceExpansion = this._getValue(this._options.braceExpansion, true);
+        this.caseSensitiveMatch = this._getValue(this._options.caseSensitiveMatch, true);
+        this.concurrency = this._getValue(this._options.concurrency, CPU_COUNT);
+        this.cwd = this._getValue(this._options.cwd, process.cwd());
+        this.deep = this._getValue(this._options.deep, Infinity);
+        this.dot = this._getValue(this._options.dot, false);
+        this.extglob = this._getValue(this._options.extglob, true);
+        this.followSymbolicLinks = this._getValue(this._options.followSymbolicLinks, true);
+        this.fs = this._getFileSystemMethods(this._options.fs);
+        this.globstar = this._getValue(this._options.globstar, true);
+        this.ignore = this._getValue(this._options.ignore, []);
+        this.markDirectories = this._getValue(this._options.markDirectories, false);
+        this.objectMode = this._getValue(this._options.objectMode, false);
+        this.onlyDirectories = this._getValue(this._options.onlyDirectories, false);
+        this.onlyFiles = this._getValue(this._options.onlyFiles, true);
+        this.stats = this._getValue(this._options.stats, false);
+        this.suppressErrors = this._getValue(this._options.suppressErrors, false);
+        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, false);
+        this.unique = this._getValue(this._options.unique, true);
+        if (this.onlyDirectories) {
+            this.onlyFiles = false;
+        }
+        if (this.stats) {
+            this.objectMode = true;
+        }
+    }
+    _getValue(option, value) {
+        return option === undefined ? value : option;
+    }
+    _getFileSystemMethods(methods = {}) {
+        return Object.assign({}, exports.DEFAULT_FILE_SYSTEM_ADAPTER, methods);
+    }
+}
+exports.default = Settings;
+
+
+/***/ }),
+/* 663 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+const path = __webpack_require__(16);
+const pathType = __webpack_require__(664);
+
+const getExtensions = extensions => extensions.length > 1 ? `{${extensions.join(',')}}` : extensions[0];
+
+const getPath = (filepath, cwd) => {
+	const pth = filepath[0] === '!' ? filepath.slice(1) : filepath;
+	return path.isAbsolute(pth) ? pth : path.join(cwd, pth);
+};
+
+const addExtensions = (file, extensions) => {
+	if (path.extname(file)) {
+		return `**/${file}`;
+	}
+
+	return `**/${file}.${getExtensions(extensions)}`;
+};
+
+const getGlob = (directory, options) => {
+	if (options.files && !Array.isArray(options.files)) {
+		throw new TypeError(`Expected \`files\` to be of type \`Array\` but received type \`${typeof options.files}\``);
+	}
+
+	if (options.extensions && !Array.isArray(options.extensions)) {
+		throw new TypeError(`Expected \`extensions\` to be of type \`Array\` but received type \`${typeof options.extensions}\``);
+	}
+
+	if (options.files && options.extensions) {
+		return options.files.map(x => path.posix.join(directory, addExtensions(x, options.extensions)));
+	}
+
+	if (options.files) {
+		return options.files.map(x => path.posix.join(directory, `**/${x}`));
+	}
+
+	if (options.extensions) {
+		return [path.posix.join(directory, `**/*.${getExtensions(options.extensions)}`)];
+	}
+
+	return [path.posix.join(directory, '**')];
+};
+
+module.exports = async (input, options) => {
+	options = {
+		cwd: process.cwd(),
+		...options
+	};
+
+	if (typeof options.cwd !== 'string') {
+		throw new TypeError(`Expected \`cwd\` to be of type \`string\` but received type \`${typeof options.cwd}\``);
+	}
+
+	const globs = await Promise.all([].concat(input).map(async x => {
+		const isDirectory = await pathType.isDirectory(getPath(x, options.cwd));
+		return isDirectory ? getGlob(x, options) : x;
+	}));
+
+	return [].concat.apply([], globs); // eslint-disable-line prefer-spread
+};
+
+module.exports.sync = (input, options) => {
+	options = {
+		cwd: process.cwd(),
+		...options
+	};
+
+	if (typeof options.cwd !== 'string') {
+		throw new TypeError(`Expected \`cwd\` to be of type \`string\` but received type \`${typeof options.cwd}\``);
+	}
+
+	const globs = [].concat(input).map(x => pathType.isDirectorySync(getPath(x, options.cwd)) ? getGlob(x, options) : x);
+
+	return [].concat.apply([], globs); // eslint-disable-line prefer-spread
+};
+
+
+/***/ }),
+/* 664 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+const {promisify} = __webpack_require__(29);
+const fs = __webpack_require__(23);
+
+async function isType(fsStatType, statsMethodName, filePath) {
+	if (typeof filePath !== 'string') {
+		throw new TypeError(`Expected a string, got ${typeof filePath}`);
+	}
+
+	try {
+		const stats = await promisify(fs[fsStatType])(filePath);
+		return stats[statsMethodName]();
+	} catch (error) {
+		if (error.code === 'ENOENT') {
+			return false;
+		}
+
+		throw error;
+	}
+}
+
+function isTypeSync(fsStatType, statsMethodName, filePath) {
+	if (typeof filePath !== 'string') {
+		throw new TypeError(`Expected a string, got ${typeof filePath}`);
+	}
+
+	try {
+		return fs[fsStatType](filePath)[statsMethodName]();
+	} catch (error) {
+		if (error.code === 'ENOENT') {
+			return false;
+		}
+
+		throw error;
+	}
+}
+
+exports.isFile = isType.bind(null, 'stat', 'isFile');
+exports.isDirectory = isType.bind(null, 'stat', 'isDirectory');
+exports.isSymlink = isType.bind(null, 'lstat', 'isSymbolicLink');
+exports.isFileSync = isTypeSync.bind(null, 'statSync', 'isFile');
+exports.isDirectorySync = isTypeSync.bind(null, 'statSync', 'isDirectory');
+exports.isSymlinkSync = isTypeSync.bind(null, 'lstatSync', 'isSymbolicLink');
+
+
+/***/ }),
+/* 665 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const stream_1 = __webpack_require__(27);
-const stream_2 = __webpack_require__(622);
-const provider_1 = __webpack_require__(649);
-class ProviderStream extends provider_1.default {
-    constructor() {
-        super(...arguments);
-        this._reader = new stream_2.default(this._settings);
-    }
-    read(task) {
-        const root = this._getRootDirectory(task);
-        const options = this._getReaderOptions(task);
-        const source = this.api(root, task, options);
-        const dest = new stream_1.Readable({ objectMode: true, read: () => { } });
-        source
-            .once('error', (error) => dest.emit('error', error))
-            .on('data', (entry) => dest.emit('data', options.transform(entry)))
-            .once('end', () => dest.emit('end'));
-        return dest;
-    }
-    api(root, task, options) {
-        if (task.dynamic) {
-            return this._reader.dynamic(root, options);
-        }
-        return this._reader.static(task.patterns, options);
-    }
-}
-exports.default = ProviderStream;
+
+const {promisify} = __webpack_require__(29);
+const fs = __webpack_require__(23);
+const path = __webpack_require__(16);
+const fastGlob = __webpack_require__(597);
+const gitIgnore = __webpack_require__(666);
+const slash = __webpack_require__(667);
+
+const DEFAULT_IGNORE = [
+	'**/node_modules/**',
+	'**/flow-typed/**',
+	'**/coverage/**',
+	'**/.git'
+];
+
+const readFileP = promisify(fs.readFile);
+
+const mapGitIgnorePatternTo = base => ignore => {
+	if (ignore.startsWith('!')) {
+		return '!' + path.posix.join(base, ignore.slice(1));
+	}
+
+	return path.posix.join(base, ignore);
+};
+
+const parseGitIgnore = (content, options) => {
+	const base = slash(path.relative(options.cwd, path.dirname(options.fileName)));
+
+	return content
+		.split(/\r?\n/)
+		.filter(Boolean)
+		.filter(line => !line.startsWith('#'))
+		.map(mapGitIgnorePatternTo(base));
+};
+
+const reduceIgnore = files => {
+	return files.reduce((ignores, file) => {
+		ignores.add(parseGitIgnore(file.content, {
+			cwd: file.cwd,
+			fileName: file.filePath
+		}));
+		return ignores;
+	}, gitIgnore());
+};
+
+const ensureAbsolutePathForCwd = (cwd, p) => {
+	if (path.isAbsolute(p)) {
+		if (p.startsWith(cwd)) {
+			return p;
+		}
+
+		throw new Error(`Path ${p} is not in cwd ${cwd}`);
+	}
+
+	return path.join(cwd, p);
+};
+
+const getIsIgnoredPredecate = (ignores, cwd) => {
+	return p => ignores.ignores(slash(path.relative(cwd, ensureAbsolutePathForCwd(cwd, p))));
+};
+
+const getFile = async (file, cwd) => {
+	const filePath = path.join(cwd, file);
+	const content = await readFileP(filePath, 'utf8');
+
+	return {
+		cwd,
+		filePath,
+		content
+	};
+};
+
+const getFileSync = (file, cwd) => {
+	const filePath = path.join(cwd, file);
+	const content = fs.readFileSync(filePath, 'utf8');
+
+	return {
+		cwd,
+		filePath,
+		content
+	};
+};
+
+const normalizeOptions = ({
+	ignore = [],
+	cwd = process.cwd()
+} = {}) => {
+	return {ignore, cwd};
+};
+
+module.exports = async options => {
+	options = normalizeOptions(options);
+
+	const paths = await fastGlob('**/.gitignore', {
+		ignore: DEFAULT_IGNORE.concat(options.ignore),
+		cwd: options.cwd
+	});
+
+	const files = await Promise.all(paths.map(file => getFile(file, options.cwd)));
+	const ignores = reduceIgnore(files);
+
+	return getIsIgnoredPredecate(ignores, options.cwd);
+};
+
+module.exports.sync = options => {
+	options = normalizeOptions(options);
+
+	const paths = fastGlob.sync('**/.gitignore', {
+		ignore: DEFAULT_IGNORE.concat(options.ignore),
+		cwd: options.cwd
+	});
+
+	const files = paths.map(file => getFileSync(file, options.cwd));
+	const ignores = reduceIgnore(files);
+
+	return getIsIgnoredPredecate(ignores, options.cwd);
+};
 
 
 /***/ }),
-/* 655 */
-/***/ (function(module, exports, __webpack_require__) {
+/* 666 */
+/***/ (function(module, exports) {
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const sync_1 = __webpack_require__(656);
-const provider_1 = __webpack_require__(649);
-class ProviderSync extends provider_1.default {
-    constructor() {
-        super(...arguments);
-        this._reader = new sync_1.default(this._settings);
-    }
-    read(task) {
-        const root = this._getRootDirectory(task);
-        const options = this._getReaderOptions(task);
-        const entries = this.api(root, task, options);
-        return entries.map(options.transform);
-    }
-    api(root, task, options) {
-        if (task.dynamic) {
-            return this._reader.dynamic(root, options);
-        }
-        return this._reader.static(task.patterns, options);
-    }
-}
-exports.default = ProviderSync;
+// A simple implementation of make-array
+function makeArray (subject) {
+  return Array.isArray(subject)
+    ? subject
+    : [subject]
+}
+
+const REGEX_TEST_BLANK_LINE = /^\s+$/
+const REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/
+const REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/
+const REGEX_SPLITALL_CRLF = /\r?\n/g
+// /foo,
+// ./foo,
+// ../foo,
+// .
+// ..
+const REGEX_TEST_INVALID_PATH = /^\.*\/|^\.+$/
+
+const SLASH = '/'
+const KEY_IGNORE = typeof Symbol !== 'undefined'
+  ? Symbol.for('node-ignore')
+  /* istanbul ignore next */
+  : 'node-ignore'
+
+const define = (object, key, value) =>
+  Object.defineProperty(object, key, {value})
+
+const REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g
+
+// Sanitize the range of a regular expression
+// The cases are complicated, see test cases for details
+const sanitizeRange = range => range.replace(
+  REGEX_REGEXP_RANGE,
+  (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0)
+    ? match
+    // Invalid range (out of order) which is ok for gitignore rules but
+    //   fatal for JavaScript regular expression, so eliminate it.
+    : ''
+)
+
+// > If the pattern ends with a slash,
+// > it is removed for the purpose of the following description,
+// > but it would only find a match with a directory.
+// > In other words, foo/ will match a directory foo and paths underneath it,
+// > but will not match a regular file or a symbolic link foo
+// >  (this is consistent with the way how pathspec works in general in Git).
+// '`foo/`' will not match regular file '`foo`' or symbolic link '`foo`'
+// -> ignore-rules will not deal with it, because it costs extra `fs.stat` call
+//      you could use option `mark: true` with `glob`
+
+// '`foo/`' should not continue with the '`..`'
+const DEFAULT_REPLACER_PREFIX = [
+
+  // > Trailing spaces are ignored unless they are quoted with backslash ("\")
+  [
+    // (a\ ) -> (a )
+    // (a  ) -> (a)
+    // (a \ ) -> (a  )
+    /\\?\s+$/,
+    match => match.indexOf('\\') === 0
+      ? ' '
+      : ''
+  ],
+
+  // replace (\ ) with ' '
+  [
+    /\\\s/g,
+    () => ' '
+  ],
+
+  // Escape metacharacters
+  // which is written down by users but means special for regular expressions.
+
+  // > There are 12 characters with special meanings:
+  // > - the backslash \,
+  // > - the caret ^,
+  // > - the dollar sign $,
+  // > - the period or dot .,
+  // > - the vertical bar or pipe symbol |,
+  // > - the question mark ?,
+  // > - the asterisk or star *,
+  // > - the plus sign +,
+  // > - the opening parenthesis (,
+  // > - the closing parenthesis ),
+  // > - and the opening square bracket [,
+  // > - the opening curly brace {,
+  // > These special characters are often called "metacharacters".
+  [
+    /[\\^$.|*+(){]/g,
+    match => `\\${match}`
+  ],
+
+  [
+    // > [abc] matches any character inside the brackets
+    // >    (in this case a, b, or c);
+    /\[([^\]/]*)($|\])/g,
+    (match, p1, p2) => p2 === ']'
+      ? `[${sanitizeRange(p1)}]`
+      : `\\${match}`
+  ],
+
+  [
+    // > a question mark (?) matches a single character
+    /(?!\\)\?/g,
+    () => '[^/]'
+  ],
+
+  // leading slash
+  [
+
+    // > A leading slash matches the beginning of the pathname.
+    // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+    // A leading slash matches the beginning of the pathname
+    /^\//,
+    () => '^'
+  ],
+
+  // replace special metacharacter slash after the leading slash
+  [
+    /\//g,
+    () => '\\/'
+  ],
+
+  [
+    // > A leading "**" followed by a slash means match in all directories.
+    // > For example, "**/foo" matches file or directory "foo" anywhere,
+    // > the same as pattern "foo".
+    // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+    // >   under directory "foo".
+    // Notice that the '*'s have been replaced as '\\*'
+    /^\^*\\\*\\\*\\\//,
+
+    // '**/foo' <-> 'foo'
+    () => '^(?:.*\\/)?'
+  ]
+]
+
+const DEFAULT_REPLACER_SUFFIX = [
+  // starting
+  [
+    // there will be no leading '/'
+    //   (which has been replaced by section "leading slash")
+    // If starts with '**', adding a '^' to the regular expression also works
+    /^(?=[^^])/,
+    function startingReplacer () {
+      return !/\/(?!$)/.test(this)
+        // > If the pattern does not contain a slash /,
+        // >   Git treats it as a shell glob pattern
+        // Actually, if there is only a trailing slash,
+        //   git also treats it as a shell glob pattern
+        ? '(?:^|\\/)'
+
+        // > Otherwise, Git treats the pattern as a shell glob suitable for
+        // >   consumption by fnmatch(3)
+        : '^'
+    }
+  ],
+
+  // two globstars
+  [
+    // Use lookahead assertions so that we could match more than one `'/**'`
+    /\\\/\\\*\\\*(?=\\\/|$)/g,
+
+    // Zero, one or several directories
+    // should not use '*', or it will be replaced by the next replacer
+
+    // Check if it is not the last `'/**'`
+    (_, index, str) => index + 6 < str.length
+
+      // case: /**/
+      // > A slash followed by two consecutive asterisks then a slash matches
+      // >   zero or more directories.
+      // > For example, "a/**/b" matches "a/b", "a/x/b", "a/x/y/b" and so on.
+      // '/**/'
+      ? '(?:\\/[^\\/]+)*'
+
+      // case: /**
+      // > A trailing `"/**"` matches everything inside.
+
+      // #21: everything inside but it should not include the current folder
+      : '\\/.+'
+  ],
+
+  // intermediate wildcards
+  [
+    // Never replace escaped '*'
+    // ignore rule '\*' will match the path '*'
+
+    // 'abc.*/' -> go
+    // 'abc.*'  -> skip this rule
+    /(^|[^\\]+)\\\*(?=.+)/g,
+
+    // '*.js' matches '.js'
+    // '*.js' doesn't match 'abc'
+    (_, p1) => `${p1}[^\\/]*`
+  ],
+
+  // trailing wildcard
+  [
+    /(\^|\\\/)?\\\*$/,
+    (_, p1) => {
+      const prefix = p1
+        // '\^':
+        // '/*' does not match ''
+        // '/*' does not match everything
+
+        // '\\\/':
+        // 'abc/*' does not match 'abc/'
+        ? `${p1}[^/]+`
+
+        // 'a*' matches 'a'
+        // 'a*' matches 'aa'
+        : '[^/]*'
+
+      return `${prefix}(?=$|\\/$)`
+    }
+  ],
+
+  [
+    // unescape
+    /\\\\\\/g,
+    () => '\\'
+  ]
+]
+
+const POSITIVE_REPLACERS = [
+  ...DEFAULT_REPLACER_PREFIX,
+
+  // 'f'
+  // matches
+  // - /f(end)
+  // - /f/
+  // - (start)f(end)
+  // - (start)f/
+  // doesn't match
+  // - oof
+  // - foo
+  // pseudo:
+  // -> (^|/)f(/|$)
+
+  // ending
+  [
+    // 'js' will not match 'js.'
+    // 'ab' will not match 'abc'
+    /(?:[^*/])$/,
+
+    // 'js*' will not match 'a.js'
+    // 'js/' will not match 'a.js'
+    // 'js' will match 'a.js' and 'a.js/'
+    match => `${match}(?=$|\\/)`
+  ],
+
+  ...DEFAULT_REPLACER_SUFFIX
+]
+
+const NEGATIVE_REPLACERS = [
+  ...DEFAULT_REPLACER_PREFIX,
+
+  // #24, #38
+  // The MISSING rule of [gitignore docs](https://git-scm.com/docs/gitignore)
+  // A negative pattern without a trailing wildcard should not
+  // re-include the things inside that directory.
+
+  // eg:
+  // ['node_modules/*', '!node_modules']
+  // should ignore `node_modules/a.js`
+  [
+    /(?:[^*])$/,
+    match => `${match}(?=$|\\/$)`
+  ],
+
+  ...DEFAULT_REPLACER_SUFFIX
+]
+
+// A simple cache, because an ignore rule only has only one certain meaning
+const regexCache = Object.create(null)
+
+// @param {pattern}
+const makeRegex = (pattern, negative, ignorecase) => {
+  const r = regexCache[pattern]
+  if (r) {
+    return r
+  }
+
+  const replacers = negative
+    ? NEGATIVE_REPLACERS
+    : POSITIVE_REPLACERS
+
+  const source = replacers.reduce(
+    (prev, current) => prev.replace(current[0], current[1].bind(pattern)),
+    pattern
+  )
+
+  return regexCache[pattern] = ignorecase
+    ? new RegExp(source, 'i')
+    : new RegExp(source)
+}
+
+const isString = subject => typeof subject === 'string'
+
+// > A blank line matches no files, so it can serve as a separator for readability.
+const checkPattern = pattern => pattern
+  && isString(pattern)
+  && !REGEX_TEST_BLANK_LINE.test(pattern)
+
+  // > A line starting with # serves as a comment.
+  && pattern.indexOf('#') !== 0
+
+const splitPattern = pattern => pattern.split(REGEX_SPLITALL_CRLF)
+
+class IgnoreRule {
+  constructor (
+    origin,
+    pattern,
+    negative,
+    regex
+  ) {
+    this.origin = origin
+    this.pattern = pattern
+    this.negative = negative
+    this.regex = regex
+  }
+}
+
+const createRule = (pattern, ignorecase) => {
+  const origin = pattern
+  let negative = false
+
+  // > An optional prefix "!" which negates the pattern;
+  if (pattern.indexOf('!') === 0) {
+    negative = true
+    pattern = pattern.substr(1)
+  }
 
+  pattern = pattern
+  // > Put a backslash ("\") in front of the first "!" for patterns that
+  // >   begin with a literal "!", for example, `"\!important!.txt"`.
+  .replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, '!')
+  // > Put a backslash ("\") in front of the first hash for patterns that
+  // >   begin with a hash.
+  .replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, '#')
 
-/***/ }),
-/* 656 */
-/***/ (function(module, exports, __webpack_require__) {
+  const regex = makeRegex(pattern, negative, ignorecase)
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fsStat = __webpack_require__(623);
-const fsWalk = __webpack_require__(628);
-const reader_1 = __webpack_require__(648);
-class ReaderSync extends reader_1.default {
-    constructor() {
-        super(...arguments);
-        this._walkSync = fsWalk.walkSync;
-        this._statSync = fsStat.statSync;
-    }
-    dynamic(root, options) {
-        return this._walkSync(root, options);
-    }
-    static(patterns, options) {
-        const entries = [];
-        for (const pattern of patterns) {
-            const filepath = this._getFullEntryPath(pattern);
-            const entry = this._getEntry(filepath, pattern, options);
-            if (entry === null || !options.entryFilter(entry)) {
-                continue;
-            }
-            entries.push(entry);
-        }
-        return entries;
-    }
-    _getEntry(filepath, pattern, options) {
-        try {
-            const stats = this._getStat(filepath);
-            return this._makeEntry(stats, pattern);
-        }
-        catch (error) {
-            if (options.errorFilter(error)) {
-                return null;
-            }
-            throw error;
-        }
-    }
-    _getStat(filepath) {
-        return this._statSync(filepath, this._fsStatSettings);
-    }
-}
-exports.default = ReaderSync;
+  return new IgnoreRule(
+    origin,
+    pattern,
+    negative,
+    regex
+  )
+}
 
+const throwError = (message, Ctor) => {
+  throw new Ctor(message)
+}
 
-/***/ }),
-/* 657 */
-/***/ (function(module, exports, __webpack_require__) {
+const checkPath = (path, originalPath, doThrow) => {
+  if (!isString(path)) {
+    return doThrow(
+      `path must be a string, but got \`${originalPath}\``,
+      TypeError
+    )
+  }
 
-"use strict";
-
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __webpack_require__(23);
-const os = __webpack_require__(11);
-const CPU_COUNT = os.cpus().length;
-exports.DEFAULT_FILE_SYSTEM_ADAPTER = {
-    lstat: fs.lstat,
-    lstatSync: fs.lstatSync,
-    stat: fs.stat,
-    statSync: fs.statSync,
-    readdir: fs.readdir,
-    readdirSync: fs.readdirSync
-};
-// tslint:enable no-redundant-jsdoc
-class Settings {
-    constructor(_options = {}) {
-        this._options = _options;
-        this.absolute = this._getValue(this._options.absolute, false);
-        this.baseNameMatch = this._getValue(this._options.baseNameMatch, false);
-        this.braceExpansion = this._getValue(this._options.braceExpansion, true);
-        this.caseSensitiveMatch = this._getValue(this._options.caseSensitiveMatch, true);
-        this.concurrency = this._getValue(this._options.concurrency, CPU_COUNT);
-        this.cwd = this._getValue(this._options.cwd, process.cwd());
-        this.deep = this._getValue(this._options.deep, Infinity);
-        this.dot = this._getValue(this._options.dot, false);
-        this.extglob = this._getValue(this._options.extglob, true);
-        this.followSymbolicLinks = this._getValue(this._options.followSymbolicLinks, true);
-        this.fs = this._getFileSystemMethods(this._options.fs);
-        this.globstar = this._getValue(this._options.globstar, true);
-        this.ignore = this._getValue(this._options.ignore, []);
-        this.markDirectories = this._getValue(this._options.markDirectories, false);
-        this.objectMode = this._getValue(this._options.objectMode, false);
-        this.onlyDirectories = this._getValue(this._options.onlyDirectories, false);
-        this.onlyFiles = this._getValue(this._options.onlyFiles, true);
-        this.stats = this._getValue(this._options.stats, false);
-        this.suppressErrors = this._getValue(this._options.suppressErrors, false);
-        this.throwErrorOnBrokenSymbolicLink = this._getValue(this._options.throwErrorOnBrokenSymbolicLink, false);
-        this.unique = this._getValue(this._options.unique, true);
-        if (this.onlyDirectories) {
-            this.onlyFiles = false;
-        }
-        if (this.stats) {
-            this.objectMode = true;
-        }
-    }
-    _getValue(option, value) {
-        return option === undefined ? value : option;
-    }
-    _getFileSystemMethods(methods = {}) {
-        return Object.assign({}, exports.DEFAULT_FILE_SYSTEM_ADAPTER, methods);
-    }
-}
-exports.default = Settings;
+  // We don't know if we should ignore '', so throw
+  if (!path) {
+    return doThrow(`path must not be empty`, TypeError)
+  }
 
+  // Check if it is a relative path
+  if (checkPath.isNotRelative(path)) {
+    const r = '`path.relative()`d'
+    return doThrow(
+      `path should be a ${r} string, but got "${originalPath}"`,
+      RangeError
+    )
+  }
 
-/***/ }),
-/* 658 */
-/***/ (function(module, exports, __webpack_require__) {
+  return true
+}
 
-"use strict";
+const isNotRelative = path => REGEX_TEST_INVALID_PATH.test(path)
 
-const path = __webpack_require__(16);
-const pathType = __webpack_require__(659);
+checkPath.isNotRelative = isNotRelative
+checkPath.convert = p => p
 
-const getExtensions = extensions => extensions.length > 1 ? `{${extensions.join(',')}}` : extensions[0];
+class Ignore {
+  constructor ({
+    ignorecase = true
+  } = {}) {
+    this._rules = []
+    this._ignorecase = ignorecase
+    define(this, KEY_IGNORE, true)
+    this._initCache()
+  }
 
-const getPath = (filepath, cwd) => {
-	const pth = filepath[0] === '!' ? filepath.slice(1) : filepath;
-	return path.isAbsolute(pth) ? pth : path.join(cwd, pth);
-};
+  _initCache () {
+    this._ignoreCache = Object.create(null)
+    this._testCache = Object.create(null)
+  }
 
-const addExtensions = (file, extensions) => {
-	if (path.extname(file)) {
-		return `**/${file}`;
-	}
+  _addPattern (pattern) {
+    // #32
+    if (pattern && pattern[KEY_IGNORE]) {
+      this._rules = this._rules.concat(pattern._rules)
+      this._added = true
+      return
+    }
 
-	return `**/${file}.${getExtensions(extensions)}`;
-};
+    if (checkPattern(pattern)) {
+      const rule = createRule(pattern, this._ignorecase)
+      this._added = true
+      this._rules.push(rule)
+    }
+  }
 
-const getGlob = (directory, options) => {
-	if (options.files && !Array.isArray(options.files)) {
-		throw new TypeError(`Expected \`files\` to be of type \`Array\` but received type \`${typeof options.files}\``);
-	}
+  // @param {Array<string> | string | Ignore} pattern
+  add (pattern) {
+    this._added = false
 
-	if (options.extensions && !Array.isArray(options.extensions)) {
-		throw new TypeError(`Expected \`extensions\` to be of type \`Array\` but received type \`${typeof options.extensions}\``);
-	}
+    makeArray(
+      isString(pattern)
+        ? splitPattern(pattern)
+        : pattern
+    ).forEach(this._addPattern, this)
 
-	if (options.files && options.extensions) {
-		return options.files.map(x => path.posix.join(directory, addExtensions(x, options.extensions)));
-	}
+    // Some rules have just added to the ignore,
+    // making the behavior changed.
+    if (this._added) {
+      this._initCache()
+    }
 
-	if (options.files) {
-		return options.files.map(x => path.posix.join(directory, `**/${x}`));
-	}
+    return this
+  }
 
-	if (options.extensions) {
-		return [path.posix.join(directory, `**/*.${getExtensions(options.extensions)}`)];
-	}
+  // legacy
+  addPattern (pattern) {
+    return this.add(pattern)
+  }
 
-	return [path.posix.join(directory, '**')];
-};
+  //          |           ignored : unignored
+  // negative |   0:0   |   0:1   |   1:0   |   1:1
+  // -------- | ------- | ------- | ------- | --------
+  //     0    |  TEST   |  TEST   |  SKIP   |    X
+  //     1    |  TESTIF |  SKIP   |  TEST   |    X
 
-module.exports = async (input, options) => {
-	options = {
-		cwd: process.cwd(),
-		...options
-	};
+  // - SKIP: always skip
+  // - TEST: always test
+  // - TESTIF: only test if checkUnignored
+  // - X: that never happen
 
-	if (typeof options.cwd !== 'string') {
-		throw new TypeError(`Expected \`cwd\` to be of type \`string\` but received type \`${typeof options.cwd}\``);
-	}
+  // @param {boolean} whether should check if the path is unignored,
+  //   setting `checkUnignored` to `false` could reduce additional
+  //   path matching.
 
-	const globs = await Promise.all([].concat(input).map(async x => {
-		const isDirectory = await pathType.isDirectory(getPath(x, options.cwd));
-		return isDirectory ? getGlob(x, options) : x;
-	}));
+  // @returns {TestResult} true if a file is ignored
+  _testOne (path, checkUnignored) {
+    let ignored = false
+    let unignored = false
 
-	return [].concat.apply([], globs); // eslint-disable-line prefer-spread
-};
+    this._rules.forEach(rule => {
+      const {negative} = rule
+      if (
+        unignored === negative && ignored !== unignored
+        || negative && !ignored && !unignored && !checkUnignored
+      ) {
+        return
+      }
 
-module.exports.sync = (input, options) => {
-	options = {
-		cwd: process.cwd(),
-		...options
-	};
+      const matched = rule.regex.test(path)
 
-	if (typeof options.cwd !== 'string') {
-		throw new TypeError(`Expected \`cwd\` to be of type \`string\` but received type \`${typeof options.cwd}\``);
-	}
+      if (matched) {
+        ignored = !negative
+        unignored = negative
+      }
+    })
 
-	const globs = [].concat(input).map(x => pathType.isDirectorySync(getPath(x, options.cwd)) ? getGlob(x, options) : x);
+    return {
+      ignored,
+      unignored
+    }
+  }
 
-	return [].concat.apply([], globs); // eslint-disable-line prefer-spread
-};
+  // @returns {TestResult}
+  _test (originalPath, cache, checkUnignored, slices) {
+    const path = originalPath
+      // Supports nullable path
+      && checkPath.convert(originalPath)
 
+    checkPath(path, originalPath, throwError)
 
-/***/ }),
-/* 659 */
-/***/ (function(module, exports, __webpack_require__) {
+    return this._t(path, cache, checkUnignored, slices)
+  }
 
-"use strict";
+  _t (path, cache, checkUnignored, slices) {
+    if (path in cache) {
+      return cache[path]
+    }
 
-const {promisify} = __webpack_require__(29);
-const fs = __webpack_require__(23);
+    if (!slices) {
+      // path/to/a.js
+      // ['path', 'to', 'a.js']
+      slices = path.split(SLASH)
+    }
 
-async function isType(fsStatType, statsMethodName, filePath) {
-	if (typeof filePath !== 'string') {
-		throw new TypeError(`Expected a string, got ${typeof filePath}`);
-	}
+    slices.pop()
 
-	try {
-		const stats = await promisify(fs[fsStatType])(filePath);
-		return stats[statsMethodName]();
-	} catch (error) {
-		if (error.code === 'ENOENT') {
-			return false;
-		}
+    // If the path has no parent directory, just test it
+    if (!slices.length) {
+      return cache[path] = this._testOne(path, checkUnignored)
+    }
 
-		throw error;
-	}
-}
+    const parent = this._t(
+      slices.join(SLASH) + SLASH,
+      cache,
+      checkUnignored,
+      slices
+    )
 
-function isTypeSync(fsStatType, statsMethodName, filePath) {
-	if (typeof filePath !== 'string') {
-		throw new TypeError(`Expected a string, got ${typeof filePath}`);
-	}
+    // If the path contains a parent directory, check the parent first
+    return cache[path] = parent.ignored
+      // > It is not possible to re-include a file if a parent directory of
+      // >   that file is excluded.
+      ? parent
+      : this._testOne(path, checkUnignored)
+  }
 
-	try {
-		return fs[fsStatType](filePath)[statsMethodName]();
-	} catch (error) {
-		if (error.code === 'ENOENT') {
-			return false;
-		}
+  ignores (path) {
+    return this._test(path, this._ignoreCache, false).ignored
+  }
 
-		throw error;
-	}
+  createFilter () {
+    return path => !this.ignores(path)
+  }
+
+  filter (paths) {
+    return makeArray(paths).filter(this.createFilter())
+  }
+
+  // @returns {TestResult}
+  test (path) {
+    return this._test(path, this._testCache, true)
+  }
 }
 
-exports.isFile = isType.bind(null, 'stat', 'isFile');
-exports.isDirectory = isType.bind(null, 'stat', 'isDirectory');
-exports.isSymlink = isType.bind(null, 'lstat', 'isSymbolicLink');
-exports.isFileSync = isTypeSync.bind(null, 'statSync', 'isFile');
-exports.isDirectorySync = isTypeSync.bind(null, 'statSync', 'isDirectory');
-exports.isSymlinkSync = isTypeSync.bind(null, 'lstatSync', 'isSymbolicLink');
+const factory = options => new Ignore(options)
 
+const returnFalse = () => false
 
-/***/ }),
-/* 660 */
-/***/ (function(module, exports, __webpack_require__) {
+const isPathValid = path =>
+  checkPath(path && checkPath.convert(path), path, returnFalse)
 
-"use strict";
+factory.isPathValid = isPathValid
 
-const {promisify} = __webpack_require__(29);
-const fs = __webpack_require__(23);
-const path = __webpack_require__(16);
-const fastGlob = __webpack_require__(592);
-const gitIgnore = __webpack_require__(661);
-const slash = __webpack_require__(662);
+// Fixes typescript
+factory.default = factory
 
-const DEFAULT_IGNORE = [
-	'**/node_modules/**',
-	'**/flow-typed/**',
-	'**/coverage/**',
-	'**/.git'
-];
+module.exports = factory
 
-const readFileP = promisify(fs.readFile);
+// Windows
+// --------------------------------------------------------------
+/* istanbul ignore if  */
+if (
+  // Detect `process` so that it can run in browsers.
+  typeof process !== 'undefined'
+  && (
+    process.env && process.env.IGNORE_TEST_WIN32
+    || process.platform === 'win32'
+  )
+) {
+  /* eslint no-control-regex: "off" */
+  const makePosix = str => /^\\\\\?\\/.test(str)
+  || /["<>|\u0000-\u001F]+/u.test(str)
+    ? str
+    : str.replace(/\\/g, '/')
 
-const mapGitIgnorePatternTo = base => ignore => {
-	if (ignore.startsWith('!')) {
-		return '!' + path.posix.join(base, ignore.slice(1));
-	}
+  checkPath.convert = makePosix
 
-	return path.posix.join(base, ignore);
-};
+  // 'C:\\foo'     <- 'C:\\foo' has been converted to 'C:/'
+  // 'd:\\foo'
+  const REGIX_IS_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i
+  checkPath.isNotRelative = path =>
+    REGIX_IS_WINDOWS_PATH_ABSOLUTE.test(path)
+    || isNotRelative(path)
+}
 
-const parseGitIgnore = (content, options) => {
-	const base = slash(path.relative(options.cwd, path.dirname(options.fileName)));
 
-	return content
-		.split(/\r?\n/)
-		.filter(Boolean)
-		.filter(line => !line.startsWith('#'))
-		.map(mapGitIgnorePatternTo(base));
-};
+/***/ }),
+/* 667 */
+/***/ (function(module, exports, __webpack_require__) {
 
-const reduceIgnore = files => {
-	return files.reduce((ignores, file) => {
-		ignores.add(parseGitIgnore(file.content, {
-			cwd: file.cwd,
-			fileName: file.filePath
-		}));
-		return ignores;
-	}, gitIgnore());
-};
+"use strict";
 
-const ensureAbsolutePathForCwd = (cwd, p) => {
-	if (path.isAbsolute(p)) {
-		if (p.startsWith(cwd)) {
-			return p;
-		}
+module.exports = path => {
+	const isExtendedLengthPath = /^\\\\\?\\/.test(path);
+	const hasNonAscii = /[^\u0000-\u0080]+/.test(path); // eslint-disable-line no-control-regex
 
-		throw new Error(`Path ${p} is not in cwd ${cwd}`);
+	if (isExtendedLengthPath || hasNonAscii) {
+		return path;
 	}
 
-	return path.join(cwd, p);
-};
-
-const getIsIgnoredPredecate = (ignores, cwd) => {
-	return p => ignores.ignores(slash(path.relative(cwd, ensureAbsolutePathForCwd(cwd, p))));
+	return path.replace(/\\/g, '/');
 };
 
-const getFile = async (file, cwd) => {
-	const filePath = path.join(cwd, file);
-	const content = await readFileP(filePath, 'utf8');
-
-	return {
-		cwd,
-		filePath,
-		content
-	};
-};
 
-const getFileSync = (file, cwd) => {
-	const filePath = path.join(cwd, file);
-	const content = fs.readFileSync(filePath, 'utf8');
+/***/ }),
+/* 668 */
+/***/ (function(module, exports, __webpack_require__) {
 
-	return {
-		cwd,
-		filePath,
-		content
-	};
-};
+"use strict";
 
-const normalizeOptions = ({
-	ignore = [],
-	cwd = process.cwd()
-} = {}) => {
-	return {ignore, cwd};
-};
+const {Transform} = __webpack_require__(27);
 
-module.exports = async options => {
-	options = normalizeOptions(options);
+class ObjectTransform extends Transform {
+	constructor() {
+		super({
+			objectMode: true
+		});
+	}
+}
 
-	const paths = await fastGlob('**/.gitignore', {
-		ignore: DEFAULT_IGNORE.concat(options.ignore),
-		cwd: options.cwd
-	});
+class FilterStream extends ObjectTransform {
+	constructor(filter) {
+		super();
+		this._filter = filter;
+	}
 
-	const files = await Promise.all(paths.map(file => getFile(file, options.cwd)));
-	const ignores = reduceIgnore(files);
+	_transform(data, encoding, callback) {
+		if (this._filter(data)) {
+			this.push(data);
+		}
 
-	return getIsIgnoredPredecate(ignores, options.cwd);
-};
+		callback();
+	}
+}
 
-module.exports.sync = options => {
-	options = normalizeOptions(options);
+class UniqueStream extends ObjectTransform {
+	constructor() {
+		super();
+		this._pushed = new Set();
+	}
 
-	const paths = fastGlob.sync('**/.gitignore', {
-		ignore: DEFAULT_IGNORE.concat(options.ignore),
-		cwd: options.cwd
-	});
+	_transform(data, encoding, callback) {
+		if (!this._pushed.has(data)) {
+			this.push(data);
+			this._pushed.add(data);
+		}
 
-	const files = paths.map(file => getFileSync(file, options.cwd));
-	const ignores = reduceIgnore(files);
+		callback();
+	}
+}
 
-	return getIsIgnoredPredecate(ignores, options.cwd);
+module.exports = {
+	FilterStream,
+	UniqueStream
 };
 
 
 /***/ }),
-/* 661 */
-/***/ (function(module, exports) {
+/* 669 */
+/***/ (function(module, exports, __webpack_require__) {
 
-// A simple implementation of make-array
-function makeArray (subject) {
-  return Array.isArray(subject)
-    ? subject
-    : [subject]
-}
+"use strict";
 
-const REGEX_TEST_BLANK_LINE = /^\s+$/
-const REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/
-const REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/
-const REGEX_SPLITALL_CRLF = /\r?\n/g
-// /foo,
-// ./foo,
-// ../foo,
-// .
-// ..
-const REGEX_TEST_INVALID_PATH = /^\.*\/|^\.+$/
+const path = __webpack_require__(16);
 
-const SLASH = '/'
-const KEY_IGNORE = typeof Symbol !== 'undefined'
-  ? Symbol.for('node-ignore')
-  /* istanbul ignore next */
-  : 'node-ignore'
+module.exports = path_ => {
+	let cwd = process.cwd();
 
-const define = (object, key, value) =>
-  Object.defineProperty(object, key, {value})
+	path_ = path.resolve(path_);
 
-const REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g
+	if (process.platform === 'win32') {
+		cwd = cwd.toLowerCase();
+		path_ = path_.toLowerCase();
+	}
 
-// Sanitize the range of a regular expression
-// The cases are complicated, see test cases for details
-const sanitizeRange = range => range.replace(
-  REGEX_REGEXP_RANGE,
-  (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0)
-    ? match
-    // Invalid range (out of order) which is ok for gitignore rules but
-    //   fatal for JavaScript regular expression, so eliminate it.
-    : ''
-)
+	return path_ === cwd;
+};
 
-// > If the pattern ends with a slash,
-// > it is removed for the purpose of the following description,
-// > but it would only find a match with a directory.
-// > In other words, foo/ will match a directory foo and paths underneath it,
-// > but will not match a regular file or a symbolic link foo
-// >  (this is consistent with the way how pathspec works in general in Git).
-// '`foo/`' will not match regular file '`foo`' or symbolic link '`foo`'
-// -> ignore-rules will not deal with it, because it costs extra `fs.stat` call
-//      you could use option `mark: true` with `glob`
 
-// '`foo/`' should not continue with the '`..`'
-const DEFAULT_REPLACER_PREFIX = [
+/***/ }),
+/* 670 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  // > Trailing spaces are ignored unless they are quoted with backslash ("\")
-  [
-    // (a\ ) -> (a )
-    // (a  ) -> (a)
-    // (a \ ) -> (a  )
-    /\\?\s+$/,
-    match => match.indexOf('\\') === 0
-      ? ' '
-      : ''
-  ],
+"use strict";
 
-  // replace (\ ) with ' '
-  [
-    /\\\s/g,
-    () => ' '
-  ],
+const path = __webpack_require__(16);
 
-  // Escape metacharacters
-  // which is written down by users but means special for regular expressions.
+module.exports = (childPath, parentPath) => {
+	childPath = path.resolve(childPath);
+	parentPath = path.resolve(parentPath);
 
-  // > There are 12 characters with special meanings:
-  // > - the backslash \,
-  // > - the caret ^,
-  // > - the dollar sign $,
-  // > - the period or dot .,
-  // > - the vertical bar or pipe symbol |,
-  // > - the question mark ?,
-  // > - the asterisk or star *,
-  // > - the plus sign +,
-  // > - the opening parenthesis (,
-  // > - the closing parenthesis ),
-  // > - and the opening square bracket [,
-  // > - the opening curly brace {,
-  // > These special characters are often called "metacharacters".
-  [
-    /[\\^$.|*+(){]/g,
-    match => `\\${match}`
-  ],
+	if (process.platform === 'win32') {
+		childPath = childPath.toLowerCase();
+		parentPath = parentPath.toLowerCase();
+	}
 
-  [
-    // > [abc] matches any character inside the brackets
-    // >    (in this case a, b, or c);
-    /\[([^\]/]*)($|\])/g,
-    (match, p1, p2) => p2 === ']'
-      ? `[${sanitizeRange(p1)}]`
-      : `\\${match}`
-  ],
+	if (childPath === parentPath) {
+		return false;
+	}
 
-  [
-    // > a question mark (?) matches a single character
-    /(?!\\)\?/g,
-    () => '[^/]'
-  ],
+	childPath += path.sep;
+	parentPath += path.sep;
 
-  // leading slash
-  [
+	return childPath.startsWith(parentPath);
+};
 
-    // > A leading slash matches the beginning of the pathname.
-    // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
-    // A leading slash matches the beginning of the pathname
-    /^\//,
-    () => '^'
-  ],
 
-  // replace special metacharacter slash after the leading slash
-  [
-    /\//g,
-    () => '\\/'
-  ],
+/***/ }),
+/* 671 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  [
-    // > A leading "**" followed by a slash means match in all directories.
-    // > For example, "**/foo" matches file or directory "foo" anywhere,
-    // > the same as pattern "foo".
-    // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
-    // >   under directory "foo".
-    // Notice that the '*'s have been replaced as '\\*'
-    /^\^*\\\*\\\*\\\//,
+const assert = __webpack_require__(30)
+const path = __webpack_require__(16)
+const fs = __webpack_require__(23)
+let glob = undefined
+try {
+  glob = __webpack_require__(592)
+} catch (_err) {
+  // treat glob as optional.
+}
 
-    // '**/foo' <-> 'foo'
-    () => '^(?:.*\\/)?'
-  ]
-]
+const defaultGlobOpts = {
+  nosort: true,
+  silent: true
+}
 
-const DEFAULT_REPLACER_SUFFIX = [
-  // starting
-  [
-    // there will be no leading '/'
-    //   (which has been replaced by section "leading slash")
-    // If starts with '**', adding a '^' to the regular expression also works
-    /^(?=[^^])/,
-    function startingReplacer () {
-      return !/\/(?!$)/.test(this)
-        // > If the pattern does not contain a slash /,
-        // >   Git treats it as a shell glob pattern
-        // Actually, if there is only a trailing slash,
-        //   git also treats it as a shell glob pattern
-        ? '(?:^|\\/)'
+// for EMFILE handling
+let timeout = 0
 
-        // > Otherwise, Git treats the pattern as a shell glob suitable for
-        // >   consumption by fnmatch(3)
-        : '^'
-    }
-  ],
+const isWindows = (process.platform === "win32")
 
-  // two globstars
-  [
-    // Use lookahead assertions so that we could match more than one `'/**'`
-    /\\\/\\\*\\\*(?=\\\/|$)/g,
+const defaults = options => {
+  const methods = [
+    'unlink',
+    'chmod',
+    'stat',
+    'lstat',
+    'rmdir',
+    'readdir'
+  ]
+  methods.forEach(m => {
+    options[m] = options[m] || fs[m]
+    m = m + 'Sync'
+    options[m] = options[m] || fs[m]
+  })
 
-    // Zero, one or several directories
-    // should not use '*', or it will be replaced by the next replacer
+  options.maxBusyTries = options.maxBusyTries || 3
+  options.emfileWait = options.emfileWait || 1000
+  if (options.glob === false) {
+    options.disableGlob = true
+  }
+  if (options.disableGlob !== true && glob === undefined) {
+    throw Error('glob dependency not found, set `options.disableGlob = true` if intentional')
+  }
+  options.disableGlob = options.disableGlob || false
+  options.glob = options.glob || defaultGlobOpts
+}
 
-    // Check if it is not the last `'/**'`
-    (_, index, str) => index + 6 < str.length
+const rimraf = (p, options, cb) => {
+  if (typeof options === 'function') {
+    cb = options
+    options = {}
+  }
 
-      // case: /**/
-      // > A slash followed by two consecutive asterisks then a slash matches
-      // >   zero or more directories.
-      // > For example, "a/**/b" matches "a/b", "a/x/b", "a/x/y/b" and so on.
-      // '/**/'
-      ? '(?:\\/[^\\/]+)*'
+  assert(p, 'rimraf: missing path')
+  assert.equal(typeof p, 'string', 'rimraf: path should be a string')
+  assert.equal(typeof cb, 'function', 'rimraf: callback function required')
+  assert(options, 'rimraf: invalid options argument provided')
+  assert.equal(typeof options, 'object', 'rimraf: options should be object')
 
-      // case: /**
-      // > A trailing `"/**"` matches everything inside.
+  defaults(options)
 
-      // #21: everything inside but it should not include the current folder
-      : '\\/.+'
-  ],
+  let busyTries = 0
+  let errState = null
+  let n = 0
 
-  // intermediate wildcards
-  [
-    // Never replace escaped '*'
-    // ignore rule '\*' will match the path '*'
+  const next = (er) => {
+    errState = errState || er
+    if (--n === 0)
+      cb(errState)
+  }
 
-    // 'abc.*/' -> go
-    // 'abc.*'  -> skip this rule
-    /(^|[^\\]+)\\\*(?=.+)/g,
+  const afterGlob = (er, results) => {
+    if (er)
+      return cb(er)
 
-    // '*.js' matches '.js'
-    // '*.js' doesn't match 'abc'
-    (_, p1) => `${p1}[^\\/]*`
-  ],
+    n = results.length
+    if (n === 0)
+      return cb()
 
-  // trailing wildcard
-  [
-    /(\^|\\\/)?\\\*$/,
-    (_, p1) => {
-      const prefix = p1
-        // '\^':
-        // '/*' does not match ''
-        // '/*' does not match everything
+    results.forEach(p => {
+      const CB = (er) => {
+        if (er) {
+          if ((er.code === "EBUSY" || er.code === "ENOTEMPTY" || er.code === "EPERM") &&
+              busyTries < options.maxBusyTries) {
+            busyTries ++
+            // try again, with the same exact callback as this one.
+            return setTimeout(() => rimraf_(p, options, CB), busyTries * 100)
+          }
 
-        // '\\\/':
-        // 'abc/*' does not match 'abc/'
-        ? `${p1}[^/]+`
+          // this one won't happen if graceful-fs is used.
+          if (er.code === "EMFILE" && timeout < options.emfileWait) {
+            return setTimeout(() => rimraf_(p, options, CB), timeout ++)
+          }
 
-        // 'a*' matches 'a'
-        // 'a*' matches 'aa'
-        : '[^/]*'
+          // already gone
+          if (er.code === "ENOENT") er = null
+        }
 
-      return `${prefix}(?=$|\\/$)`
-    }
-  ],
+        timeout = 0
+        next(er)
+      }
+      rimraf_(p, options, CB)
+    })
+  }
 
-  [
-    // unescape
-    /\\\\\\/g,
-    () => '\\'
-  ]
-]
+  if (options.disableGlob || !glob.hasMagic(p))
+    return afterGlob(null, [p])
 
-const POSITIVE_REPLACERS = [
-  ...DEFAULT_REPLACER_PREFIX,
+  options.lstat(p, (er, stat) => {
+    if (!er)
+      return afterGlob(null, [p])
 
-  // 'f'
-  // matches
-  // - /f(end)
-  // - /f/
-  // - (start)f(end)
-  // - (start)f/
-  // doesn't match
-  // - oof
-  // - foo
-  // pseudo:
-  // -> (^|/)f(/|$)
+    glob(p, options.glob, afterGlob)
+  })
 
-  // ending
-  [
-    // 'js' will not match 'js.'
-    // 'ab' will not match 'abc'
-    /(?:[^*/])$/,
+}
 
-    // 'js*' will not match 'a.js'
-    // 'js/' will not match 'a.js'
-    // 'js' will match 'a.js' and 'a.js/'
-    match => `${match}(?=$|\\/)`
-  ],
+// Two possible strategies.
+// 1. Assume it's a file.  unlink it, then do the dir stuff on EPERM or EISDIR
+// 2. Assume it's a directory.  readdir, then do the file stuff on ENOTDIR
+//
+// Both result in an extra syscall when you guess wrong.  However, there
+// are likely far more normal files in the world than directories.  This
+// is based on the assumption that a the average number of files per
+// directory is >= 1.
+//
+// If anyone ever complains about this, then I guess the strategy could
+// be made configurable somehow.  But until then, YAGNI.
+const rimraf_ = (p, options, cb) => {
+  assert(p)
+  assert(options)
+  assert(typeof cb === 'function')
 
-  ...DEFAULT_REPLACER_SUFFIX
-]
+  // sunos lets the root user unlink directories, which is... weird.
+  // so we have to lstat here and make sure it's not a dir.
+  options.lstat(p, (er, st) => {
+    if (er && er.code === "ENOENT")
+      return cb(null)
 
-const NEGATIVE_REPLACERS = [
-  ...DEFAULT_REPLACER_PREFIX,
+    // Windows can EPERM on stat.  Life is suffering.
+    if (er && er.code === "EPERM" && isWindows)
+      fixWinEPERM(p, options, er, cb)
 
-  // #24, #38
-  // The MISSING rule of [gitignore docs](https://git-scm.com/docs/gitignore)
-  // A negative pattern without a trailing wildcard should not
-  // re-include the things inside that directory.
+    if (st && st.isDirectory())
+      return rmdir(p, options, er, cb)
 
-  // eg:
-  // ['node_modules/*', '!node_modules']
-  // should ignore `node_modules/a.js`
-  [
-    /(?:[^*])$/,
-    match => `${match}(?=$|\\/$)`
-  ],
+    options.unlink(p, er => {
+      if (er) {
+        if (er.code === "ENOENT")
+          return cb(null)
+        if (er.code === "EPERM")
+          return (isWindows)
+            ? fixWinEPERM(p, options, er, cb)
+            : rmdir(p, options, er, cb)
+        if (er.code === "EISDIR")
+          return rmdir(p, options, er, cb)
+      }
+      return cb(er)
+    })
+  })
+}
 
-  ...DEFAULT_REPLACER_SUFFIX
-]
+const fixWinEPERM = (p, options, er, cb) => {
+  assert(p)
+  assert(options)
+  assert(typeof cb === 'function')
+  if (er)
+    assert(er instanceof Error)
 
-// A simple cache, because an ignore rule only has only one certain meaning
-const regexCache = Object.create(null)
+  options.chmod(p, 0o666, er2 => {
+    if (er2)
+      cb(er2.code === "ENOENT" ? null : er)
+    else
+      options.stat(p, (er3, stats) => {
+        if (er3)
+          cb(er3.code === "ENOENT" ? null : er)
+        else if (stats.isDirectory())
+          rmdir(p, options, er, cb)
+        else
+          options.unlink(p, cb)
+      })
+  })
+}
 
-// @param {pattern}
-const makeRegex = (pattern, negative, ignorecase) => {
-  const r = regexCache[pattern]
-  if (r) {
-    return r
+const fixWinEPERMSync = (p, options, er) => {
+  assert(p)
+  assert(options)
+  if (er)
+    assert(er instanceof Error)
+
+  try {
+    options.chmodSync(p, 0o666)
+  } catch (er2) {
+    if (er2.code === "ENOENT")
+      return
+    else
+      throw er
   }
 
-  const replacers = negative
-    ? NEGATIVE_REPLACERS
-    : POSITIVE_REPLACERS
+  let stats
+  try {
+    stats = options.statSync(p)
+  } catch (er3) {
+    if (er3.code === "ENOENT")
+      return
+    else
+      throw er
+  }
 
-  const source = replacers.reduce(
-    (prev, current) => prev.replace(current[0], current[1].bind(pattern)),
-    pattern
-  )
+  if (stats.isDirectory())
+    rmdirSync(p, options, er)
+  else
+    options.unlinkSync(p)
+}
 
-  return regexCache[pattern] = ignorecase
-    ? new RegExp(source, 'i')
-    : new RegExp(source)
+const rmdir = (p, options, originalEr, cb) => {
+  assert(p)
+  assert(options)
+  if (originalEr)
+    assert(originalEr instanceof Error)
+  assert(typeof cb === 'function')
+
+  // try to rmdir first, and only readdir on ENOTEMPTY or EEXIST (SunOS)
+  // if we guessed wrong, and it's not a directory, then
+  // raise the original error.
+  options.rmdir(p, er => {
+    if (er && (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM"))
+      rmkids(p, options, cb)
+    else if (er && er.code === "ENOTDIR")
+      cb(originalEr)
+    else
+      cb(er)
+  })
 }
 
-const isString = subject => typeof subject === 'string'
+const rmkids = (p, options, cb) => {
+  assert(p)
+  assert(options)
+  assert(typeof cb === 'function')
 
-// > A blank line matches no files, so it can serve as a separator for readability.
-const checkPattern = pattern => pattern
-  && isString(pattern)
-  && !REGEX_TEST_BLANK_LINE.test(pattern)
+  options.readdir(p, (er, files) => {
+    if (er)
+      return cb(er)
+    let n = files.length
+    if (n === 0)
+      return options.rmdir(p, cb)
+    let errState
+    files.forEach(f => {
+      rimraf(path.join(p, f), options, er => {
+        if (errState)
+          return
+        if (er)
+          return cb(errState = er)
+        if (--n === 0)
+          options.rmdir(p, cb)
+      })
+    })
+  })
+}
 
-  // > A line starting with # serves as a comment.
-  && pattern.indexOf('#') !== 0
+// this looks simpler, and is strictly *faster*, but will
+// tie up the JavaScript thread and fail on excessively
+// deep directory trees.
+const rimrafSync = (p, options) => {
+  options = options || {}
+  defaults(options)
 
-const splitPattern = pattern => pattern.split(REGEX_SPLITALL_CRLF)
+  assert(p, 'rimraf: missing path')
+  assert.equal(typeof p, 'string', 'rimraf: path should be a string')
+  assert(options, 'rimraf: missing options')
+  assert.equal(typeof options, 'object', 'rimraf: options should be object')
 
-class IgnoreRule {
-  constructor (
-    origin,
-    pattern,
-    negative,
-    regex
-  ) {
-    this.origin = origin
-    this.pattern = pattern
-    this.negative = negative
-    this.regex = regex
+  let results
+
+  if (options.disableGlob || !glob.hasMagic(p)) {
+    results = [p]
+  } else {
+    try {
+      options.lstatSync(p)
+      results = [p]
+    } catch (er) {
+      results = glob.sync(p, options.glob)
+    }
   }
-}
 
-const createRule = (pattern, ignorecase) => {
-  const origin = pattern
-  let negative = false
+  if (!results.length)
+    return
 
-  // > An optional prefix "!" which negates the pattern;
-  if (pattern.indexOf('!') === 0) {
-    negative = true
-    pattern = pattern.substr(1)
-  }
+  for (let i = 0; i < results.length; i++) {
+    const p = results[i]
 
-  pattern = pattern
-  // > Put a backslash ("\") in front of the first "!" for patterns that
-  // >   begin with a literal "!", for example, `"\!important!.txt"`.
-  .replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, '!')
-  // > Put a backslash ("\") in front of the first hash for patterns that
-  // >   begin with a hash.
-  .replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, '#')
+    let st
+    try {
+      st = options.lstatSync(p)
+    } catch (er) {
+      if (er.code === "ENOENT")
+        return
 
-  const regex = makeRegex(pattern, negative, ignorecase)
+      // Windows can EPERM on stat.  Life is suffering.
+      if (er.code === "EPERM" && isWindows)
+        fixWinEPERMSync(p, options, er)
+    }
 
-  return new IgnoreRule(
-    origin,
-    pattern,
-    negative,
-    regex
-  )
-}
+    try {
+      // sunos lets the root user unlink directories, which is... weird.
+      if (st && st.isDirectory())
+        rmdirSync(p, options, null)
+      else
+        options.unlinkSync(p)
+    } catch (er) {
+      if (er.code === "ENOENT")
+        return
+      if (er.code === "EPERM")
+        return isWindows ? fixWinEPERMSync(p, options, er) : rmdirSync(p, options, er)
+      if (er.code !== "EISDIR")
+        throw er
 
-const throwError = (message, Ctor) => {
-  throw new Ctor(message)
+      rmdirSync(p, options, er)
+    }
+  }
 }
 
-const checkPath = (path, originalPath, doThrow) => {
-  if (!isString(path)) {
-    return doThrow(
-      `path must be a string, but got \`${originalPath}\``,
-      TypeError
-    )
-  }
+const rmdirSync = (p, options, originalEr) => {
+  assert(p)
+  assert(options)
+  if (originalEr)
+    assert(originalEr instanceof Error)
 
-  // We don't know if we should ignore '', so throw
-  if (!path) {
-    return doThrow(`path must not be empty`, TypeError)
+  try {
+    options.rmdirSync(p)
+  } catch (er) {
+    if (er.code === "ENOENT")
+      return
+    if (er.code === "ENOTDIR")
+      throw originalEr
+    if (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM")
+      rmkidsSync(p, options)
   }
+}
 
-  // Check if it is a relative path
-  if (checkPath.isNotRelative(path)) {
-    const r = '`path.relative()`d'
-    return doThrow(
-      `path should be a ${r} string, but got "${originalPath}"`,
-      RangeError
-    )
-  }
+const rmkidsSync = (p, options) => {
+  assert(p)
+  assert(options)
+  options.readdirSync(p).forEach(f => rimrafSync(path.join(p, f), options))
 
-  return true
+  // We only end up here once we got ENOTEMPTY at least once, and
+  // at this point, we are guaranteed to have removed all the kids.
+  // So, we know that it won't be ENOENT or ENOTDIR or anything else.
+  // try really hard to delete stuff on windows, because it has a
+  // PROFOUNDLY annoying habit of not closing handles promptly when
+  // files are deleted, resulting in spurious ENOTEMPTY errors.
+  const retries = isWindows ? 100 : 1
+  let i = 0
+  do {
+    let threw = true
+    try {
+      const ret = options.rmdirSync(p, options)
+      threw = false
+      return ret
+    } finally {
+      if (++i < retries && threw)
+        continue
+    }
+  } while (true)
 }
 
-const isNotRelative = path => REGEX_TEST_INVALID_PATH.test(path)
+module.exports = rimraf
+rimraf.sync = rimrafSync
 
-checkPath.isNotRelative = isNotRelative
-checkPath.convert = p => p
 
-class Ignore {
-  constructor ({
-    ignorecase = true
-  } = {}) {
-    this._rules = []
-    this._ignorecase = ignorecase
-    define(this, KEY_IGNORE, true)
-    this._initCache()
-  }
+/***/ }),
+/* 672 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  _initCache () {
-    this._ignoreCache = Object.create(null)
-    this._testCache = Object.create(null)
-  }
+"use strict";
 
-  _addPattern (pattern) {
-    // #32
-    if (pattern && pattern[KEY_IGNORE]) {
-      this._rules = this._rules.concat(pattern._rules)
-      this._added = true
-      return
-    }
+const AggregateError = __webpack_require__(673);
 
-    if (checkPattern(pattern)) {
-      const rule = createRule(pattern, this._ignorecase)
-      this._added = true
-      this._rules.push(rule)
-    }
-  }
+module.exports = async (
+	iterable,
+	mapper,
+	{
+		concurrency = Infinity,
+		stopOnError = true
+	} = {}
+) => {
+	return new Promise((resolve, reject) => {
+		if (typeof mapper !== 'function') {
+			throw new TypeError('Mapper function is required');
+		}
 
-  // @param {Array<string> | string | Ignore} pattern
-  add (pattern) {
-    this._added = false
+		if (!(typeof concurrency === 'number' && concurrency >= 1)) {
+			throw new TypeError(`Expected \`concurrency\` to be a number from 1 and up, got \`${concurrency}\` (${typeof concurrency})`);
+		}
 
-    makeArray(
-      isString(pattern)
-        ? splitPattern(pattern)
-        : pattern
-    ).forEach(this._addPattern, this)
+		const ret = [];
+		const errors = [];
+		const iterator = iterable[Symbol.iterator]();
+		let isRejected = false;
+		let isIterableDone = false;
+		let resolvingCount = 0;
+		let currentIndex = 0;
 
-    // Some rules have just added to the ignore,
-    // making the behavior changed.
-    if (this._added) {
-      this._initCache()
-    }
+		const next = () => {
+			if (isRejected) {
+				return;
+			}
 
-    return this
-  }
+			const nextItem = iterator.next();
+			const i = currentIndex;
+			currentIndex++;
 
-  // legacy
-  addPattern (pattern) {
-    return this.add(pattern)
-  }
+			if (nextItem.done) {
+				isIterableDone = true;
 
-  //          |           ignored : unignored
-  // negative |   0:0   |   0:1   |   1:0   |   1:1
-  // -------- | ------- | ------- | ------- | --------
-  //     0    |  TEST   |  TEST   |  SKIP   |    X
-  //     1    |  TESTIF |  SKIP   |  TEST   |    X
+				if (resolvingCount === 0) {
+					if (!stopOnError && errors.length !== 0) {
+						reject(new AggregateError(errors));
+					} else {
+						resolve(ret);
+					}
+				}
 
-  // - SKIP: always skip
-  // - TEST: always test
-  // - TESTIF: only test if checkUnignored
-  // - X: that never happen
+				return;
+			}
 
-  // @param {boolean} whether should check if the path is unignored,
-  //   setting `checkUnignored` to `false` could reduce additional
-  //   path matching.
+			resolvingCount++;
 
-  // @returns {TestResult} true if a file is ignored
-  _testOne (path, checkUnignored) {
-    let ignored = false
-    let unignored = false
+			(async () => {
+				try {
+					const element = await nextItem.value;
+					ret[i] = await mapper(element, i);
+					resolvingCount--;
+					next();
+				} catch (error) {
+					if (stopOnError) {
+						isRejected = true;
+						reject(error);
+					} else {
+						errors.push(error);
+						resolvingCount--;
+						next();
+					}
+				}
+			})();
+		};
 
-    this._rules.forEach(rule => {
-      const {negative} = rule
-      if (
-        unignored === negative && ignored !== unignored
-        || negative && !ignored && !unignored && !checkUnignored
-      ) {
-        return
-      }
+		for (let i = 0; i < concurrency; i++) {
+			next();
 
-      const matched = rule.regex.test(path)
+			if (isIterableDone) {
+				break;
+			}
+		}
+	});
+};
 
-      if (matched) {
-        ignored = !negative
-        unignored = negative
-      }
-    })
 
-    return {
-      ignored,
-      unignored
-    }
-  }
+/***/ }),
+/* 673 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  // @returns {TestResult}
-  _test (originalPath, cache, checkUnignored, slices) {
-    const path = originalPath
-      // Supports nullable path
-      && checkPath.convert(originalPath)
+"use strict";
 
-    checkPath(path, originalPath, throwError)
+const indentString = __webpack_require__(674);
+const cleanStack = __webpack_require__(675);
 
-    return this._t(path, cache, checkUnignored, slices)
-  }
+const cleanInternalStack = stack => stack.replace(/\s+at .*aggregate-error\/index.js:\d+:\d+\)?/g, '');
 
-  _t (path, cache, checkUnignored, slices) {
-    if (path in cache) {
-      return cache[path]
-    }
+class AggregateError extends Error {
+	constructor(errors) {
+		if (!Array.isArray(errors)) {
+			throw new TypeError(`Expected input to be an Array, got ${typeof errors}`);
+		}
 
-    if (!slices) {
-      // path/to/a.js
-      // ['path', 'to', 'a.js']
-      slices = path.split(SLASH)
-    }
+		errors = [...errors].map(error => {
+			if (error instanceof Error) {
+				return error;
+			}
 
-    slices.pop()
+			if (error !== null && typeof error === 'object') {
+				// Handle plain error objects with message property and/or possibly other metadata
+				return Object.assign(new Error(error.message), error);
+			}
 
-    // If the path has no parent directory, just test it
-    if (!slices.length) {
-      return cache[path] = this._testOne(path, checkUnignored)
-    }
+			return new Error(error);
+		});
 
-    const parent = this._t(
-      slices.join(SLASH) + SLASH,
-      cache,
-      checkUnignored,
-      slices
-    )
+		let message = errors
+			.map(error => {
+				// The `stack` property is not standardized, so we can't assume it exists
+				return typeof error.stack === 'string' ? cleanInternalStack(cleanStack(error.stack)) : String(error);
+			})
+			.join('\n');
+		message = '\n' + indentString(message, 4);
+		super(message);
 
-    // If the path contains a parent directory, check the parent first
-    return cache[path] = parent.ignored
-      // > It is not possible to re-include a file if a parent directory of
-      // >   that file is excluded.
-      ? parent
-      : this._testOne(path, checkUnignored)
-  }
+		this.name = 'AggregateError';
 
-  ignores (path) {
-    return this._test(path, this._ignoreCache, false).ignored
-  }
+		Object.defineProperty(this, '_errors', {value: errors});
+	}
 
-  createFilter () {
-    return path => !this.ignores(path)
-  }
+	* [Symbol.iterator]() {
+		for (const error of this._errors) {
+			yield error;
+		}
+	}
+}
 
-  filter (paths) {
-    return makeArray(paths).filter(this.createFilter())
-  }
+module.exports = AggregateError;
 
-  // @returns {TestResult}
-  test (path) {
-    return this._test(path, this._testCache, true)
-  }
-}
 
-const factory = options => new Ignore(options)
+/***/ }),
+/* 674 */
+/***/ (function(module, exports, __webpack_require__) {
 
-const returnFalse = () => false
+"use strict";
 
-const isPathValid = path =>
-  checkPath(path && checkPath.convert(path), path, returnFalse)
 
-factory.isPathValid = isPathValid
+module.exports = (string, count = 1, options) => {
+	options = {
+		indent: ' ',
+		includeEmptyLines: false,
+		...options
+	};
 
-// Fixes typescript
-factory.default = factory
+	if (typeof string !== 'string') {
+		throw new TypeError(
+			`Expected \`input\` to be a \`string\`, got \`${typeof string}\``
+		);
+	}
 
-module.exports = factory
+	if (typeof count !== 'number') {
+		throw new TypeError(
+			`Expected \`count\` to be a \`number\`, got \`${typeof count}\``
+		);
+	}
 
-// Windows
-// --------------------------------------------------------------
-/* istanbul ignore if  */
-if (
-  // Detect `process` so that it can run in browsers.
-  typeof process !== 'undefined'
-  && (
-    process.env && process.env.IGNORE_TEST_WIN32
-    || process.platform === 'win32'
-  )
-) {
-  /* eslint no-control-regex: "off" */
-  const makePosix = str => /^\\\\\?\\/.test(str)
-  || /["<>|\u0000-\u001F]+/u.test(str)
-    ? str
-    : str.replace(/\\/g, '/')
+	if (typeof options.indent !== 'string') {
+		throw new TypeError(
+			`Expected \`options.indent\` to be a \`string\`, got \`${typeof options.indent}\``
+		);
+	}
 
-  checkPath.convert = makePosix
+	if (count === 0) {
+		return string;
+	}
 
-  // 'C:\\foo'     <- 'C:\\foo' has been converted to 'C:/'
-  // 'd:\\foo'
-  const REGIX_IS_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i
-  checkPath.isNotRelative = path =>
-    REGIX_IS_WINDOWS_PATH_ABSOLUTE.test(path)
-    || isNotRelative(path)
-}
+	const regex = options.includeEmptyLines ? /^/gm : /^(?!\s*$)/gm;
+
+	return string.replace(regex, options.indent.repeat(count));
+};
 
 
 /***/ }),
-/* 662 */
+/* 675 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-module.exports = path => {
-	const isExtendedLengthPath = /^\\\\\?\\/.test(path);
-	const hasNonAscii = /[^\u0000-\u0080]+/.test(path); // eslint-disable-line no-control-regex
+const os = __webpack_require__(11);
 
-	if (isExtendedLengthPath || hasNonAscii) {
-		return path;
-	}
+const extractPathRegex = /\s+at.*(?:\(|\s)(.*)\)?/;
+const pathRegex = /^(?:(?:(?:node|(?:internal\/[\w/]*|.*node_modules\/(?:babel-polyfill|pirates)\/.*)?\w+)\.js:\d+:\d+)|native)/;
+const homeDir = typeof os.homedir === 'undefined' ? '' : os.homedir();
+
+module.exports = (stack, options) => {
+	options = Object.assign({pretty: false}, options);
+
+	return stack.replace(/\\/g, '/')
+		.split('\n')
+		.filter(line => {
+			const pathMatches = line.match(extractPathRegex);
+			if (pathMatches === null || !pathMatches[1]) {
+				return true;
+			}
+
+			const match = pathMatches[1];
+
+			// Electron
+			if (
+				match.includes('.app/Contents/Resources/electron.asar') ||
+				match.includes('.app/Contents/Resources/default_app.asar')
+			) {
+				return false;
+			}
+
+			return !pathRegex.test(match);
+		})
+		.filter(line => line.trim() !== '')
+		.map(line => {
+			if (options.pretty) {
+				return line.replace(extractPathRegex, (m, p1) => m.replace(p1, p1.replace(homeDir, '~')));
+			}
 
-	return path.replace(/\\/g, '/');
+			return line;
+		})
+		.join('\n');
 };
 
 
 /***/ }),
-/* 663 */
+/* 676 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const {Transform} = __webpack_require__(27);
+const chalk = __webpack_require__(677);
+const cliCursor = __webpack_require__(681);
+const cliSpinners = __webpack_require__(685);
+const logSymbols = __webpack_require__(566);
 
-class ObjectTransform extends Transform {
-	constructor() {
-		super({
-			objectMode: true
-		});
-	}
-}
+class Ora {
+	constructor(options) {
+		if (typeof options === 'string') {
+			options = {
+				text: options
+			};
+		}
 
-class FilterStream extends ObjectTransform {
-	constructor(filter) {
-		super();
-		this._filter = filter;
-	}
+		this.options = Object.assign({
+			text: '',
+			color: 'cyan',
+			stream: process.stderr
+		}, options);
 
-	_transform(data, encoding, callback) {
-		if (this._filter(data)) {
-			this.push(data);
-		}
+		const sp = this.options.spinner;
+		this.spinner = typeof sp === 'object' ? sp : (process.platform === 'win32' ? cliSpinners.line : (cliSpinners[sp] || cliSpinners.dots)); // eslint-disable-line no-nested-ternary
 
-		callback();
-	}
-}
+		if (this.spinner.frames === undefined) {
+			throw new Error('Spinner must define `frames`');
+		}
 
-class UniqueStream extends ObjectTransform {
-	constructor() {
-		super();
-		this._pushed = new Set();
+		this.text = this.options.text;
+		this.color = this.options.color;
+		this.interval = this.options.interval || this.spinner.interval || 100;
+		this.stream = this.options.stream;
+		this.id = null;
+		this.frameIndex = 0;
+		this.enabled = typeof this.options.enabled === 'boolean' ? this.options.enabled : ((this.stream && this.stream.isTTY) && !process.env.CI);
 	}
+	frame() {
+		const frames = this.spinner.frames;
+		let frame = frames[this.frameIndex];
 
-	_transform(data, encoding, callback) {
-		if (!this._pushed.has(data)) {
-			this.push(data);
-			this._pushed.add(data);
+		if (this.color) {
+			frame = chalk[this.color](frame);
 		}
 
-		callback();
-	}
-}
+		this.frameIndex = ++this.frameIndex % frames.length;
 
-module.exports = {
-	FilterStream,
-	UniqueStream
-};
+		return frame + ' ' + this.text;
+	}
+	clear() {
+		if (!this.enabled) {
+			return this;
+		}
 
+		this.stream.clearLine();
+		this.stream.cursorTo(0);
 
-/***/ }),
-/* 664 */
-/***/ (function(module, exports, __webpack_require__) {
+		return this;
+	}
+	render() {
+		this.clear();
+		this.stream.write(this.frame());
 
-var fs = __webpack_require__(23)
-var polyfills = __webpack_require__(665)
-var legacy = __webpack_require__(666)
-var clone = __webpack_require__(667)
+		return this;
+	}
+	start(text) {
+		if (text) {
+			this.text = text;
+		}
 
-var util = __webpack_require__(29)
+		if (!this.enabled || this.id) {
+			return this;
+		}
 
-/* istanbul ignore next - node 0.x polyfill */
-var gracefulQueue
-var previousSymbol
+		cliCursor.hide(this.stream);
+		this.render();
+		this.id = setInterval(this.render.bind(this), this.interval);
 
-/* istanbul ignore else - node 0.x polyfill */
-if (typeof Symbol === 'function' && typeof Symbol.for === 'function') {
-  gracefulQueue = Symbol.for('graceful-fs.queue')
-  // This is used in testing by future versions
-  previousSymbol = Symbol.for('graceful-fs.previous')
-} else {
-  gracefulQueue = '___graceful-fs.queue'
-  previousSymbol = '___graceful-fs.previous'
-}
+		return this;
+	}
+	stop() {
+		if (!this.enabled) {
+			return this;
+		}
 
-function noop () {}
+		clearInterval(this.id);
+		this.id = null;
+		this.frameIndex = 0;
+		this.clear();
+		cliCursor.show(this.stream);
 
-var debug = noop
-if (util.debuglog)
-  debug = util.debuglog('gfs4')
-else if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || ''))
-  debug = function() {
-    var m = util.format.apply(util, arguments)
-    m = 'GFS4: ' + m.split(/\n/).join('\nGFS4: ')
-    console.error(m)
-  }
+		return this;
+	}
+	succeed(text) {
+		return this.stopAndPersist({symbol: logSymbols.success, text});
+	}
+	fail(text) {
+		return this.stopAndPersist({symbol: logSymbols.error, text});
+	}
+	warn(text) {
+		return this.stopAndPersist({symbol: logSymbols.warning, text});
+	}
+	info(text) {
+		return this.stopAndPersist({symbol: logSymbols.info, text});
+	}
+	stopAndPersist(options) {
+		if (!this.enabled) {
+			return this;
+		}
 
-// Once time initialization
-if (!global[gracefulQueue]) {
-  // This queue can be shared by multiple loaded instances
-  var queue = []
-  Object.defineProperty(global, gracefulQueue, {
-    get: function() {
-      return queue
-    }
-  })
+		// Legacy argument
+		// TODO: Deprecate sometime in the future
+		if (typeof options === 'string') {
+			options = {
+				symbol: options
+			};
+		}
 
-  // Patch fs.close/closeSync to shared queue version, because we need
-  // to retry() whenever a close happens *anywhere* in the program.
-  // This is essential when multiple graceful-fs instances are
-  // in play at the same time.
-  fs.close = (function (fs$close) {
-    function close (fd, cb) {
-      return fs$close.call(fs, fd, function (err) {
-        // This function uses the graceful-fs shared queue
-        if (!err) {
-          retry()
-        }
+		options = options || {};
 
-        if (typeof cb === 'function')
-          cb.apply(this, arguments)
-      })
-    }
+		this.stop();
+		this.stream.write(`${options.symbol || ' '} ${options.text || this.text}\n`);
 
-    Object.defineProperty(close, previousSymbol, {
-      value: fs$close
-    })
-    return close
-  })(fs.close)
+		return this;
+	}
+}
 
-  fs.closeSync = (function (fs$closeSync) {
-    function closeSync (fd) {
-      // This function uses the graceful-fs shared queue
-      fs$closeSync.apply(fs, arguments)
-      retry()
-    }
+module.exports = function (opts) {
+	return new Ora(opts);
+};
 
-    Object.defineProperty(closeSync, previousSymbol, {
-      value: fs$closeSync
-    })
-    return closeSync
-  })(fs.closeSync)
+module.exports.promise = (action, options) => {
+	if (typeof action.then !== 'function') {
+		throw new TypeError('Parameter `action` must be a Promise');
+	}
 
-  if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || '')) {
-    process.on('exit', function() {
-      debug(global[gracefulQueue])
-      __webpack_require__(30).equal(global[gracefulQueue].length, 0)
-    })
-  }
-}
+	const spinner = new Ora(options);
+	spinner.start();
 
-module.exports = patch(clone(fs))
-if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs.__patched) {
-    module.exports = patch(fs)
-    fs.__patched = true;
-}
+	action.then(
+		() => {
+			spinner.succeed();
+		},
+		() => {
+			spinner.fail();
+		}
+	);
 
-function patch (fs) {
-  // Everything that references the open() function needs to be in here
-  polyfills(fs)
-  fs.gracefulify = patch
+	return spinner;
+};
 
-  fs.createReadStream = createReadStream
-  fs.createWriteStream = createWriteStream
-  var fs$readFile = fs.readFile
-  fs.readFile = readFile
-  function readFile (path, options, cb) {
-    if (typeof options === 'function')
-      cb = options, options = null
 
-    return go$readFile(path, options, cb)
+/***/ }),
+/* 677 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    function go$readFile (path, options, cb) {
-      return fs$readFile(path, options, function (err) {
-        if (err && (err.code === 'EMFILE' || err.code === 'ENFILE'))
-          enqueue([go$readFile, [path, options, cb]])
-        else {
-          if (typeof cb === 'function')
-            cb.apply(this, arguments)
-          retry()
-        }
-      })
-    }
-  }
+"use strict";
 
-  var fs$writeFile = fs.writeFile
-  fs.writeFile = writeFile
-  function writeFile (path, data, options, cb) {
-    if (typeof options === 'function')
-      cb = options, options = null
+const escapeStringRegexp = __webpack_require__(3);
+const ansiStyles = __webpack_require__(678);
+const stdoutColor = __webpack_require__(679).stdout;
 
-    return go$writeFile(path, data, options, cb)
+const template = __webpack_require__(680);
 
-    function go$writeFile (path, data, options, cb) {
-      return fs$writeFile(path, data, options, function (err) {
-        if (err && (err.code === 'EMFILE' || err.code === 'ENFILE'))
-          enqueue([go$writeFile, [path, data, options, cb]])
-        else {
-          if (typeof cb === 'function')
-            cb.apply(this, arguments)
-          retry()
-        }
-      })
-    }
-  }
+const isSimpleWindowsTerm = process.platform === 'win32' && !(process.env.TERM || '').toLowerCase().startsWith('xterm');
 
-  var fs$appendFile = fs.appendFile
-  if (fs$appendFile)
-    fs.appendFile = appendFile
-  function appendFile (path, data, options, cb) {
-    if (typeof options === 'function')
-      cb = options, options = null
+// `supportsColor.level` → `ansiStyles.color[name]` mapping
+const levelMapping = ['ansi', 'ansi', 'ansi256', 'ansi16m'];
 
-    return go$appendFile(path, data, options, cb)
+// `color-convert` models to exclude from the Chalk API due to conflicts and such
+const skipModels = new Set(['gray']);
 
-    function go$appendFile (path, data, options, cb) {
-      return fs$appendFile(path, data, options, function (err) {
-        if (err && (err.code === 'EMFILE' || err.code === 'ENFILE'))
-          enqueue([go$appendFile, [path, data, options, cb]])
-        else {
-          if (typeof cb === 'function')
-            cb.apply(this, arguments)
-          retry()
-        }
-      })
-    }
-  }
+const styles = Object.create(null);
 
-  var fs$readdir = fs.readdir
-  fs.readdir = readdir
-  function readdir (path, options, cb) {
-    var args = [path]
-    if (typeof options !== 'function') {
-      args.push(options)
-    } else {
-      cb = options
-    }
-    args.push(go$readdir$cb)
+function applyOptions(obj, options) {
+	options = options || {};
 
-    return go$readdir(args)
+	// Detect level if not set manually
+	const scLevel = stdoutColor ? stdoutColor.level : 0;
+	obj.level = options.level === undefined ? scLevel : options.level;
+	obj.enabled = 'enabled' in options ? options.enabled : obj.level > 0;
+}
 
-    function go$readdir$cb (err, files) {
-      if (files && files.sort)
-        files.sort()
+function Chalk(options) {
+	// We check for this.template here since calling `chalk.constructor()`
+	// by itself will have a `this` of a previously constructed chalk object
+	if (!this || !(this instanceof Chalk) || this.template) {
+		const chalk = {};
+		applyOptions(chalk, options);
 
-      if (err && (err.code === 'EMFILE' || err.code === 'ENFILE'))
-        enqueue([go$readdir, [args]])
+		chalk.template = function () {
+			const args = [].slice.call(arguments);
+			return chalkTag.apply(null, [chalk.template].concat(args));
+		};
 
-      else {
-        if (typeof cb === 'function')
-          cb.apply(this, arguments)
-        retry()
-      }
-    }
-  }
+		Object.setPrototypeOf(chalk, Chalk.prototype);
+		Object.setPrototypeOf(chalk.template, chalk);
 
-  function go$readdir (args) {
-    return fs$readdir.apply(fs, args)
-  }
+		chalk.template.constructor = Chalk;
 
-  if (process.version.substr(0, 4) === 'v0.8') {
-    var legStreams = legacy(fs)
-    ReadStream = legStreams.ReadStream
-    WriteStream = legStreams.WriteStream
-  }
+		return chalk.template;
+	}
 
-  var fs$ReadStream = fs.ReadStream
-  if (fs$ReadStream) {
-    ReadStream.prototype = Object.create(fs$ReadStream.prototype)
-    ReadStream.prototype.open = ReadStream$open
-  }
+	applyOptions(this, options);
+}
 
-  var fs$WriteStream = fs.WriteStream
-  if (fs$WriteStream) {
-    WriteStream.prototype = Object.create(fs$WriteStream.prototype)
-    WriteStream.prototype.open = WriteStream$open
-  }
+// Use bright blue on Windows as the normal blue color is illegible
+if (isSimpleWindowsTerm) {
+	ansiStyles.blue.open = '\u001B[94m';
+}
 
-  Object.defineProperty(fs, 'ReadStream', {
-    get: function () {
-      return ReadStream
-    },
-    set: function (val) {
-      ReadStream = val
-    },
-    enumerable: true,
-    configurable: true
-  })
-  Object.defineProperty(fs, 'WriteStream', {
-    get: function () {
-      return WriteStream
-    },
-    set: function (val) {
-      WriteStream = val
-    },
-    enumerable: true,
-    configurable: true
-  })
+for (const key of Object.keys(ansiStyles)) {
+	ansiStyles[key].closeRe = new RegExp(escapeStringRegexp(ansiStyles[key].close), 'g');
 
-  // legacy names
-  Object.defineProperty(fs, 'FileReadStream', {
-    get: function () {
-      return ReadStream
-    },
-    set: function (val) {
-      ReadStream = val
-    },
-    enumerable: true,
-    configurable: true
-  })
-  Object.defineProperty(fs, 'FileWriteStream', {
-    get: function () {
-      return WriteStream
-    },
-    set: function (val) {
-      WriteStream = val
-    },
-    enumerable: true,
-    configurable: true
-  })
+	styles[key] = {
+		get() {
+			const codes = ansiStyles[key];
+			return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, key);
+		}
+	};
+}
 
-  function ReadStream (path, options) {
-    if (this instanceof ReadStream)
-      return fs$ReadStream.apply(this, arguments), this
-    else
-      return ReadStream.apply(Object.create(ReadStream.prototype), arguments)
-  }
+styles.visible = {
+	get() {
+		return build.call(this, this._styles || [], true, 'visible');
+	}
+};
 
-  function ReadStream$open () {
-    var that = this
-    open(that.path, that.flags, that.mode, function (err, fd) {
-      if (err) {
-        if (that.autoClose)
-          that.destroy()
+ansiStyles.color.closeRe = new RegExp(escapeStringRegexp(ansiStyles.color.close), 'g');
+for (const model of Object.keys(ansiStyles.color.ansi)) {
+	if (skipModels.has(model)) {
+		continue;
+	}
 
-        that.emit('error', err)
-      } else {
-        that.fd = fd
-        that.emit('open', fd)
-        that.read()
-      }
-    })
-  }
+	styles[model] = {
+		get() {
+			const level = this.level;
+			return function () {
+				const open = ansiStyles.color[levelMapping[level]][model].apply(null, arguments);
+				const codes = {
+					open,
+					close: ansiStyles.color.close,
+					closeRe: ansiStyles.color.closeRe
+				};
+				return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, model);
+			};
+		}
+	};
+}
 
-  function WriteStream (path, options) {
-    if (this instanceof WriteStream)
-      return fs$WriteStream.apply(this, arguments), this
-    else
-      return WriteStream.apply(Object.create(WriteStream.prototype), arguments)
-  }
+ansiStyles.bgColor.closeRe = new RegExp(escapeStringRegexp(ansiStyles.bgColor.close), 'g');
+for (const model of Object.keys(ansiStyles.bgColor.ansi)) {
+	if (skipModels.has(model)) {
+		continue;
+	}
 
-  function WriteStream$open () {
-    var that = this
-    open(that.path, that.flags, that.mode, function (err, fd) {
-      if (err) {
-        that.destroy()
-        that.emit('error', err)
-      } else {
-        that.fd = fd
-        that.emit('open', fd)
-      }
-    })
-  }
+	const bgModel = 'bg' + model[0].toUpperCase() + model.slice(1);
+	styles[bgModel] = {
+		get() {
+			const level = this.level;
+			return function () {
+				const open = ansiStyles.bgColor[levelMapping[level]][model].apply(null, arguments);
+				const codes = {
+					open,
+					close: ansiStyles.bgColor.close,
+					closeRe: ansiStyles.bgColor.closeRe
+				};
+				return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, model);
+			};
+		}
+	};
+}
 
-  function createReadStream (path, options) {
-    return new fs.ReadStream(path, options)
-  }
+const proto = Object.defineProperties(() => {}, styles);
 
-  function createWriteStream (path, options) {
-    return new fs.WriteStream(path, options)
-  }
+function build(_styles, _empty, key) {
+	const builder = function () {
+		return applyStyle.apply(builder, arguments);
+	};
 
-  var fs$open = fs.open
-  fs.open = open
-  function open (path, flags, mode, cb) {
-    if (typeof mode === 'function')
-      cb = mode, mode = null
+	builder._styles = _styles;
+	builder._empty = _empty;
 
-    return go$open(path, flags, mode, cb)
+	const self = this;
 
-    function go$open (path, flags, mode, cb) {
-      return fs$open(path, flags, mode, function (err, fd) {
-        if (err && (err.code === 'EMFILE' || err.code === 'ENFILE'))
-          enqueue([go$open, [path, flags, mode, cb]])
-        else {
-          if (typeof cb === 'function')
-            cb.apply(this, arguments)
-          retry()
-        }
-      })
-    }
-  }
+	Object.defineProperty(builder, 'level', {
+		enumerable: true,
+		get() {
+			return self.level;
+		},
+		set(level) {
+			self.level = level;
+		}
+	});
 
-  return fs
-}
+	Object.defineProperty(builder, 'enabled', {
+		enumerable: true,
+		get() {
+			return self.enabled;
+		},
+		set(enabled) {
+			self.enabled = enabled;
+		}
+	});
 
-function enqueue (elem) {
-  debug('ENQUEUE', elem[0].name, elem[1])
-  global[gracefulQueue].push(elem)
-}
+	// See below for fix regarding invisible grey/dim combination on Windows
+	builder.hasGrey = this.hasGrey || key === 'gray' || key === 'grey';
 
-function retry () {
-  var elem = global[gracefulQueue].shift()
-  if (elem) {
-    debug('RETRY', elem[0].name, elem[1])
-    elem[0].apply(null, elem[1])
-  }
+	// `__proto__` is used because we must return a function, but there is
+	// no way to create a function with a different prototype
+	builder.__proto__ = proto; // eslint-disable-line no-proto
+
+	return builder;
 }
 
+function applyStyle() {
+	// Support varags, but simply cast to string in case there's only one arg
+	const args = arguments;
+	const argsLen = args.length;
+	let str = String(arguments[0]);
 
-/***/ }),
-/* 665 */
-/***/ (function(module, exports, __webpack_require__) {
+	if (argsLen === 0) {
+		return '';
+	}
 
-var constants = __webpack_require__(25)
+	if (argsLen > 1) {
+		// Don't slice `arguments`, it prevents V8 optimizations
+		for (let a = 1; a < argsLen; a++) {
+			str += ' ' + args[a];
+		}
+	}
 
-var origCwd = process.cwd
-var cwd = null
+	if (!this.enabled || this.level <= 0 || !str) {
+		return this._empty ? '' : str;
+	}
 
-var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform
+	// Turns out that on Windows dimmed gray text becomes invisible in cmd.exe,
+	// see https://github.com/chalk/chalk/issues/58
+	// If we're on Windows and we're dealing with a gray color, temporarily make 'dim' a noop.
+	const originalDim = ansiStyles.dim.open;
+	if (isSimpleWindowsTerm && this.hasGrey) {
+		ansiStyles.dim.open = '';
+	}
 
-process.cwd = function() {
-  if (!cwd)
-    cwd = origCwd.call(process)
-  return cwd
-}
-try {
-  process.cwd()
-} catch (er) {}
+	for (const code of this._styles.slice().reverse()) {
+		// Replace any instances already present with a re-opening code
+		// otherwise only the part of the string until said closing code
+		// will be colored, and the rest will simply be 'plain'.
+		str = code.open + str.replace(code.closeRe, code.open) + code.close;
 
-var chdir = process.chdir
-process.chdir = function(d) {
-  cwd = null
-  chdir.call(process, d)
-}
+		// Close the styling before a linebreak and reopen
+		// after next line to fix a bleed issue on macOS
+		// https://github.com/chalk/chalk/pull/92
+		str = str.replace(/\r?\n/g, `${code.close}$&${code.open}`);
+	}
 
-module.exports = patch
+	// Reset the original `dim` if we changed it to work around the Windows dimmed gray issue
+	ansiStyles.dim.open = originalDim;
 
-function patch (fs) {
-  // (re-)implement some things that are known busted or missing.
+	return str;
+}
 
-  // lchmod, broken prior to 0.6.2
-  // back-port the fix here.
-  if (constants.hasOwnProperty('O_SYMLINK') &&
-      process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-    patchLchmod(fs)
-  }
+function chalkTag(chalk, strings) {
+	if (!Array.isArray(strings)) {
+		// If chalk() was called by itself or with a string,
+		// return the string itself as a string.
+		return [].slice.call(arguments, 1).join(' ');
+	}
 
-  // lutimes implementation, or no-op
-  if (!fs.lutimes) {
-    patchLutimes(fs)
-  }
+	const args = [].slice.call(arguments, 2);
+	const parts = [strings.raw[0]];
 
-  // https://github.com/isaacs/node-graceful-fs/issues/4
-  // Chown should not fail on einval or eperm if non-root.
-  // It should not fail on enosys ever, as this just indicates
-  // that a fs doesn't support the intended operation.
+	for (let i = 1; i < strings.length; i++) {
+		parts.push(String(args[i - 1]).replace(/[{}\\]/g, '\\$&'));
+		parts.push(String(strings.raw[i]));
+	}
 
-  fs.chown = chownFix(fs.chown)
-  fs.fchown = chownFix(fs.fchown)
-  fs.lchown = chownFix(fs.lchown)
+	return template(chalk, parts.join(''));
+}
 
-  fs.chmod = chmodFix(fs.chmod)
-  fs.fchmod = chmodFix(fs.fchmod)
-  fs.lchmod = chmodFix(fs.lchmod)
+Object.defineProperties(Chalk.prototype, styles);
 
-  fs.chownSync = chownFixSync(fs.chownSync)
-  fs.fchownSync = chownFixSync(fs.fchownSync)
-  fs.lchownSync = chownFixSync(fs.lchownSync)
+module.exports = Chalk(); // eslint-disable-line new-cap
+module.exports.supportsColor = stdoutColor;
+module.exports.default = module.exports; // For TypeScript
 
-  fs.chmodSync = chmodFixSync(fs.chmodSync)
-  fs.fchmodSync = chmodFixSync(fs.fchmodSync)
-  fs.lchmodSync = chmodFixSync(fs.lchmodSync)
 
-  fs.stat = statFix(fs.stat)
-  fs.fstat = statFix(fs.fstat)
-  fs.lstat = statFix(fs.lstat)
+/***/ }),
+/* 678 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  fs.statSync = statFixSync(fs.statSync)
-  fs.fstatSync = statFixSync(fs.fstatSync)
-  fs.lstatSync = statFixSync(fs.lstatSync)
+"use strict";
+/* WEBPACK VAR INJECTION */(function(module) {
+const colorConvert = __webpack_require__(6);
 
-  // if lchmod/lchown do not exist, then make them no-ops
-  if (!fs.lchmod) {
-    fs.lchmod = function (path, mode, cb) {
-      if (cb) process.nextTick(cb)
-    }
-    fs.lchmodSync = function () {}
-  }
-  if (!fs.lchown) {
-    fs.lchown = function (path, uid, gid, cb) {
-      if (cb) process.nextTick(cb)
-    }
-    fs.lchownSync = function () {}
-  }
+const wrapAnsi16 = (fn, offset) => function () {
+	const code = fn.apply(colorConvert, arguments);
+	return `\u001B[${code + offset}m`;
+};
 
-  // on Windows, A/V software can lock the directory, causing this
-  // to fail with an EACCES or EPERM if the directory contains newly
-  // created files.  Try again on failure, for up to 60 seconds.
+const wrapAnsi256 = (fn, offset) => function () {
+	const code = fn.apply(colorConvert, arguments);
+	return `\u001B[${38 + offset};5;${code}m`;
+};
 
-  // Set the timeout this long because some Windows Anti-Virus, such as Parity
-  // bit9, may lock files for up to a minute, causing npm package install
-  // failures. Also, take care to yield the scheduler. Windows scheduling gives
-  // CPU to a busy looping process, which can cause the program causing the lock
-  // contention to be starved of CPU by node, so the contention doesn't resolve.
-  if (platform === "win32") {
-    fs.rename = (function (fs$rename) { return function (from, to, cb) {
-      var start = Date.now()
-      var backoff = 0;
-      fs$rename(from, to, function CB (er) {
-        if (er
-            && (er.code === "EACCES" || er.code === "EPERM")
-            && Date.now() - start < 60000) {
-          setTimeout(function() {
-            fs.stat(to, function (stater, st) {
-              if (stater && stater.code === "ENOENT")
-                fs$rename(from, to, CB);
-              else
-                cb(er)
-            })
-          }, backoff)
-          if (backoff < 100)
-            backoff += 10;
-          return;
-        }
-        if (cb) cb(er)
-      })
-    }})(fs.rename)
-  }
+const wrapAnsi16m = (fn, offset) => function () {
+	const rgb = fn.apply(colorConvert, arguments);
+	return `\u001B[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;
+};
 
-  // if read() returns EAGAIN, then just try it again.
-  fs.read = (function (fs$read) {
-    function read (fd, buffer, offset, length, position, callback_) {
-      var callback
-      if (callback_ && typeof callback_ === 'function') {
-        var eagCounter = 0
-        callback = function (er, _, __) {
-          if (er && er.code === 'EAGAIN' && eagCounter < 10) {
-            eagCounter ++
-            return fs$read.call(fs, fd, buffer, offset, length, position, callback)
-          }
-          callback_.apply(this, arguments)
-        }
-      }
-      return fs$read.call(fs, fd, buffer, offset, length, position, callback)
-    }
+function assembleStyles() {
+	const codes = new Map();
+	const styles = {
+		modifier: {
+			reset: [0, 0],
+			// 21 isn't widely supported and 22 does the same thing
+			bold: [1, 22],
+			dim: [2, 22],
+			italic: [3, 23],
+			underline: [4, 24],
+			inverse: [7, 27],
+			hidden: [8, 28],
+			strikethrough: [9, 29]
+		},
+		color: {
+			black: [30, 39],
+			red: [31, 39],
+			green: [32, 39],
+			yellow: [33, 39],
+			blue: [34, 39],
+			magenta: [35, 39],
+			cyan: [36, 39],
+			white: [37, 39],
+			gray: [90, 39],
 
-    // This ensures `util.promisify` works as it does for native `fs.read`.
-    read.__proto__ = fs$read
-    return read
-  })(fs.read)
+			// Bright color
+			redBright: [91, 39],
+			greenBright: [92, 39],
+			yellowBright: [93, 39],
+			blueBright: [94, 39],
+			magentaBright: [95, 39],
+			cyanBright: [96, 39],
+			whiteBright: [97, 39]
+		},
+		bgColor: {
+			bgBlack: [40, 49],
+			bgRed: [41, 49],
+			bgGreen: [42, 49],
+			bgYellow: [43, 49],
+			bgBlue: [44, 49],
+			bgMagenta: [45, 49],
+			bgCyan: [46, 49],
+			bgWhite: [47, 49],
 
-  fs.readSync = (function (fs$readSync) { return function (fd, buffer, offset, length, position) {
-    var eagCounter = 0
-    while (true) {
-      try {
-        return fs$readSync.call(fs, fd, buffer, offset, length, position)
-      } catch (er) {
-        if (er.code === 'EAGAIN' && eagCounter < 10) {
-          eagCounter ++
-          continue
-        }
-        throw er
-      }
-    }
-  }})(fs.readSync)
+			// Bright color
+			bgBlackBright: [100, 49],
+			bgRedBright: [101, 49],
+			bgGreenBright: [102, 49],
+			bgYellowBright: [103, 49],
+			bgBlueBright: [104, 49],
+			bgMagentaBright: [105, 49],
+			bgCyanBright: [106, 49],
+			bgWhiteBright: [107, 49]
+		}
+	};
 
-  function patchLchmod (fs) {
-    fs.lchmod = function (path, mode, callback) {
-      fs.open( path
-             , constants.O_WRONLY | constants.O_SYMLINK
-             , mode
-             , function (err, fd) {
-        if (err) {
-          if (callback) callback(err)
-          return
-        }
-        // prefer to return the chmod error, if one occurs,
-        // but still try to close, and report closing errors if they occur.
-        fs.fchmod(fd, mode, function (err) {
-          fs.close(fd, function(err2) {
-            if (callback) callback(err || err2)
-          })
-        })
-      })
-    }
+	// Fix humans
+	styles.color.grey = styles.color.gray;
 
-    fs.lchmodSync = function (path, mode) {
-      var fd = fs.openSync(path, constants.O_WRONLY | constants.O_SYMLINK, mode)
+	for (const groupName of Object.keys(styles)) {
+		const group = styles[groupName];
 
-      // prefer to return the chmod error, if one occurs,
-      // but still try to close, and report closing errors if they occur.
-      var threw = true
-      var ret
-      try {
-        ret = fs.fchmodSync(fd, mode)
-        threw = false
-      } finally {
-        if (threw) {
-          try {
-            fs.closeSync(fd)
-          } catch (er) {}
-        } else {
-          fs.closeSync(fd)
-        }
-      }
-      return ret
-    }
-  }
+		for (const styleName of Object.keys(group)) {
+			const style = group[styleName];
 
-  function patchLutimes (fs) {
-    if (constants.hasOwnProperty("O_SYMLINK")) {
-      fs.lutimes = function (path, at, mt, cb) {
-        fs.open(path, constants.O_SYMLINK, function (er, fd) {
-          if (er) {
-            if (cb) cb(er)
-            return
-          }
-          fs.futimes(fd, at, mt, function (er) {
-            fs.close(fd, function (er2) {
-              if (cb) cb(er || er2)
-            })
-          })
-        })
-      }
+			styles[styleName] = {
+				open: `\u001B[${style[0]}m`,
+				close: `\u001B[${style[1]}m`
+			};
 
-      fs.lutimesSync = function (path, at, mt) {
-        var fd = fs.openSync(path, constants.O_SYMLINK)
-        var ret
-        var threw = true
-        try {
-          ret = fs.futimesSync(fd, at, mt)
-          threw = false
-        } finally {
-          if (threw) {
-            try {
-              fs.closeSync(fd)
-            } catch (er) {}
-          } else {
-            fs.closeSync(fd)
-          }
-        }
-        return ret
-      }
+			group[styleName] = styles[styleName];
 
-    } else {
-      fs.lutimes = function (_a, _b, _c, cb) { if (cb) process.nextTick(cb) }
-      fs.lutimesSync = function () {}
-    }
-  }
+			codes.set(style[0], style[1]);
+		}
 
-  function chmodFix (orig) {
-    if (!orig) return orig
-    return function (target, mode, cb) {
-      return orig.call(fs, target, mode, function (er) {
-        if (chownErOk(er)) er = null
-        if (cb) cb.apply(this, arguments)
-      })
-    }
-  }
+		Object.defineProperty(styles, groupName, {
+			value: group,
+			enumerable: false
+		});
 
-  function chmodFixSync (orig) {
-    if (!orig) return orig
-    return function (target, mode) {
-      try {
-        return orig.call(fs, target, mode)
-      } catch (er) {
-        if (!chownErOk(er)) throw er
-      }
-    }
-  }
+		Object.defineProperty(styles, 'codes', {
+			value: codes,
+			enumerable: false
+		});
+	}
 
+	const ansi2ansi = n => n;
+	const rgb2rgb = (r, g, b) => [r, g, b];
 
-  function chownFix (orig) {
-    if (!orig) return orig
-    return function (target, uid, gid, cb) {
-      return orig.call(fs, target, uid, gid, function (er) {
-        if (chownErOk(er)) er = null
-        if (cb) cb.apply(this, arguments)
-      })
-    }
-  }
+	styles.color.close = '\u001B[39m';
+	styles.bgColor.close = '\u001B[49m';
 
-  function chownFixSync (orig) {
-    if (!orig) return orig
-    return function (target, uid, gid) {
-      try {
-        return orig.call(fs, target, uid, gid)
-      } catch (er) {
-        if (!chownErOk(er)) throw er
-      }
-    }
-  }
+	styles.color.ansi = {
+		ansi: wrapAnsi16(ansi2ansi, 0)
+	};
+	styles.color.ansi256 = {
+		ansi256: wrapAnsi256(ansi2ansi, 0)
+	};
+	styles.color.ansi16m = {
+		rgb: wrapAnsi16m(rgb2rgb, 0)
+	};
 
-  function statFix (orig) {
-    if (!orig) return orig
-    // Older versions of Node erroneously returned signed integers for
-    // uid + gid.
-    return function (target, options, cb) {
-      if (typeof options === 'function') {
-        cb = options
-        options = null
-      }
-      function callback (er, stats) {
-        if (stats) {
-          if (stats.uid < 0) stats.uid += 0x100000000
-          if (stats.gid < 0) stats.gid += 0x100000000
-        }
-        if (cb) cb.apply(this, arguments)
-      }
-      return options ? orig.call(fs, target, options, callback)
-        : orig.call(fs, target, callback)
-    }
-  }
+	styles.bgColor.ansi = {
+		ansi: wrapAnsi16(ansi2ansi, 10)
+	};
+	styles.bgColor.ansi256 = {
+		ansi256: wrapAnsi256(ansi2ansi, 10)
+	};
+	styles.bgColor.ansi16m = {
+		rgb: wrapAnsi16m(rgb2rgb, 10)
+	};
 
-  function statFixSync (orig) {
-    if (!orig) return orig
-    // Older versions of Node erroneously returned signed integers for
-    // uid + gid.
-    return function (target, options) {
-      var stats = options ? orig.call(fs, target, options)
-        : orig.call(fs, target)
-      if (stats.uid < 0) stats.uid += 0x100000000
-      if (stats.gid < 0) stats.gid += 0x100000000
-      return stats;
-    }
-  }
+	for (let key of Object.keys(colorConvert)) {
+		if (typeof colorConvert[key] !== 'object') {
+			continue;
+		}
 
-  // ENOSYS means that the fs doesn't support the op. Just ignore
-  // that, because it doesn't matter.
-  //
-  // if there's no getuid, or if getuid() is something other
-  // than 0, and the error is EINVAL or EPERM, then just ignore
-  // it.
-  //
-  // This specific case is a silent failure in cp, install, tar,
-  // and most other unix tools that manage permissions.
-  //
-  // When running as root, or if other types of errors are
-  // encountered, then it's strict.
-  function chownErOk (er) {
-    if (!er)
-      return true
+		const suite = colorConvert[key];
 
-    if (er.code === "ENOSYS")
-      return true
+		if (key === 'ansi16') {
+			key = 'ansi';
+		}
 
-    var nonroot = !process.getuid || process.getuid() !== 0
-    if (nonroot) {
-      if (er.code === "EINVAL" || er.code === "EPERM")
-        return true
-    }
+		if ('ansi16' in suite) {
+			styles.color.ansi[key] = wrapAnsi16(suite.ansi16, 0);
+			styles.bgColor.ansi[key] = wrapAnsi16(suite.ansi16, 10);
+		}
 
-    return false
-  }
+		if ('ansi256' in suite) {
+			styles.color.ansi256[key] = wrapAnsi256(suite.ansi256, 0);
+			styles.bgColor.ansi256[key] = wrapAnsi256(suite.ansi256, 10);
+		}
+
+		if ('rgb' in suite) {
+			styles.color.ansi16m[key] = wrapAnsi16m(suite.rgb, 0);
+			styles.bgColor.ansi16m[key] = wrapAnsi16m(suite.rgb, 10);
+		}
+	}
+
+	return styles;
 }
 
+// Make the export immutable
+Object.defineProperty(module, 'exports', {
+	enumerable: true,
+	get: assembleStyles
+});
+
+/* WEBPACK VAR INJECTION */}.call(this, __webpack_require__(5)(module)))
 
 /***/ }),
-/* 666 */
+/* 679 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var Stream = __webpack_require__(27).Stream
-
-module.exports = legacy
-
-function legacy (fs) {
-  return {
-    ReadStream: ReadStream,
-    WriteStream: WriteStream
-  }
+"use strict";
 
-  function ReadStream (path, options) {
-    if (!(this instanceof ReadStream)) return new ReadStream(path, options);
+const os = __webpack_require__(11);
+const hasFlag = __webpack_require__(12);
 
-    Stream.call(this);
+const env = process.env;
 
-    var self = this;
+let forceColor;
+if (hasFlag('no-color') ||
+	hasFlag('no-colors') ||
+	hasFlag('color=false')) {
+	forceColor = false;
+} else if (hasFlag('color') ||
+	hasFlag('colors') ||
+	hasFlag('color=true') ||
+	hasFlag('color=always')) {
+	forceColor = true;
+}
+if ('FORCE_COLOR' in env) {
+	forceColor = env.FORCE_COLOR.length === 0 || parseInt(env.FORCE_COLOR, 10) !== 0;
+}
 
-    this.path = path;
-    this.fd = null;
-    this.readable = true;
-    this.paused = false;
+function translateLevel(level) {
+	if (level === 0) {
+		return false;
+	}
 
-    this.flags = 'r';
-    this.mode = 438; /*=0666*/
-    this.bufferSize = 64 * 1024;
+	return {
+		level,
+		hasBasic: true,
+		has256: level >= 2,
+		has16m: level >= 3
+	};
+}
 
-    options = options || {};
+function supportsColor(stream) {
+	if (forceColor === false) {
+		return 0;
+	}
 
-    // Mixin options into this
-    var keys = Object.keys(options);
-    for (var index = 0, length = keys.length; index < length; index++) {
-      var key = keys[index];
-      this[key] = options[key];
-    }
+	if (hasFlag('color=16m') ||
+		hasFlag('color=full') ||
+		hasFlag('color=truecolor')) {
+		return 3;
+	}
 
-    if (this.encoding) this.setEncoding(this.encoding);
+	if (hasFlag('color=256')) {
+		return 2;
+	}
 
-    if (this.start !== undefined) {
-      if ('number' !== typeof this.start) {
-        throw TypeError('start must be a Number');
-      }
-      if (this.end === undefined) {
-        this.end = Infinity;
-      } else if ('number' !== typeof this.end) {
-        throw TypeError('end must be a Number');
-      }
+	if (stream && !stream.isTTY && forceColor !== true) {
+		// VS code debugger doesn't have isTTY set
+		if (env.VSCODE_PID) {
+			return 1;
+		}
+		return 0;
+	}
 
-      if (this.start > this.end) {
-        throw new Error('start must be <= end');
-      }
+	const min = forceColor ? 1 : 0;
 
-      this.pos = this.start;
-    }
+	if (process.platform === 'win32') {
+		// Node.js 7.5.0 is the first version of Node.js to include a patch to
+		// libuv that enables 256 color output on Windows. Anything earlier and it
+		// won't work. However, here we target Node.js 8 at minimum as it is an LTS
+		// release, and Node.js 7 is not. Windows 10 build 10586 is the first Windows
+		// release that supports 256 colors. Windows 10 build 14931 is the first release
+		// that supports 16m/TrueColor.
+		const osRelease = os.release().split('.');
+		if (
+			Number(process.versions.node.split('.')[0]) >= 8 &&
+			Number(osRelease[0]) >= 10 &&
+			Number(osRelease[2]) >= 10586
+		) {
+			return Number(osRelease[2]) >= 14931 ? 3 : 2;
+		}
 
-    if (this.fd !== null) {
-      process.nextTick(function() {
-        self._read();
-      });
-      return;
-    }
+		return 1;
+	}
 
-    fs.open(this.path, this.flags, this.mode, function (err, fd) {
-      if (err) {
-        self.emit('error', err);
-        self.readable = false;
-        return;
-      }
+	if ('CI' in env) {
+		if (['TRAVIS', 'CIRCLECI', 'APPVEYOR', 'GITLAB_CI'].some(sign => sign in env) || env.CI_NAME === 'codeship') {
+			return 1;
+		}
 
-      self.fd = fd;
-      self.emit('open', fd);
-      self._read();
-    })
-  }
+		return min;
+	}
 
-  function WriteStream (path, options) {
-    if (!(this instanceof WriteStream)) return new WriteStream(path, options);
+	if ('TEAMCITY_VERSION' in env) {
+		return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
+	}
 
-    Stream.call(this);
+	if (env.COLORTERM === 'truecolor') {
+		return 3;
+	}
 
-    this.path = path;
-    this.fd = null;
-    this.writable = true;
+	if ('TERM_PROGRAM' in env) {
+		const version = parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);
 
-    this.flags = 'w';
-    this.encoding = 'binary';
-    this.mode = 438; /*=0666*/
-    this.bytesWritten = 0;
+		switch (env.TERM_PROGRAM) {
+			case 'iTerm.app':
+				return version >= 3 ? 3 : 2;
+			case 'Apple_Terminal':
+				return 2;
+			// No default
+		}
+	}
 
-    options = options || {};
+	if (/-256(color)?$/i.test(env.TERM)) {
+		return 2;
+	}
 
-    // Mixin options into this
-    var keys = Object.keys(options);
-    for (var index = 0, length = keys.length; index < length; index++) {
-      var key = keys[index];
-      this[key] = options[key];
-    }
+	if (/^screen|^xterm|^vt100|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
+		return 1;
+	}
 
-    if (this.start !== undefined) {
-      if ('number' !== typeof this.start) {
-        throw TypeError('start must be a Number');
-      }
-      if (this.start < 0) {
-        throw new Error('start must be >= zero');
-      }
+	if ('COLORTERM' in env) {
+		return 1;
+	}
 
-      this.pos = this.start;
-    }
+	if (env.TERM === 'dumb') {
+		return min;
+	}
 
-    this.busy = false;
-    this._queue = [];
+	return min;
+}
 
-    if (this.fd === null) {
-      this._open = fs.open;
-      this._queue.push([this._open, this.path, this.flags, this.mode, undefined]);
-      this.flush();
-    }
-  }
+function getSupportLevel(stream) {
+	const level = supportsColor(stream);
+	return translateLevel(level);
 }
 
+module.exports = {
+	supportsColor: getSupportLevel,
+	stdout: getSupportLevel(process.stdout),
+	stderr: getSupportLevel(process.stderr)
+};
+
 
 /***/ }),
-/* 667 */
+/* 680 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
+const TEMPLATE_REGEX = /(?:\\(u[a-f\d]{4}|x[a-f\d]{2}|.))|(?:\{(~)?(\w+(?:\([^)]*\))?(?:\.\w+(?:\([^)]*\))?)*)(?:[ \t]|(?=\r?\n)))|(\})|((?:.|[\r\n\f])+?)/gi;
+const STYLE_REGEX = /(?:^|\.)(\w+)(?:\(([^)]*)\))?/g;
+const STRING_REGEX = /^(['"])((?:\\.|(?!\1)[^\\])*)\1$/;
+const ESCAPE_REGEX = /\\(u[a-f\d]{4}|x[a-f\d]{2}|.)|([^\\])/gi;
 
-module.exports = clone
+const ESCAPES = new Map([
+	['n', '\n'],
+	['r', '\r'],
+	['t', '\t'],
+	['b', '\b'],
+	['f', '\f'],
+	['v', '\v'],
+	['0', '\0'],
+	['\\', '\\'],
+	['e', '\u001B'],
+	['a', '\u0007']
+]);
 
-function clone (obj) {
-  if (obj === null || typeof obj !== 'object')
-    return obj
+function unescape(c) {
+	if ((c[0] === 'u' && c.length === 5) || (c[0] === 'x' && c.length === 3)) {
+		return String.fromCharCode(parseInt(c.slice(1), 16));
+	}
 
-  if (obj instanceof Object)
-    var copy = { __proto__: obj.__proto__ }
-  else
-    var copy = Object.create(null)
+	return ESCAPES.get(c) || c;
+}
 
-  Object.getOwnPropertyNames(obj).forEach(function (key) {
-    Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key))
-  })
+function parseArguments(name, args) {
+	const results = [];
+	const chunks = args.trim().split(/\s*,\s*/g);
+	let matches;
 
-  return copy
+	for (const chunk of chunks) {
+		if (!isNaN(chunk)) {
+			results.push(Number(chunk));
+		} else if ((matches = chunk.match(STRING_REGEX))) {
+			results.push(matches[2].replace(ESCAPE_REGEX, (m, escape, chr) => escape ? unescape(escape) : chr));
+		} else {
+			throw new Error(`Invalid Chalk template style argument: ${chunk} (in style '${name}')`);
+		}
+	}
+
+	return results;
 }
 
+function parseStyle(style) {
+	STYLE_REGEX.lastIndex = 0;
 
-/***/ }),
-/* 668 */
-/***/ (function(module, exports, __webpack_require__) {
+	const results = [];
+	let matches;
 
-"use strict";
+	while ((matches = STYLE_REGEX.exec(style)) !== null) {
+		const name = matches[1];
 
-const path = __webpack_require__(16);
+		if (matches[2]) {
+			const args = parseArguments(name, matches[2]);
+			results.push([name].concat(args));
+		} else {
+			results.push([name]);
+		}
+	}
 
-module.exports = path_ => {
-	let cwd = process.cwd();
+	return results;
+}
 
-	path_ = path.resolve(path_);
+function buildStyle(chalk, styles) {
+	const enabled = {};
 
-	if (process.platform === 'win32') {
-		cwd = cwd.toLowerCase();
-		path_ = path_.toLowerCase();
+	for (const layer of styles) {
+		for (const style of layer.styles) {
+			enabled[style[0]] = layer.inverse ? null : style.slice(1);
+		}
 	}
 
-	return path_ === cwd;
+	let current = chalk;
+	for (const styleName of Object.keys(enabled)) {
+		if (Array.isArray(enabled[styleName])) {
+			if (!(styleName in current)) {
+				throw new Error(`Unknown Chalk style: ${styleName}`);
+			}
+
+			if (enabled[styleName].length > 0) {
+				current = current[styleName].apply(current, enabled[styleName]);
+			} else {
+				current = current[styleName];
+			}
+		}
+	}
+
+	return current;
+}
+
+module.exports = (chalk, tmp) => {
+	const styles = [];
+	const chunks = [];
+	let chunk = [];
+
+	// eslint-disable-next-line max-params
+	tmp.replace(TEMPLATE_REGEX, (m, escapeChar, inverse, style, close, chr) => {
+		if (escapeChar) {
+			chunk.push(unescape(escapeChar));
+		} else if (style) {
+			const str = chunk.join('');
+			chunk = [];
+			chunks.push(styles.length === 0 ? str : buildStyle(chalk, styles)(str));
+			styles.push({inverse, styles: parseStyle(style)});
+		} else if (close) {
+			if (styles.length === 0) {
+				throw new Error('Found extraneous } in Chalk template literal');
+			}
+
+			chunks.push(buildStyle(chalk, styles)(chunk.join('')));
+			chunk = [];
+			styles.pop();
+		} else {
+			chunk.push(chr);
+		}
+	});
+
+	chunks.push(chunk.join(''));
+
+	if (styles.length > 0) {
+		const errMsg = `Chalk template literal is missing ${styles.length} closing bracket${styles.length === 1 ? '' : 's'} (\`}\`)`;
+		throw new Error(errMsg);
+	}
+
+	return chunks.join('');
 };
 
 
 /***/ }),
-/* 669 */
+/* 681 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const path = __webpack_require__(16);
+const restoreCursor = __webpack_require__(682);
 
-module.exports = (childPath, parentPath) => {
-	childPath = path.resolve(childPath);
-	parentPath = path.resolve(parentPath);
+let hidden = false;
 
-	if (process.platform === 'win32') {
-		childPath = childPath.toLowerCase();
-		parentPath = parentPath.toLowerCase();
+exports.show = stream => {
+	const s = stream || process.stderr;
+
+	if (!s.isTTY) {
+		return;
 	}
 
-	if (childPath === parentPath) {
-		return false;
+	hidden = false;
+	s.write('\u001b[?25h');
+};
+
+exports.hide = stream => {
+	const s = stream || process.stderr;
+
+	if (!s.isTTY) {
+		return;
 	}
 
-	childPath += path.sep;
-	parentPath += path.sep;
+	restoreCursor();
+	hidden = true;
+	s.write('\u001b[?25l');
+};
 
-	return childPath.startsWith(parentPath);
+exports.toggle = (force, stream) => {
+	if (force !== undefined) {
+		hidden = force;
+	}
+
+	if (hidden) {
+		exports.show(stream);
+	} else {
+		exports.hide(stream);
+	}
 };
 
 
 /***/ }),
-/* 670 */
+/* 682 */
 /***/ (function(module, exports, __webpack_require__) {
 
-const assert = __webpack_require__(30)
-const path = __webpack_require__(16)
-const fs = __webpack_require__(23)
-let glob = undefined
-try {
-  glob = __webpack_require__(502)
-} catch (_err) {
-  // treat glob as optional.
-}
+"use strict";
 
-const defaultGlobOpts = {
-  nosort: true,
-  silent: true
-}
+const onetime = __webpack_require__(683);
+const signalExit = __webpack_require__(377);
 
-// for EMFILE handling
-let timeout = 0
+module.exports = onetime(() => {
+	signalExit(() => {
+		process.stderr.write('\u001b[?25h');
+	}, {alwaysLast: true});
+});
 
-const isWindows = (process.platform === "win32")
 
-const defaults = options => {
-  const methods = [
-    'unlink',
-    'chmod',
-    'stat',
-    'lstat',
-    'rmdir',
-    'readdir'
-  ]
-  methods.forEach(m => {
-    options[m] = options[m] || fs[m]
-    m = m + 'Sync'
-    options[m] = options[m] || fs[m]
-  })
+/***/ }),
+/* 683 */
+/***/ (function(module, exports, __webpack_require__) {
+
+"use strict";
+
+const mimicFn = __webpack_require__(684);
+
+module.exports = (fn, opts) => {
+	// TODO: Remove this in v3
+	if (opts === true) {
+		throw new TypeError('The second argument is now an options object');
+	}
+
+	if (typeof fn !== 'function') {
+		throw new TypeError('Expected a function');
+	}
+
+	opts = opts || {};
+
+	let ret;
+	let called = false;
+	const fnName = fn.displayName || fn.name || '<anonymous>';
 
-  options.maxBusyTries = options.maxBusyTries || 3
-  options.emfileWait = options.emfileWait || 1000
-  if (options.glob === false) {
-    options.disableGlob = true
-  }
-  if (options.disableGlob !== true && glob === undefined) {
-    throw Error('glob dependency not found, set `options.disableGlob = true` if intentional')
-  }
-  options.disableGlob = options.disableGlob || false
-  options.glob = options.glob || defaultGlobOpts
-}
+	const onetime = function () {
+		if (called) {
+			if (opts.throw === true) {
+				throw new Error(`Function \`${fnName}\` can only be called once`);
+			}
 
-const rimraf = (p, options, cb) => {
-  if (typeof options === 'function') {
-    cb = options
-    options = {}
-  }
+			return ret;
+		}
 
-  assert(p, 'rimraf: missing path')
-  assert.equal(typeof p, 'string', 'rimraf: path should be a string')
-  assert.equal(typeof cb, 'function', 'rimraf: callback function required')
-  assert(options, 'rimraf: invalid options argument provided')
-  assert.equal(typeof options, 'object', 'rimraf: options should be object')
+		called = true;
+		ret = fn.apply(this, arguments);
+		fn = null;
 
-  defaults(options)
+		return ret;
+	};
 
-  let busyTries = 0
-  let errState = null
-  let n = 0
+	mimicFn(onetime, fn);
 
-  const next = (er) => {
-    errState = errState || er
-    if (--n === 0)
-      cb(errState)
-  }
+	return onetime;
+};
 
-  const afterGlob = (er, results) => {
-    if (er)
-      return cb(er)
 
-    n = results.length
-    if (n === 0)
-      return cb()
+/***/ }),
+/* 684 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    results.forEach(p => {
-      const CB = (er) => {
-        if (er) {
-          if ((er.code === "EBUSY" || er.code === "ENOTEMPTY" || er.code === "EPERM") &&
-              busyTries < options.maxBusyTries) {
-            busyTries ++
-            // try again, with the same exact callback as this one.
-            return setTimeout(() => rimraf_(p, options, CB), busyTries * 100)
-          }
+"use strict";
 
-          // this one won't happen if graceful-fs is used.
-          if (er.code === "EMFILE" && timeout < options.emfileWait) {
-            return setTimeout(() => rimraf_(p, options, CB), timeout ++)
-          }
+module.exports = (to, from) => {
+	// TODO: use `Reflect.ownKeys()` when targeting Node.js 6
+	for (const prop of Object.getOwnPropertyNames(from).concat(Object.getOwnPropertySymbols(from))) {
+		Object.defineProperty(to, prop, Object.getOwnPropertyDescriptor(from, prop));
+	}
 
-          // already gone
-          if (er.code === "ENOENT") er = null
-        }
+	return to;
+};
 
-        timeout = 0
-        next(er)
-      }
-      rimraf_(p, options, CB)
-    })
-  }
 
-  if (options.disableGlob || !glob.hasMagic(p))
-    return afterGlob(null, [p])
+/***/ }),
+/* 685 */
+/***/ (function(module, exports, __webpack_require__) {
 
-  options.lstat(p, (er, stat) => {
-    if (!er)
-      return afterGlob(null, [p])
+"use strict";
 
-    glob(p, options.glob, afterGlob)
-  })
+module.exports = __webpack_require__(686);
 
-}
 
-// Two possible strategies.
-// 1. Assume it's a file.  unlink it, then do the dir stuff on EPERM or EISDIR
-// 2. Assume it's a directory.  readdir, then do the file stuff on ENOTDIR
-//
-// Both result in an extra syscall when you guess wrong.  However, there
-// are likely far more normal files in the world than directories.  This
-// is based on the assumption that a the average number of files per
-// directory is >= 1.
-//
-// If anyone ever complains about this, then I guess the strategy could
-// be made configurable somehow.  But until then, YAGNI.
-const rimraf_ = (p, options, cb) => {
-  assert(p)
-  assert(options)
-  assert(typeof cb === 'function')
+/***/ }),
+/* 686 */
+/***/ (function(module) {
 
-  // sunos lets the root user unlink directories, which is... weird.
-  // so we have to lstat here and make sure it's not a dir.
-  options.lstat(p, (er, st) => {
-    if (er && er.code === "ENOENT")
-      return cb(null)
+module.exports = JSON.parse("{\"dots\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠹\",\"⠸\",\"⠼\",\"⠴\",\"⠦\",\"⠧\",\"⠇\",\"⠏\"]},\"dots2\":{\"interval\":80,\"frames\":[\"⣾\",\"⣽\",\"⣻\",\"⢿\",\"⡿\",\"⣟\",\"⣯\",\"⣷\"]},\"dots3\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠚\",\"⠞\",\"⠖\",\"⠦\",\"⠴\",\"⠲\",\"⠳\",\"⠓\"]},\"dots4\":{\"interval\":80,\"frames\":[\"⠄\",\"⠆\",\"⠇\",\"⠋\",\"⠙\",\"⠸\",\"⠰\",\"⠠\",\"⠰\",\"⠸\",\"⠙\",\"⠋\",\"⠇\",\"⠆\"]},\"dots5\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\"]},\"dots6\":{\"interval\":80,\"frames\":[\"⠁\",\"⠉\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠤\",\"⠄\",\"⠄\",\"⠤\",\"⠴\",\"⠲\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠚\",\"⠙\",\"⠉\",\"⠁\"]},\"dots7\":{\"interval\":80,\"frames\":[\"⠈\",\"⠉\",\"⠋\",\"⠓\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠖\",\"⠦\",\"⠤\",\"⠠\",\"⠠\",\"⠤\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\",\"⠉\",\"⠈\"]},\"dots8\":{\"interval\":80,\"frames\":[\"⠁\",\"⠁\",\"⠉\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠤\",\"⠄\",\"⠄\",\"⠤\",\"⠠\",\"⠠\",\"⠤\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\",\"⠉\",\"⠈\",\"⠈\"]},\"dots9\":{\"interval\":80,\"frames\":[\"⢹\",\"⢺\",\"⢼\",\"⣸\",\"⣇\",\"⡧\",\"⡗\",\"⡏\"]},\"dots10\":{\"interval\":80,\"frames\":[\"⢄\",\"⢂\",\"⢁\",\"⡁\",\"⡈\",\"⡐\",\"⡠\"]},\"dots11\":{\"interval\":100,\"frames\":[\"⠁\",\"⠂\",\"⠄\",\"⡀\",\"⢀\",\"⠠\",\"⠐\",\"⠈\"]},\"dots12\":{\"interval\":80,\"frames\":[\"⢀⠀\",\"⡀⠀\",\"⠄⠀\",\"⢂⠀\",\"⡂⠀\",\"⠅⠀\",\"⢃⠀\",\"⡃⠀\",\"⠍⠀\",\"⢋⠀\",\"⡋⠀\",\"⠍⠁\",\"⢋⠁\",\"⡋⠁\",\"⠍⠉\",\"⠋⠉\",\"⠋⠉\",\"⠉⠙\",\"⠉⠙\",\"⠉⠩\",\"⠈⢙\",\"⠈⡙\",\"⢈⠩\",\"⡀⢙\",\"⠄⡙\",\"⢂⠩\",\"⡂⢘\",\"⠅⡘\",\"⢃⠨\",\"⡃⢐\",\"⠍⡐\",\"⢋⠠\",\"⡋⢀\",\"⠍⡁\",\"⢋⠁\",\"⡋⠁\",\"⠍⠉\",\"⠋⠉\",\"⠋⠉\",\"⠉⠙\",\"⠉⠙\",\"⠉⠩\",\"⠈⢙\",\"⠈⡙\",\"⠈⠩\",\"⠀⢙\",\"⠀⡙\",\"⠀⠩\",\"⠀⢘\",\"⠀⡘\",\"⠀⠨\",\"⠀⢐\",\"⠀⡐\",\"⠀⠠\",\"⠀⢀\",\"⠀⡀\"]},\"line\":{\"interval\":130,\"frames\":[\"-\",\"\\\\\",\"|\",\"/\"]},\"line2\":{\"interval\":100,\"frames\":[\"⠂\",\"-\",\"–\",\"—\",\"–\",\"-\"]},\"pipe\":{\"interval\":100,\"frames\":[\"┤\",\"┘\",\"┴\",\"└\",\"├\",\"┌\",\"┬\",\"┐\"]},\"simpleDots\":{\"interval\":400,\"frames\":[\".  \",\".. \",\"...\",\"   \"]},\"simpleDotsScrolling\":{\"interval\":200,\"frames\":[\".  \",\".. \",\"...\",\" ..\",\"  .\",\"   \"]},\"star\":{\"interval\":70,\"frames\":[\"✶\",\"✸\",\"✹\",\"✺\",\"✹\",\"✷\"]},\"star2\":{\"interval\":80,\"frames\":[\"+\",\"x\",\"*\"]},\"flip\":{\"interval\":70,\"frames\":[\"_\",\"_\",\"_\",\"-\",\"`\",\"`\",\"'\",\"´\",\"-\",\"_\",\"_\",\"_\"]},\"hamburger\":{\"interval\":100,\"frames\":[\"☱\",\"☲\",\"☴\"]},\"growVertical\":{\"interval\":120,\"frames\":[\"▁\",\"▃\",\"▄\",\"▅\",\"▆\",\"▇\",\"▆\",\"▅\",\"▄\",\"▃\"]},\"growHorizontal\":{\"interval\":120,\"frames\":[\"▏\",\"▎\",\"▍\",\"▌\",\"▋\",\"▊\",\"▉\",\"▊\",\"▋\",\"▌\",\"▍\",\"▎\"]},\"balloon\":{\"interval\":140,\"frames\":[\" \",\".\",\"o\",\"O\",\"@\",\"*\",\" \"]},\"balloon2\":{\"interval\":120,\"frames\":[\".\",\"o\",\"O\",\"°\",\"O\",\"o\",\".\"]},\"noise\":{\"interval\":100,\"frames\":[\"▓\",\"▒\",\"░\"]},\"bounce\":{\"interval\":120,\"frames\":[\"⠁\",\"⠂\",\"⠄\",\"⠂\"]},\"boxBounce\":{\"interval\":120,\"frames\":[\"▖\",\"▘\",\"▝\",\"▗\"]},\"boxBounce2\":{\"interval\":100,\"frames\":[\"▌\",\"▀\",\"▐\",\"▄\"]},\"triangle\":{\"interval\":50,\"frames\":[\"◢\",\"◣\",\"◤\",\"◥\"]},\"arc\":{\"interval\":100,\"frames\":[\"◜\",\"◠\",\"◝\",\"◞\",\"◡\",\"◟\"]},\"circle\":{\"interval\":120,\"frames\":[\"◡\",\"⊙\",\"◠\"]},\"squareCorners\":{\"interval\":180,\"frames\":[\"◰\",\"◳\",\"◲\",\"◱\"]},\"circleQuarters\":{\"interval\":120,\"frames\":[\"◴\",\"◷\",\"◶\",\"◵\"]},\"circleHalves\":{\"interval\":50,\"frames\":[\"◐\",\"◓\",\"◑\",\"◒\"]},\"squish\":{\"interval\":100,\"frames\":[\"╫\",\"╪\"]},\"toggle\":{\"interval\":250,\"frames\":[\"⊶\",\"⊷\"]},\"toggle2\":{\"interval\":80,\"frames\":[\"▫\",\"▪\"]},\"toggle3\":{\"interval\":120,\"frames\":[\"□\",\"■\"]},\"toggle4\":{\"interval\":100,\"frames\":[\"■\",\"□\",\"▪\",\"▫\"]},\"toggle5\":{\"interval\":100,\"frames\":[\"▮\",\"▯\"]},\"toggle6\":{\"interval\":300,\"frames\":[\"ဝ\",\"၀\"]},\"toggle7\":{\"interval\":80,\"frames\":[\"⦾\",\"⦿\"]},\"toggle8\":{\"interval\":100,\"frames\":[\"◍\",\"◌\"]},\"toggle9\":{\"interval\":100,\"frames\":[\"◉\",\"◎\"]},\"toggle10\":{\"interval\":100,\"frames\":[\"㊂\",\"㊀\",\"㊁\"]},\"toggle11\":{\"interval\":50,\"frames\":[\"⧇\",\"⧆\"]},\"toggle12\":{\"interval\":120,\"frames\":[\"☗\",\"☖\"]},\"toggle13\":{\"interval\":80,\"frames\":[\"=\",\"*\",\"-\"]},\"arrow\":{\"interval\":100,\"frames\":[\"←\",\"↖\",\"↑\",\"↗\",\"→\",\"↘\",\"↓\",\"↙\"]},\"arrow2\":{\"interval\":80,\"frames\":[\"⬆️ \",\"↗️ \",\"➡️ \",\"↘️ \",\"⬇️ \",\"↙️ \",\"⬅️ \",\"↖️ \"]},\"arrow3\":{\"interval\":120,\"frames\":[\"▹▹▹▹▹\",\"▸▹▹▹▹\",\"▹▸▹▹▹\",\"▹▹▸▹▹\",\"▹▹▹▸▹\",\"▹▹▹▹▸\"]},\"bouncingBar\":{\"interval\":80,\"frames\":[\"[    ]\",\"[=   ]\",\"[==  ]\",\"[=== ]\",\"[ ===]\",\"[  ==]\",\"[   =]\",\"[    ]\",\"[   =]\",\"[  ==]\",\"[ ===]\",\"[====]\",\"[=== ]\",\"[==  ]\",\"[=   ]\"]},\"bouncingBall\":{\"interval\":80,\"frames\":[\"( ●    )\",\"(  ●   )\",\"(   ●  )\",\"(    ● )\",\"(     ●)\",\"(    ● )\",\"(   ●  )\",\"(  ●   )\",\"( ●    )\",\"(●     )\"]},\"smiley\":{\"interval\":200,\"frames\":[\"😄 \",\"😝 \"]},\"monkey\":{\"interval\":300,\"frames\":[\"🙈 \",\"🙈 \",\"🙉 \",\"🙊 \"]},\"hearts\":{\"interval\":100,\"frames\":[\"💛 \",\"💙 \",\"💜 \",\"💚 \",\"❤️ \"]},\"clock\":{\"interval\":100,\"frames\":[\"🕐 \",\"🕑 \",\"🕒 \",\"🕓 \",\"🕔 \",\"🕕 \",\"🕖 \",\"🕗 \",\"🕘 \",\"🕙 \",\"🕚 \"]},\"earth\":{\"interval\":180,\"frames\":[\"🌍 \",\"🌎 \",\"🌏 \"]},\"moon\":{\"interval\":80,\"frames\":[\"🌑 \",\"🌒 \",\"🌓 \",\"🌔 \",\"🌕 \",\"🌖 \",\"🌗 \",\"🌘 \"]},\"runner\":{\"interval\":140,\"frames\":[\"🚶 \",\"🏃 \"]},\"pong\":{\"interval\":80,\"frames\":[\"▐⠂       ▌\",\"▐⠈       ▌\",\"▐ ⠂      ▌\",\"▐ ⠠      ▌\",\"▐  ⡀     ▌\",\"▐  ⠠     ▌\",\"▐   ⠂    ▌\",\"▐   ⠈    ▌\",\"▐    ⠂   ▌\",\"▐    ⠠   ▌\",\"▐     ⡀  ▌\",\"▐     ⠠  ▌\",\"▐      ⠂ ▌\",\"▐      ⠈ ▌\",\"▐       ⠂▌\",\"▐       ⠠▌\",\"▐       ⡀▌\",\"▐      ⠠ ▌\",\"▐      ⠂ ▌\",\"▐     ⠈  ▌\",\"▐     ⠂  ▌\",\"▐    ⠠   ▌\",\"▐    ⡀   ▌\",\"▐   ⠠    ▌\",\"▐   ⠂    ▌\",\"▐  ⠈     ▌\",\"▐  ⠂     ▌\",\"▐ ⠠      ▌\",\"▐ ⡀      ▌\",\"▐⠠       ▌\"]},\"shark\":{\"interval\":120,\"frames\":[\"▐|\\\\____________▌\",\"▐_|\\\\___________▌\",\"▐__|\\\\__________▌\",\"▐___|\\\\_________▌\",\"▐____|\\\\________▌\",\"▐_____|\\\\_______▌\",\"▐______|\\\\______▌\",\"▐_______|\\\\_____▌\",\"▐________|\\\\____▌\",\"▐_________|\\\\___▌\",\"▐__________|\\\\__▌\",\"▐___________|\\\\_▌\",\"▐____________|\\\\▌\",\"▐____________/|▌\",\"▐___________/|_▌\",\"▐__________/|__▌\",\"▐_________/|___▌\",\"▐________/|____▌\",\"▐_______/|_____▌\",\"▐______/|______▌\",\"▐_____/|_______▌\",\"▐____/|________▌\",\"▐___/|_________▌\",\"▐__/|__________▌\",\"▐_/|___________▌\",\"▐/|____________▌\"]},\"dqpb\":{\"interval\":100,\"frames\":[\"d\",\"q\",\"p\",\"b\"]},\"weather\":{\"interval\":100,\"frames\":[\"☀️ \",\"☀️ \",\"☀️ \",\"🌤 \",\"⛅️ \",\"🌥 \",\"☁️ \",\"🌧 \",\"🌨 \",\"🌧 \",\"🌨 \",\"🌧 \",\"🌨 \",\"⛈ \",\"🌨 \",\"🌧 \",\"🌨 \",\"☁️ \",\"🌥 \",\"⛅️ \",\"🌤 \",\"☀️ \",\"☀️ \"]},\"christmas\":{\"interval\":400,\"frames\":[\"🌲\",\"🎄\"]}}");
 
-    // Windows can EPERM on stat.  Life is suffering.
-    if (er && er.code === "EPERM" && isWindows)
-      fixWinEPERM(p, options, er, cb)
+/***/ }),
+/* 687 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
-    if (st && st.isDirectory())
-      return rmdir(p, options, er, cb)
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "RunCommand", function() { return RunCommand; });
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(34);
+/* harmony import */ var _utils_parallelize__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(500);
+/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(501);
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-    options.unlink(p, er => {
-      if (er) {
-        if (er.code === "ENOENT")
-          return cb(null)
-        if (er.code === "EPERM")
-          return (isWindows)
-            ? fixWinEPERM(p, options, er, cb)
-            : rmdir(p, options, er, cb)
-        if (er.code === "EISDIR")
-          return rmdir(p, options, er, cb)
-      }
-      return cb(er)
-    })
-  })
-}
 
-const fixWinEPERM = (p, options, er, cb) => {
-  assert(p)
-  assert(options)
-  assert(typeof cb === 'function')
-  if (er)
-    assert(er instanceof Error)
 
-  options.chmod(p, 0o666, er2 => {
-    if (er2)
-      cb(er2.code === "ENOENT" ? null : er)
-    else
-      options.stat(p, (er3, stats) => {
-        if (er3)
-          cb(er3.code === "ENOENT" ? null : er)
-        else if (stats.isDirectory())
-          rmdir(p, options, er, cb)
-        else
-          options.unlink(p, cb)
-      })
-  })
-}
 
-const fixWinEPERMSync = (p, options, er) => {
-  assert(p)
-  assert(options)
-  if (er)
-    assert(er instanceof Error)
+const RunCommand = {
+  description: 'Run script defined in package.json in each package that contains that script.',
+  name: 'run',
 
-  try {
-    options.chmodSync(p, 0o666)
-  } catch (er2) {
-    if (er2.code === "ENOENT")
-      return
-    else
-      throw er
-  }
+  async run(projects, projectGraph, {
+    extraArgs
+  }) {
+    const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_3__["topologicallyBatchProjects"])(projects, projectGraph);
 
-  let stats
-  try {
-    stats = options.statSync(p)
-  } catch (er3) {
-    if (er3.code === "ENOENT")
-      return
-    else
-      throw er
+    if (extraArgs.length === 0) {
+      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red.bold('\nNo script specified'));
+      process.exit(1);
+    }
+
+    const scriptName = extraArgs[0];
+    const scriptArgs = extraArgs.slice(1);
+    _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`\nRunning script [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(scriptName)}] in batched topological order\n`));
+    await Object(_utils_parallelize__WEBPACK_IMPORTED_MODULE_2__["parallelizeBatches"])(batchedProjects, async pkg => {
+      if (pkg.hasScript(scriptName)) {
+        await pkg.runScriptStreaming(scriptName, scriptArgs);
+      }
+    });
   }
 
-  if (stats.isDirectory())
-    rmdirSync(p, options, er)
-  else
-    options.unlinkSync(p)
-}
+};
 
-const rmdir = (p, options, originalEr, cb) => {
-  assert(p)
-  assert(options)
-  if (originalEr)
-    assert(originalEr instanceof Error)
-  assert(typeof cb === 'function')
+/***/ }),
+/* 688 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
-  // try to rmdir first, and only readdir on ENOTEMPTY or EEXIST (SunOS)
-  // if we guessed wrong, and it's not a directory, then
-  // raise the original error.
-  options.rmdir(p, er => {
-    if (er && (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM"))
-      rmkids(p, options, cb)
-    else if (er && er.code === "ENOTDIR")
-      cb(originalEr)
-    else
-      cb(er)
-  })
-}
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "WatchCommand", function() { return WatchCommand; });
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(34);
+/* harmony import */ var _utils_parallelize__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(500);
+/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(501);
+/* harmony import */ var _utils_watch__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(689);
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-const rmkids = (p, options, cb) => {
-  assert(p)
-  assert(options)
-  assert(typeof cb === 'function')
 
-  options.readdir(p, (er, files) => {
-    if (er)
-      return cb(er)
-    let n = files.length
-    if (n === 0)
-      return options.rmdir(p, cb)
-    let errState
-    files.forEach(f => {
-      rimraf(path.join(p, f), options, er => {
-        if (errState)
-          return
-        if (er)
-          return cb(errState = er)
-        if (--n === 0)
-          options.rmdir(p, cb)
-      })
-    })
-  })
-}
 
-// this looks simpler, and is strictly *faster*, but will
-// tie up the JavaScript thread and fail on excessively
-// deep directory trees.
-const rimrafSync = (p, options) => {
-  options = options || {}
-  defaults(options)
 
-  assert(p, 'rimraf: missing path')
-  assert.equal(typeof p, 'string', 'rimraf: path should be a string')
-  assert(options, 'rimraf: missing options')
-  assert.equal(typeof options, 'object', 'rimraf: options should be object')
 
-  let results
 
-  if (options.disableGlob || !glob.hasMagic(p)) {
-    results = [p]
-  } else {
-    try {
-      options.lstatSync(p)
-      results = [p]
-    } catch (er) {
-      results = glob.sync(p, options.glob)
-    }
-  }
+/**
+ * Name of the script in the package/project package.json file to run during `kbn watch`.
+ */
+const watchScriptName = 'kbn:watch';
+/**
+ * Name of the Kibana project.
+ */
 
-  if (!results.length)
-    return
+const kibanaProjectName = 'kibana';
+/**
+ * Command that traverses through list of available projects/packages that have `kbn:watch` script in their
+ * package.json files, groups them into topology aware batches and then processes theses batches one by one
+ * running `kbn:watch` scripts in parallel within the same batch.
+ *
+ * Command internally relies on the fact that most of the build systems that are triggered by `kbn:watch`
+ * will emit special "marker" once build/watch process is ready that we can use as completion condition for
+ * the `kbn:watch` script and eventually for the entire batch. Currently we support completion "markers" for
+ * `webpack` and `tsc` only, for the rest we rely on predefined timeouts.
+ */
 
-  for (let i = 0; i < results.length; i++) {
-    const p = results[i]
+const WatchCommand = {
+  description: 'Runs `kbn:watch` script for every project.',
+  name: 'watch',
 
-    let st
-    try {
-      st = options.lstatSync(p)
-    } catch (er) {
-      if (er.code === "ENOENT")
-        return
+  async run(projects, projectGraph) {
+    const projectsToWatch = new Map();
 
-      // Windows can EPERM on stat.  Life is suffering.
-      if (er.code === "EPERM" && isWindows)
-        fixWinEPERMSync(p, options, er)
+    for (const project of projects.values()) {
+      // We can't watch project that doesn't have `kbn:watch` script.
+      if (project.hasScript(watchScriptName)) {
+        projectsToWatch.set(project.name, project);
+      }
     }
 
-    try {
-      // sunos lets the root user unlink directories, which is... weird.
-      if (st && st.isDirectory())
-        rmdirSync(p, options, null)
-      else
-        options.unlinkSync(p)
-    } catch (er) {
-      if (er.code === "ENOENT")
-        return
-      if (er.code === "EPERM")
-        return isWindows ? fixWinEPERMSync(p, options, er) : rmdirSync(p, options, er)
-      if (er.code !== "EISDIR")
-        throw er
-
-      rmdirSync(p, options, er)
+    if (projectsToWatch.size === 0) {
+      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`\nThere are no projects to watch found. Make sure that projects define 'kbn:watch' script in 'package.json'.\n`));
+      return;
     }
-  }
-}
-
-const rmdirSync = (p, options, originalEr) => {
-  assert(p)
-  assert(options)
-  if (originalEr)
-    assert(originalEr instanceof Error)
 
-  try {
-    options.rmdirSync(p)
-  } catch (er) {
-    if (er.code === "ENOENT")
-      return
-    if (er.code === "ENOTDIR")
-      throw originalEr
-    if (er.code === "ENOTEMPTY" || er.code === "EEXIST" || er.code === "EPERM")
-      rmkidsSync(p, options)
-  }
-}
+    const projectNames = Array.from(projectsToWatch.keys());
+    _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(`Running ${watchScriptName} scripts for [${projectNames.join(', ')}].`))); // Kibana should always be run the last, so we don't rely on automatic
+    // topological batching and push it to the last one-entry batch manually.
 
-const rmkidsSync = (p, options) => {
-  assert(p)
-  assert(options)
-  options.readdirSync(p).forEach(f => rimrafSync(path.join(p, f), options))
+    const shouldWatchKibanaProject = projectsToWatch.delete(kibanaProjectName);
+    const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_3__["topologicallyBatchProjects"])(projectsToWatch, projectGraph);
 
-  // We only end up here once we got ENOTEMPTY at least once, and
-  // at this point, we are guaranteed to have removed all the kids.
-  // So, we know that it won't be ENOENT or ENOTDIR or anything else.
-  // try really hard to delete stuff on windows, because it has a
-  // PROFOUNDLY annoying habit of not closing handles promptly when
-  // files are deleted, resulting in spurious ENOTEMPTY errors.
-  const retries = isWindows ? 100 : 1
-  let i = 0
-  do {
-    let threw = true
-    try {
-      const ret = options.rmdirSync(p, options)
-      threw = false
-      return ret
-    } finally {
-      if (++i < retries && threw)
-        continue
+    if (shouldWatchKibanaProject) {
+      batchedProjects.push([projects.get(kibanaProjectName)]);
     }
-  } while (true)
-}
 
-module.exports = rimraf
-rimraf.sync = rimrafSync
+    await Object(_utils_parallelize__WEBPACK_IMPORTED_MODULE_2__["parallelizeBatches"])(batchedProjects, async pkg => {
+      const completionHint = await Object(_utils_watch__WEBPACK_IMPORTED_MODULE_4__["waitUntilWatchIsReady"])(pkg.runScriptStreaming(watchScriptName).stdout);
+      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`[${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(pkg.name)}] Initial build completed (${completionHint}).`));
+    });
+  }
 
+};
 
 /***/ }),
-/* 671 */
-/***/ (function(module, exports, __webpack_require__) {
+/* 689 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "waitUntilWatchIsReady", function() { return waitUntilWatchIsReady; });
+/* harmony import */ var rxjs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(392);
+/* harmony import */ var rxjs_operators__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(169);
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-const AggregateError = __webpack_require__(672);
 
-module.exports = async (
-	iterable,
-	mapper,
-	{
-		concurrency = Infinity,
-		stopOnError = true
-	} = {}
-) => {
-	return new Promise((resolve, reject) => {
-		if (typeof mapper !== 'function') {
-			throw new TypeError('Mapper function is required');
-		}
+/**
+ * Number of milliseconds we wait before we fall back to the default watch handler.
+ */
 
-		if (!(typeof concurrency === 'number' && concurrency >= 1)) {
-			throw new TypeError(`Expected \`concurrency\` to be a number from 1 and up, got \`${concurrency}\` (${typeof concurrency})`);
-		}
+const defaultHandlerDelay = 3000;
+/**
+ * If default watch handler is used, then it's the number of milliseconds we wait for
+ * any build output before we consider watch task ready.
+ */
 
-		const ret = [];
-		const errors = [];
-		const iterator = iterable[Symbol.iterator]();
-		let isRejected = false;
-		let isIterableDone = false;
-		let resolvingCount = 0;
-		let currentIndex = 0;
+const defaultHandlerReadinessTimeout = 2000;
+/**
+ * Describes configurable watch options.
+ */
+
+function getWatchHandlers(buildOutput$, {
+  handlerDelay = defaultHandlerDelay,
+  handlerReadinessTimeout = defaultHandlerReadinessTimeout
+}) {
+  const typescriptHandler = buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('$ tsc')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('Compilation complete.')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mapTo"])('tsc'))));
+  const webpackHandler = buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('$ webpack')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('Chunk Names')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mapTo"])('webpack'))));
+  const defaultHandler = rxjs__WEBPACK_IMPORTED_MODULE_0__["of"](undefined).pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["delay"])(handlerReadinessTimeout), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["timeout"])(handlerDelay), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["catchError"])(() => rxjs__WEBPACK_IMPORTED_MODULE_0__["of"]('timeout')))));
+  return [typescriptHandler, webpackHandler, defaultHandler];
+}
 
-		const next = () => {
-			if (isRejected) {
-				return;
-			}
+function waitUntilWatchIsReady(stream, opts = {}) {
+  const buildOutput$ = new rxjs__WEBPACK_IMPORTED_MODULE_0__["Subject"]();
 
-			const nextItem = iterator.next();
-			const i = currentIndex;
-			currentIndex++;
+  const onDataListener = data => buildOutput$.next(data.toString('utf-8'));
 
-			if (nextItem.done) {
-				isIterableDone = true;
+  const onEndListener = () => buildOutput$.complete();
 
-				if (resolvingCount === 0) {
-					if (!stopOnError && errors.length !== 0) {
-						reject(new AggregateError(errors));
-					} else {
-						resolve(ret);
-					}
-				}
+  const onErrorListener = e => buildOutput$.error(e);
 
-				return;
-			}
+  stream.once('end', onEndListener);
+  stream.once('error', onErrorListener);
+  stream.on('data', onDataListener);
+  return rxjs__WEBPACK_IMPORTED_MODULE_0__["race"](getWatchHandlers(buildOutput$, opts)).pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mergeMap"])(whenReady => whenReady), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["finalize"])(() => {
+    stream.removeListener('data', onDataListener);
+    stream.removeListener('end', onEndListener);
+    stream.removeListener('error', onErrorListener);
+    buildOutput$.complete();
+  })).toPromise();
+}
 
-			resolvingCount++;
+/***/ }),
+/* 690 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
-			(async () => {
-				try {
-					const element = await nextItem.value;
-					ret[i] = await mapper(element, i);
-					resolvingCount--;
-					next();
-				} catch (error) {
-					if (stopOnError) {
-						isRejected = true;
-						reject(error);
-					} else {
-						errors.push(error);
-						resolvingCount--;
-						next();
-					}
-				}
-			})();
-		};
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "runCommand", function() { return runCommand; });
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var indent_string__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(691);
+/* harmony import */ var indent_string__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(indent_string__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var wrap_ansi__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(692);
+/* harmony import */ var wrap_ansi__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(wrap_ansi__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var _utils_errors__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(515);
+/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(34);
+/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(501);
+/* harmony import */ var _utils_projects_tree__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(699);
+/* harmony import */ var _utils_kibana__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(700);
+function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }
 
-		for (let i = 0; i < concurrency; i++) {
-			next();
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(source, true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(source).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
 
-			if (isIterableDone) {
-				break;
-			}
-		}
-	});
-};
+function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
 
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-/***/ }),
-/* 672 */
-/***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
 
-const indentString = __webpack_require__(673);
-const cleanStack = __webpack_require__(674);
 
-const cleanInternalStack = stack => stack.replace(/\s+at .*aggregate-error\/index.js:\d+:\d+\)?/g, '');
 
-class AggregateError extends Error {
-	constructor(errors) {
-		if (!Array.isArray(errors)) {
-			throw new TypeError(`Expected input to be an Array, got ${typeof errors}`);
-		}
 
-		errors = [...errors].map(error => {
-			if (error instanceof Error) {
-				return error;
-			}
 
-			if (error !== null && typeof error === 'object') {
-				// Handle plain error objects with message property and/or possibly other metadata
-				return Object.assign(new Error(error.message), error);
-			}
 
-			return new Error(error);
-		});
+async function runCommand(command, config) {
+  try {
+    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`Running [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(command.name)}] command from [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.yellow(config.rootPath)}]:\n`));
+    const kbn = await _utils_kibana__WEBPACK_IMPORTED_MODULE_7__["Kibana"].loadFrom(config.rootPath);
+    const projects = kbn.getFilteredProjects({
+      skipKibanaPlugins: Boolean(config.options['skip-kibana-plugins']),
+      ossOnly: Boolean(config.options.oss),
+      exclude: toArray(config.options.exclude),
+      include: toArray(config.options.include)
+    });
 
-		let message = errors
-			.map(error => {
-				// The `stack` property is not standardized, so we can't assume it exists
-				return typeof error.stack === 'string' ? cleanInternalStack(cleanStack(error.stack)) : String(error);
-			})
-			.join('\n');
-		message = '\n' + indentString(message, 4);
-		super(message);
+    if (projects.size === 0) {
+      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`There are no projects found. Double check project name(s) in '-i/--include' and '-e/--exclude' filters.\n`));
+      return process.exit(1);
+    }
 
-		this.name = 'AggregateError';
+    const projectGraph = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_5__["buildProjectGraph"])(projects);
+    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`Found [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(projects.size.toString())}] projects:\n`));
+    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(Object(_utils_projects_tree__WEBPACK_IMPORTED_MODULE_6__["renderProjectsTree"])(config.rootPath, projects));
+    await command.run(projects, projectGraph, _objectSpread({}, config, {
+      kbn
+    }));
+  } catch (e) {
+    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold.red(`\n[${command.name}] failed:\n`));
 
-		Object.defineProperty(this, '_errors', {value: errors});
-	}
+    if (e instanceof _utils_errors__WEBPACK_IMPORTED_MODULE_3__["CliError"]) {
+      const msg = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`CliError: ${e.message}\n`);
+      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(wrap_ansi__WEBPACK_IMPORTED_MODULE_2___default()(msg, 80));
+      const keys = Object.keys(e.meta);
 
-	* [Symbol.iterator]() {
-		for (const error of this._errors) {
-			yield error;
-		}
-	}
+      if (keys.length > 0) {
+        const metaOutput = keys.map(key => {
+          const value = e.meta[key];
+          return `${key}: ${value}`;
+        });
+        _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write('Additional debugging info:\n');
+        _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(indent_string__WEBPACK_IMPORTED_MODULE_1___default()(metaOutput.join('\n'), 3));
+      }
+    } else {
+      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(e.stack);
+    }
+
+    process.exit(1);
+  }
 }
 
-module.exports = AggregateError;
+function toArray(value) {
+  if (value == null) {
+    return [];
+  }
 
+  return Array.isArray(value) ? value : [value];
+}
 
 /***/ }),
-/* 673 */
+/* 691 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -77778,1043 +79934,754 @@ module.exports = (str, count, opts) => {
 
 
 /***/ }),
-/* 674 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-const os = __webpack_require__(11);
-
-const extractPathRegex = /\s+at.*(?:\(|\s)(.*)\)?/;
-const pathRegex = /^(?:(?:(?:node|(?:internal\/[\w/]*|.*node_modules\/(?:babel-polyfill|pirates)\/.*)?\w+)\.js:\d+:\d+)|native)/;
-const homeDir = os.homedir();
-
-module.exports = (stack, options) => {
-	options = Object.assign({pretty: false}, options);
-
-	return stack.replace(/\\/g, '/')
-		.split('\n')
-		.filter(line => {
-			const pathMatches = line.match(extractPathRegex);
-			if (pathMatches === null || !pathMatches[1]) {
-				return true;
-			}
-
-			const match = pathMatches[1];
-
-			// Electron
-			if (
-				match.includes('.app/Contents/Resources/electron.asar') ||
-				match.includes('.app/Contents/Resources/default_app.asar')
-			) {
-				return false;
-			}
-
-			return !pathRegex.test(match);
-		})
-		.filter(line => line.trim() !== '')
-		.map(line => {
-			if (options.pretty) {
-				return line.replace(extractPathRegex, (m, p1) => m.replace(p1, p1.replace(homeDir, '~')));
-			}
-
-			return line;
-		})
-		.join('\n');
-};
-
-
-/***/ }),
-/* 675 */
+/* 692 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const chalk = __webpack_require__(676);
-const cliCursor = __webpack_require__(680);
-const cliSpinners = __webpack_require__(684);
-const logSymbols = __webpack_require__(566);
-
-class Ora {
-	constructor(options) {
-		if (typeof options === 'string') {
-			options = {
-				text: options
-			};
-		}
-
-		this.options = Object.assign({
-			text: '',
-			color: 'cyan',
-			stream: process.stderr
-		}, options);
-
-		const sp = this.options.spinner;
-		this.spinner = typeof sp === 'object' ? sp : (process.platform === 'win32' ? cliSpinners.line : (cliSpinners[sp] || cliSpinners.dots)); // eslint-disable-line no-nested-ternary
-
-		if (this.spinner.frames === undefined) {
-			throw new Error('Spinner must define `frames`');
-		}
-
-		this.text = this.options.text;
-		this.color = this.options.color;
-		this.interval = this.options.interval || this.spinner.interval || 100;
-		this.stream = this.options.stream;
-		this.id = null;
-		this.frameIndex = 0;
-		this.enabled = typeof this.options.enabled === 'boolean' ? this.options.enabled : ((this.stream && this.stream.isTTY) && !process.env.CI);
-	}
-	frame() {
-		const frames = this.spinner.frames;
-		let frame = frames[this.frameIndex];
-
-		if (this.color) {
-			frame = chalk[this.color](frame);
-		}
-
-		this.frameIndex = ++this.frameIndex % frames.length;
-
-		return frame + ' ' + this.text;
-	}
-	clear() {
-		if (!this.enabled) {
-			return this;
-		}
-
-		this.stream.clearLine();
-		this.stream.cursorTo(0);
-
-		return this;
-	}
-	render() {
-		this.clear();
-		this.stream.write(this.frame());
-
-		return this;
-	}
-	start(text) {
-		if (text) {
-			this.text = text;
-		}
-
-		if (!this.enabled || this.id) {
-			return this;
-		}
-
-		cliCursor.hide(this.stream);
-		this.render();
-		this.id = setInterval(this.render.bind(this), this.interval);
-
-		return this;
-	}
-	stop() {
-		if (!this.enabled) {
-			return this;
-		}
-
-		clearInterval(this.id);
-		this.id = null;
-		this.frameIndex = 0;
-		this.clear();
-		cliCursor.show(this.stream);
+const stringWidth = __webpack_require__(693);
+const stripAnsi = __webpack_require__(697);
 
-		return this;
-	}
-	succeed(text) {
-		return this.stopAndPersist({symbol: logSymbols.success, text});
-	}
-	fail(text) {
-		return this.stopAndPersist({symbol: logSymbols.error, text});
-	}
-	warn(text) {
-		return this.stopAndPersist({symbol: logSymbols.warning, text});
-	}
-	info(text) {
-		return this.stopAndPersist({symbol: logSymbols.info, text});
-	}
-	stopAndPersist(options) {
-		if (!this.enabled) {
-			return this;
-		}
+const ESCAPES = new Set([
+	'\u001B',
+	'\u009B'
+]);
 
-		// Legacy argument
-		// TODO: Deprecate sometime in the future
-		if (typeof options === 'string') {
-			options = {
-				symbol: options
-			};
-		}
+const END_CODE = 39;
 
-		options = options || {};
+const ESCAPE_CODES = new Map([
+	[0, 0],
+	[1, 22],
+	[2, 22],
+	[3, 23],
+	[4, 24],
+	[7, 27],
+	[8, 28],
+	[9, 29],
+	[30, 39],
+	[31, 39],
+	[32, 39],
+	[33, 39],
+	[34, 39],
+	[35, 39],
+	[36, 39],
+	[37, 39],
+	[90, 39],
+	[40, 49],
+	[41, 49],
+	[42, 49],
+	[43, 49],
+	[44, 49],
+	[45, 49],
+	[46, 49],
+	[47, 49]
+]);
 
-		this.stop();
-		this.stream.write(`${options.symbol || ' '} ${options.text || this.text}\n`);
+const wrapAnsi = code => `${ESCAPES.values().next().value}[${code}m`;
 
-		return this;
-	}
-}
+// Calculate the length of words split on ' ', ignoring
+// the extra characters added by ansi escape codes
+const wordLengths = str => str.split(' ').map(s => stringWidth(s));
 
-module.exports = function (opts) {
-	return new Ora(opts);
-};
+// Wrap a long word across multiple rows
+// Ansi escape codes do not count towards length
+const wrapWord = (rows, word, cols) => {
+	const arr = Array.from(word);
 
-module.exports.promise = (action, options) => {
-	if (typeof action.then !== 'function') {
-		throw new TypeError('Parameter `action` must be a Promise');
-	}
+	let insideEscape = false;
+	let visible = stringWidth(stripAnsi(rows[rows.length - 1]));
 
-	const spinner = new Ora(options);
-	spinner.start();
+	for (const item of arr.entries()) {
+		const i = item[0];
+		const char = item[1];
+		const charLength = stringWidth(char);
 
-	action.then(
-		() => {
-			spinner.succeed();
-		},
-		() => {
-			spinner.fail();
+		if (visible + charLength <= cols) {
+			rows[rows.length - 1] += char;
+		} else {
+			rows.push(char);
+			visible = 0;
 		}
-	);
-
-	return spinner;
-};
-
-
-/***/ }),
-/* 676 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-const escapeStringRegexp = __webpack_require__(3);
-const ansiStyles = __webpack_require__(677);
-const stdoutColor = __webpack_require__(678).stdout;
-
-const template = __webpack_require__(679);
-
-const isSimpleWindowsTerm = process.platform === 'win32' && !(process.env.TERM || '').toLowerCase().startsWith('xterm');
-
-// `supportsColor.level` → `ansiStyles.color[name]` mapping
-const levelMapping = ['ansi', 'ansi', 'ansi256', 'ansi16m'];
-
-// `color-convert` models to exclude from the Chalk API due to conflicts and such
-const skipModels = new Set(['gray']);
-
-const styles = Object.create(null);
-
-function applyOptions(obj, options) {
-	options = options || {};
-
-	// Detect level if not set manually
-	const scLevel = stdoutColor ? stdoutColor.level : 0;
-	obj.level = options.level === undefined ? scLevel : options.level;
-	obj.enabled = 'enabled' in options ? options.enabled : obj.level > 0;
-}
-
-function Chalk(options) {
-	// We check for this.template here since calling `chalk.constructor()`
-	// by itself will have a `this` of a previously constructed chalk object
-	if (!this || !(this instanceof Chalk) || this.template) {
-		const chalk = {};
-		applyOptions(chalk, options);
-
-		chalk.template = function () {
-			const args = [].slice.call(arguments);
-			return chalkTag.apply(null, [chalk.template].concat(args));
-		};
-
-		Object.setPrototypeOf(chalk, Chalk.prototype);
-		Object.setPrototypeOf(chalk.template, chalk);
-
-		chalk.template.constructor = Chalk;
-
-		return chalk.template;
-	}
-
-	applyOptions(this, options);
-}
-
-// Use bright blue on Windows as the normal blue color is illegible
-if (isSimpleWindowsTerm) {
-	ansiStyles.blue.open = '\u001B[94m';
-}
-
-for (const key of Object.keys(ansiStyles)) {
-	ansiStyles[key].closeRe = new RegExp(escapeStringRegexp(ansiStyles[key].close), 'g');
 
-	styles[key] = {
-		get() {
-			const codes = ansiStyles[key];
-			return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, key);
+		if (ESCAPES.has(char)) {
+			insideEscape = true;
+		} else if (insideEscape && char === 'm') {
+			insideEscape = false;
+			continue;
 		}
-	};
-}
-
-styles.visible = {
-	get() {
-		return build.call(this, this._styles || [], true, 'visible');
-	}
-};
-
-ansiStyles.color.closeRe = new RegExp(escapeStringRegexp(ansiStyles.color.close), 'g');
-for (const model of Object.keys(ansiStyles.color.ansi)) {
-	if (skipModels.has(model)) {
-		continue;
-	}
-
-	styles[model] = {
-		get() {
-			const level = this.level;
-			return function () {
-				const open = ansiStyles.color[levelMapping[level]][model].apply(null, arguments);
-				const codes = {
-					open,
-					close: ansiStyles.color.close,
-					closeRe: ansiStyles.color.closeRe
-				};
-				return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, model);
-			};
+
+		if (insideEscape) {
+			continue;
 		}
-	};
-}
 
-ansiStyles.bgColor.closeRe = new RegExp(escapeStringRegexp(ansiStyles.bgColor.close), 'g');
-for (const model of Object.keys(ansiStyles.bgColor.ansi)) {
-	if (skipModels.has(model)) {
-		continue;
-	}
+		visible += charLength;
 
-	const bgModel = 'bg' + model[0].toUpperCase() + model.slice(1);
-	styles[bgModel] = {
-		get() {
-			const level = this.level;
-			return function () {
-				const open = ansiStyles.bgColor[levelMapping[level]][model].apply(null, arguments);
-				const codes = {
-					open,
-					close: ansiStyles.bgColor.close,
-					closeRe: ansiStyles.bgColor.closeRe
-				};
-				return build.call(this, this._styles ? this._styles.concat(codes) : [codes], this._empty, model);
-			};
+		if (visible === cols && i < arr.length - 1) {
+			rows.push('');
+			visible = 0;
 		}
-	};
-}
+	}
 
-const proto = Object.defineProperties(() => {}, styles);
+	// It's possible that the last row we copy over is only
+	// ansi escape characters, handle this edge-case
+	if (!visible && rows[rows.length - 1].length > 0 && rows.length > 1) {
+		rows[rows.length - 2] += rows.pop();
+	}
+};
 
-function build(_styles, _empty, key) {
-	const builder = function () {
-		return applyStyle.apply(builder, arguments);
-	};
+// The wrap-ansi module can be invoked
+// in either 'hard' or 'soft' wrap mode
+//
+// 'hard' will never allow a string to take up more
+// than cols characters
+//
+// 'soft' allows long words to expand past the column length
+const exec = (str, cols, opts) => {
+	const options = opts || {};
 
-	builder._styles = _styles;
-	builder._empty = _empty;
+	if (str.trim() === '') {
+		return options.trim === false ? str : str.trim();
+	}
 
-	const self = this;
+	let pre = '';
+	let ret = '';
+	let escapeCode;
 
-	Object.defineProperty(builder, 'level', {
-		enumerable: true,
-		get() {
-			return self.level;
-		},
-		set(level) {
-			self.level = level;
-		}
-	});
+	const lengths = wordLengths(str);
+	const words = str.split(' ');
+	const rows = [''];
 
-	Object.defineProperty(builder, 'enabled', {
-		enumerable: true,
-		get() {
-			return self.enabled;
-		},
-		set(enabled) {
-			self.enabled = enabled;
-		}
-	});
+	for (const item of Array.from(words).entries()) {
+		const i = item[0];
+		const word = item[1];
 
-	// See below for fix regarding invisible grey/dim combination on Windows
-	builder.hasGrey = this.hasGrey || key === 'gray' || key === 'grey';
+		rows[rows.length - 1] = options.trim === false ? rows[rows.length - 1] : rows[rows.length - 1].trim();
+		let rowLength = stringWidth(rows[rows.length - 1]);
 
-	// `__proto__` is used because we must return a function, but there is
-	// no way to create a function with a different prototype
-	builder.__proto__ = proto; // eslint-disable-line no-proto
+		if (rowLength || word === '') {
+			if (rowLength === cols && options.wordWrap === false) {
+				// If we start with a new word but the current row length equals the length of the columns, add a new row
+				rows.push('');
+				rowLength = 0;
+			}
 
-	return builder;
-}
+			rows[rows.length - 1] += ' ';
+			rowLength++;
+		}
 
-function applyStyle() {
-	// Support varags, but simply cast to string in case there's only one arg
-	const args = arguments;
-	const argsLen = args.length;
-	let str = String(arguments[0]);
+		// In 'hard' wrap mode, the length of a line is
+		// never allowed to extend past 'cols'
+		if (lengths[i] > cols && options.hard) {
+			if (rowLength) {
+				rows.push('');
+			}
+			wrapWord(rows, word, cols);
+			continue;
+		}
 
-	if (argsLen === 0) {
-		return '';
-	}
+		if (rowLength + lengths[i] > cols && rowLength > 0) {
+			if (options.wordWrap === false && rowLength < cols) {
+				wrapWord(rows, word, cols);
+				continue;
+			}
 
-	if (argsLen > 1) {
-		// Don't slice `arguments`, it prevents V8 optimizations
-		for (let a = 1; a < argsLen; a++) {
-			str += ' ' + args[a];
+			rows.push('');
 		}
-	}
 
-	if (!this.enabled || this.level <= 0 || !str) {
-		return this._empty ? '' : str;
-	}
+		if (rowLength + lengths[i] > cols && options.wordWrap === false) {
+			wrapWord(rows, word, cols);
+			continue;
+		}
 
-	// Turns out that on Windows dimmed gray text becomes invisible in cmd.exe,
-	// see https://github.com/chalk/chalk/issues/58
-	// If we're on Windows and we're dealing with a gray color, temporarily make 'dim' a noop.
-	const originalDim = ansiStyles.dim.open;
-	if (isSimpleWindowsTerm && this.hasGrey) {
-		ansiStyles.dim.open = '';
+		rows[rows.length - 1] += word;
 	}
 
-	for (const code of this._styles.slice().reverse()) {
-		// Replace any instances already present with a re-opening code
-		// otherwise only the part of the string until said closing code
-		// will be colored, and the rest will simply be 'plain'.
-		str = code.open + str.replace(code.closeRe, code.open) + code.close;
-
-		// Close the styling before a linebreak and reopen
-		// after next line to fix a bleed issue on macOS
-		// https://github.com/chalk/chalk/pull/92
-		str = str.replace(/\r?\n/g, `${code.close}$&${code.open}`);
-	}
+	pre = rows.map(r => options.trim === false ? r : r.trim()).join('\n');
 
-	// Reset the original `dim` if we changed it to work around the Windows dimmed gray issue
-	ansiStyles.dim.open = originalDim;
+	for (const item of Array.from(pre).entries()) {
+		const i = item[0];
+		const char = item[1];
 
-	return str;
-}
+		ret += char;
 
-function chalkTag(chalk, strings) {
-	if (!Array.isArray(strings)) {
-		// If chalk() was called by itself or with a string,
-		// return the string itself as a string.
-		return [].slice.call(arguments, 1).join(' ');
-	}
+		if (ESCAPES.has(char)) {
+			const code = parseFloat(/\d[^m]*/.exec(pre.slice(i, i + 4)));
+			escapeCode = code === END_CODE ? null : code;
+		}
 
-	const args = [].slice.call(arguments, 2);
-	const parts = [strings.raw[0]];
+		const code = ESCAPE_CODES.get(Number(escapeCode));
 
-	for (let i = 1; i < strings.length; i++) {
-		parts.push(String(args[i - 1]).replace(/[{}\\]/g, '\\$&'));
-		parts.push(String(strings.raw[i]));
+		if (escapeCode && code) {
+			if (pre[i + 1] === '\n') {
+				ret += wrapAnsi(code);
+			} else if (char === '\n') {
+				ret += wrapAnsi(escapeCode);
+			}
+		}
 	}
 
-	return template(chalk, parts.join(''));
-}
-
-Object.defineProperties(Chalk.prototype, styles);
+	return ret;
+};
 
-module.exports = Chalk(); // eslint-disable-line new-cap
-module.exports.supportsColor = stdoutColor;
-module.exports.default = module.exports; // For TypeScript
+// For each newline, invoke the method separately
+module.exports = (str, cols, opts) => {
+	return String(str)
+		.normalize()
+		.split('\n')
+		.map(line => exec(line, cols, opts))
+		.join('\n');
+};
 
 
 /***/ }),
-/* 677 */
+/* 693 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-/* WEBPACK VAR INJECTION */(function(module) {
-const colorConvert = __webpack_require__(6);
 
-const wrapAnsi16 = (fn, offset) => function () {
-	const code = fn.apply(colorConvert, arguments);
-	return `\u001B[${code + offset}m`;
-};
+const stripAnsi = __webpack_require__(694);
+const isFullwidthCodePoint = __webpack_require__(696);
 
-const wrapAnsi256 = (fn, offset) => function () {
-	const code = fn.apply(colorConvert, arguments);
-	return `\u001B[${38 + offset};5;${code}m`;
-};
+module.exports = str => {
+	if (typeof str !== 'string' || str.length === 0) {
+		return 0;
+	}
 
-const wrapAnsi16m = (fn, offset) => function () {
-	const rgb = fn.apply(colorConvert, arguments);
-	return `\u001B[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;
-};
+	str = stripAnsi(str);
 
-function assembleStyles() {
-	const codes = new Map();
-	const styles = {
-		modifier: {
-			reset: [0, 0],
-			// 21 isn't widely supported and 22 does the same thing
-			bold: [1, 22],
-			dim: [2, 22],
-			italic: [3, 23],
-			underline: [4, 24],
-			inverse: [7, 27],
-			hidden: [8, 28],
-			strikethrough: [9, 29]
-		},
-		color: {
-			black: [30, 39],
-			red: [31, 39],
-			green: [32, 39],
-			yellow: [33, 39],
-			blue: [34, 39],
-			magenta: [35, 39],
-			cyan: [36, 39],
-			white: [37, 39],
-			gray: [90, 39],
+	let width = 0;
 
-			// Bright color
-			redBright: [91, 39],
-			greenBright: [92, 39],
-			yellowBright: [93, 39],
-			blueBright: [94, 39],
-			magentaBright: [95, 39],
-			cyanBright: [96, 39],
-			whiteBright: [97, 39]
-		},
-		bgColor: {
-			bgBlack: [40, 49],
-			bgRed: [41, 49],
-			bgGreen: [42, 49],
-			bgYellow: [43, 49],
-			bgBlue: [44, 49],
-			bgMagenta: [45, 49],
-			bgCyan: [46, 49],
-			bgWhite: [47, 49],
+	for (let i = 0; i < str.length; i++) {
+		const code = str.codePointAt(i);
 
-			// Bright color
-			bgBlackBright: [100, 49],
-			bgRedBright: [101, 49],
-			bgGreenBright: [102, 49],
-			bgYellowBright: [103, 49],
-			bgBlueBright: [104, 49],
-			bgMagentaBright: [105, 49],
-			bgCyanBright: [106, 49],
-			bgWhiteBright: [107, 49]
+		// Ignore control characters
+		if (code <= 0x1F || (code >= 0x7F && code <= 0x9F)) {
+			continue;
 		}
-	};
 
-	// Fix humans
-	styles.color.grey = styles.color.gray;
+		// Ignore combining characters
+		if (code >= 0x300 && code <= 0x36F) {
+			continue;
+		}
 
-	for (const groupName of Object.keys(styles)) {
-		const group = styles[groupName];
+		// Surrogates
+		if (code > 0xFFFF) {
+			i++;
+		}
 
-		for (const styleName of Object.keys(group)) {
-			const style = group[styleName];
+		width += isFullwidthCodePoint(code) ? 2 : 1;
+	}
 
-			styles[styleName] = {
-				open: `\u001B[${style[0]}m`,
-				close: `\u001B[${style[1]}m`
-			};
+	return width;
+};
 
-			group[styleName] = styles[styleName];
 
-			codes.set(style[0], style[1]);
-		}
+/***/ }),
+/* 694 */
+/***/ (function(module, exports, __webpack_require__) {
 
-		Object.defineProperty(styles, groupName, {
-			value: group,
-			enumerable: false
-		});
+"use strict";
 
-		Object.defineProperty(styles, 'codes', {
-			value: codes,
-			enumerable: false
-		});
-	}
+const ansiRegex = __webpack_require__(695);
 
-	const ansi2ansi = n => n;
-	const rgb2rgb = (r, g, b) => [r, g, b];
+module.exports = input => typeof input === 'string' ? input.replace(ansiRegex(), '') : input;
 
-	styles.color.close = '\u001B[39m';
-	styles.bgColor.close = '\u001B[49m';
 
-	styles.color.ansi = {
-		ansi: wrapAnsi16(ansi2ansi, 0)
-	};
-	styles.color.ansi256 = {
-		ansi256: wrapAnsi256(ansi2ansi, 0)
-	};
-	styles.color.ansi16m = {
-		rgb: wrapAnsi16m(rgb2rgb, 0)
-	};
+/***/ }),
+/* 695 */
+/***/ (function(module, exports, __webpack_require__) {
 
-	styles.bgColor.ansi = {
-		ansi: wrapAnsi16(ansi2ansi, 10)
-	};
-	styles.bgColor.ansi256 = {
-		ansi256: wrapAnsi256(ansi2ansi, 10)
-	};
-	styles.bgColor.ansi16m = {
-		rgb: wrapAnsi16m(rgb2rgb, 10)
-	};
+"use strict";
 
-	for (let key of Object.keys(colorConvert)) {
-		if (typeof colorConvert[key] !== 'object') {
-			continue;
-		}
 
-		const suite = colorConvert[key];
+module.exports = () => {
+	const pattern = [
+		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)',
+		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))'
+	].join('|');
 
-		if (key === 'ansi16') {
-			key = 'ansi';
-		}
+	return new RegExp(pattern, 'g');
+};
 
-		if ('ansi16' in suite) {
-			styles.color.ansi[key] = wrapAnsi16(suite.ansi16, 0);
-			styles.bgColor.ansi[key] = wrapAnsi16(suite.ansi16, 10);
-		}
 
-		if ('ansi256' in suite) {
-			styles.color.ansi256[key] = wrapAnsi256(suite.ansi256, 0);
-			styles.bgColor.ansi256[key] = wrapAnsi256(suite.ansi256, 10);
-		}
+/***/ }),
+/* 696 */
+/***/ (function(module, exports, __webpack_require__) {
 
-		if ('rgb' in suite) {
-			styles.color.ansi16m[key] = wrapAnsi16m(suite.rgb, 0);
-			styles.bgColor.ansi16m[key] = wrapAnsi16m(suite.rgb, 10);
-		}
+"use strict";
+
+/* eslint-disable yoda */
+module.exports = x => {
+	if (Number.isNaN(x)) {
+		return false;
 	}
 
-	return styles;
-}
+	// code points are derived from:
+	// http://www.unix.org/Public/UNIDATA/EastAsianWidth.txt
+	if (
+		x >= 0x1100 && (
+			x <= 0x115f ||  // Hangul Jamo
+			x === 0x2329 || // LEFT-POINTING ANGLE BRACKET
+			x === 0x232a || // RIGHT-POINTING ANGLE BRACKET
+			// CJK Radicals Supplement .. Enclosed CJK Letters and Months
+			(0x2e80 <= x && x <= 0x3247 && x !== 0x303f) ||
+			// Enclosed CJK Letters and Months .. CJK Unified Ideographs Extension A
+			(0x3250 <= x && x <= 0x4dbf) ||
+			// CJK Unified Ideographs .. Yi Radicals
+			(0x4e00 <= x && x <= 0xa4c6) ||
+			// Hangul Jamo Extended-A
+			(0xa960 <= x && x <= 0xa97c) ||
+			// Hangul Syllables
+			(0xac00 <= x && x <= 0xd7a3) ||
+			// CJK Compatibility Ideographs
+			(0xf900 <= x && x <= 0xfaff) ||
+			// Vertical Forms
+			(0xfe10 <= x && x <= 0xfe19) ||
+			// CJK Compatibility Forms .. Small Form Variants
+			(0xfe30 <= x && x <= 0xfe6b) ||
+			// Halfwidth and Fullwidth Forms
+			(0xff01 <= x && x <= 0xff60) ||
+			(0xffe0 <= x && x <= 0xffe6) ||
+			// Kana Supplement
+			(0x1b000 <= x && x <= 0x1b001) ||
+			// Enclosed Ideographic Supplement
+			(0x1f200 <= x && x <= 0x1f251) ||
+			// CJK Unified Ideographs Extension B .. Tertiary Ideographic Plane
+			(0x20000 <= x && x <= 0x3fffd)
+		)
+	) {
+		return true;
+	}
 
-// Make the export immutable
-Object.defineProperty(module, 'exports', {
-	enumerable: true,
-	get: assembleStyles
-});
+	return false;
+};
 
-/* WEBPACK VAR INJECTION */}.call(this, __webpack_require__(5)(module)))
 
 /***/ }),
-/* 678 */
+/* 697 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const os = __webpack_require__(11);
-const hasFlag = __webpack_require__(12);
+const ansiRegex = __webpack_require__(698);
 
-const env = process.env;
+module.exports = input => typeof input === 'string' ? input.replace(ansiRegex(), '') : input;
 
-let forceColor;
-if (hasFlag('no-color') ||
-	hasFlag('no-colors') ||
-	hasFlag('color=false')) {
-	forceColor = false;
-} else if (hasFlag('color') ||
-	hasFlag('colors') ||
-	hasFlag('color=true') ||
-	hasFlag('color=always')) {
-	forceColor = true;
-}
-if ('FORCE_COLOR' in env) {
-	forceColor = env.FORCE_COLOR.length === 0 || parseInt(env.FORCE_COLOR, 10) !== 0;
-}
 
-function translateLevel(level) {
-	if (level === 0) {
-		return false;
-	}
+/***/ }),
+/* 698 */
+/***/ (function(module, exports, __webpack_require__) {
 
-	return {
-		level,
-		hasBasic: true,
-		has256: level >= 2,
-		has16m: level >= 3
-	};
-}
+"use strict";
 
-function supportsColor(stream) {
-	if (forceColor === false) {
-		return 0;
-	}
 
-	if (hasFlag('color=16m') ||
-		hasFlag('color=full') ||
-		hasFlag('color=truecolor')) {
-		return 3;
-	}
+module.exports = () => {
+	const pattern = [
+		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)',
+		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))'
+	].join('|');
 
-	if (hasFlag('color=256')) {
-		return 2;
-	}
+	return new RegExp(pattern, 'g');
+};
+
+
+/***/ }),
+/* 699 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
+
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "renderProjectsTree", function() { return renderProjectsTree; });
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
+/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(16);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-	if (stream && !stream.isTTY && forceColor !== true) {
-		// VS code debugger doesn't have isTTY set
-		if (env.VSCODE_PID) {
-			return 1;
-		}
-		return 0;
-	}
 
-	const min = forceColor ? 1 : 0;
+const projectKey = Symbol('__project');
+function renderProjectsTree(rootPath, projects) {
+  const projectsTree = buildProjectsTree(rootPath, projects);
+  return treeToString(createTreeStructure(projectsTree));
+}
 
-	if (process.platform === 'win32') {
-		// Node.js 7.5.0 is the first version of Node.js to include a patch to
-		// libuv that enables 256 color output on Windows. Anything earlier and it
-		// won't work. However, here we target Node.js 8 at minimum as it is an LTS
-		// release, and Node.js 7 is not. Windows 10 build 10586 is the first Windows
-		// release that supports 256 colors. Windows 10 build 14931 is the first release
-		// that supports 16m/TrueColor.
-		const osRelease = os.release().split('.');
-		if (
-			Number(process.versions.node.split('.')[0]) >= 8 &&
-			Number(osRelease[0]) >= 10 &&
-			Number(osRelease[2]) >= 10586
-		) {
-			return Number(osRelease[2]) >= 14931 ? 3 : 2;
-		}
+function treeToString(tree) {
+  return [tree.name].concat(childrenToStrings(tree.children, '')).join('\n');
+}
 
-		return 1;
-	}
+function childrenToStrings(tree, treePrefix) {
+  if (tree === undefined) {
+    return [];
+  }
 
-	if ('CI' in env) {
-		if (['TRAVIS', 'CIRCLECI', 'APPVEYOR', 'GITLAB_CI'].some(sign => sign in env) || env.CI_NAME === 'codeship') {
-			return 1;
-		}
+  let strings = [];
+  tree.forEach((node, index) => {
+    const isLastNode = tree.length - 1 === index;
+    const nodePrefix = isLastNode ? '└── ' : '├── ';
+    const childPrefix = isLastNode ? '    ' : '│   ';
+    const childrenPrefix = treePrefix + childPrefix;
+    strings.push(`${treePrefix}${nodePrefix}${node.name}`);
+    strings = strings.concat(childrenToStrings(node.children, childrenPrefix));
+  });
+  return strings;
+}
 
-		return min;
-	}
+function createTreeStructure(tree) {
+  let name;
+  const children = [];
 
-	if ('TEAMCITY_VERSION' in env) {
-		return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
-	}
+  for (const [dir, project] of tree.entries()) {
+    // This is a leaf node (aka a project)
+    if (typeof project === 'string') {
+      name = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(project);
+      continue;
+    } // If there's only one project and the key indicates it's a leaf node, we
+    // know that we're at a package folder that contains a package.json, so we
+    // "inline it" so we don't get unnecessary levels, i.e. we'll just see
+    // `foo` instead of `foo -> foo`.
 
-	if (env.COLORTERM === 'truecolor') {
-		return 3;
-	}
 
-	if ('TERM_PROGRAM' in env) {
-		const version = parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);
+    if (project.size === 1 && project.has(projectKey)) {
+      const projectName = project.get(projectKey);
+      children.push({
+        children: [],
+        name: dirOrProjectName(dir, projectName)
+      });
+      continue;
+    }
 
-		switch (env.TERM_PROGRAM) {
-			case 'iTerm.app':
-				return version >= 3 ? 3 : 2;
-			case 'Apple_Terminal':
-				return 2;
-			// No default
-		}
-	}
+    const subtree = createTreeStructure(project); // If the name is specified, we know there's a package at the "root" of the
+    // subtree itself.
 
-	if (/-256(color)?$/i.test(env.TERM)) {
-		return 2;
-	}
+    if (subtree.name !== undefined) {
+      const projectName = subtree.name;
+      children.push({
+        children: subtree.children,
+        name: dirOrProjectName(dir, projectName)
+      });
+      continue;
+    } // Special-case whenever we have one child, so we don't get unnecessary
+    // folders in the output. E.g. instead of `foo -> bar -> baz` we get
+    // `foo/bar/baz` instead.
 
-	if (/^screen|^xterm|^vt100|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
-		return 1;
-	}
 
-	if ('COLORTERM' in env) {
-		return 1;
-	}
+    if (subtree.children && subtree.children.length === 1) {
+      const child = subtree.children[0];
+      const newName = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.dim(path__WEBPACK_IMPORTED_MODULE_1___default.a.join(dir.toString(), child.name));
+      children.push({
+        children: child.children,
+        name: newName
+      });
+      continue;
+    }
 
-	if (env.TERM === 'dumb') {
-		return min;
-	}
+    children.push({
+      children: subtree.children,
+      name: chalk__WEBPACK_IMPORTED_MODULE_0___default.a.dim(dir.toString())
+    });
+  }
 
-	return min;
+  return {
+    name,
+    children
+  };
 }
 
-function getSupportLevel(stream) {
-	const level = supportsColor(stream);
-	return translateLevel(level);
+function dirOrProjectName(dir, projectName) {
+  return dir === projectName ? chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(dir) : chalk__WEBPACK_IMPORTED_MODULE_0___default.a`{dim ${dir.toString()} ({reset.green ${projectName}})}`;
 }
 
-module.exports = {
-	supportsColor: getSupportLevel,
-	stdout: getSupportLevel(process.stdout),
-	stderr: getSupportLevel(process.stderr)
-};
-
-
-/***/ }),
-/* 679 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-const TEMPLATE_REGEX = /(?:\\(u[a-f\d]{4}|x[a-f\d]{2}|.))|(?:\{(~)?(\w+(?:\([^)]*\))?(?:\.\w+(?:\([^)]*\))?)*)(?:[ \t]|(?=\r?\n)))|(\})|((?:.|[\r\n\f])+?)/gi;
-const STYLE_REGEX = /(?:^|\.)(\w+)(?:\(([^)]*)\))?/g;
-const STRING_REGEX = /^(['"])((?:\\.|(?!\1)[^\\])*)\1$/;
-const ESCAPE_REGEX = /\\(u[a-f\d]{4}|x[a-f\d]{2}|.)|([^\\])/gi;
-
-const ESCAPES = new Map([
-	['n', '\n'],
-	['r', '\r'],
-	['t', '\t'],
-	['b', '\b'],
-	['f', '\f'],
-	['v', '\v'],
-	['0', '\0'],
-	['\\', '\\'],
-	['e', '\u001B'],
-	['a', '\u0007']
-]);
+function buildProjectsTree(rootPath, projects) {
+  const tree = new Map();
 
-function unescape(c) {
-	if ((c[0] === 'u' && c.length === 5) || (c[0] === 'x' && c.length === 3)) {
-		return String.fromCharCode(parseInt(c.slice(1), 16));
-	}
+  for (const project of projects.values()) {
+    if (rootPath === project.path) {
+      tree.set(projectKey, project.name);
+    } else {
+      const relativeProjectPath = path__WEBPACK_IMPORTED_MODULE_1___default.a.relative(rootPath, project.path);
+      addProjectToTree(tree, relativeProjectPath.split(path__WEBPACK_IMPORTED_MODULE_1___default.a.sep), project);
+    }
+  }
 
-	return ESCAPES.get(c) || c;
+  return tree;
 }
 
-function parseArguments(name, args) {
-	const results = [];
-	const chunks = args.trim().split(/\s*,\s*/g);
-	let matches;
+function addProjectToTree(tree, pathParts, project) {
+  if (pathParts.length === 0) {
+    tree.set(projectKey, project.name);
+  } else {
+    const [currentDir, ...rest] = pathParts;
 
-	for (const chunk of chunks) {
-		if (!isNaN(chunk)) {
-			results.push(Number(chunk));
-		} else if ((matches = chunk.match(STRING_REGEX))) {
-			results.push(matches[2].replace(ESCAPE_REGEX, (m, escape, chr) => escape ? unescape(escape) : chr));
-		} else {
-			throw new Error(`Invalid Chalk template style argument: ${chunk} (in style '${name}')`);
-		}
-	}
+    if (!tree.has(currentDir)) {
+      tree.set(currentDir, new Map());
+    }
 
-	return results;
+    const subtree = tree.get(currentDir);
+    addProjectToTree(subtree, rest, project);
+  }
 }
 
-function parseStyle(style) {
-	STYLE_REGEX.lastIndex = 0;
+/***/ }),
+/* 700 */
+/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
-	const results = [];
-	let matches;
+"use strict";
+__webpack_require__.r(__webpack_exports__);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "Kibana", function() { return Kibana; });
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(16);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var multimatch__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(701);
+/* harmony import */ var multimatch__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(multimatch__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var _projects__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(501);
+/* harmony import */ var _config__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(580);
+function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }
 
-	while ((matches = STYLE_REGEX.exec(style)) !== null) {
-		const name = matches[1];
+function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(source, true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(source).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
 
-		if (matches[2]) {
-			const args = parseArguments(name, matches[2]);
-			results.push([name].concat(args));
-		} else {
-			results.push([name]);
-		}
-	}
+function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
 
-	return results;
-}
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
 
-function buildStyle(chalk, styles) {
-	const enabled = {};
 
-	for (const layer of styles) {
-		for (const style of layer.styles) {
-			enabled[style[0]] = layer.inverse ? null : style.slice(1);
-		}
-	}
 
-	let current = chalk;
-	for (const styleName of Object.keys(enabled)) {
-		if (Array.isArray(enabled[styleName])) {
-			if (!(styleName in current)) {
-				throw new Error(`Unknown Chalk style: ${styleName}`);
-			}
 
-			if (enabled[styleName].length > 0) {
-				current = current[styleName].apply(current, enabled[styleName]);
-			} else {
-				current = current[styleName];
-			}
-		}
-	}
+/**
+ * Helper class for dealing with a set of projects as children of
+ * the Kibana project. The kbn/pm is currently implemented to be
+ * more generic, where everything is an operation of generic projects,
+ * but that leads to exceptions where we need the kibana project and
+ * do things like `project.get('kibana')!`.
+ *
+ * Using this helper we can restructre the generic list of projects
+ * as a Kibana object which encapulates all the projects in the
+ * workspace and knows about the root Kibana project.
+ */
 
-	return current;
-}
+class Kibana {
+  static async loadFrom(rootPath) {
+    return new Kibana((await Object(_projects__WEBPACK_IMPORTED_MODULE_2__["getProjects"])(rootPath, Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])({
+      rootPath
+    }))));
+  }
 
-module.exports = (chalk, tmp) => {
-	const styles = [];
-	const chunks = [];
-	let chunk = [];
+  constructor(allWorkspaceProjects) {
+    this.allWorkspaceProjects = allWorkspaceProjects;
 
-	// eslint-disable-next-line max-params
-	tmp.replace(TEMPLATE_REGEX, (m, escapeChar, inverse, style, close, chr) => {
-		if (escapeChar) {
-			chunk.push(unescape(escapeChar));
-		} else if (style) {
-			const str = chunk.join('');
-			chunk = [];
-			chunks.push(styles.length === 0 ? str : buildStyle(chalk, styles)(str));
-			styles.push({inverse, styles: parseStyle(style)});
-		} else if (close) {
-			if (styles.length === 0) {
-				throw new Error('Found extraneous } in Chalk template literal');
-			}
+    _defineProperty(this, "kibanaProject", void 0);
 
-			chunks.push(buildStyle(chalk, styles)(chunk.join('')));
-			chunk = [];
-			styles.pop();
-		} else {
-			chunk.push(chr);
-		}
-	});
+    const kibanaProject = allWorkspaceProjects.get('kibana');
 
-	chunks.push(chunk.join(''));
+    if (!kibanaProject) {
+      throw new TypeError('Unable to create Kibana object without all projects, including the Kibana project.');
+    }
 
-	if (styles.length > 0) {
-		const errMsg = `Chalk template literal is missing ${styles.length} closing bracket${styles.length === 1 ? '' : 's'} (\`}\`)`;
-		throw new Error(errMsg);
-	}
+    this.kibanaProject = kibanaProject;
+  }
+  /** make an absolute path by resolving subPath relative to the kibana repo */
 
-	return chunks.join('');
-};
 
+  getAbsolute(...subPath) {
+    return path__WEBPACK_IMPORTED_MODULE_0___default.a.resolve(this.kibanaProject.path, ...subPath);
+  }
+  /** convert an absolute path to a relative path, relative to the kibana repo */
 
-/***/ }),
-/* 680 */
-/***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
+  getRelative(absolute) {
+    return path__WEBPACK_IMPORTED_MODULE_0___default.a.relative(this.kibanaProject.path, absolute);
+  }
+  /** get a copy of the map of all projects in the kibana workspace */
 
-const restoreCursor = __webpack_require__(681);
 
-let hidden = false;
+  getAllProjects() {
+    return new Map(this.allWorkspaceProjects);
+  }
+  /** determine if a project with the given name exists */
 
-exports.show = stream => {
-	const s = stream || process.stderr;
 
-	if (!s.isTTY) {
-		return;
-	}
+  hasProject(name) {
+    return this.allWorkspaceProjects.has(name);
+  }
+  /** get a specific project, throws if the name is not known (use hasProject() first) */
 
-	hidden = false;
-	s.write('\u001b[?25h');
-};
 
-exports.hide = stream => {
-	const s = stream || process.stderr;
+  getProject(name) {
+    const project = this.allWorkspaceProjects.get(name);
 
-	if (!s.isTTY) {
-		return;
-	}
+    if (!project) {
+      throw new Error(`No package with name "${name}" in the workspace`);
+    }
 
-	restoreCursor();
-	hidden = true;
-	s.write('\u001b[?25l');
-};
+    return project;
+  }
+  /** get a project and all of the projects it depends on in a ProjectMap */
 
-exports.toggle = (force, stream) => {
-	if (force !== undefined) {
-		hidden = force;
-	}
 
-	if (hidden) {
-		exports.show(stream);
-	} else {
-		exports.hide(stream);
-	}
-};
+  getProjectAndDeps(name) {
+    const project = this.getProject(name);
+    return Object(_projects__WEBPACK_IMPORTED_MODULE_2__["includeTransitiveProjects"])([project], this.allWorkspaceProjects);
+  }
+  /** filter the projects to just those matching certain paths/include/exclude tags */
 
 
-/***/ }),
-/* 681 */
-/***/ (function(module, exports, __webpack_require__) {
+  getFilteredProjects(options) {
+    const allProjects = this.getAllProjects();
+    const filteredProjects = new Map();
+    const pkgJsonPaths = Array.from(allProjects.values()).map(p => p.packageJsonLocation);
+    const filteredPkgJsonGlobs = Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])(_objectSpread({}, options, {
+      rootPath: this.kibanaProject.path
+    })).map(g => path__WEBPACK_IMPORTED_MODULE_0___default.a.resolve(g, 'package.json'));
+    const matchingPkgJsonPaths = multimatch__WEBPACK_IMPORTED_MODULE_1___default()(pkgJsonPaths, filteredPkgJsonGlobs);
 
-"use strict";
+    for (const project of allProjects.values()) {
+      const pathMatches = matchingPkgJsonPaths.includes(project.packageJsonLocation);
+      const notExcluded = !options.exclude.includes(project.name);
+      const isIncluded = !options.include.length || options.include.includes(project.name);
 
-const onetime = __webpack_require__(682);
-const signalExit = __webpack_require__(377);
+      if (pathMatches && notExcluded && isIncluded) {
+        filteredProjects.set(project.name, project);
+      }
+    }
 
-module.exports = onetime(() => {
-	signalExit(() => {
-		process.stderr.write('\u001b[?25h');
-	}, {alwaysLast: true});
-});
+    return filteredProjects;
+  }
 
+}
 
 /***/ }),
-/* 682 */
+/* 701 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const mimicFn = __webpack_require__(683);
+const minimatch = __webpack_require__(505);
+const arrayUnion = __webpack_require__(702);
+const arrayDiffer = __webpack_require__(703);
+const arrify = __webpack_require__(704);
 
-module.exports = (fn, opts) => {
-	// TODO: Remove this in v3
-	if (opts === true) {
-		throw new TypeError('The second argument is now an options object');
-	}
+module.exports = (list, patterns, options = {}) => {
+	list = arrify(list);
+	patterns = arrify(patterns);
 
-	if (typeof fn !== 'function') {
-		throw new TypeError('Expected a function');
+	if (list.length === 0 || patterns.length === 0) {
+		return [];
 	}
 
-	opts = opts || {};
+	return patterns.reduce((result, pattern) => {
+		let process = arrayUnion;
 
-	let ret;
-	let called = false;
-	const fnName = fn.displayName || fn.name || '<anonymous>';
+		if (pattern[0] === '!') {
+			pattern = pattern.slice(1);
+			process = arrayDiffer;
+		}
 
-	const onetime = function () {
-		if (called) {
-			if (opts.throw === true) {
-				throw new Error(`Function \`${fnName}\` can only be called once`);
-			}
+		return process(result, minimatch.match(list, pattern, options));
+	}, []);
+};
 
-			return ret;
-		}
 
-		called = true;
-		ret = fn.apply(this, arguments);
-		fn = null;
+/***/ }),
+/* 702 */
+/***/ (function(module, exports, __webpack_require__) {
 
-		return ret;
-	};
+"use strict";
 
-	mimicFn(onetime, fn);
 
-	return onetime;
+module.exports = (...arguments_) => {
+	return [...new Set([].concat(...arguments_))];
 };
 
 
 /***/ }),
-/* 683 */
+/* 703 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-module.exports = (to, from) => {
-	// TODO: use `Reflect.ownKeys()` when targeting Node.js 6
-	for (const prop of Object.getOwnPropertyNames(from).concat(Object.getOwnPropertySymbols(from))) {
-		Object.defineProperty(to, prop, Object.getOwnPropertyDescriptor(from, prop));
-	}
 
-	return to;
+const arrayDiffer = (array, ...values) => {
+	const rest = new Set([].concat(...values));
+	return array.filter(element => !rest.has(element));
 };
 
+module.exports = arrayDiffer;
+
 
 /***/ }),
-/* 684 */
+/* 704 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-module.exports = __webpack_require__(685);
 
+const arrify = value => {
+	if (value === null || value === undefined) {
+		return [];
+	}
 
-/***/ }),
-/* 685 */
-/***/ (function(module) {
+	if (Array.isArray(value)) {
+		return value;
+	}
+
+	if (typeof value === 'string') {
+		return [value];
+	}
+
+	if (typeof value[Symbol.iterator] === 'function') {
+		return [...value];
+	}
+
+	return [value];
+};
+
+module.exports = arrify;
 
-module.exports = JSON.parse("{\"dots\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠹\",\"⠸\",\"⠼\",\"⠴\",\"⠦\",\"⠧\",\"⠇\",\"⠏\"]},\"dots2\":{\"interval\":80,\"frames\":[\"⣾\",\"⣽\",\"⣻\",\"⢿\",\"⡿\",\"⣟\",\"⣯\",\"⣷\"]},\"dots3\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠚\",\"⠞\",\"⠖\",\"⠦\",\"⠴\",\"⠲\",\"⠳\",\"⠓\"]},\"dots4\":{\"interval\":80,\"frames\":[\"⠄\",\"⠆\",\"⠇\",\"⠋\",\"⠙\",\"⠸\",\"⠰\",\"⠠\",\"⠰\",\"⠸\",\"⠙\",\"⠋\",\"⠇\",\"⠆\"]},\"dots5\":{\"interval\":80,\"frames\":[\"⠋\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\"]},\"dots6\":{\"interval\":80,\"frames\":[\"⠁\",\"⠉\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠤\",\"⠄\",\"⠄\",\"⠤\",\"⠴\",\"⠲\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠚\",\"⠙\",\"⠉\",\"⠁\"]},\"dots7\":{\"interval\":80,\"frames\":[\"⠈\",\"⠉\",\"⠋\",\"⠓\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠖\",\"⠦\",\"⠤\",\"⠠\",\"⠠\",\"⠤\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\",\"⠉\",\"⠈\"]},\"dots8\":{\"interval\":80,\"frames\":[\"⠁\",\"⠁\",\"⠉\",\"⠙\",\"⠚\",\"⠒\",\"⠂\",\"⠂\",\"⠒\",\"⠲\",\"⠴\",\"⠤\",\"⠄\",\"⠄\",\"⠤\",\"⠠\",\"⠠\",\"⠤\",\"⠦\",\"⠖\",\"⠒\",\"⠐\",\"⠐\",\"⠒\",\"⠓\",\"⠋\",\"⠉\",\"⠈\",\"⠈\"]},\"dots9\":{\"interval\":80,\"frames\":[\"⢹\",\"⢺\",\"⢼\",\"⣸\",\"⣇\",\"⡧\",\"⡗\",\"⡏\"]},\"dots10\":{\"interval\":80,\"frames\":[\"⢄\",\"⢂\",\"⢁\",\"⡁\",\"⡈\",\"⡐\",\"⡠\"]},\"dots11\":{\"interval\":100,\"frames\":[\"⠁\",\"⠂\",\"⠄\",\"⡀\",\"⢀\",\"⠠\",\"⠐\",\"⠈\"]},\"dots12\":{\"interval\":80,\"frames\":[\"⢀⠀\",\"⡀⠀\",\"⠄⠀\",\"⢂⠀\",\"⡂⠀\",\"⠅⠀\",\"⢃⠀\",\"⡃⠀\",\"⠍⠀\",\"⢋⠀\",\"⡋⠀\",\"⠍⠁\",\"⢋⠁\",\"⡋⠁\",\"⠍⠉\",\"⠋⠉\",\"⠋⠉\",\"⠉⠙\",\"⠉⠙\",\"⠉⠩\",\"⠈⢙\",\"⠈⡙\",\"⢈⠩\",\"⡀⢙\",\"⠄⡙\",\"⢂⠩\",\"⡂⢘\",\"⠅⡘\",\"⢃⠨\",\"⡃⢐\",\"⠍⡐\",\"⢋⠠\",\"⡋⢀\",\"⠍⡁\",\"⢋⠁\",\"⡋⠁\",\"⠍⠉\",\"⠋⠉\",\"⠋⠉\",\"⠉⠙\",\"⠉⠙\",\"⠉⠩\",\"⠈⢙\",\"⠈⡙\",\"⠈⠩\",\"⠀⢙\",\"⠀⡙\",\"⠀⠩\",\"⠀⢘\",\"⠀⡘\",\"⠀⠨\",\"⠀⢐\",\"⠀⡐\",\"⠀⠠\",\"⠀⢀\",\"⠀⡀\"]},\"line\":{\"interval\":130,\"frames\":[\"-\",\"\\\\\",\"|\",\"/\"]},\"line2\":{\"interval\":100,\"frames\":[\"⠂\",\"-\",\"–\",\"—\",\"–\",\"-\"]},\"pipe\":{\"interval\":100,\"frames\":[\"┤\",\"┘\",\"┴\",\"└\",\"├\",\"┌\",\"┬\",\"┐\"]},\"simpleDots\":{\"interval\":400,\"frames\":[\".  \",\".. \",\"...\",\"   \"]},\"simpleDotsScrolling\":{\"interval\":200,\"frames\":[\".  \",\".. \",\"...\",\" ..\",\"  .\",\"   \"]},\"star\":{\"interval\":70,\"frames\":[\"✶\",\"✸\",\"✹\",\"✺\",\"✹\",\"✷\"]},\"star2\":{\"interval\":80,\"frames\":[\"+\",\"x\",\"*\"]},\"flip\":{\"interval\":70,\"frames\":[\"_\",\"_\",\"_\",\"-\",\"`\",\"`\",\"'\",\"´\",\"-\",\"_\",\"_\",\"_\"]},\"hamburger\":{\"interval\":100,\"frames\":[\"☱\",\"☲\",\"☴\"]},\"growVertical\":{\"interval\":120,\"frames\":[\"▁\",\"▃\",\"▄\",\"▅\",\"▆\",\"▇\",\"▆\",\"▅\",\"▄\",\"▃\"]},\"growHorizontal\":{\"interval\":120,\"frames\":[\"▏\",\"▎\",\"▍\",\"▌\",\"▋\",\"▊\",\"▉\",\"▊\",\"▋\",\"▌\",\"▍\",\"▎\"]},\"balloon\":{\"interval\":140,\"frames\":[\" \",\".\",\"o\",\"O\",\"@\",\"*\",\" \"]},\"balloon2\":{\"interval\":120,\"frames\":[\".\",\"o\",\"O\",\"°\",\"O\",\"o\",\".\"]},\"noise\":{\"interval\":100,\"frames\":[\"▓\",\"▒\",\"░\"]},\"bounce\":{\"interval\":120,\"frames\":[\"⠁\",\"⠂\",\"⠄\",\"⠂\"]},\"boxBounce\":{\"interval\":120,\"frames\":[\"▖\",\"▘\",\"▝\",\"▗\"]},\"boxBounce2\":{\"interval\":100,\"frames\":[\"▌\",\"▀\",\"▐\",\"▄\"]},\"triangle\":{\"interval\":50,\"frames\":[\"◢\",\"◣\",\"◤\",\"◥\"]},\"arc\":{\"interval\":100,\"frames\":[\"◜\",\"◠\",\"◝\",\"◞\",\"◡\",\"◟\"]},\"circle\":{\"interval\":120,\"frames\":[\"◡\",\"⊙\",\"◠\"]},\"squareCorners\":{\"interval\":180,\"frames\":[\"◰\",\"◳\",\"◲\",\"◱\"]},\"circleQuarters\":{\"interval\":120,\"frames\":[\"◴\",\"◷\",\"◶\",\"◵\"]},\"circleHalves\":{\"interval\":50,\"frames\":[\"◐\",\"◓\",\"◑\",\"◒\"]},\"squish\":{\"interval\":100,\"frames\":[\"╫\",\"╪\"]},\"toggle\":{\"interval\":250,\"frames\":[\"⊶\",\"⊷\"]},\"toggle2\":{\"interval\":80,\"frames\":[\"▫\",\"▪\"]},\"toggle3\":{\"interval\":120,\"frames\":[\"□\",\"■\"]},\"toggle4\":{\"interval\":100,\"frames\":[\"■\",\"□\",\"▪\",\"▫\"]},\"toggle5\":{\"interval\":100,\"frames\":[\"▮\",\"▯\"]},\"toggle6\":{\"interval\":300,\"frames\":[\"ဝ\",\"၀\"]},\"toggle7\":{\"interval\":80,\"frames\":[\"⦾\",\"⦿\"]},\"toggle8\":{\"interval\":100,\"frames\":[\"◍\",\"◌\"]},\"toggle9\":{\"interval\":100,\"frames\":[\"◉\",\"◎\"]},\"toggle10\":{\"interval\":100,\"frames\":[\"㊂\",\"㊀\",\"㊁\"]},\"toggle11\":{\"interval\":50,\"frames\":[\"⧇\",\"⧆\"]},\"toggle12\":{\"interval\":120,\"frames\":[\"☗\",\"☖\"]},\"toggle13\":{\"interval\":80,\"frames\":[\"=\",\"*\",\"-\"]},\"arrow\":{\"interval\":100,\"frames\":[\"←\",\"↖\",\"↑\",\"↗\",\"→\",\"↘\",\"↓\",\"↙\"]},\"arrow2\":{\"interval\":80,\"frames\":[\"⬆️ \",\"↗️ \",\"➡️ \",\"↘️ \",\"⬇️ \",\"↙️ \",\"⬅️ \",\"↖️ \"]},\"arrow3\":{\"interval\":120,\"frames\":[\"▹▹▹▹▹\",\"▸▹▹▹▹\",\"▹▸▹▹▹\",\"▹▹▸▹▹\",\"▹▹▹▸▹\",\"▹▹▹▹▸\"]},\"bouncingBar\":{\"interval\":80,\"frames\":[\"[    ]\",\"[=   ]\",\"[==  ]\",\"[=== ]\",\"[ ===]\",\"[  ==]\",\"[   =]\",\"[    ]\",\"[   =]\",\"[  ==]\",\"[ ===]\",\"[====]\",\"[=== ]\",\"[==  ]\",\"[=   ]\"]},\"bouncingBall\":{\"interval\":80,\"frames\":[\"( ●    )\",\"(  ●   )\",\"(   ●  )\",\"(    ● )\",\"(     ●)\",\"(    ● )\",\"(   ●  )\",\"(  ●   )\",\"( ●    )\",\"(●     )\"]},\"smiley\":{\"interval\":200,\"frames\":[\"😄 \",\"😝 \"]},\"monkey\":{\"interval\":300,\"frames\":[\"🙈 \",\"🙈 \",\"🙉 \",\"🙊 \"]},\"hearts\":{\"interval\":100,\"frames\":[\"💛 \",\"💙 \",\"💜 \",\"💚 \",\"❤️ \"]},\"clock\":{\"interval\":100,\"frames\":[\"🕐 \",\"🕑 \",\"🕒 \",\"🕓 \",\"🕔 \",\"🕕 \",\"🕖 \",\"🕗 \",\"🕘 \",\"🕙 \",\"🕚 \"]},\"earth\":{\"interval\":180,\"frames\":[\"🌍 \",\"🌎 \",\"🌏 \"]},\"moon\":{\"interval\":80,\"frames\":[\"🌑 \",\"🌒 \",\"🌓 \",\"🌔 \",\"🌕 \",\"🌖 \",\"🌗 \",\"🌘 \"]},\"runner\":{\"interval\":140,\"frames\":[\"🚶 \",\"🏃 \"]},\"pong\":{\"interval\":80,\"frames\":[\"▐⠂       ▌\",\"▐⠈       ▌\",\"▐ ⠂      ▌\",\"▐ ⠠      ▌\",\"▐  ⡀     ▌\",\"▐  ⠠     ▌\",\"▐   ⠂    ▌\",\"▐   ⠈    ▌\",\"▐    ⠂   ▌\",\"▐    ⠠   ▌\",\"▐     ⡀  ▌\",\"▐     ⠠  ▌\",\"▐      ⠂ ▌\",\"▐      ⠈ ▌\",\"▐       ⠂▌\",\"▐       ⠠▌\",\"▐       ⡀▌\",\"▐      ⠠ ▌\",\"▐      ⠂ ▌\",\"▐     ⠈  ▌\",\"▐     ⠂  ▌\",\"▐    ⠠   ▌\",\"▐    ⡀   ▌\",\"▐   ⠠    ▌\",\"▐   ⠂    ▌\",\"▐  ⠈     ▌\",\"▐  ⠂     ▌\",\"▐ ⠠      ▌\",\"▐ ⡀      ▌\",\"▐⠠       ▌\"]},\"shark\":{\"interval\":120,\"frames\":[\"▐|\\\\____________▌\",\"▐_|\\\\___________▌\",\"▐__|\\\\__________▌\",\"▐___|\\\\_________▌\",\"▐____|\\\\________▌\",\"▐_____|\\\\_______▌\",\"▐______|\\\\______▌\",\"▐_______|\\\\_____▌\",\"▐________|\\\\____▌\",\"▐_________|\\\\___▌\",\"▐__________|\\\\__▌\",\"▐___________|\\\\_▌\",\"▐____________|\\\\▌\",\"▐____________/|▌\",\"▐___________/|_▌\",\"▐__________/|__▌\",\"▐_________/|___▌\",\"▐________/|____▌\",\"▐_______/|_____▌\",\"▐______/|______▌\",\"▐_____/|_______▌\",\"▐____/|________▌\",\"▐___/|_________▌\",\"▐__/|__________▌\",\"▐_/|___________▌\",\"▐/|____________▌\"]},\"dqpb\":{\"interval\":100,\"frames\":[\"d\",\"q\",\"p\",\"b\"]},\"weather\":{\"interval\":100,\"frames\":[\"☀️ \",\"☀️ \",\"☀️ \",\"🌤 \",\"⛅️ \",\"🌥 \",\"☁️ \",\"🌧 \",\"🌨 \",\"🌧 \",\"🌨 \",\"🌧 \",\"🌨 \",\"⛈ \",\"🌨 \",\"🌧 \",\"🌨 \",\"☁️ \",\"🌥 \",\"⛅️ \",\"🌤 \",\"☀️ \",\"☀️ \"]},\"christmas\":{\"interval\":400,\"frames\":[\"🌲\",\"🎄\"]}}");
 
 /***/ }),
-/* 686 */
+/* 705 */
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "RunCommand", function() { return RunCommand; });
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(34);
-/* harmony import */ var _utils_parallelize__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(500);
-/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(501);
+/* harmony import */ var _build_production_projects__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(706);
+/* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "buildProductionProjects", function() { return _build_production_projects__WEBPACK_IMPORTED_MODULE_0__["buildProductionProjects"]; });
+
+/* harmony import */ var _prepare_project_dependencies__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(923);
+/* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "prepareExternalProjectDependencies", function() { return _prepare_project_dependencies__WEBPACK_IMPORTED_MODULE_1__["prepareExternalProjectDependencies"]; });
+
 /*
  * Licensed to Elasticsearch B.V. under one or more contributor
  * license agreements. See the NOTICE file distributed with
@@ -78836,46 +80703,24 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
-
-const RunCommand = {
-  description: 'Run script defined in package.json in each package that contains that script.',
-  name: 'run',
-
-  async run(projects, projectGraph, {
-    extraArgs
-  }) {
-    const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_3__["topologicallyBatchProjects"])(projects, projectGraph);
-
-    if (extraArgs.length === 0) {
-      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red.bold('\nNo script specified'));
-      process.exit(1);
-    }
-
-    const scriptName = extraArgs[0];
-    const scriptArgs = extraArgs.slice(1);
-    _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`\nRunning script [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(scriptName)}] in batched topological order\n`));
-    await Object(_utils_parallelize__WEBPACK_IMPORTED_MODULE_2__["parallelizeBatches"])(batchedProjects, async pkg => {
-      if (pkg.hasScript(scriptName)) {
-        await pkg.runScriptStreaming(scriptName, scriptArgs);
-      }
-    });
-  }
-
-};
-
 /***/ }),
-/* 687 */
+/* 706 */
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
 __webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "WatchCommand", function() { return WatchCommand; });
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(34);
-/* harmony import */ var _utils_parallelize__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(500);
-/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(501);
-/* harmony import */ var _utils_watch__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(688);
+/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "buildProductionProjects", function() { return buildProductionProjects; });
+/* harmony import */ var cpy__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(707);
+/* harmony import */ var cpy__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(cpy__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(588);
+/* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(del__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(16);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var _config__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(580);
+/* harmony import */ var _utils_fs__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(20);
+/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(34);
+/* harmony import */ var _utils_package_json__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(517);
+/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(501);
 /*
  * Licensed to Elasticsearch B.V. under one or more contributor
  * license agreements. See the NOTICE file distributed with
@@ -78900,1532 +80745,2066 @@ __webpack_require__.r(__webpack_exports__);
 
 
 
+
+
+async function buildProductionProjects({
+  kibanaRoot,
+  buildRoot,
+  onlyOSS
+}) {
+  const projects = await getProductionProjects(kibanaRoot, onlyOSS);
+  const projectGraph = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["buildProjectGraph"])(projects);
+  const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["topologicallyBatchProjects"])(projects, projectGraph);
+  const projectNames = [...projects.values()].map(project => project.name);
+  _utils_log__WEBPACK_IMPORTED_MODULE_5__["log"].write(`Preparing production build for [${projectNames.join(', ')}]`);
+
+  for (const batch of batchedProjects) {
+    for (const project of batch) {
+      await deleteTarget(project);
+      await buildProject(project);
+      await copyToBuild(project, kibanaRoot, buildRoot);
+    }
+  }
+}
 /**
- * Name of the script in the package/project package.json file to run during `kbn watch`.
- */
-const watchScriptName = 'kbn:watch';
-/**
- * Name of the Kibana project.
+ * Returns the subset of projects that should be built into the production
+ * bundle. As we copy these into Kibana's `node_modules` during the build step,
+ * and let Kibana's build process be responsible for installing dependencies,
+ * we only include Kibana's transitive _production_ dependencies. If onlyOSS
+ * is supplied, we omit projects with build.oss in their package.json set to false.
  */
 
-const kibanaProjectName = 'kibana';
+async function getProductionProjects(rootPath, onlyOSS) {
+  const projectPaths = Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])({
+    rootPath
+  });
+  const projects = await Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["getProjects"])(rootPath, projectPaths);
+  const projectsSubset = [projects.get('kibana')];
+
+  if (projects.has('x-pack')) {
+    projectsSubset.push(projects.get('x-pack'));
+  }
+
+  const productionProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["includeTransitiveProjects"])(projectsSubset, projects, {
+    onlyProductionDependencies: true
+  }); // We remove Kibana, as we're already building Kibana
+
+  productionProjects.delete('kibana');
+
+  if (onlyOSS) {
+    productionProjects.forEach(project => {
+      if (project.getBuildConfig().oss === false) {
+        productionProjects.delete(project.json.name);
+      }
+    });
+  }
+
+  return productionProjects;
+}
+
+async function deleteTarget(project) {
+  const targetDir = project.targetLocation;
+
+  if (await Object(_utils_fs__WEBPACK_IMPORTED_MODULE_4__["isDirectory"])(targetDir)) {
+    await del__WEBPACK_IMPORTED_MODULE_1___default()(targetDir, {
+      force: true
+    });
+  }
+}
+
+async function buildProject(project) {
+  if (project.hasScript('build')) {
+    await project.runScript('build');
+  }
+}
 /**
- * Command that traverses through list of available projects/packages that have `kbn:watch` script in their
- * package.json files, groups them into topology aware batches and then processes theses batches one by one
- * running `kbn:watch` scripts in parallel within the same batch.
+ * Copy all the project's files from its "intermediate build directory" and
+ * into the build. The intermediate directory can either be the root of the
+ * project or some other location defined in the project's `package.json`.
  *
- * Command internally relies on the fact that most of the build systems that are triggered by `kbn:watch`
- * will emit special "marker" once build/watch process is ready that we can use as completion condition for
- * the `kbn:watch` script and eventually for the entire batch. Currently we support completion "markers" for
- * `webpack` and `tsc` only, for the rest we rely on predefined timeouts.
+ * When copying all the files into the build, we exclude `node_modules` because
+ * we want the Kibana build to be responsible for actually installing all
+ * dependencies. The primary reason for allowing the Kibana build process to
+ * manage dependencies is that it will "dedupe" them, so we don't include
+ * unnecessary copies of dependencies.
  */
 
-const WatchCommand = {
-  description: 'Runs `kbn:watch` script for every project.',
-  name: 'watch',
 
-  async run(projects, projectGraph) {
-    const projectsToWatch = new Map();
+async function copyToBuild(project, kibanaRoot, buildRoot) {
+  // We want the package to have the same relative location within the build
+  const relativeProjectPath = Object(path__WEBPACK_IMPORTED_MODULE_2__["relative"])(kibanaRoot, project.path);
+  const buildProjectPath = Object(path__WEBPACK_IMPORTED_MODULE_2__["resolve"])(buildRoot, relativeProjectPath);
+  await cpy__WEBPACK_IMPORTED_MODULE_0___default()(['**/*', '!node_modules/**'], buildProjectPath, {
+    cwd: project.getIntermediateBuildDirectory(),
+    dot: true,
+    nodir: true,
+    parents: true
+  }); // If a project is using an intermediate build directory, we special-case our
+  // handling of `package.json`, as the project build process might have copied
+  // (a potentially modified) `package.json` into the intermediate build
+  // directory already. If so, we want to use that `package.json` as the basis
+  // for creating the production-ready `package.json`. If it's not present in
+  // the intermediate build, we fall back to using the project's already defined
+  // `package.json`.
 
-    for (const project of projects.values()) {
-      // We can't watch project that doesn't have `kbn:watch` script.
-      if (project.hasScript(watchScriptName)) {
-        projectsToWatch.set(project.name, project);
-      }
-    }
+  const packageJson = (await Object(_utils_fs__WEBPACK_IMPORTED_MODULE_4__["isFile"])(Object(path__WEBPACK_IMPORTED_MODULE_2__["join"])(buildProjectPath, 'package.json'))) ? await Object(_utils_package_json__WEBPACK_IMPORTED_MODULE_6__["readPackageJson"])(buildProjectPath) : project.json;
+  await Object(_utils_package_json__WEBPACK_IMPORTED_MODULE_6__["writePackageJson"])(buildProjectPath, packageJson);
+}
 
-    if (projectsToWatch.size === 0) {
-      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`\nThere are no projects to watch found. Make sure that projects define 'kbn:watch' script in 'package.json'.\n`));
-      return;
-    }
+/***/ }),
+/* 707 */
+/***/ (function(module, exports, __webpack_require__) {
 
-    const projectNames = Array.from(projectsToWatch.keys());
-    _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(`Running ${watchScriptName} scripts for [${projectNames.join(', ')}].`))); // Kibana should always be run the last, so we don't rely on automatic
-    // topological batching and push it to the last one-entry batch manually.
+"use strict";
 
-    const shouldWatchKibanaProject = projectsToWatch.delete(kibanaProjectName);
-    const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_3__["topologicallyBatchProjects"])(projectsToWatch, projectGraph);
+const EventEmitter = __webpack_require__(379);
+const path = __webpack_require__(16);
+const arrify = __webpack_require__(708);
+const globby = __webpack_require__(709);
+const cpFile = __webpack_require__(912);
+const CpyError = __webpack_require__(921);
 
-    if (shouldWatchKibanaProject) {
-      batchedProjects.push([projects.get(kibanaProjectName)]);
-    }
+const preprocessSrcPath = (srcPath, options) => options.cwd ? path.resolve(options.cwd, srcPath) : srcPath;
 
-    await Object(_utils_parallelize__WEBPACK_IMPORTED_MODULE_2__["parallelizeBatches"])(batchedProjects, async pkg => {
-      const completionHint = await Object(_utils_watch__WEBPACK_IMPORTED_MODULE_4__["waitUntilWatchIsReady"])(pkg.runScriptStreaming(watchScriptName).stdout);
-      _utils_log__WEBPACK_IMPORTED_MODULE_1__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`[${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(pkg.name)}] Initial build completed (${completionHint}).`));
-    });
-  }
+const preprocessDestPath = (srcPath, dest, options) => {
+	let basename = path.basename(srcPath);
+	const dirname = path.dirname(srcPath);
+
+	if (typeof options.rename === 'string') {
+		basename = options.rename;
+	} else if (typeof options.rename === 'function') {
+		basename = options.rename(basename);
+	}
+
+	if (options.cwd) {
+		dest = path.resolve(options.cwd, dest);
+	}
+
+	if (options.parents) {
+		return path.join(dest, dirname, basename);
+	}
+
+	return path.join(dest, basename);
+};
+
+const cpy = (src, dest, options = {}) => {
+	src = arrify(src);
+
+	const progressEmitter = new EventEmitter();
+
+	if (src.length === 0 || !dest) {
+		const promise = Promise.reject(new CpyError('`files` and `destination` required'));
+		promise.on = (...args) => {
+			progressEmitter.on(...args);
+			return promise;
+		};
+
+		return promise;
+	}
+
+	const copyStatus = new Map();
+	let completedFiles = 0;
+	let completedSize = 0;
+
+	const promise = globby(src, options)
+		.catch(error => {
+			throw new CpyError(`Cannot glob \`${src}\`: ${error.message}`, error);
+		})
+		.then(files => {
+			if (files.length === 0) {
+				progressEmitter.emit('progress', {
+					totalFiles: 0,
+					percent: 1,
+					completedFiles: 0,
+					completedSize: 0
+				});
+			}
+
+			return Promise.all(files.map(srcPath => {
+				const from = preprocessSrcPath(srcPath, options);
+				const to = preprocessDestPath(srcPath, dest, options);
+
+				return cpFile(from, to, options)
+					.on('progress', event => {
+						const fileStatus = copyStatus.get(event.src) || {written: 0, percent: 0};
+
+						if (fileStatus.written !== event.written || fileStatus.percent !== event.percent) {
+							completedSize -= fileStatus.written;
+							completedSize += event.written;
+
+							if (event.percent === 1 && fileStatus.percent !== 1) {
+								completedFiles++;
+							}
+
+							copyStatus.set(event.src, {written: event.written, percent: event.percent});
+
+							progressEmitter.emit('progress', {
+								totalFiles: files.length,
+								percent: completedFiles / files.length,
+								completedFiles,
+								completedSize
+							});
+						}
+					})
+					.then(() => to)
+					.catch(error => {
+						throw new CpyError(`Cannot copy from \`${from}\` to \`${to}\`: ${error.message}`, error);
+					});
+			}));
+		});
+
+	promise.on = (...args) => {
+		progressEmitter.on(...args);
+		return promise;
+	};
 
+	return promise;
 };
 
+module.exports = cpy;
+// TODO: Remove this for the next major release
+module.exports.default = cpy;
+
+
 /***/ }),
-/* 688 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
+/* 708 */
+/***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "waitUntilWatchIsReady", function() { return waitUntilWatchIsReady; });
-/* harmony import */ var rxjs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(392);
-/* harmony import */ var rxjs_operators__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(169);
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 
+module.exports = function (val) {
+	if (val === null || val === undefined) {
+		return [];
+	}
 
-/**
- * Number of milliseconds we wait before we fall back to the default watch handler.
- */
+	return Array.isArray(val) ? val : [val];
+};
 
-const defaultHandlerDelay = 3000;
-/**
- * If default watch handler is used, then it's the number of milliseconds we wait for
- * any build output before we consider watch task ready.
- */
 
-const defaultHandlerReadinessTimeout = 2000;
-/**
- * Describes configurable watch options.
- */
+/***/ }),
+/* 709 */
+/***/ (function(module, exports, __webpack_require__) {
 
-function getWatchHandlers(buildOutput$, {
-  handlerDelay = defaultHandlerDelay,
-  handlerReadinessTimeout = defaultHandlerReadinessTimeout
-}) {
-  const typescriptHandler = buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('$ tsc')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('Compilation complete.')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mapTo"])('tsc'))));
-  const webpackHandler = buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('$ webpack')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["first"])(data => data.includes('Chunk Names')), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mapTo"])('webpack'))));
-  const defaultHandler = rxjs__WEBPACK_IMPORTED_MODULE_0__["of"](undefined).pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["delay"])(handlerReadinessTimeout), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["map"])(() => buildOutput$.pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["timeout"])(handlerDelay), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["catchError"])(() => rxjs__WEBPACK_IMPORTED_MODULE_0__["of"]('timeout')))));
-  return [typescriptHandler, webpackHandler, defaultHandler];
-}
+"use strict";
 
-function waitUntilWatchIsReady(stream, opts = {}) {
-  const buildOutput$ = new rxjs__WEBPACK_IMPORTED_MODULE_0__["Subject"]();
+const fs = __webpack_require__(23);
+const arrayUnion = __webpack_require__(710);
+const glob = __webpack_require__(712);
+const fastGlob = __webpack_require__(717);
+const dirGlob = __webpack_require__(905);
+const gitignore = __webpack_require__(908);
 
-  const onDataListener = data => buildOutput$.next(data.toString('utf-8'));
+const DEFAULT_FILTER = () => false;
 
-  const onEndListener = () => buildOutput$.complete();
+const isNegative = pattern => pattern[0] === '!';
 
-  const onErrorListener = e => buildOutput$.error(e);
+const assertPatternsInput = patterns => {
+	if (!patterns.every(x => typeof x === 'string')) {
+		throw new TypeError('Patterns must be a string or an array of strings');
+	}
+};
+
+const checkCwdOption = options => {
+	if (options && options.cwd && !fs.statSync(options.cwd).isDirectory()) {
+		throw new Error('The `cwd` option must be a path to a directory');
+	}
+};
+
+const generateGlobTasks = (patterns, taskOptions) => {
+	patterns = arrayUnion([].concat(patterns));
+	assertPatternsInput(patterns);
+	checkCwdOption(taskOptions);
+
+	const globTasks = [];
+
+	taskOptions = Object.assign({
+		ignore: [],
+		expandDirectories: true
+	}, taskOptions);
+
+	patterns.forEach((pattern, i) => {
+		if (isNegative(pattern)) {
+			return;
+		}
+
+		const ignore = patterns
+			.slice(i)
+			.filter(isNegative)
+			.map(pattern => pattern.slice(1));
+
+		const options = Object.assign({}, taskOptions, {
+			ignore: taskOptions.ignore.concat(ignore)
+		});
+
+		globTasks.push({pattern, options});
+	});
+
+	return globTasks;
+};
+
+const globDirs = (task, fn) => {
+	let options = {};
+	if (task.options.cwd) {
+		options.cwd = task.options.cwd;
+	}
+
+	if (Array.isArray(task.options.expandDirectories)) {
+		options = Object.assign(options, {files: task.options.expandDirectories});
+	} else if (typeof task.options.expandDirectories === 'object') {
+		options = Object.assign(options, task.options.expandDirectories);
+	}
+
+	return fn(task.pattern, options);
+};
+
+const getPattern = (task, fn) => task.options.expandDirectories ? globDirs(task, fn) : [task.pattern];
+
+const globToTask = task => glob => {
+	const {options} = task;
+	if (options.ignore && Array.isArray(options.ignore) && options.expandDirectories) {
+		options.ignore = dirGlob.sync(options.ignore);
+	}
+
+	return {
+		pattern: glob,
+		options
+	};
+};
+
+const globby = (patterns, options) => {
+	let globTasks;
+
+	try {
+		globTasks = generateGlobTasks(patterns, options);
+	} catch (error) {
+		return Promise.reject(error);
+	}
+
+	const getTasks = Promise.all(globTasks.map(task => Promise.resolve(getPattern(task, dirGlob))
+		.then(globs => Promise.all(globs.map(globToTask(task))))
+	))
+		.then(tasks => arrayUnion(...tasks));
+
+	const getFilter = () => {
+		return Promise.resolve(
+			options && options.gitignore ?
+				gitignore({cwd: options.cwd, ignore: options.ignore}) :
+				DEFAULT_FILTER
+		);
+	};
+
+	return getFilter()
+		.then(filter => {
+			return getTasks
+				.then(tasks => Promise.all(tasks.map(task => fastGlob(task.pattern, task.options))))
+				.then(paths => arrayUnion(...paths))
+				.then(paths => paths.filter(p => !filter(p)));
+		});
+};
+
+module.exports = globby;
+// TODO: Remove this for the next major release
+module.exports.default = globby;
+
+module.exports.sync = (patterns, options) => {
+	const globTasks = generateGlobTasks(patterns, options);
+
+	const getFilter = () => {
+		return options && options.gitignore ?
+			gitignore.sync({cwd: options.cwd, ignore: options.ignore}) :
+			DEFAULT_FILTER;
+	};
+
+	const tasks = globTasks.reduce((tasks, task) => {
+		const newTask = getPattern(task, dirGlob.sync).map(globToTask(task));
+		return tasks.concat(newTask);
+	}, []);
+
+	const filter = getFilter();
+	return tasks.reduce(
+		(matches, task) => arrayUnion(matches, fastGlob.sync(task.pattern, task.options)),
+		[]
+	).filter(p => !filter(p));
+};
+
+module.exports.generateGlobTasks = generateGlobTasks;
+
+module.exports.hasMagic = (patterns, options) => []
+	.concat(patterns)
+	.some(pattern => glob.hasMagic(pattern, options));
+
+module.exports.gitignore = gitignore;
 
-  stream.once('end', onEndListener);
-  stream.once('error', onErrorListener);
-  stream.on('data', onDataListener);
-  return rxjs__WEBPACK_IMPORTED_MODULE_0__["race"](getWatchHandlers(buildOutput$, opts)).pipe(Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["mergeMap"])(whenReady => whenReady), Object(rxjs_operators__WEBPACK_IMPORTED_MODULE_1__["finalize"])(() => {
-    stream.removeListener('data', onDataListener);
-    stream.removeListener('end', onEndListener);
-    stream.removeListener('error', onErrorListener);
-    buildOutput$.complete();
-  })).toPromise();
-}
 
 /***/ }),
-/* 689 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
+/* 710 */
+/***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "runCommand", function() { return runCommand; });
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var indent_string__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(673);
-/* harmony import */ var indent_string__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(indent_string__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var wrap_ansi__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(690);
-/* harmony import */ var wrap_ansi__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(wrap_ansi__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _utils_errors__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(515);
-/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(34);
-/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(501);
-/* harmony import */ var _utils_projects_tree__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(697);
-/* harmony import */ var _utils_kibana__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(698);
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }
-
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(source, true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(source).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
 
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+var arrayUniq = __webpack_require__(711);
 
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
+module.exports = function () {
+	return arrayUniq([].concat.apply([], arguments));
+};
 
 
+/***/ }),
+/* 711 */
+/***/ (function(module, exports, __webpack_require__) {
 
+"use strict";
 
 
+// there's 3 implementations written in increasing order of efficiency
 
+// 1 - no Set type is defined
+function uniqNoSet(arr) {
+	var ret = [];
 
+	for (var i = 0; i < arr.length; i++) {
+		if (ret.indexOf(arr[i]) === -1) {
+			ret.push(arr[i]);
+		}
+	}
 
-async function runCommand(command, config) {
-  try {
-    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`Running [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(command.name)}] command from [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.yellow(config.rootPath)}]:\n`));
-    const kbn = await _utils_kibana__WEBPACK_IMPORTED_MODULE_7__["Kibana"].loadFrom(config.rootPath);
-    const projects = kbn.getFilteredProjects({
-      skipKibanaPlugins: Boolean(config.options['skip-kibana-plugins']),
-      ossOnly: Boolean(config.options.oss),
-      exclude: toArray(config.options.exclude),
-      include: toArray(config.options.include)
-    });
+	return ret;
+}
 
-    if (projects.size === 0) {
-      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`There are no projects found. Double check project name(s) in '-i/--include' and '-e/--exclude' filters.\n`));
-      return process.exit(1);
-    }
+// 2 - a simple Set type is defined
+function uniqSet(arr) {
+	var seen = new Set();
+	return arr.filter(function (el) {
+		if (!seen.has(el)) {
+			seen.add(el);
+			return true;
+		}
 
-    const projectGraph = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_5__["buildProjectGraph"])(projects);
-    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold(`Found [${chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(projects.size.toString())}] projects:\n`));
-    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(Object(_utils_projects_tree__WEBPACK_IMPORTED_MODULE_6__["renderProjectsTree"])(config.rootPath, projects));
-    await command.run(projects, projectGraph, _objectSpread({}, config, {
-      kbn
-    }));
-  } catch (e) {
-    _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(chalk__WEBPACK_IMPORTED_MODULE_0___default.a.bold.red(`\n[${command.name}] failed:\n`));
+		return false;
+	});
+}
 
-    if (e instanceof _utils_errors__WEBPACK_IMPORTED_MODULE_3__["CliError"]) {
-      const msg = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.red(`CliError: ${e.message}\n`);
-      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(wrap_ansi__WEBPACK_IMPORTED_MODULE_2___default()(msg, 80));
-      const keys = Object.keys(e.meta);
+// 3 - a standard Set type is defined and it has a forEach method
+function uniqSetWithForEach(arr) {
+	var ret = [];
 
-      if (keys.length > 0) {
-        const metaOutput = keys.map(key => {
-          const value = e.meta[key];
-          return `${key}: ${value}`;
-        });
-        _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write('Additional debugging info:\n');
-        _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(indent_string__WEBPACK_IMPORTED_MODULE_1___default()(metaOutput.join('\n'), 3));
-      }
-    } else {
-      _utils_log__WEBPACK_IMPORTED_MODULE_4__["log"].write(e.stack);
-    }
+	(new Set(arr)).forEach(function (el) {
+		ret.push(el);
+	});
 
-    process.exit(1);
-  }
+	return ret;
 }
 
-function toArray(value) {
-  if (value == null) {
-    return [];
-  }
+// V8 currently has a broken implementation
+// https://github.com/joyent/node/issues/8449
+function doesForEachActuallyWork() {
+	var ret = false;
 
-  return Array.isArray(value) ? value : [value];
+	(new Set([true])).forEach(function (el) {
+		ret = el;
+	});
+
+	return ret === true;
+}
+
+if ('Set' in global) {
+	if (typeof Set.prototype.forEach === 'function' && doesForEachActuallyWork()) {
+		module.exports = uniqSetWithForEach;
+	} else {
+		module.exports = uniqSet;
+	}
+} else {
+	module.exports = uniqNoSet;
 }
 
+
 /***/ }),
-/* 690 */
+/* 712 */
 /***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
+// Approach:
+//
+// 1. Get the minimatch set
+// 2. For each pattern in the set, PROCESS(pattern, false)
+// 3. Store matches per-set, then uniq them
+//
+// PROCESS(pattern, inGlobStar)
+// Get the first [n] items from pattern that are all strings
+// Join these together.  This is PREFIX.
+//   If there is no more remaining, then stat(PREFIX) and
+//   add to matches if it succeeds.  END.
+//
+// If inGlobStar and PREFIX is symlink and points to dir
+//   set ENTRIES = []
+// else readdir(PREFIX) as ENTRIES
+//   If fail, END
+//
+// with ENTRIES
+//   If pattern[n] is GLOBSTAR
+//     // handle the case where the globstar match is empty
+//     // by pruning it out, and testing the resulting pattern
+//     PROCESS(pattern[0..n] + pattern[n+1 .. $], false)
+//     // handle other cases.
+//     for ENTRY in ENTRIES (not dotfiles)
+//       // attach globstar + tail onto the entry
+//       // Mark that this entry is a globstar match
+//       PROCESS(pattern[0..n] + ENTRY + pattern[n .. $], true)
+//
+//   else // not globstar
+//     for ENTRY in ENTRIES (not dotfiles, unless pattern[n] is dot)
+//       Test ENTRY against pattern[n]
+//       If fails, continue
+//       If passes, PROCESS(pattern[0..n] + item + pattern[n+1 .. $])
+//
+// Caveat:
+//   Cache all stats and readdirs results to minimize syscall.  Since all
+//   we ever care about is existence and directory-ness, we can just keep
+//   `true` for files, and [children,...] for directories, or `false` for
+//   things that don't exist.
 
-const stringWidth = __webpack_require__(691);
-const stripAnsi = __webpack_require__(695);
+module.exports = glob
 
-const ESCAPES = new Set([
-	'\u001B',
-	'\u009B'
-]);
+var fs = __webpack_require__(23)
+var rp = __webpack_require__(503)
+var minimatch = __webpack_require__(505)
+var Minimatch = minimatch.Minimatch
+var inherits = __webpack_require__(713)
+var EE = __webpack_require__(379).EventEmitter
+var path = __webpack_require__(16)
+var assert = __webpack_require__(30)
+var isAbsolute = __webpack_require__(511)
+var globSync = __webpack_require__(715)
+var common = __webpack_require__(716)
+var alphasort = common.alphasort
+var alphasorti = common.alphasorti
+var setopts = common.setopts
+var ownProp = common.ownProp
+var inflight = __webpack_require__(514)
+var util = __webpack_require__(29)
+var childrenIgnored = common.childrenIgnored
+var isIgnored = common.isIgnored
 
-const END_CODE = 39;
+var once = __webpack_require__(385)
 
-const ESCAPE_CODES = new Map([
-	[0, 0],
-	[1, 22],
-	[2, 22],
-	[3, 23],
-	[4, 24],
-	[7, 27],
-	[8, 28],
-	[9, 29],
-	[30, 39],
-	[31, 39],
-	[32, 39],
-	[33, 39],
-	[34, 39],
-	[35, 39],
-	[36, 39],
-	[37, 39],
-	[90, 39],
-	[40, 49],
-	[41, 49],
-	[42, 49],
-	[43, 49],
-	[44, 49],
-	[45, 49],
-	[46, 49],
-	[47, 49]
-]);
+function glob (pattern, options, cb) {
+  if (typeof options === 'function') cb = options, options = {}
+  if (!options) options = {}
 
-const wrapAnsi = code => `${ESCAPES.values().next().value}[${code}m`;
+  if (options.sync) {
+    if (cb)
+      throw new TypeError('callback provided to sync glob')
+    return globSync(pattern, options)
+  }
 
-// Calculate the length of words split on ' ', ignoring
-// the extra characters added by ansi escape codes
-const wordLengths = str => str.split(' ').map(s => stringWidth(s));
+  return new Glob(pattern, options, cb)
+}
 
-// Wrap a long word across multiple rows
-// Ansi escape codes do not count towards length
-const wrapWord = (rows, word, cols) => {
-	const arr = Array.from(word);
+glob.sync = globSync
+var GlobSync = glob.GlobSync = globSync.GlobSync
 
-	let insideEscape = false;
-	let visible = stringWidth(stripAnsi(rows[rows.length - 1]));
+// old api surface
+glob.glob = glob
 
-	for (const item of arr.entries()) {
-		const i = item[0];
-		const char = item[1];
-		const charLength = stringWidth(char);
+function extend (origin, add) {
+  if (add === null || typeof add !== 'object') {
+    return origin
+  }
 
-		if (visible + charLength <= cols) {
-			rows[rows.length - 1] += char;
-		} else {
-			rows.push(char);
-			visible = 0;
-		}
+  var keys = Object.keys(add)
+  var i = keys.length
+  while (i--) {
+    origin[keys[i]] = add[keys[i]]
+  }
+  return origin
+}
 
-		if (ESCAPES.has(char)) {
-			insideEscape = true;
-		} else if (insideEscape && char === 'm') {
-			insideEscape = false;
-			continue;
-		}
+glob.hasMagic = function (pattern, options_) {
+  var options = extend({}, options_)
+  options.noprocess = true
 
-		if (insideEscape) {
-			continue;
-		}
+  var g = new Glob(pattern, options)
+  var set = g.minimatch.set
 
-		visible += charLength;
+  if (!pattern)
+    return false
 
-		if (visible === cols && i < arr.length - 1) {
-			rows.push('');
-			visible = 0;
-		}
-	}
+  if (set.length > 1)
+    return true
 
-	// It's possible that the last row we copy over is only
-	// ansi escape characters, handle this edge-case
-	if (!visible && rows[rows.length - 1].length > 0 && rows.length > 1) {
-		rows[rows.length - 2] += rows.pop();
-	}
-};
+  for (var j = 0; j < set[0].length; j++) {
+    if (typeof set[0][j] !== 'string')
+      return true
+  }
 
-// The wrap-ansi module can be invoked
-// in either 'hard' or 'soft' wrap mode
-//
-// 'hard' will never allow a string to take up more
-// than cols characters
-//
-// 'soft' allows long words to expand past the column length
-const exec = (str, cols, opts) => {
-	const options = opts || {};
+  return false
+}
 
-	if (str.trim() === '') {
-		return options.trim === false ? str : str.trim();
-	}
+glob.Glob = Glob
+inherits(Glob, EE)
+function Glob (pattern, options, cb) {
+  if (typeof options === 'function') {
+    cb = options
+    options = null
+  }
 
-	let pre = '';
-	let ret = '';
-	let escapeCode;
+  if (options && options.sync) {
+    if (cb)
+      throw new TypeError('callback provided to sync glob')
+    return new GlobSync(pattern, options)
+  }
 
-	const lengths = wordLengths(str);
-	const words = str.split(' ');
-	const rows = [''];
+  if (!(this instanceof Glob))
+    return new Glob(pattern, options, cb)
 
-	for (const item of Array.from(words).entries()) {
-		const i = item[0];
-		const word = item[1];
+  setopts(this, pattern, options)
+  this._didRealPath = false
 
-		rows[rows.length - 1] = options.trim === false ? rows[rows.length - 1] : rows[rows.length - 1].trim();
-		let rowLength = stringWidth(rows[rows.length - 1]);
+  // process each pattern in the minimatch set
+  var n = this.minimatch.set.length
 
-		if (rowLength || word === '') {
-			if (rowLength === cols && options.wordWrap === false) {
-				// If we start with a new word but the current row length equals the length of the columns, add a new row
-				rows.push('');
-				rowLength = 0;
-			}
+  // The matches are stored as {<filename>: true,...} so that
+  // duplicates are automagically pruned.
+  // Later, we do an Object.keys() on these.
+  // Keep them as a list so we can fill in when nonull is set.
+  this.matches = new Array(n)
 
-			rows[rows.length - 1] += ' ';
-			rowLength++;
-		}
+  if (typeof cb === 'function') {
+    cb = once(cb)
+    this.on('error', cb)
+    this.on('end', function (matches) {
+      cb(null, matches)
+    })
+  }
 
-		// In 'hard' wrap mode, the length of a line is
-		// never allowed to extend past 'cols'
-		if (lengths[i] > cols && options.hard) {
-			if (rowLength) {
-				rows.push('');
-			}
-			wrapWord(rows, word, cols);
-			continue;
-		}
+  var self = this
+  this._processing = 0
 
-		if (rowLength + lengths[i] > cols && rowLength > 0) {
-			if (options.wordWrap === false && rowLength < cols) {
-				wrapWord(rows, word, cols);
-				continue;
-			}
+  this._emitQueue = []
+  this._processQueue = []
+  this.paused = false
 
-			rows.push('');
-		}
+  if (this.noprocess)
+    return this
 
-		if (rowLength + lengths[i] > cols && options.wordWrap === false) {
-			wrapWord(rows, word, cols);
-			continue;
-		}
+  if (n === 0)
+    return done()
 
-		rows[rows.length - 1] += word;
-	}
+  var sync = true
+  for (var i = 0; i < n; i ++) {
+    this._process(this.minimatch.set[i], i, false, done)
+  }
+  sync = false
 
-	pre = rows.map(r => options.trim === false ? r : r.trim()).join('\n');
+  function done () {
+    --self._processing
+    if (self._processing <= 0) {
+      if (sync) {
+        process.nextTick(function () {
+          self._finish()
+        })
+      } else {
+        self._finish()
+      }
+    }
+  }
+}
 
-	for (const item of Array.from(pre).entries()) {
-		const i = item[0];
-		const char = item[1];
+Glob.prototype._finish = function () {
+  assert(this instanceof Glob)
+  if (this.aborted)
+    return
 
-		ret += char;
+  if (this.realpath && !this._didRealpath)
+    return this._realpath()
 
-		if (ESCAPES.has(char)) {
-			const code = parseFloat(/\d[^m]*/.exec(pre.slice(i, i + 4)));
-			escapeCode = code === END_CODE ? null : code;
-		}
+  common.finish(this)
+  this.emit('end', this.found)
+}
 
-		const code = ESCAPE_CODES.get(Number(escapeCode));
+Glob.prototype._realpath = function () {
+  if (this._didRealpath)
+    return
 
-		if (escapeCode && code) {
-			if (pre[i + 1] === '\n') {
-				ret += wrapAnsi(code);
-			} else if (char === '\n') {
-				ret += wrapAnsi(escapeCode);
-			}
-		}
-	}
+  this._didRealpath = true
 
-	return ret;
-};
+  var n = this.matches.length
+  if (n === 0)
+    return this._finish()
 
-// For each newline, invoke the method separately
-module.exports = (str, cols, opts) => {
-	return String(str)
-		.normalize()
-		.split('\n')
-		.map(line => exec(line, cols, opts))
-		.join('\n');
-};
+  var self = this
+  for (var i = 0; i < this.matches.length; i++)
+    this._realpathSet(i, next)
+
+  function next () {
+    if (--n === 0)
+      self._finish()
+  }
+}
 
+Glob.prototype._realpathSet = function (index, cb) {
+  var matchset = this.matches[index]
+  if (!matchset)
+    return cb()
 
-/***/ }),
-/* 691 */
-/***/ (function(module, exports, __webpack_require__) {
+  var found = Object.keys(matchset)
+  var self = this
+  var n = found.length
+
+  if (n === 0)
+    return cb()
+
+  var set = this.matches[index] = Object.create(null)
+  found.forEach(function (p, i) {
+    // If there's a problem with the stat, then it means that
+    // one or more of the links in the realpath couldn't be
+    // resolved.  just return the abs value in that case.
+    p = self._makeAbs(p)
+    rp.realpath(p, self.realpathCache, function (er, real) {
+      if (!er)
+        set[real] = true
+      else if (er.syscall === 'stat')
+        set[p] = true
+      else
+        self.emit('error', er) // srsly wtf right here
+
+      if (--n === 0) {
+        self.matches[index] = set
+        cb()
+      }
+    })
+  })
+}
+
+Glob.prototype._mark = function (p) {
+  return common.mark(this, p)
+}
 
-"use strict";
+Glob.prototype._makeAbs = function (f) {
+  return common.makeAbs(this, f)
+}
 
-const stripAnsi = __webpack_require__(692);
-const isFullwidthCodePoint = __webpack_require__(694);
+Glob.prototype.abort = function () {
+  this.aborted = true
+  this.emit('abort')
+}
 
-module.exports = str => {
-	if (typeof str !== 'string' || str.length === 0) {
-		return 0;
-	}
+Glob.prototype.pause = function () {
+  if (!this.paused) {
+    this.paused = true
+    this.emit('pause')
+  }
+}
 
-	str = stripAnsi(str);
+Glob.prototype.resume = function () {
+  if (this.paused) {
+    this.emit('resume')
+    this.paused = false
+    if (this._emitQueue.length) {
+      var eq = this._emitQueue.slice(0)
+      this._emitQueue.length = 0
+      for (var i = 0; i < eq.length; i ++) {
+        var e = eq[i]
+        this._emitMatch(e[0], e[1])
+      }
+    }
+    if (this._processQueue.length) {
+      var pq = this._processQueue.slice(0)
+      this._processQueue.length = 0
+      for (var i = 0; i < pq.length; i ++) {
+        var p = pq[i]
+        this._processing--
+        this._process(p[0], p[1], p[2], p[3])
+      }
+    }
+  }
+}
 
-	let width = 0;
+Glob.prototype._process = function (pattern, index, inGlobStar, cb) {
+  assert(this instanceof Glob)
+  assert(typeof cb === 'function')
 
-	for (let i = 0; i < str.length; i++) {
-		const code = str.codePointAt(i);
+  if (this.aborted)
+    return
 
-		// Ignore control characters
-		if (code <= 0x1F || (code >= 0x7F && code <= 0x9F)) {
-			continue;
-		}
+  this._processing++
+  if (this.paused) {
+    this._processQueue.push([pattern, index, inGlobStar, cb])
+    return
+  }
 
-		// Ignore combining characters
-		if (code >= 0x300 && code <= 0x36F) {
-			continue;
-		}
+  //console.error('PROCESS %d', this._processing, pattern)
 
-		// Surrogates
-		if (code > 0xFFFF) {
-			i++;
-		}
+  // Get the first [n] parts of pattern that are all strings.
+  var n = 0
+  while (typeof pattern[n] === 'string') {
+    n ++
+  }
+  // now n is the index of the first one that is *not* a string.
 
-		width += isFullwidthCodePoint(code) ? 2 : 1;
-	}
+  // see if there's anything else
+  var prefix
+  switch (n) {
+    // if not, then this is rather simple
+    case pattern.length:
+      this._processSimple(pattern.join('/'), index, cb)
+      return
 
-	return width;
-};
+    case 0:
+      // pattern *starts* with some non-trivial item.
+      // going to readdir(cwd), but not include the prefix in matches.
+      prefix = null
+      break
 
+    default:
+      // pattern has some string bits in the front.
+      // whatever it starts with, whether that's 'absolute' like /foo/bar,
+      // or 'relative' like '../baz'
+      prefix = pattern.slice(0, n).join('/')
+      break
+  }
 
-/***/ }),
-/* 692 */
-/***/ (function(module, exports, __webpack_require__) {
+  var remain = pattern.slice(n)
 
-"use strict";
+  // get the list of entries.
+  var read
+  if (prefix === null)
+    read = '.'
+  else if (isAbsolute(prefix) || isAbsolute(pattern.join('/'))) {
+    if (!prefix || !isAbsolute(prefix))
+      prefix = '/' + prefix
+    read = prefix
+  } else
+    read = prefix
 
-const ansiRegex = __webpack_require__(693);
+  var abs = this._makeAbs(read)
 
-module.exports = input => typeof input === 'string' ? input.replace(ansiRegex(), '') : input;
+  //if ignored, skip _processing
+  if (childrenIgnored(this, read))
+    return cb()
 
+  var isGlobStar = remain[0] === minimatch.GLOBSTAR
+  if (isGlobStar)
+    this._processGlobStar(prefix, read, abs, remain, index, inGlobStar, cb)
+  else
+    this._processReaddir(prefix, read, abs, remain, index, inGlobStar, cb)
+}
 
-/***/ }),
-/* 693 */
-/***/ (function(module, exports, __webpack_require__) {
+Glob.prototype._processReaddir = function (prefix, read, abs, remain, index, inGlobStar, cb) {
+  var self = this
+  this._readdir(abs, inGlobStar, function (er, entries) {
+    return self._processReaddir2(prefix, read, abs, remain, index, inGlobStar, entries, cb)
+  })
+}
 
-"use strict";
+Glob.prototype._processReaddir2 = function (prefix, read, abs, remain, index, inGlobStar, entries, cb) {
 
+  // if the abs isn't a dir, then nothing can match!
+  if (!entries)
+    return cb()
 
-module.exports = () => {
-	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)',
-		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))'
-	].join('|');
+  // It will only match dot entries if it starts with a dot, or if
+  // dot is set.  Stuff like @(.foo|.bar) isn't allowed.
+  var pn = remain[0]
+  var negate = !!this.minimatch.negate
+  var rawGlob = pn._glob
+  var dotOk = this.dot || rawGlob.charAt(0) === '.'
 
-	return new RegExp(pattern, 'g');
-};
+  var matchedEntries = []
+  for (var i = 0; i < entries.length; i++) {
+    var e = entries[i]
+    if (e.charAt(0) !== '.' || dotOk) {
+      var m
+      if (negate && !prefix) {
+        m = !e.match(pn)
+      } else {
+        m = e.match(pn)
+      }
+      if (m)
+        matchedEntries.push(e)
+    }
+  }
 
+  //console.error('prd2', prefix, entries, remain[0]._glob, matchedEntries)
 
-/***/ }),
-/* 694 */
-/***/ (function(module, exports, __webpack_require__) {
+  var len = matchedEntries.length
+  // If there are no matched entries, then nothing matches.
+  if (len === 0)
+    return cb()
 
-"use strict";
+  // if this is the last remaining pattern bit, then no need for
+  // an additional stat *unless* the user has specified mark or
+  // stat explicitly.  We know they exist, since readdir returned
+  // them.
 
-/* eslint-disable yoda */
-module.exports = x => {
-	if (Number.isNaN(x)) {
-		return false;
-	}
+  if (remain.length === 1 && !this.mark && !this.stat) {
+    if (!this.matches[index])
+      this.matches[index] = Object.create(null)
 
-	// code points are derived from:
-	// http://www.unix.org/Public/UNIDATA/EastAsianWidth.txt
-	if (
-		x >= 0x1100 && (
-			x <= 0x115f ||  // Hangul Jamo
-			x === 0x2329 || // LEFT-POINTING ANGLE BRACKET
-			x === 0x232a || // RIGHT-POINTING ANGLE BRACKET
-			// CJK Radicals Supplement .. Enclosed CJK Letters and Months
-			(0x2e80 <= x && x <= 0x3247 && x !== 0x303f) ||
-			// Enclosed CJK Letters and Months .. CJK Unified Ideographs Extension A
-			(0x3250 <= x && x <= 0x4dbf) ||
-			// CJK Unified Ideographs .. Yi Radicals
-			(0x4e00 <= x && x <= 0xa4c6) ||
-			// Hangul Jamo Extended-A
-			(0xa960 <= x && x <= 0xa97c) ||
-			// Hangul Syllables
-			(0xac00 <= x && x <= 0xd7a3) ||
-			// CJK Compatibility Ideographs
-			(0xf900 <= x && x <= 0xfaff) ||
-			// Vertical Forms
-			(0xfe10 <= x && x <= 0xfe19) ||
-			// CJK Compatibility Forms .. Small Form Variants
-			(0xfe30 <= x && x <= 0xfe6b) ||
-			// Halfwidth and Fullwidth Forms
-			(0xff01 <= x && x <= 0xff60) ||
-			(0xffe0 <= x && x <= 0xffe6) ||
-			// Kana Supplement
-			(0x1b000 <= x && x <= 0x1b001) ||
-			// Enclosed Ideographic Supplement
-			(0x1f200 <= x && x <= 0x1f251) ||
-			// CJK Unified Ideographs Extension B .. Tertiary Ideographic Plane
-			(0x20000 <= x && x <= 0x3fffd)
-		)
-	) {
-		return true;
-	}
+    for (var i = 0; i < len; i ++) {
+      var e = matchedEntries[i]
+      if (prefix) {
+        if (prefix !== '/')
+          e = prefix + '/' + e
+        else
+          e = prefix + e
+      }
 
-	return false;
-};
+      if (e.charAt(0) === '/' && !this.nomount) {
+        e = path.join(this.root, e)
+      }
+      this._emitMatch(index, e)
+    }
+    // This was the last one, and no stats were needed
+    return cb()
+  }
 
+  // now test all matched entries as stand-ins for that part
+  // of the pattern.
+  remain.shift()
+  for (var i = 0; i < len; i ++) {
+    var e = matchedEntries[i]
+    var newPattern
+    if (prefix) {
+      if (prefix !== '/')
+        e = prefix + '/' + e
+      else
+        e = prefix + e
+    }
+    this._process([e].concat(remain), index, inGlobStar, cb)
+  }
+  cb()
+}
 
-/***/ }),
-/* 695 */
-/***/ (function(module, exports, __webpack_require__) {
+Glob.prototype._emitMatch = function (index, e) {
+  if (this.aborted)
+    return
 
-"use strict";
+  if (isIgnored(this, e))
+    return
 
-const ansiRegex = __webpack_require__(696);
+  if (this.paused) {
+    this._emitQueue.push([index, e])
+    return
+  }
 
-module.exports = input => typeof input === 'string' ? input.replace(ansiRegex(), '') : input;
+  var abs = isAbsolute(e) ? e : this._makeAbs(e)
 
+  if (this.mark)
+    e = this._mark(e)
 
-/***/ }),
-/* 696 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (this.absolute)
+    e = abs
 
-"use strict";
+  if (this.matches[index][e])
+    return
 
+  if (this.nodir) {
+    var c = this.cache[abs]
+    if (c === 'DIR' || Array.isArray(c))
+      return
+  }
 
-module.exports = () => {
-	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\\u0007)',
-		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))'
-	].join('|');
+  this.matches[index][e] = true
 
-	return new RegExp(pattern, 'g');
-};
+  var st = this.statCache[abs]
+  if (st)
+    this.emit('stat', e, st)
 
+  this.emit('match', e)
+}
 
-/***/ }),
-/* 697 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
+Glob.prototype._readdirInGlobStar = function (abs, cb) {
+  if (this.aborted)
+    return
 
-"use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "renderProjectsTree", function() { return renderProjectsTree; });
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2);
-/* harmony import */ var chalk__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(chalk__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(16);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
+  // follow all symlinked directories forever
+  // just proceed as if this is a non-globstar situation
+  if (this.follow)
+    return this._readdir(abs, false, cb)
 
+  var lstatkey = 'lstat\0' + abs
+  var self = this
+  var lstatcb = inflight(lstatkey, lstatcb_)
 
-const projectKey = Symbol('__project');
-function renderProjectsTree(rootPath, projects) {
-  const projectsTree = buildProjectsTree(rootPath, projects);
-  return treeToString(createTreeStructure(projectsTree));
-}
+  if (lstatcb)
+    fs.lstat(abs, lstatcb)
 
-function treeToString(tree) {
-  return [tree.name].concat(childrenToStrings(tree.children, '')).join('\n');
-}
+  function lstatcb_ (er, lstat) {
+    if (er && er.code === 'ENOENT')
+      return cb()
 
-function childrenToStrings(tree, treePrefix) {
-  if (tree === undefined) {
-    return [];
-  }
+    var isSym = lstat && lstat.isSymbolicLink()
+    self.symlinks[abs] = isSym
 
-  let strings = [];
-  tree.forEach((node, index) => {
-    const isLastNode = tree.length - 1 === index;
-    const nodePrefix = isLastNode ? '└── ' : '├── ';
-    const childPrefix = isLastNode ? '    ' : '│   ';
-    const childrenPrefix = treePrefix + childPrefix;
-    strings.push(`${treePrefix}${nodePrefix}${node.name}`);
-    strings = strings.concat(childrenToStrings(node.children, childrenPrefix));
-  });
-  return strings;
+    // If it's not a symlink or a dir, then it's definitely a regular file.
+    // don't bother doing a readdir in that case.
+    if (!isSym && lstat && !lstat.isDirectory()) {
+      self.cache[abs] = 'FILE'
+      cb()
+    } else
+      self._readdir(abs, false, cb)
+  }
 }
 
-function createTreeStructure(tree) {
-  let name;
-  const children = [];
+Glob.prototype._readdir = function (abs, inGlobStar, cb) {
+  if (this.aborted)
+    return
 
-  for (const [dir, project] of tree.entries()) {
-    // This is a leaf node (aka a project)
-    if (typeof project === 'string') {
-      name = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(project);
-      continue;
-    } // If there's only one project and the key indicates it's a leaf node, we
-    // know that we're at a package folder that contains a package.json, so we
-    // "inline it" so we don't get unnecessary levels, i.e. we'll just see
-    // `foo` instead of `foo -> foo`.
+  cb = inflight('readdir\0'+abs+'\0'+inGlobStar, cb)
+  if (!cb)
+    return
 
+  //console.error('RD %j %j', +inGlobStar, abs)
+  if (inGlobStar && !ownProp(this.symlinks, abs))
+    return this._readdirInGlobStar(abs, cb)
 
-    if (project.size === 1 && project.has(projectKey)) {
-      const projectName = project.get(projectKey);
-      children.push({
-        children: [],
-        name: dirOrProjectName(dir, projectName)
-      });
-      continue;
-    }
+  if (ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
+    if (!c || c === 'FILE')
+      return cb()
 
-    const subtree = createTreeStructure(project); // If the name is specified, we know there's a package at the "root" of the
-    // subtree itself.
+    if (Array.isArray(c))
+      return cb(null, c)
+  }
 
-    if (subtree.name !== undefined) {
-      const projectName = subtree.name;
-      children.push({
-        children: subtree.children,
-        name: dirOrProjectName(dir, projectName)
-      });
-      continue;
-    } // Special-case whenever we have one child, so we don't get unnecessary
-    // folders in the output. E.g. instead of `foo -> bar -> baz` we get
-    // `foo/bar/baz` instead.
+  var self = this
+  fs.readdir(abs, readdirCb(this, abs, cb))
+}
 
+function readdirCb (self, abs, cb) {
+  return function (er, entries) {
+    if (er)
+      self._readdirError(abs, er, cb)
+    else
+      self._readdirEntries(abs, entries, cb)
+  }
+}
 
-    if (subtree.children && subtree.children.length === 1) {
-      const child = subtree.children[0];
-      const newName = chalk__WEBPACK_IMPORTED_MODULE_0___default.a.dim(path__WEBPACK_IMPORTED_MODULE_1___default.a.join(dir.toString(), child.name));
-      children.push({
-        children: child.children,
-        name: newName
-      });
-      continue;
-    }
+Glob.prototype._readdirEntries = function (abs, entries, cb) {
+  if (this.aborted)
+    return
 
-    children.push({
-      children: subtree.children,
-      name: chalk__WEBPACK_IMPORTED_MODULE_0___default.a.dim(dir.toString())
-    });
+  // if we haven't asked to stat everything, then just
+  // assume that everything in there exists, so we can avoid
+  // having to stat it a second time.
+  if (!this.mark && !this.stat) {
+    for (var i = 0; i < entries.length; i ++) {
+      var e = entries[i]
+      if (abs === '/')
+        e = abs + e
+      else
+        e = abs + '/' + e
+      this.cache[e] = true
+    }
   }
 
-  return {
-    name,
-    children
-  };
+  this.cache[abs] = entries
+  return cb(null, entries)
 }
 
-function dirOrProjectName(dir, projectName) {
-  return dir === projectName ? chalk__WEBPACK_IMPORTED_MODULE_0___default.a.green(dir) : chalk__WEBPACK_IMPORTED_MODULE_0___default.a`{dim ${dir.toString()} ({reset.green ${projectName}})}`;
-}
+Glob.prototype._readdirError = function (f, er, cb) {
+  if (this.aborted)
+    return
 
-function buildProjectsTree(rootPath, projects) {
-  const tree = new Map();
+  // handle errors, and cache the information
+  switch (er.code) {
+    case 'ENOTSUP': // https://github.com/isaacs/node-glob/issues/205
+    case 'ENOTDIR': // totally normal. means it *does* exist.
+      var abs = this._makeAbs(f)
+      this.cache[abs] = 'FILE'
+      if (abs === this.cwdAbs) {
+        var error = new Error(er.code + ' invalid cwd ' + this.cwd)
+        error.path = this.cwd
+        error.code = er.code
+        this.emit('error', error)
+        this.abort()
+      }
+      break
 
-  for (const project of projects.values()) {
-    if (rootPath === project.path) {
-      tree.set(projectKey, project.name);
-    } else {
-      const relativeProjectPath = path__WEBPACK_IMPORTED_MODULE_1___default.a.relative(rootPath, project.path);
-      addProjectToTree(tree, relativeProjectPath.split(path__WEBPACK_IMPORTED_MODULE_1___default.a.sep), project);
-    }
+    case 'ENOENT': // not terribly unusual
+    case 'ELOOP':
+    case 'ENAMETOOLONG':
+    case 'UNKNOWN':
+      this.cache[this._makeAbs(f)] = false
+      break
+
+    default: // some unusual error.  Treat as failure.
+      this.cache[this._makeAbs(f)] = false
+      if (this.strict) {
+        this.emit('error', er)
+        // If the error is handled, then we abort
+        // if not, we threw out of here
+        this.abort()
+      }
+      if (!this.silent)
+        console.error('glob error', er)
+      break
   }
 
-  return tree;
+  return cb()
 }
 
-function addProjectToTree(tree, pathParts, project) {
-  if (pathParts.length === 0) {
-    tree.set(projectKey, project.name);
-  } else {
-    const [currentDir, ...rest] = pathParts;
-
-    if (!tree.has(currentDir)) {
-      tree.set(currentDir, new Map());
-    }
-
-    const subtree = tree.get(currentDir);
-    addProjectToTree(subtree, rest, project);
-  }
+Glob.prototype._processGlobStar = function (prefix, read, abs, remain, index, inGlobStar, cb) {
+  var self = this
+  this._readdir(abs, inGlobStar, function (er, entries) {
+    self._processGlobStar2(prefix, read, abs, remain, index, inGlobStar, entries, cb)
+  })
 }
 
-/***/ }),
-/* 698 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
 
-"use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "Kibana", function() { return Kibana; });
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(16);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var multimatch__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(699);
-/* harmony import */ var multimatch__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(multimatch__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var _projects__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(501);
-/* harmony import */ var _config__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(580);
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); keys.push.apply(keys, symbols); } return keys; }
+Glob.prototype._processGlobStar2 = function (prefix, read, abs, remain, index, inGlobStar, entries, cb) {
+  //console.error('pgs2', prefix, remain[0], entries)
 
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(source, true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(source).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
+  // no entries means not a dir, so it can never have matches
+  // foo.txt/** doesn't match foo.txt
+  if (!entries)
+    return cb()
 
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+  // test without the globstar, and with every child both below
+  // and replacing the globstar.
+  var remainWithoutGlobStar = remain.slice(1)
+  var gspref = prefix ? [ prefix ] : []
+  var noGlobStar = gspref.concat(remainWithoutGlobStar)
 
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
+  // the noGlobStar pattern exits the inGlobStar state
+  this._process(noGlobStar, index, false, cb)
 
+  var isSym = this.symlinks[abs]
+  var len = entries.length
 
+  // If it's a symlink, and we're in a globstar, then stop
+  if (isSym && inGlobStar)
+    return cb()
 
+  for (var i = 0; i < len; i++) {
+    var e = entries[i]
+    if (e.charAt(0) === '.' && !this.dot)
+      continue
 
-/**
- * Helper class for dealing with a set of projects as children of
- * the Kibana project. The kbn/pm is currently implemented to be
- * more generic, where everything is an operation of generic projects,
- * but that leads to exceptions where we need the kibana project and
- * do things like `project.get('kibana')!`.
- *
- * Using this helper we can restructre the generic list of projects
- * as a Kibana object which encapulates all the projects in the
- * workspace and knows about the root Kibana project.
- */
+    // these two cases enter the inGlobStar state
+    var instead = gspref.concat(entries[i], remainWithoutGlobStar)
+    this._process(instead, index, true, cb)
 
-class Kibana {
-  static async loadFrom(rootPath) {
-    return new Kibana((await Object(_projects__WEBPACK_IMPORTED_MODULE_2__["getProjects"])(rootPath, Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])({
-      rootPath
-    }))));
+    var below = gspref.concat(entries[i], remain)
+    this._process(below, index, true, cb)
   }
 
-  constructor(allWorkspaceProjects) {
-    this.allWorkspaceProjects = allWorkspaceProjects;
-
-    _defineProperty(this, "kibanaProject", void 0);
+  cb()
+}
 
-    const kibanaProject = allWorkspaceProjects.get('kibana');
+Glob.prototype._processSimple = function (prefix, index, cb) {
+  // XXX review this.  Shouldn't it be doing the mounting etc
+  // before doing stat?  kinda weird?
+  var self = this
+  this._stat(prefix, function (er, exists) {
+    self._processSimple2(prefix, index, er, exists, cb)
+  })
+}
+Glob.prototype._processSimple2 = function (prefix, index, er, exists, cb) {
 
-    if (!kibanaProject) {
-      throw new TypeError('Unable to create Kibana object without all projects, including the Kibana project.');
-    }
+  //console.error('ps2', prefix, exists)
 
-    this.kibanaProject = kibanaProject;
-  }
-  /** make an absolute path by resolving subPath relative to the kibana repo */
+  if (!this.matches[index])
+    this.matches[index] = Object.create(null)
 
+  // If it doesn't exist, then just mark the lack of results
+  if (!exists)
+    return cb()
 
-  getAbsolute(...subPath) {
-    return path__WEBPACK_IMPORTED_MODULE_0___default.a.resolve(this.kibanaProject.path, ...subPath);
+  if (prefix && isAbsolute(prefix) && !this.nomount) {
+    var trail = /[\/\\]$/.test(prefix)
+    if (prefix.charAt(0) === '/') {
+      prefix = path.join(this.root, prefix)
+    } else {
+      prefix = path.resolve(this.root, prefix)
+      if (trail)
+        prefix += '/'
+    }
   }
-  /** convert an absolute path to a relative path, relative to the kibana repo */
 
+  if (process.platform === 'win32')
+    prefix = prefix.replace(/\\/g, '/')
 
-  getRelative(absolute) {
-    return path__WEBPACK_IMPORTED_MODULE_0___default.a.relative(this.kibanaProject.path, absolute);
-  }
-  /** get a copy of the map of all projects in the kibana workspace */
-
+  // Mark this as a match
+  this._emitMatch(index, prefix)
+  cb()
+}
 
-  getAllProjects() {
-    return new Map(this.allWorkspaceProjects);
-  }
-  /** determine if a project with the given name exists */
+// Returns either 'DIR', 'FILE', or false
+Glob.prototype._stat = function (f, cb) {
+  var abs = this._makeAbs(f)
+  var needDir = f.slice(-1) === '/'
 
+  if (f.length > this.maxLength)
+    return cb()
 
-  hasProject(name) {
-    return this.allWorkspaceProjects.has(name);
-  }
-  /** get a specific project, throws if the name is not known (use hasProject() first) */
+  if (!this.stat && ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
 
+    if (Array.isArray(c))
+      c = 'DIR'
 
-  getProject(name) {
-    const project = this.allWorkspaceProjects.get(name);
+    // It exists, but maybe not how we need it
+    if (!needDir || c === 'DIR')
+      return cb(null, c)
 
-    if (!project) {
-      throw new Error(`No package with name "${name}" in the workspace`);
-    }
+    if (needDir && c === 'FILE')
+      return cb()
 
-    return project;
+    // otherwise we have to stat, because maybe c=true
+    // if we know it exists, but not what it is.
   }
-  /** get a project and all of the projects it depends on in a ProjectMap */
-
 
-  getProjectAndDeps(name) {
-    const project = this.getProject(name);
-    return Object(_projects__WEBPACK_IMPORTED_MODULE_2__["includeTransitiveProjects"])([project], this.allWorkspaceProjects);
+  var exists
+  var stat = this.statCache[abs]
+  if (stat !== undefined) {
+    if (stat === false)
+      return cb(null, stat)
+    else {
+      var type = stat.isDirectory() ? 'DIR' : 'FILE'
+      if (needDir && type === 'FILE')
+        return cb()
+      else
+        return cb(null, type, stat)
+    }
   }
-  /** filter the projects to just those matching certain paths/include/exclude tags */
-
-
-  getFilteredProjects(options) {
-    const allProjects = this.getAllProjects();
-    const filteredProjects = new Map();
-    const pkgJsonPaths = Array.from(allProjects.values()).map(p => p.packageJsonLocation);
-    const filteredPkgJsonGlobs = Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])(_objectSpread({}, options, {
-      rootPath: this.kibanaProject.path
-    })).map(g => path__WEBPACK_IMPORTED_MODULE_0___default.a.resolve(g, 'package.json'));
-    const matchingPkgJsonPaths = multimatch__WEBPACK_IMPORTED_MODULE_1___default()(pkgJsonPaths, filteredPkgJsonGlobs);
 
-    for (const project of allProjects.values()) {
-      const pathMatches = matchingPkgJsonPaths.includes(project.packageJsonLocation);
-      const notExcluded = !options.exclude.includes(project.name);
-      const isIncluded = !options.include.length || options.include.includes(project.name);
+  var self = this
+  var statcb = inflight('stat\0' + abs, lstatcb_)
+  if (statcb)
+    fs.lstat(abs, statcb)
 
-      if (pathMatches && notExcluded && isIncluded) {
-        filteredProjects.set(project.name, project);
-      }
+  function lstatcb_ (er, lstat) {
+    if (lstat && lstat.isSymbolicLink()) {
+      // If it's a symlink, then treat it as the target, unless
+      // the target does not exist, then treat it as a file.
+      return fs.stat(abs, function (er, stat) {
+        if (er)
+          self._stat2(f, abs, null, lstat, cb)
+        else
+          self._stat2(f, abs, er, stat, cb)
+      })
+    } else {
+      self._stat2(f, abs, er, lstat, cb)
     }
-
-    return filteredProjects;
   }
-
 }
 
-/***/ }),
-/* 699 */
-/***/ (function(module, exports, __webpack_require__) {
-
-"use strict";
-
-const minimatch = __webpack_require__(505);
-const arrayUnion = __webpack_require__(700);
-const arrayDiffer = __webpack_require__(701);
-const arrify = __webpack_require__(702);
+Glob.prototype._stat2 = function (f, abs, er, stat, cb) {
+  if (er && (er.code === 'ENOENT' || er.code === 'ENOTDIR')) {
+    this.statCache[abs] = false
+    return cb()
+  }
 
-module.exports = (list, patterns, options = {}) => {
-	list = arrify(list);
-	patterns = arrify(patterns);
+  var needDir = f.slice(-1) === '/'
+  this.statCache[abs] = stat
 
-	if (list.length === 0 || patterns.length === 0) {
-		return [];
-	}
+  if (abs.slice(-1) === '/' && stat && !stat.isDirectory())
+    return cb(null, false, stat)
 
-	return patterns.reduce((result, pattern) => {
-		let process = arrayUnion;
+  var c = true
+  if (stat)
+    c = stat.isDirectory() ? 'DIR' : 'FILE'
+  this.cache[abs] = this.cache[abs] || c
 
-		if (pattern[0] === '!') {
-			pattern = pattern.slice(1);
-			process = arrayDiffer;
-		}
+  if (needDir && c === 'FILE')
+    return cb()
 
-		return process(result, minimatch.match(list, pattern, options));
-	}, []);
-};
+  return cb(null, c, stat)
+}
 
 
 /***/ }),
-/* 700 */
+/* 713 */
 /***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
+try {
+  var util = __webpack_require__(29);
+  /* istanbul ignore next */
+  if (typeof util.inherits !== 'function') throw '';
+  module.exports = util.inherits;
+} catch (e) {
+  /* istanbul ignore next */
+  module.exports = __webpack_require__(714);
+}
 
 
-module.exports = (...arguments_) => {
-	return [...new Set([].concat(...arguments_))];
-};
+/***/ }),
+/* 714 */
+/***/ (function(module, exports) {
+
+if (typeof Object.create === 'function') {
+  // implementation from standard node.js 'util' module
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor
+      ctor.prototype = Object.create(superCtor.prototype, {
+        constructor: {
+          value: ctor,
+          enumerable: false,
+          writable: true,
+          configurable: true
+        }
+      })
+    }
+  };
+} else {
+  // old school shim for old browsers
+  module.exports = function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor
+      var TempCtor = function () {}
+      TempCtor.prototype = superCtor.prototype
+      ctor.prototype = new TempCtor()
+      ctor.prototype.constructor = ctor
+    }
+  }
+}
 
 
 /***/ }),
-/* 701 */
+/* 715 */
 /***/ (function(module, exports, __webpack_require__) {
 
-"use strict";
+module.exports = globSync
+globSync.GlobSync = GlobSync
 
+var fs = __webpack_require__(23)
+var rp = __webpack_require__(503)
+var minimatch = __webpack_require__(505)
+var Minimatch = minimatch.Minimatch
+var Glob = __webpack_require__(712).Glob
+var util = __webpack_require__(29)
+var path = __webpack_require__(16)
+var assert = __webpack_require__(30)
+var isAbsolute = __webpack_require__(511)
+var common = __webpack_require__(716)
+var alphasort = common.alphasort
+var alphasorti = common.alphasorti
+var setopts = common.setopts
+var ownProp = common.ownProp
+var childrenIgnored = common.childrenIgnored
+var isIgnored = common.isIgnored
 
-const arrayDiffer = (array, ...values) => {
-	const rest = new Set([].concat(...values));
-	return array.filter(element => !rest.has(element));
-};
+function globSync (pattern, options) {
+  if (typeof options === 'function' || arguments.length === 3)
+    throw new TypeError('callback provided to sync glob\n'+
+                        'See: https://github.com/isaacs/node-glob/issues/167')
 
-module.exports = arrayDiffer;
+  return new GlobSync(pattern, options).found
+}
 
+function GlobSync (pattern, options) {
+  if (!pattern)
+    throw new Error('must provide pattern')
 
-/***/ }),
-/* 702 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (typeof options === 'function' || arguments.length === 3)
+    throw new TypeError('callback provided to sync glob\n'+
+                        'See: https://github.com/isaacs/node-glob/issues/167')
 
-"use strict";
+  if (!(this instanceof GlobSync))
+    return new GlobSync(pattern, options)
 
+  setopts(this, pattern, options)
 
-const arrify = value => {
-	if (value === null || value === undefined) {
-		return [];
-	}
+  if (this.noprocess)
+    return this
 
-	if (Array.isArray(value)) {
-		return value;
-	}
+  var n = this.minimatch.set.length
+  this.matches = new Array(n)
+  for (var i = 0; i < n; i ++) {
+    this._process(this.minimatch.set[i], i, false)
+  }
+  this._finish()
+}
 
-	if (typeof value === 'string') {
-		return [value];
-	}
+GlobSync.prototype._finish = function () {
+  assert(this instanceof GlobSync)
+  if (this.realpath) {
+    var self = this
+    this.matches.forEach(function (matchset, index) {
+      var set = self.matches[index] = Object.create(null)
+      for (var p in matchset) {
+        try {
+          p = self._makeAbs(p)
+          var real = rp.realpathSync(p, self.realpathCache)
+          set[real] = true
+        } catch (er) {
+          if (er.syscall === 'stat')
+            set[self._makeAbs(p)] = true
+          else
+            throw er
+        }
+      }
+    })
+  }
+  common.finish(this)
+}
 
-	if (typeof value[Symbol.iterator] === 'function') {
-		return [...value];
-	}
 
-	return [value];
-};
+GlobSync.prototype._process = function (pattern, index, inGlobStar) {
+  assert(this instanceof GlobSync)
 
-module.exports = arrify;
+  // Get the first [n] parts of pattern that are all strings.
+  var n = 0
+  while (typeof pattern[n] === 'string') {
+    n ++
+  }
+  // now n is the index of the first one that is *not* a string.
 
+  // See if there's anything else
+  var prefix
+  switch (n) {
+    // if not, then this is rather simple
+    case pattern.length:
+      this._processSimple(pattern.join('/'), index)
+      return
 
-/***/ }),
-/* 703 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
+    case 0:
+      // pattern *starts* with some non-trivial item.
+      // going to readdir(cwd), but not include the prefix in matches.
+      prefix = null
+      break
 
-"use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony import */ var _build_production_projects__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(704);
-/* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "buildProductionProjects", function() { return _build_production_projects__WEBPACK_IMPORTED_MODULE_0__["buildProductionProjects"]; });
+    default:
+      // pattern has some string bits in the front.
+      // whatever it starts with, whether that's 'absolute' like /foo/bar,
+      // or 'relative' like '../baz'
+      prefix = pattern.slice(0, n).join('/')
+      break
+  }
 
-/* harmony import */ var _prepare_project_dependencies__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(914);
-/* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "prepareExternalProjectDependencies", function() { return _prepare_project_dependencies__WEBPACK_IMPORTED_MODULE_1__["prepareExternalProjectDependencies"]; });
+  var remain = pattern.slice(n)
 
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
+  // get the list of entries.
+  var read
+  if (prefix === null)
+    read = '.'
+  else if (isAbsolute(prefix) || isAbsolute(pattern.join('/'))) {
+    if (!prefix || !isAbsolute(prefix))
+      prefix = '/' + prefix
+    read = prefix
+  } else
+    read = prefix
 
+  var abs = this._makeAbs(read)
 
+  //if ignored, skip processing
+  if (childrenIgnored(this, read))
+    return
 
-/***/ }),
-/* 704 */
-/***/ (function(module, __webpack_exports__, __webpack_require__) {
+  var isGlobStar = remain[0] === minimatch.GLOBSTAR
+  if (isGlobStar)
+    this._processGlobStar(prefix, read, abs, remain, index, inGlobStar)
+  else
+    this._processReaddir(prefix, read, abs, remain, index, inGlobStar)
+}
 
-"use strict";
-__webpack_require__.r(__webpack_exports__);
-/* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "buildProductionProjects", function() { return buildProductionProjects; });
-/* harmony import */ var cpy__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(705);
-/* harmony import */ var cpy__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(cpy__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(588);
-/* harmony import */ var del__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(del__WEBPACK_IMPORTED_MODULE_1__);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(16);
-/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
-/* harmony import */ var _config__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(580);
-/* harmony import */ var _utils_fs__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(20);
-/* harmony import */ var _utils_log__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(34);
-/* harmony import */ var _utils_package_json__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(517);
-/* harmony import */ var _utils_projects__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(501);
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
 
+GlobSync.prototype._processReaddir = function (prefix, read, abs, remain, index, inGlobStar) {
+  var entries = this._readdir(abs, inGlobStar)
 
+  // if the abs isn't a dir, then nothing can match!
+  if (!entries)
+    return
 
+  // It will only match dot entries if it starts with a dot, or if
+  // dot is set.  Stuff like @(.foo|.bar) isn't allowed.
+  var pn = remain[0]
+  var negate = !!this.minimatch.negate
+  var rawGlob = pn._glob
+  var dotOk = this.dot || rawGlob.charAt(0) === '.'
 
+  var matchedEntries = []
+  for (var i = 0; i < entries.length; i++) {
+    var e = entries[i]
+    if (e.charAt(0) !== '.' || dotOk) {
+      var m
+      if (negate && !prefix) {
+        m = !e.match(pn)
+      } else {
+        m = e.match(pn)
+      }
+      if (m)
+        matchedEntries.push(e)
+    }
+  }
 
+  var len = matchedEntries.length
+  // If there are no matched entries, then nothing matches.
+  if (len === 0)
+    return
 
+  // if this is the last remaining pattern bit, then no need for
+  // an additional stat *unless* the user has specified mark or
+  // stat explicitly.  We know they exist, since readdir returned
+  // them.
 
+  if (remain.length === 1 && !this.mark && !this.stat) {
+    if (!this.matches[index])
+      this.matches[index] = Object.create(null)
 
-async function buildProductionProjects({
-  kibanaRoot,
-  buildRoot,
-  onlyOSS
-}) {
-  const projects = await getProductionProjects(kibanaRoot, onlyOSS);
-  const projectGraph = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["buildProjectGraph"])(projects);
-  const batchedProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["topologicallyBatchProjects"])(projects, projectGraph);
-  const projectNames = [...projects.values()].map(project => project.name);
-  _utils_log__WEBPACK_IMPORTED_MODULE_5__["log"].write(`Preparing production build for [${projectNames.join(', ')}]`);
+    for (var i = 0; i < len; i ++) {
+      var e = matchedEntries[i]
+      if (prefix) {
+        if (prefix.slice(-1) !== '/')
+          e = prefix + '/' + e
+        else
+          e = prefix + e
+      }
 
-  for (const batch of batchedProjects) {
-    for (const project of batch) {
-      await deleteTarget(project);
-      await buildProject(project);
-      await copyToBuild(project, kibanaRoot, buildRoot);
+      if (e.charAt(0) === '/' && !this.nomount) {
+        e = path.join(this.root, e)
+      }
+      this._emitMatch(index, e)
     }
+    // This was the last one, and no stats were needed
+    return
+  }
+
+  // now test all matched entries as stand-ins for that part
+  // of the pattern.
+  remain.shift()
+  for (var i = 0; i < len; i ++) {
+    var e = matchedEntries[i]
+    var newPattern
+    if (prefix)
+      newPattern = [prefix, e]
+    else
+      newPattern = [e]
+    this._process(newPattern.concat(remain), index, inGlobStar)
   }
 }
-/**
- * Returns the subset of projects that should be built into the production
- * bundle. As we copy these into Kibana's `node_modules` during the build step,
- * and let Kibana's build process be responsible for installing dependencies,
- * we only include Kibana's transitive _production_ dependencies. If onlyOSS
- * is supplied, we omit projects with build.oss in their package.json set to false.
- */
 
-async function getProductionProjects(rootPath, onlyOSS) {
-  const projectPaths = Object(_config__WEBPACK_IMPORTED_MODULE_3__["getProjectPaths"])({
-    rootPath
-  });
-  const projects = await Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["getProjects"])(rootPath, projectPaths);
-  const projectsSubset = [projects.get('kibana')];
 
-  if (projects.has('x-pack')) {
-    projectsSubset.push(projects.get('x-pack'));
-  }
+GlobSync.prototype._emitMatch = function (index, e) {
+  if (isIgnored(this, e))
+    return
 
-  const productionProjects = Object(_utils_projects__WEBPACK_IMPORTED_MODULE_7__["includeTransitiveProjects"])(projectsSubset, projects, {
-    onlyProductionDependencies: true
-  }); // We remove Kibana, as we're already building Kibana
+  var abs = this._makeAbs(e)
 
-  productionProjects.delete('kibana');
+  if (this.mark)
+    e = this._mark(e)
 
-  if (onlyOSS) {
-    productionProjects.forEach(project => {
-      if (project.getBuildConfig().oss === false) {
-        productionProjects.delete(project.json.name);
-      }
-    });
+  if (this.absolute) {
+    e = abs
   }
 
-  return productionProjects;
-}
-
-async function deleteTarget(project) {
-  const targetDir = project.targetLocation;
+  if (this.matches[index][e])
+    return
 
-  if (await Object(_utils_fs__WEBPACK_IMPORTED_MODULE_4__["isDirectory"])(targetDir)) {
-    await del__WEBPACK_IMPORTED_MODULE_1___default()(targetDir, {
-      force: true
-    });
+  if (this.nodir) {
+    var c = this.cache[abs]
+    if (c === 'DIR' || Array.isArray(c))
+      return
   }
-}
 
-async function buildProject(project) {
-  if (project.hasScript('build')) {
-    await project.runScript('build');
-  }
+  this.matches[index][e] = true
+
+  if (this.stat)
+    this._stat(e)
 }
-/**
- * Copy all the project's files from its "intermediate build directory" and
- * into the build. The intermediate directory can either be the root of the
- * project or some other location defined in the project's `package.json`.
- *
- * When copying all the files into the build, we exclude `node_modules` because
- * we want the Kibana build to be responsible for actually installing all
- * dependencies. The primary reason for allowing the Kibana build process to
- * manage dependencies is that it will "dedupe" them, so we don't include
- * unnecessary copies of dependencies.
- */
 
 
-async function copyToBuild(project, kibanaRoot, buildRoot) {
-  // We want the package to have the same relative location within the build
-  const relativeProjectPath = Object(path__WEBPACK_IMPORTED_MODULE_2__["relative"])(kibanaRoot, project.path);
-  const buildProjectPath = Object(path__WEBPACK_IMPORTED_MODULE_2__["resolve"])(buildRoot, relativeProjectPath);
-  await cpy__WEBPACK_IMPORTED_MODULE_0___default()(['**/*', '!node_modules/**'], buildProjectPath, {
-    cwd: project.getIntermediateBuildDirectory(),
-    dot: true,
-    nodir: true,
-    parents: true
-  }); // If a project is using an intermediate build directory, we special-case our
-  // handling of `package.json`, as the project build process might have copied
-  // (a potentially modified) `package.json` into the intermediate build
-  // directory already. If so, we want to use that `package.json` as the basis
-  // for creating the production-ready `package.json`. If it's not present in
-  // the intermediate build, we fall back to using the project's already defined
-  // `package.json`.
+GlobSync.prototype._readdirInGlobStar = function (abs) {
+  // follow all symlinked directories forever
+  // just proceed as if this is a non-globstar situation
+  if (this.follow)
+    return this._readdir(abs, false)
 
-  const packageJson = (await Object(_utils_fs__WEBPACK_IMPORTED_MODULE_4__["isFile"])(Object(path__WEBPACK_IMPORTED_MODULE_2__["join"])(buildProjectPath, 'package.json'))) ? await Object(_utils_package_json__WEBPACK_IMPORTED_MODULE_6__["readPackageJson"])(buildProjectPath) : project.json;
-  await Object(_utils_package_json__WEBPACK_IMPORTED_MODULE_6__["writePackageJson"])(buildProjectPath, packageJson);
-}
+  var entries
+  var lstat
+  var stat
+  try {
+    lstat = fs.lstatSync(abs)
+  } catch (er) {
+    if (er.code === 'ENOENT') {
+      // lstat failed, doesn't exist
+      return null
+    }
+  }
 
-/***/ }),
-/* 705 */
-/***/ (function(module, exports, __webpack_require__) {
+  var isSym = lstat && lstat.isSymbolicLink()
+  this.symlinks[abs] = isSym
 
-"use strict";
+  // If it's not a symlink or a dir, then it's definitely a regular file.
+  // don't bother doing a readdir in that case.
+  if (!isSym && lstat && !lstat.isDirectory())
+    this.cache[abs] = 'FILE'
+  else
+    entries = this._readdir(abs, false)
 
-const EventEmitter = __webpack_require__(379);
-const path = __webpack_require__(16);
-const arrify = __webpack_require__(706);
-const globby = __webpack_require__(707);
-const cpFile = __webpack_require__(905);
-const CpyError = __webpack_require__(912);
+  return entries
+}
 
-const preprocessSrcPath = (srcPath, options) => options.cwd ? path.resolve(options.cwd, srcPath) : srcPath;
+GlobSync.prototype._readdir = function (abs, inGlobStar) {
+  var entries
 
-const preprocessDestPath = (srcPath, dest, options) => {
-	let basename = path.basename(srcPath);
-	const dirname = path.dirname(srcPath);
+  if (inGlobStar && !ownProp(this.symlinks, abs))
+    return this._readdirInGlobStar(abs)
 
-	if (typeof options.rename === 'string') {
-		basename = options.rename;
-	} else if (typeof options.rename === 'function') {
-		basename = options.rename(basename);
-	}
+  if (ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
+    if (!c || c === 'FILE')
+      return null
 
-	if (options.cwd) {
-		dest = path.resolve(options.cwd, dest);
-	}
+    if (Array.isArray(c))
+      return c
+  }
 
-	if (options.parents) {
-		return path.join(dest, dirname, basename);
-	}
+  try {
+    return this._readdirEntries(abs, fs.readdirSync(abs))
+  } catch (er) {
+    this._readdirError(abs, er)
+    return null
+  }
+}
 
-	return path.join(dest, basename);
-};
+GlobSync.prototype._readdirEntries = function (abs, entries) {
+  // if we haven't asked to stat everything, then just
+  // assume that everything in there exists, so we can avoid
+  // having to stat it a second time.
+  if (!this.mark && !this.stat) {
+    for (var i = 0; i < entries.length; i ++) {
+      var e = entries[i]
+      if (abs === '/')
+        e = abs + e
+      else
+        e = abs + '/' + e
+      this.cache[e] = true
+    }
+  }
 
-const cpy = (src, dest, options = {}) => {
-	src = arrify(src);
+  this.cache[abs] = entries
 
-	const progressEmitter = new EventEmitter();
+  // mark and cache dir-ness
+  return entries
+}
 
-	if (src.length === 0 || !dest) {
-		const promise = Promise.reject(new CpyError('`files` and `destination` required'));
-		promise.on = (...args) => {
-			progressEmitter.on(...args);
-			return promise;
-		};
+GlobSync.prototype._readdirError = function (f, er) {
+  // handle errors, and cache the information
+  switch (er.code) {
+    case 'ENOTSUP': // https://github.com/isaacs/node-glob/issues/205
+    case 'ENOTDIR': // totally normal. means it *does* exist.
+      var abs = this._makeAbs(f)
+      this.cache[abs] = 'FILE'
+      if (abs === this.cwdAbs) {
+        var error = new Error(er.code + ' invalid cwd ' + this.cwd)
+        error.path = this.cwd
+        error.code = er.code
+        throw error
+      }
+      break
 
-		return promise;
-	}
+    case 'ENOENT': // not terribly unusual
+    case 'ELOOP':
+    case 'ENAMETOOLONG':
+    case 'UNKNOWN':
+      this.cache[this._makeAbs(f)] = false
+      break
 
-	const copyStatus = new Map();
-	let completedFiles = 0;
-	let completedSize = 0;
+    default: // some unusual error.  Treat as failure.
+      this.cache[this._makeAbs(f)] = false
+      if (this.strict)
+        throw er
+      if (!this.silent)
+        console.error('glob error', er)
+      break
+  }
+}
 
-	const promise = globby(src, options)
-		.catch(error => {
-			throw new CpyError(`Cannot glob \`${src}\`: ${error.message}`, error);
-		})
-		.then(files => {
-			if (files.length === 0) {
-				progressEmitter.emit('progress', {
-					totalFiles: 0,
-					percent: 1,
-					completedFiles: 0,
-					completedSize: 0
-				});
-			}
+GlobSync.prototype._processGlobStar = function (prefix, read, abs, remain, index, inGlobStar) {
 
-			return Promise.all(files.map(srcPath => {
-				const from = preprocessSrcPath(srcPath, options);
-				const to = preprocessDestPath(srcPath, dest, options);
+  var entries = this._readdir(abs, inGlobStar)
 
-				return cpFile(from, to, options)
-					.on('progress', event => {
-						const fileStatus = copyStatus.get(event.src) || {written: 0, percent: 0};
+  // no entries means not a dir, so it can never have matches
+  // foo.txt/** doesn't match foo.txt
+  if (!entries)
+    return
 
-						if (fileStatus.written !== event.written || fileStatus.percent !== event.percent) {
-							completedSize -= fileStatus.written;
-							completedSize += event.written;
+  // test without the globstar, and with every child both below
+  // and replacing the globstar.
+  var remainWithoutGlobStar = remain.slice(1)
+  var gspref = prefix ? [ prefix ] : []
+  var noGlobStar = gspref.concat(remainWithoutGlobStar)
 
-							if (event.percent === 1 && fileStatus.percent !== 1) {
-								completedFiles++;
-							}
+  // the noGlobStar pattern exits the inGlobStar state
+  this._process(noGlobStar, index, false)
 
-							copyStatus.set(event.src, {written: event.written, percent: event.percent});
+  var len = entries.length
+  var isSym = this.symlinks[abs]
 
-							progressEmitter.emit('progress', {
-								totalFiles: files.length,
-								percent: completedFiles / files.length,
-								completedFiles,
-								completedSize
-							});
-						}
-					})
-					.then(() => to)
-					.catch(error => {
-						throw new CpyError(`Cannot copy from \`${from}\` to \`${to}\`: ${error.message}`, error);
-					});
-			}));
-		});
+  // If it's a symlink, and we're in a globstar, then stop
+  if (isSym && inGlobStar)
+    return
 
-	promise.on = (...args) => {
-		progressEmitter.on(...args);
-		return promise;
-	};
+  for (var i = 0; i < len; i++) {
+    var e = entries[i]
+    if (e.charAt(0) === '.' && !this.dot)
+      continue
 
-	return promise;
-};
+    // these two cases enter the inGlobStar state
+    var instead = gspref.concat(entries[i], remainWithoutGlobStar)
+    this._process(instead, index, true)
 
-module.exports = cpy;
-// TODO: Remove this for the next major release
-module.exports.default = cpy;
+    var below = gspref.concat(entries[i], remain)
+    this._process(below, index, true)
+  }
+}
 
+GlobSync.prototype._processSimple = function (prefix, index) {
+  // XXX review this.  Shouldn't it be doing the mounting etc
+  // before doing stat?  kinda weird?
+  var exists = this._stat(prefix)
 
-/***/ }),
-/* 706 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (!this.matches[index])
+    this.matches[index] = Object.create(null)
 
-"use strict";
+  // If it doesn't exist, then just mark the lack of results
+  if (!exists)
+    return
 
-module.exports = function (val) {
-	if (val === null || val === undefined) {
-		return [];
-	}
+  if (prefix && isAbsolute(prefix) && !this.nomount) {
+    var trail = /[\/\\]$/.test(prefix)
+    if (prefix.charAt(0) === '/') {
+      prefix = path.join(this.root, prefix)
+    } else {
+      prefix = path.resolve(this.root, prefix)
+      if (trail)
+        prefix += '/'
+    }
+  }
 
-	return Array.isArray(val) ? val : [val];
-};
+  if (process.platform === 'win32')
+    prefix = prefix.replace(/\\/g, '/')
 
+  // Mark this as a match
+  this._emitMatch(index, prefix)
+}
 
-/***/ }),
-/* 707 */
-/***/ (function(module, exports, __webpack_require__) {
+// Returns either 'DIR', 'FILE', or false
+GlobSync.prototype._stat = function (f) {
+  var abs = this._makeAbs(f)
+  var needDir = f.slice(-1) === '/'
 
-"use strict";
+  if (f.length > this.maxLength)
+    return false
 
-const fs = __webpack_require__(23);
-const arrayUnion = __webpack_require__(708);
-const glob = __webpack_require__(502);
-const fastGlob = __webpack_require__(710);
-const dirGlob = __webpack_require__(898);
-const gitignore = __webpack_require__(901);
+  if (!this.stat && ownProp(this.cache, abs)) {
+    var c = this.cache[abs]
 
-const DEFAULT_FILTER = () => false;
+    if (Array.isArray(c))
+      c = 'DIR'
 
-const isNegative = pattern => pattern[0] === '!';
+    // It exists, but maybe not how we need it
+    if (!needDir || c === 'DIR')
+      return c
 
-const assertPatternsInput = patterns => {
-	if (!patterns.every(x => typeof x === 'string')) {
-		throw new TypeError('Patterns must be a string or an array of strings');
-	}
-};
+    if (needDir && c === 'FILE')
+      return false
 
-const checkCwdOption = options => {
-	if (options && options.cwd && !fs.statSync(options.cwd).isDirectory()) {
-		throw new Error('The `cwd` option must be a path to a directory');
-	}
-};
+    // otherwise we have to stat, because maybe c=true
+    // if we know it exists, but not what it is.
+  }
 
-const generateGlobTasks = (patterns, taskOptions) => {
-	patterns = arrayUnion([].concat(patterns));
-	assertPatternsInput(patterns);
-	checkCwdOption(taskOptions);
+  var exists
+  var stat = this.statCache[abs]
+  if (!stat) {
+    var lstat
+    try {
+      lstat = fs.lstatSync(abs)
+    } catch (er) {
+      if (er && (er.code === 'ENOENT' || er.code === 'ENOTDIR')) {
+        this.statCache[abs] = false
+        return false
+      }
+    }
 
-	const globTasks = [];
+    if (lstat && lstat.isSymbolicLink()) {
+      try {
+        stat = fs.statSync(abs)
+      } catch (er) {
+        stat = lstat
+      }
+    } else {
+      stat = lstat
+    }
+  }
 
-	taskOptions = Object.assign({
-		ignore: [],
-		expandDirectories: true
-	}, taskOptions);
+  this.statCache[abs] = stat
 
-	patterns.forEach((pattern, i) => {
-		if (isNegative(pattern)) {
-			return;
-		}
+  var c = true
+  if (stat)
+    c = stat.isDirectory() ? 'DIR' : 'FILE'
 
-		const ignore = patterns
-			.slice(i)
-			.filter(isNegative)
-			.map(pattern => pattern.slice(1));
+  this.cache[abs] = this.cache[abs] || c
 
-		const options = Object.assign({}, taskOptions, {
-			ignore: taskOptions.ignore.concat(ignore)
-		});
+  if (needDir && c === 'FILE')
+    return false
 
-		globTasks.push({pattern, options});
-	});
+  return c
+}
 
-	return globTasks;
-};
+GlobSync.prototype._mark = function (p) {
+  return common.mark(this, p)
+}
 
-const globDirs = (task, fn) => {
-	let options = {};
-	if (task.options.cwd) {
-		options.cwd = task.options.cwd;
-	}
+GlobSync.prototype._makeAbs = function (f) {
+  return common.makeAbs(this, f)
+}
 
-	if (Array.isArray(task.options.expandDirectories)) {
-		options = Object.assign(options, {files: task.options.expandDirectories});
-	} else if (typeof task.options.expandDirectories === 'object') {
-		options = Object.assign(options, task.options.expandDirectories);
-	}
 
-	return fn(task.pattern, options);
-};
+/***/ }),
+/* 716 */
+/***/ (function(module, exports, __webpack_require__) {
 
-const getPattern = (task, fn) => task.options.expandDirectories ? globDirs(task, fn) : [task.pattern];
+exports.alphasort = alphasort
+exports.alphasorti = alphasorti
+exports.setopts = setopts
+exports.ownProp = ownProp
+exports.makeAbs = makeAbs
+exports.finish = finish
+exports.mark = mark
+exports.isIgnored = isIgnored
+exports.childrenIgnored = childrenIgnored
 
-const globToTask = task => glob => {
-	const {options} = task;
-	if (options.ignore && Array.isArray(options.ignore) && options.expandDirectories) {
-		options.ignore = dirGlob.sync(options.ignore);
-	}
+function ownProp (obj, field) {
+  return Object.prototype.hasOwnProperty.call(obj, field)
+}
 
-	return {
-		pattern: glob,
-		options
-	};
-};
+var path = __webpack_require__(16)
+var minimatch = __webpack_require__(505)
+var isAbsolute = __webpack_require__(511)
+var Minimatch = minimatch.Minimatch
 
-const globby = (patterns, options) => {
-	let globTasks;
+function alphasorti (a, b) {
+  return a.toLowerCase().localeCompare(b.toLowerCase())
+}
 
-	try {
-		globTasks = generateGlobTasks(patterns, options);
-	} catch (error) {
-		return Promise.reject(error);
-	}
+function alphasort (a, b) {
+  return a.localeCompare(b)
+}
 
-	const getTasks = Promise.all(globTasks.map(task => Promise.resolve(getPattern(task, dirGlob))
-		.then(globs => Promise.all(globs.map(globToTask(task))))
-	))
-		.then(tasks => arrayUnion(...tasks));
+function setupIgnores (self, options) {
+  self.ignore = options.ignore || []
 
-	const getFilter = () => {
-		return Promise.resolve(
-			options && options.gitignore ?
-				gitignore({cwd: options.cwd, ignore: options.ignore}) :
-				DEFAULT_FILTER
-		);
-	};
+  if (!Array.isArray(self.ignore))
+    self.ignore = [self.ignore]
 
-	return getFilter()
-		.then(filter => {
-			return getTasks
-				.then(tasks => Promise.all(tasks.map(task => fastGlob(task.pattern, task.options))))
-				.then(paths => arrayUnion(...paths))
-				.then(paths => paths.filter(p => !filter(p)));
-		});
-};
+  if (self.ignore.length) {
+    self.ignore = self.ignore.map(ignoreMap)
+  }
+}
 
-module.exports = globby;
-// TODO: Remove this for the next major release
-module.exports.default = globby;
+// ignore patterns are always in dot:true mode.
+function ignoreMap (pattern) {
+  var gmatcher = null
+  if (pattern.slice(-3) === '/**') {
+    var gpattern = pattern.replace(/(\/\*\*)+$/, '')
+    gmatcher = new Minimatch(gpattern, { dot: true })
+  }
 
-module.exports.sync = (patterns, options) => {
-	const globTasks = generateGlobTasks(patterns, options);
+  return {
+    matcher: new Minimatch(pattern, { dot: true }),
+    gmatcher: gmatcher
+  }
+}
 
-	const getFilter = () => {
-		return options && options.gitignore ?
-			gitignore.sync({cwd: options.cwd, ignore: options.ignore}) :
-			DEFAULT_FILTER;
-	};
+function setopts (self, pattern, options) {
+  if (!options)
+    options = {}
 
-	const tasks = globTasks.reduce((tasks, task) => {
-		const newTask = getPattern(task, dirGlob.sync).map(globToTask(task));
-		return tasks.concat(newTask);
-	}, []);
+  // base-matching: just use globstar for that.
+  if (options.matchBase && -1 === pattern.indexOf("/")) {
+    if (options.noglobstar) {
+      throw new Error("base matching requires globstar")
+    }
+    pattern = "**/" + pattern
+  }
 
-	const filter = getFilter();
-	return tasks.reduce(
-		(matches, task) => arrayUnion(matches, fastGlob.sync(task.pattern, task.options)),
-		[]
-	).filter(p => !filter(p));
-};
+  self.silent = !!options.silent
+  self.pattern = pattern
+  self.strict = options.strict !== false
+  self.realpath = !!options.realpath
+  self.realpathCache = options.realpathCache || Object.create(null)
+  self.follow = !!options.follow
+  self.dot = !!options.dot
+  self.mark = !!options.mark
+  self.nodir = !!options.nodir
+  if (self.nodir)
+    self.mark = true
+  self.sync = !!options.sync
+  self.nounique = !!options.nounique
+  self.nonull = !!options.nonull
+  self.nosort = !!options.nosort
+  self.nocase = !!options.nocase
+  self.stat = !!options.stat
+  self.noprocess = !!options.noprocess
+  self.absolute = !!options.absolute
 
-module.exports.generateGlobTasks = generateGlobTasks;
+  self.maxLength = options.maxLength || Infinity
+  self.cache = options.cache || Object.create(null)
+  self.statCache = options.statCache || Object.create(null)
+  self.symlinks = options.symlinks || Object.create(null)
 
-module.exports.hasMagic = (patterns, options) => []
-	.concat(patterns)
-	.some(pattern => glob.hasMagic(pattern, options));
+  setupIgnores(self, options)
 
-module.exports.gitignore = gitignore;
+  self.changedCwd = false
+  var cwd = process.cwd()
+  if (!ownProp(options, "cwd"))
+    self.cwd = cwd
+  else {
+    self.cwd = path.resolve(options.cwd)
+    self.changedCwd = self.cwd !== cwd
+  }
 
+  self.root = options.root || path.resolve(self.cwd, "/")
+  self.root = path.resolve(self.root)
+  if (process.platform === "win32")
+    self.root = self.root.replace(/\\/g, "/")
 
-/***/ }),
-/* 708 */
-/***/ (function(module, exports, __webpack_require__) {
+  // TODO: is an absolute `cwd` supposed to be resolved against `root`?
+  // e.g. { cwd: '/test', root: __dirname } === path.join(__dirname, '/test')
+  self.cwdAbs = isAbsolute(self.cwd) ? self.cwd : makeAbs(self, self.cwd)
+  if (process.platform === "win32")
+    self.cwdAbs = self.cwdAbs.replace(/\\/g, "/")
+  self.nomount = !!options.nomount
 
-"use strict";
+  // disable comments and negation in Minimatch.
+  // Note that they are not supported in Glob itself anyway.
+  options.nonegate = true
+  options.nocomment = true
 
-var arrayUniq = __webpack_require__(709);
+  self.minimatch = new Minimatch(pattern, options)
+  self.options = self.minimatch.options
+}
 
-module.exports = function () {
-	return arrayUniq([].concat.apply([], arguments));
-};
+function finish (self) {
+  var nou = self.nounique
+  var all = nou ? [] : Object.create(null)
 
+  for (var i = 0, l = self.matches.length; i < l; i ++) {
+    var matches = self.matches[i]
+    if (!matches || Object.keys(matches).length === 0) {
+      if (self.nonull) {
+        // do like the shell, and spit out the literal glob
+        var literal = self.minimatch.globSet[i]
+        if (nou)
+          all.push(literal)
+        else
+          all[literal] = true
+      }
+    } else {
+      // had matches
+      var m = Object.keys(matches)
+      if (nou)
+        all.push.apply(all, m)
+      else
+        m.forEach(function (m) {
+          all[m] = true
+        })
+    }
+  }
 
-/***/ }),
-/* 709 */
-/***/ (function(module, exports, __webpack_require__) {
+  if (!nou)
+    all = Object.keys(all)
 
-"use strict";
+  if (!self.nosort)
+    all = all.sort(self.nocase ? alphasorti : alphasort)
 
+  // at *some* point we statted all of these
+  if (self.mark) {
+    for (var i = 0; i < all.length; i++) {
+      all[i] = self._mark(all[i])
+    }
+    if (self.nodir) {
+      all = all.filter(function (e) {
+        var notDir = !(/\/$/.test(e))
+        var c = self.cache[e] || self.cache[makeAbs(self, e)]
+        if (notDir && c)
+          notDir = c !== 'DIR' && !Array.isArray(c)
+        return notDir
+      })
+    }
+  }
 
-// there's 3 implementations written in increasing order of efficiency
+  if (self.ignore.length)
+    all = all.filter(function(m) {
+      return !isIgnored(self, m)
+    })
 
-// 1 - no Set type is defined
-function uniqNoSet(arr) {
-	var ret = [];
+  self.found = all
+}
 
-	for (var i = 0; i < arr.length; i++) {
-		if (ret.indexOf(arr[i]) === -1) {
-			ret.push(arr[i]);
-		}
-	}
+function mark (self, p) {
+  var abs = makeAbs(self, p)
+  var c = self.cache[abs]
+  var m = p
+  if (c) {
+    var isDir = c === 'DIR' || Array.isArray(c)
+    var slash = p.slice(-1) === '/'
 
-	return ret;
-}
+    if (isDir && !slash)
+      m += '/'
+    else if (!isDir && slash)
+      m = m.slice(0, -1)
 
-// 2 - a simple Set type is defined
-function uniqSet(arr) {
-	var seen = new Set();
-	return arr.filter(function (el) {
-		if (!seen.has(el)) {
-			seen.add(el);
-			return true;
-		}
+    if (m !== p) {
+      var mabs = makeAbs(self, m)
+      self.statCache[mabs] = self.statCache[abs]
+      self.cache[mabs] = self.cache[abs]
+    }
+  }
 
-		return false;
-	});
+  return m
 }
 
-// 3 - a standard Set type is defined and it has a forEach method
-function uniqSetWithForEach(arr) {
-	var ret = [];
+// lotta situps...
+function makeAbs (self, f) {
+  var abs = f
+  if (f.charAt(0) === '/') {
+    abs = path.join(self.root, f)
+  } else if (isAbsolute(f) || f === '') {
+    abs = f
+  } else if (self.changedCwd) {
+    abs = path.resolve(self.cwd, f)
+  } else {
+    abs = path.resolve(f)
+  }
 
-	(new Set(arr)).forEach(function (el) {
-		ret.push(el);
-	});
+  if (process.platform === 'win32')
+    abs = abs.replace(/\\/g, '/')
 
-	return ret;
+  return abs
 }
 
-// V8 currently has a broken implementation
-// https://github.com/joyent/node/issues/8449
-function doesForEachActuallyWork() {
-	var ret = false;
 
-	(new Set([true])).forEach(function (el) {
-		ret = el;
-	});
+// Return true, if pattern ends with globstar '**', for the accompanying parent directory.
+// Ex:- If node_modules/** is the pattern, add 'node_modules' to ignore list along with it's contents
+function isIgnored (self, path) {
+  if (!self.ignore.length)
+    return false
 
-	return ret === true;
+  return self.ignore.some(function(item) {
+    return item.matcher.match(path) || !!(item.gmatcher && item.gmatcher.match(path))
+  })
 }
 
-if ('Set' in global) {
-	if (typeof Set.prototype.forEach === 'function' && doesForEachActuallyWork()) {
-		module.exports = uniqSetWithForEach;
-	} else {
-		module.exports = uniqSet;
-	}
-} else {
-	module.exports = uniqNoSet;
+function childrenIgnored (self, path) {
+  if (!self.ignore.length)
+    return false
+
+  return self.ignore.some(function(item) {
+    return !!(item.gmatcher && item.gmatcher.match(path))
+  })
 }
 
 
 /***/ }),
-/* 710 */
+/* 717 */
 /***/ (function(module, exports, __webpack_require__) {
 
-const pkg = __webpack_require__(711);
+const pkg = __webpack_require__(718);
 
 module.exports = pkg.async;
 module.exports.default = pkg.async;
@@ -80438,19 +82817,19 @@ module.exports.generateTasks = pkg.generateTasks;
 
 
 /***/ }),
-/* 711 */
+/* 718 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-var optionsManager = __webpack_require__(712);
-var taskManager = __webpack_require__(713);
-var reader_async_1 = __webpack_require__(869);
-var reader_stream_1 = __webpack_require__(893);
-var reader_sync_1 = __webpack_require__(894);
-var arrayUtils = __webpack_require__(896);
-var streamUtils = __webpack_require__(897);
+var optionsManager = __webpack_require__(719);
+var taskManager = __webpack_require__(720);
+var reader_async_1 = __webpack_require__(876);
+var reader_stream_1 = __webpack_require__(900);
+var reader_sync_1 = __webpack_require__(901);
+var arrayUtils = __webpack_require__(903);
+var streamUtils = __webpack_require__(904);
 /**
  * Synchronous API.
  */
@@ -80516,7 +82895,7 @@ function isString(source) {
 
 
 /***/ }),
-/* 712 */
+/* 719 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -80554,13 +82933,13 @@ exports.prepare = prepare;
 
 
 /***/ }),
-/* 713 */
+/* 720 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-var patternUtils = __webpack_require__(714);
+var patternUtils = __webpack_require__(721);
 /**
  * Generate tasks based on parent directory of each pattern.
  */
@@ -80651,16 +83030,16 @@ exports.convertPatternGroupToTask = convertPatternGroupToTask;
 
 
 /***/ }),
-/* 714 */
+/* 721 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
 var path = __webpack_require__(16);
-var globParent = __webpack_require__(715);
-var isGlob = __webpack_require__(718);
-var micromatch = __webpack_require__(719);
+var globParent = __webpack_require__(722);
+var isGlob = __webpack_require__(725);
+var micromatch = __webpack_require__(726);
 var GLOBSTAR = '**';
 /**
  * Return true for static pattern.
@@ -80806,15 +83185,15 @@ exports.matchAny = matchAny;
 
 
 /***/ }),
-/* 715 */
+/* 722 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 var path = __webpack_require__(16);
-var isglob = __webpack_require__(716);
-var pathDirname = __webpack_require__(717);
+var isglob = __webpack_require__(723);
+var pathDirname = __webpack_require__(724);
 var isWin32 = __webpack_require__(11).platform() === 'win32';
 
 module.exports = function globParent(str) {
@@ -80837,7 +83216,7 @@ module.exports = function globParent(str) {
 
 
 /***/ }),
-/* 716 */
+/* 723 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /*!
@@ -80847,7 +83226,7 @@ module.exports = function globParent(str) {
  * Licensed under the MIT License.
  */
 
-var isExtglob = __webpack_require__(602);
+var isExtglob = __webpack_require__(607);
 
 module.exports = function isGlob(str) {
   if (typeof str !== 'string' || str === '') {
@@ -80868,7 +83247,7 @@ module.exports = function isGlob(str) {
 
 
 /***/ }),
-/* 717 */
+/* 724 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -81018,7 +83397,7 @@ module.exports.win32 = win32;
 
 
 /***/ }),
-/* 718 */
+/* 725 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /*!
@@ -81028,7 +83407,7 @@ module.exports.win32 = win32;
  * Released under the MIT License.
  */
 
-var isExtglob = __webpack_require__(602);
+var isExtglob = __webpack_require__(607);
 var chars = { '{': '}', '(': ')', '[': ']'};
 
 module.exports = function isGlob(str, options) {
@@ -81070,7 +83449,7 @@ module.exports = function isGlob(str, options) {
 
 
 /***/ }),
-/* 719 */
+/* 726 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -81081,18 +83460,18 @@ module.exports = function isGlob(str, options) {
  */
 
 var util = __webpack_require__(29);
-var braces = __webpack_require__(720);
-var toRegex = __webpack_require__(822);
-var extend = __webpack_require__(830);
+var braces = __webpack_require__(727);
+var toRegex = __webpack_require__(829);
+var extend = __webpack_require__(837);
 
 /**
  * Local dependencies
  */
 
-var compilers = __webpack_require__(833);
-var parsers = __webpack_require__(865);
-var cache = __webpack_require__(866);
-var utils = __webpack_require__(867);
+var compilers = __webpack_require__(840);
+var parsers = __webpack_require__(872);
+var cache = __webpack_require__(873);
+var utils = __webpack_require__(874);
 var MAX_LENGTH = 1024 * 64;
 
 /**
@@ -81954,7 +84333,7 @@ module.exports = micromatch;
 
 
 /***/ }),
-/* 720 */
+/* 727 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -81964,18 +84343,18 @@ module.exports = micromatch;
  * Module dependencies
  */
 
-var toRegex = __webpack_require__(721);
-var unique = __webpack_require__(733);
-var extend = __webpack_require__(730);
+var toRegex = __webpack_require__(728);
+var unique = __webpack_require__(740);
+var extend = __webpack_require__(737);
 
 /**
  * Local dependencies
  */
 
-var compilers = __webpack_require__(734);
-var parsers = __webpack_require__(749);
-var Braces = __webpack_require__(759);
-var utils = __webpack_require__(735);
+var compilers = __webpack_require__(741);
+var parsers = __webpack_require__(756);
+var Braces = __webpack_require__(766);
+var utils = __webpack_require__(742);
 var MAX_LENGTH = 1024 * 64;
 var cache = {};
 
@@ -82279,15 +84658,15 @@ module.exports = braces;
 
 
 /***/ }),
-/* 721 */
+/* 728 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var define = __webpack_require__(722);
-var extend = __webpack_require__(730);
-var not = __webpack_require__(732);
+var define = __webpack_require__(729);
+var extend = __webpack_require__(737);
+var not = __webpack_require__(739);
 var MAX_LENGTH = 1024 * 64;
 
 /**
@@ -82434,7 +84813,7 @@ module.exports.makeRe = makeRe;
 
 
 /***/ }),
-/* 722 */
+/* 729 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -82447,7 +84826,7 @@ module.exports.makeRe = makeRe;
 
 
 
-var isDescriptor = __webpack_require__(723);
+var isDescriptor = __webpack_require__(730);
 
 module.exports = function defineProperty(obj, prop, val) {
   if (typeof obj !== 'object' && typeof obj !== 'function') {
@@ -82472,7 +84851,7 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 /***/ }),
-/* 723 */
+/* 730 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -82485,9 +84864,9 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 
-var typeOf = __webpack_require__(724);
-var isAccessor = __webpack_require__(725);
-var isData = __webpack_require__(728);
+var typeOf = __webpack_require__(731);
+var isAccessor = __webpack_require__(732);
+var isData = __webpack_require__(735);
 
 module.exports = function isDescriptor(obj, key) {
   if (typeOf(obj) !== 'object') {
@@ -82501,7 +84880,7 @@ module.exports = function isDescriptor(obj, key) {
 
 
 /***/ }),
-/* 724 */
+/* 731 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -82654,7 +85033,7 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 725 */
+/* 732 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -82667,7 +85046,7 @@ function isBuffer(val) {
 
 
 
-var typeOf = __webpack_require__(726);
+var typeOf = __webpack_require__(733);
 
 // accessor descriptor properties
 var accessor = {
@@ -82730,10 +85109,10 @@ module.exports = isAccessorDescriptor;
 
 
 /***/ }),
-/* 726 */
+/* 733 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var isBuffer = __webpack_require__(727);
+var isBuffer = __webpack_require__(734);
 var toString = Object.prototype.toString;
 
 /**
@@ -82852,7 +85231,7 @@ module.exports = function kindOf(val) {
 
 
 /***/ }),
-/* 727 */
+/* 734 */
 /***/ (function(module, exports) {
 
 /*!
@@ -82879,7 +85258,7 @@ function isSlowBuffer (obj) {
 
 
 /***/ }),
-/* 728 */
+/* 735 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -82892,7 +85271,7 @@ function isSlowBuffer (obj) {
 
 
 
-var typeOf = __webpack_require__(729);
+var typeOf = __webpack_require__(736);
 
 // data descriptor properties
 var data = {
@@ -82941,10 +85320,10 @@ module.exports = isDataDescriptor;
 
 
 /***/ }),
-/* 729 */
+/* 736 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var isBuffer = __webpack_require__(727);
+var isBuffer = __webpack_require__(734);
 var toString = Object.prototype.toString;
 
 /**
@@ -83063,13 +85442,13 @@ module.exports = function kindOf(val) {
 
 
 /***/ }),
-/* 730 */
+/* 737 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isObject = __webpack_require__(731);
+var isObject = __webpack_require__(738);
 
 module.exports = function extend(o/*, objects*/) {
   if (!isObject(o)) { o = {}; }
@@ -83103,7 +85482,7 @@ function hasOwn(obj, key) {
 
 
 /***/ }),
-/* 731 */
+/* 738 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -83123,13 +85502,13 @@ module.exports = function isExtendable(val) {
 
 
 /***/ }),
-/* 732 */
+/* 739 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var extend = __webpack_require__(730);
+var extend = __webpack_require__(737);
 
 /**
  * The main export is a function that takes a `pattern` string and an `options` object.
@@ -83196,7 +85575,7 @@ module.exports = toRegex;
 
 
 /***/ }),
-/* 733 */
+/* 740 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -83246,13 +85625,13 @@ module.exports.immutable = function uniqueImmutable(arr) {
 
 
 /***/ }),
-/* 734 */
+/* 741 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var utils = __webpack_require__(735);
+var utils = __webpack_require__(742);
 
 module.exports = function(braces, options) {
   braces.compiler
@@ -83535,25 +85914,25 @@ function hasQueue(node) {
 
 
 /***/ }),
-/* 735 */
+/* 742 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var splitString = __webpack_require__(736);
+var splitString = __webpack_require__(743);
 var utils = module.exports;
 
 /**
  * Module dependencies
  */
 
-utils.extend = __webpack_require__(730);
-utils.flatten = __webpack_require__(742);
-utils.isObject = __webpack_require__(740);
-utils.fillRange = __webpack_require__(743);
-utils.repeat = __webpack_require__(748);
-utils.unique = __webpack_require__(733);
+utils.extend = __webpack_require__(737);
+utils.flatten = __webpack_require__(749);
+utils.isObject = __webpack_require__(747);
+utils.fillRange = __webpack_require__(750);
+utils.repeat = __webpack_require__(755);
+utils.unique = __webpack_require__(740);
 
 utils.define = function(obj, key, val) {
   Object.defineProperty(obj, key, {
@@ -83885,7 +86264,7 @@ utils.escapeRegex = function(str) {
 
 
 /***/ }),
-/* 736 */
+/* 743 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -83898,7 +86277,7 @@ utils.escapeRegex = function(str) {
 
 
 
-var extend = __webpack_require__(737);
+var extend = __webpack_require__(744);
 
 module.exports = function(str, options, fn) {
   if (typeof str !== 'string') {
@@ -84063,14 +86442,14 @@ function keepEscaping(opts, str, idx) {
 
 
 /***/ }),
-/* 737 */
+/* 744 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isExtendable = __webpack_require__(738);
-var assignSymbols = __webpack_require__(741);
+var isExtendable = __webpack_require__(745);
+var assignSymbols = __webpack_require__(748);
 
 module.exports = Object.assign || function(obj/*, objects*/) {
   if (obj === null || typeof obj === 'undefined') {
@@ -84130,7 +86509,7 @@ function isEnum(obj, key) {
 
 
 /***/ }),
-/* 738 */
+/* 745 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84143,7 +86522,7 @@ function isEnum(obj, key) {
 
 
 
-var isPlainObject = __webpack_require__(739);
+var isPlainObject = __webpack_require__(746);
 
 module.exports = function isExtendable(val) {
   return isPlainObject(val) || typeof val === 'function' || Array.isArray(val);
@@ -84151,7 +86530,7 @@ module.exports = function isExtendable(val) {
 
 
 /***/ }),
-/* 739 */
+/* 746 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84164,7 +86543,7 @@ module.exports = function isExtendable(val) {
 
 
 
-var isObject = __webpack_require__(740);
+var isObject = __webpack_require__(747);
 
 function isObjectObject(o) {
   return isObject(o) === true
@@ -84195,7 +86574,7 @@ module.exports = function isPlainObject(o) {
 
 
 /***/ }),
-/* 740 */
+/* 747 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84214,7 +86593,7 @@ module.exports = function isObject(val) {
 
 
 /***/ }),
-/* 741 */
+/* 748 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84261,7 +86640,7 @@ module.exports = function(receiver, objects) {
 
 
 /***/ }),
-/* 742 */
+/* 749 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84290,7 +86669,7 @@ function flat(arr, res) {
 
 
 /***/ }),
-/* 743 */
+/* 750 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84304,10 +86683,10 @@ function flat(arr, res) {
 
 
 var util = __webpack_require__(29);
-var isNumber = __webpack_require__(744);
-var extend = __webpack_require__(730);
-var repeat = __webpack_require__(746);
-var toRegex = __webpack_require__(747);
+var isNumber = __webpack_require__(751);
+var extend = __webpack_require__(737);
+var repeat = __webpack_require__(753);
+var toRegex = __webpack_require__(754);
 
 /**
  * Return a range of numbers or letters.
@@ -84505,7 +86884,7 @@ module.exports = fillRange;
 
 
 /***/ }),
-/* 744 */
+/* 751 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84518,7 +86897,7 @@ module.exports = fillRange;
 
 
 
-var typeOf = __webpack_require__(745);
+var typeOf = __webpack_require__(752);
 
 module.exports = function isNumber(num) {
   var type = typeOf(num);
@@ -84534,10 +86913,10 @@ module.exports = function isNumber(num) {
 
 
 /***/ }),
-/* 745 */
+/* 752 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var isBuffer = __webpack_require__(727);
+var isBuffer = __webpack_require__(734);
 var toString = Object.prototype.toString;
 
 /**
@@ -84656,7 +87035,7 @@ module.exports = function kindOf(val) {
 
 
 /***/ }),
-/* 746 */
+/* 753 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84733,7 +87112,7 @@ function repeat(str, num) {
 
 
 /***/ }),
-/* 747 */
+/* 754 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -84746,8 +87125,8 @@ function repeat(str, num) {
 
 
 
-var repeat = __webpack_require__(746);
-var isNumber = __webpack_require__(744);
+var repeat = __webpack_require__(753);
+var isNumber = __webpack_require__(751);
 var cache = {};
 
 function toRegexRange(min, max, options) {
@@ -85034,7 +87413,7 @@ module.exports = toRegexRange;
 
 
 /***/ }),
-/* 748 */
+/* 755 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -85059,14 +87438,14 @@ module.exports = function repeat(ele, num) {
 
 
 /***/ }),
-/* 749 */
+/* 756 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var Node = __webpack_require__(750);
-var utils = __webpack_require__(735);
+var Node = __webpack_require__(757);
+var utils = __webpack_require__(742);
 
 /**
  * Braces parsers
@@ -85426,15 +87805,15 @@ function concatNodes(pos, node, parent, options) {
 
 
 /***/ }),
-/* 750 */
+/* 757 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isObject = __webpack_require__(740);
-var define = __webpack_require__(751);
-var utils = __webpack_require__(758);
+var isObject = __webpack_require__(747);
+var define = __webpack_require__(758);
+var utils = __webpack_require__(765);
 var ownNames;
 
 /**
@@ -85925,7 +88304,7 @@ exports = module.exports = Node;
 
 
 /***/ }),
-/* 751 */
+/* 758 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -85938,7 +88317,7 @@ exports = module.exports = Node;
 
 
 
-var isDescriptor = __webpack_require__(752);
+var isDescriptor = __webpack_require__(759);
 
 module.exports = function defineProperty(obj, prop, val) {
   if (typeof obj !== 'object' && typeof obj !== 'function') {
@@ -85963,7 +88342,7 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 /***/ }),
-/* 752 */
+/* 759 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -85976,9 +88355,9 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 
-var typeOf = __webpack_require__(753);
-var isAccessor = __webpack_require__(754);
-var isData = __webpack_require__(756);
+var typeOf = __webpack_require__(760);
+var isAccessor = __webpack_require__(761);
+var isData = __webpack_require__(763);
 
 module.exports = function isDescriptor(obj, key) {
   if (typeOf(obj) !== 'object') {
@@ -85992,7 +88371,7 @@ module.exports = function isDescriptor(obj, key) {
 
 
 /***/ }),
-/* 753 */
+/* 760 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -86127,7 +88506,7 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 754 */
+/* 761 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -86140,7 +88519,7 @@ function isBuffer(val) {
 
 
 
-var typeOf = __webpack_require__(755);
+var typeOf = __webpack_require__(762);
 
 // accessor descriptor properties
 var accessor = {
@@ -86203,7 +88582,7 @@ module.exports = isAccessorDescriptor;
 
 
 /***/ }),
-/* 755 */
+/* 762 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -86338,7 +88717,7 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 756 */
+/* 763 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -86351,7 +88730,7 @@ function isBuffer(val) {
 
 
 
-var typeOf = __webpack_require__(757);
+var typeOf = __webpack_require__(764);
 
 module.exports = function isDataDescriptor(obj, prop) {
   // data descriptor properties
@@ -86394,7 +88773,7 @@ module.exports = function isDataDescriptor(obj, prop) {
 
 
 /***/ }),
-/* 757 */
+/* 764 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -86529,13 +88908,13 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 758 */
+/* 765 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var typeOf = __webpack_require__(745);
+var typeOf = __webpack_require__(752);
 var utils = module.exports;
 
 /**
@@ -87555,17 +89934,17 @@ function assert(val, message) {
 
 
 /***/ }),
-/* 759 */
+/* 766 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var extend = __webpack_require__(730);
-var Snapdragon = __webpack_require__(760);
-var compilers = __webpack_require__(734);
-var parsers = __webpack_require__(749);
-var utils = __webpack_require__(735);
+var extend = __webpack_require__(737);
+var Snapdragon = __webpack_require__(767);
+var compilers = __webpack_require__(741);
+var parsers = __webpack_require__(756);
+var utils = __webpack_require__(742);
 
 /**
  * Customize Snapdragon parser and renderer
@@ -87666,17 +90045,17 @@ module.exports = Braces;
 
 
 /***/ }),
-/* 760 */
+/* 767 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var Base = __webpack_require__(761);
-var define = __webpack_require__(722);
-var Compiler = __webpack_require__(790);
-var Parser = __webpack_require__(819);
-var utils = __webpack_require__(799);
+var Base = __webpack_require__(768);
+var define = __webpack_require__(729);
+var Compiler = __webpack_require__(797);
+var Parser = __webpack_require__(826);
+var utils = __webpack_require__(806);
 var regexCache = {};
 var cache = {};
 
@@ -87847,20 +90226,20 @@ module.exports.Parser = Parser;
 
 
 /***/ }),
-/* 761 */
+/* 768 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 var util = __webpack_require__(29);
-var define = __webpack_require__(762);
-var CacheBase = __webpack_require__(763);
-var Emitter = __webpack_require__(764);
-var isObject = __webpack_require__(740);
-var merge = __webpack_require__(781);
-var pascal = __webpack_require__(784);
-var cu = __webpack_require__(785);
+var define = __webpack_require__(769);
+var CacheBase = __webpack_require__(770);
+var Emitter = __webpack_require__(771);
+var isObject = __webpack_require__(747);
+var merge = __webpack_require__(788);
+var pascal = __webpack_require__(791);
+var cu = __webpack_require__(792);
 
 /**
  * Optionally define a custom `cache` namespace to use.
@@ -88289,7 +90668,7 @@ module.exports.namespace = namespace;
 
 
 /***/ }),
-/* 762 */
+/* 769 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -88302,7 +90681,7 @@ module.exports.namespace = namespace;
 
 
 
-var isDescriptor = __webpack_require__(752);
+var isDescriptor = __webpack_require__(759);
 
 module.exports = function defineProperty(obj, prop, val) {
   if (typeof obj !== 'object' && typeof obj !== 'function') {
@@ -88327,21 +90706,21 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 /***/ }),
-/* 763 */
+/* 770 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isObject = __webpack_require__(740);
-var Emitter = __webpack_require__(764);
-var visit = __webpack_require__(765);
-var toPath = __webpack_require__(768);
-var union = __webpack_require__(769);
-var del = __webpack_require__(773);
-var get = __webpack_require__(771);
-var has = __webpack_require__(778);
-var set = __webpack_require__(772);
+var isObject = __webpack_require__(747);
+var Emitter = __webpack_require__(771);
+var visit = __webpack_require__(772);
+var toPath = __webpack_require__(775);
+var union = __webpack_require__(776);
+var del = __webpack_require__(780);
+var get = __webpack_require__(778);
+var has = __webpack_require__(785);
+var set = __webpack_require__(779);
 
 /**
  * Create a `Cache` constructor that when instantiated will
@@ -88595,7 +90974,7 @@ module.exports.namespace = namespace;
 
 
 /***/ }),
-/* 764 */
+/* 771 */
 /***/ (function(module, exports, __webpack_require__) {
 
 
@@ -88764,7 +91143,7 @@ Emitter.prototype.hasListeners = function(event){
 
 
 /***/ }),
-/* 765 */
+/* 772 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -88777,8 +91156,8 @@ Emitter.prototype.hasListeners = function(event){
 
 
 
-var visit = __webpack_require__(766);
-var mapVisit = __webpack_require__(767);
+var visit = __webpack_require__(773);
+var mapVisit = __webpack_require__(774);
 
 module.exports = function(collection, method, val) {
   var result;
@@ -88801,7 +91180,7 @@ module.exports = function(collection, method, val) {
 
 
 /***/ }),
-/* 766 */
+/* 773 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -88814,7 +91193,7 @@ module.exports = function(collection, method, val) {
 
 
 
-var isObject = __webpack_require__(740);
+var isObject = __webpack_require__(747);
 
 module.exports = function visit(thisArg, method, target, val) {
   if (!isObject(thisArg) && typeof thisArg !== 'function') {
@@ -88841,14 +91220,14 @@ module.exports = function visit(thisArg, method, target, val) {
 
 
 /***/ }),
-/* 767 */
+/* 774 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 var util = __webpack_require__(29);
-var visit = __webpack_require__(766);
+var visit = __webpack_require__(773);
 
 /**
  * Map `visit` over an array of objects.
@@ -88885,7 +91264,7 @@ function isObject(val) {
 
 
 /***/ }),
-/* 768 */
+/* 775 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -88898,7 +91277,7 @@ function isObject(val) {
 
 
 
-var typeOf = __webpack_require__(745);
+var typeOf = __webpack_require__(752);
 
 module.exports = function toPath(args) {
   if (typeOf(args) !== 'arguments') {
@@ -88925,16 +91304,16 @@ function filter(arr) {
 
 
 /***/ }),
-/* 769 */
+/* 776 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isObject = __webpack_require__(731);
-var union = __webpack_require__(770);
-var get = __webpack_require__(771);
-var set = __webpack_require__(772);
+var isObject = __webpack_require__(738);
+var union = __webpack_require__(777);
+var get = __webpack_require__(778);
+var set = __webpack_require__(779);
 
 module.exports = function unionValue(obj, prop, value) {
   if (!isObject(obj)) {
@@ -88962,7 +91341,7 @@ function arrayify(val) {
 
 
 /***/ }),
-/* 770 */
+/* 777 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -88998,7 +91377,7 @@ module.exports = function union(init) {
 
 
 /***/ }),
-/* 771 */
+/* 778 */
 /***/ (function(module, exports) {
 
 /*!
@@ -89054,7 +91433,7 @@ function toString(val) {
 
 
 /***/ }),
-/* 772 */
+/* 779 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89067,10 +91446,10 @@ function toString(val) {
 
 
 
-var split = __webpack_require__(736);
-var extend = __webpack_require__(730);
-var isPlainObject = __webpack_require__(739);
-var isObject = __webpack_require__(731);
+var split = __webpack_require__(743);
+var extend = __webpack_require__(737);
+var isPlainObject = __webpack_require__(746);
+var isObject = __webpack_require__(738);
 
 module.exports = function(obj, prop, val) {
   if (!isObject(obj)) {
@@ -89116,7 +91495,7 @@ function isValidKey(key) {
 
 
 /***/ }),
-/* 773 */
+/* 780 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89129,8 +91508,8 @@ function isValidKey(key) {
 
 
 
-var isObject = __webpack_require__(740);
-var has = __webpack_require__(774);
+var isObject = __webpack_require__(747);
+var has = __webpack_require__(781);
 
 module.exports = function unset(obj, prop) {
   if (!isObject(obj)) {
@@ -89155,7 +91534,7 @@ module.exports = function unset(obj, prop) {
 
 
 /***/ }),
-/* 774 */
+/* 781 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89168,9 +91547,9 @@ module.exports = function unset(obj, prop) {
 
 
 
-var isObject = __webpack_require__(775);
-var hasValues = __webpack_require__(777);
-var get = __webpack_require__(771);
+var isObject = __webpack_require__(782);
+var hasValues = __webpack_require__(784);
+var get = __webpack_require__(778);
 
 module.exports = function(obj, prop, noZero) {
   if (isObject(obj)) {
@@ -89181,7 +91560,7 @@ module.exports = function(obj, prop, noZero) {
 
 
 /***/ }),
-/* 775 */
+/* 782 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89194,7 +91573,7 @@ module.exports = function(obj, prop, noZero) {
 
 
 
-var isArray = __webpack_require__(776);
+var isArray = __webpack_require__(783);
 
 module.exports = function isObject(val) {
   return val != null && typeof val === 'object' && isArray(val) === false;
@@ -89202,7 +91581,7 @@ module.exports = function isObject(val) {
 
 
 /***/ }),
-/* 776 */
+/* 783 */
 /***/ (function(module, exports) {
 
 var toString = {}.toString;
@@ -89213,7 +91592,7 @@ module.exports = Array.isArray || function (arr) {
 
 
 /***/ }),
-/* 777 */
+/* 784 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89256,7 +91635,7 @@ module.exports = function hasValue(o, noZero) {
 
 
 /***/ }),
-/* 778 */
+/* 785 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89269,9 +91648,9 @@ module.exports = function hasValue(o, noZero) {
 
 
 
-var isObject = __webpack_require__(740);
-var hasValues = __webpack_require__(779);
-var get = __webpack_require__(771);
+var isObject = __webpack_require__(747);
+var hasValues = __webpack_require__(786);
+var get = __webpack_require__(778);
 
 module.exports = function(val, prop) {
   return hasValues(isObject(val) && prop ? get(val, prop) : val);
@@ -89279,7 +91658,7 @@ module.exports = function(val, prop) {
 
 
 /***/ }),
-/* 779 */
+/* 786 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89292,8 +91671,8 @@ module.exports = function(val, prop) {
 
 
 
-var typeOf = __webpack_require__(780);
-var isNumber = __webpack_require__(744);
+var typeOf = __webpack_require__(787);
+var isNumber = __webpack_require__(751);
 
 module.exports = function hasValue(val) {
   // is-number checks for NaN and other edge cases
@@ -89346,10 +91725,10 @@ module.exports = function hasValue(val) {
 
 
 /***/ }),
-/* 780 */
+/* 787 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var isBuffer = __webpack_require__(727);
+var isBuffer = __webpack_require__(734);
 var toString = Object.prototype.toString;
 
 /**
@@ -89471,14 +91850,14 @@ module.exports = function kindOf(val) {
 
 
 /***/ }),
-/* 781 */
+/* 788 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isExtendable = __webpack_require__(782);
-var forIn = __webpack_require__(783);
+var isExtendable = __webpack_require__(789);
+var forIn = __webpack_require__(790);
 
 function mixinDeep(target, objects) {
   var len = arguments.length, i = 0;
@@ -89542,7 +91921,7 @@ module.exports = mixinDeep;
 
 
 /***/ }),
-/* 782 */
+/* 789 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89555,7 +91934,7 @@ module.exports = mixinDeep;
 
 
 
-var isPlainObject = __webpack_require__(739);
+var isPlainObject = __webpack_require__(746);
 
 module.exports = function isExtendable(val) {
   return isPlainObject(val) || typeof val === 'function' || Array.isArray(val);
@@ -89563,7 +91942,7 @@ module.exports = function isExtendable(val) {
 
 
 /***/ }),
-/* 783 */
+/* 790 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89586,7 +91965,7 @@ module.exports = function forIn(obj, fn, thisArg) {
 
 
 /***/ }),
-/* 784 */
+/* 791 */
 /***/ (function(module, exports) {
 
 /*!
@@ -89613,14 +91992,14 @@ module.exports = pascalcase;
 
 
 /***/ }),
-/* 785 */
+/* 792 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 var util = __webpack_require__(29);
-var utils = __webpack_require__(786);
+var utils = __webpack_require__(793);
 
 /**
  * Expose class utils
@@ -89985,7 +92364,7 @@ cu.bubble = function(Parent, events) {
 
 
 /***/ }),
-/* 786 */
+/* 793 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -89999,10 +92378,10 @@ var utils = {};
  * Lazily required module dependencies
  */
 
-utils.union = __webpack_require__(770);
-utils.define = __webpack_require__(722);
-utils.isObj = __webpack_require__(740);
-utils.staticExtend = __webpack_require__(787);
+utils.union = __webpack_require__(777);
+utils.define = __webpack_require__(729);
+utils.isObj = __webpack_require__(747);
+utils.staticExtend = __webpack_require__(794);
 
 
 /**
@@ -90013,7 +92392,7 @@ module.exports = utils;
 
 
 /***/ }),
-/* 787 */
+/* 794 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -90026,8 +92405,8 @@ module.exports = utils;
 
 
 
-var copy = __webpack_require__(788);
-var define = __webpack_require__(722);
+var copy = __webpack_require__(795);
+var define = __webpack_require__(729);
 var util = __webpack_require__(29);
 
 /**
@@ -90110,15 +92489,15 @@ module.exports = extend;
 
 
 /***/ }),
-/* 788 */
+/* 795 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var typeOf = __webpack_require__(745);
-var copyDescriptor = __webpack_require__(789);
-var define = __webpack_require__(722);
+var typeOf = __webpack_require__(752);
+var copyDescriptor = __webpack_require__(796);
+var define = __webpack_require__(729);
 
 /**
  * Copy static properties, prototype properties, and descriptors from one object to another.
@@ -90291,7 +92670,7 @@ module.exports.has = has;
 
 
 /***/ }),
-/* 789 */
+/* 796 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -90379,16 +92758,16 @@ function isObject(val) {
 
 
 /***/ }),
-/* 790 */
+/* 797 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var use = __webpack_require__(791);
-var define = __webpack_require__(722);
-var debug = __webpack_require__(793)('snapdragon:compiler');
-var utils = __webpack_require__(799);
+var use = __webpack_require__(798);
+var define = __webpack_require__(729);
+var debug = __webpack_require__(800)('snapdragon:compiler');
+var utils = __webpack_require__(806);
 
 /**
  * Create a new `Compiler` with the given `options`.
@@ -90542,7 +92921,7 @@ Compiler.prototype = {
 
     // source map support
     if (opts.sourcemap) {
-      var sourcemaps = __webpack_require__(818);
+      var sourcemaps = __webpack_require__(825);
       sourcemaps(this);
       this.mapVisit(this.ast.nodes);
       this.applySourceMaps();
@@ -90563,7 +92942,7 @@ module.exports = Compiler;
 
 
 /***/ }),
-/* 791 */
+/* 798 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -90576,7 +92955,7 @@ module.exports = Compiler;
 
 
 
-var utils = __webpack_require__(792);
+var utils = __webpack_require__(799);
 
 module.exports = function base(app, opts) {
   if (!utils.isObject(app) && typeof app !== 'function') {
@@ -90691,7 +93070,7 @@ module.exports = function base(app, opts) {
 
 
 /***/ }),
-/* 792 */
+/* 799 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -90705,8 +93084,8 @@ var utils = {};
  * Lazily required module dependencies
  */
 
-utils.define = __webpack_require__(722);
-utils.isObject = __webpack_require__(740);
+utils.define = __webpack_require__(729);
+utils.isObject = __webpack_require__(747);
 
 
 utils.isString = function(val) {
@@ -90721,7 +93100,7 @@ module.exports = utils;
 
 
 /***/ }),
-/* 793 */
+/* 800 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -90730,14 +93109,14 @@ module.exports = utils;
  */
 
 if (typeof process !== 'undefined' && process.type === 'renderer') {
-  module.exports = __webpack_require__(794);
+  module.exports = __webpack_require__(801);
 } else {
-  module.exports = __webpack_require__(797);
+  module.exports = __webpack_require__(804);
 }
 
 
 /***/ }),
-/* 794 */
+/* 801 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -90746,7 +93125,7 @@ if (typeof process !== 'undefined' && process.type === 'renderer') {
  * Expose `debug()` as the module.
  */
 
-exports = module.exports = __webpack_require__(795);
+exports = module.exports = __webpack_require__(802);
 exports.log = log;
 exports.formatArgs = formatArgs;
 exports.save = save;
@@ -90928,7 +93307,7 @@ function localstorage() {
 
 
 /***/ }),
-/* 795 */
+/* 802 */
 /***/ (function(module, exports, __webpack_require__) {
 
 
@@ -90944,7 +93323,7 @@ exports.coerce = coerce;
 exports.disable = disable;
 exports.enable = enable;
 exports.enabled = enabled;
-exports.humanize = __webpack_require__(796);
+exports.humanize = __webpack_require__(803);
 
 /**
  * The currently active debug mode names, and names to skip.
@@ -91136,7 +93515,7 @@ function coerce(val) {
 
 
 /***/ }),
-/* 796 */
+/* 803 */
 /***/ (function(module, exports) {
 
 /**
@@ -91294,7 +93673,7 @@ function plural(ms, n, name) {
 
 
 /***/ }),
-/* 797 */
+/* 804 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -91310,7 +93689,7 @@ var util = __webpack_require__(29);
  * Expose `debug()` as the module.
  */
 
-exports = module.exports = __webpack_require__(795);
+exports = module.exports = __webpack_require__(802);
 exports.init = init;
 exports.log = log;
 exports.formatArgs = formatArgs;
@@ -91489,7 +93868,7 @@ function createWritableStdioStream (fd) {
 
     case 'PIPE':
     case 'TCP':
-      var net = __webpack_require__(798);
+      var net = __webpack_require__(805);
       stream = new net.Socket({
         fd: fd,
         readable: false,
@@ -91548,13 +93927,13 @@ exports.enable(load());
 
 
 /***/ }),
-/* 798 */
+/* 805 */
 /***/ (function(module, exports) {
 
 module.exports = require("net");
 
 /***/ }),
-/* 799 */
+/* 806 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -91564,9 +93943,9 @@ module.exports = require("net");
  * Module dependencies
  */
 
-exports.extend = __webpack_require__(730);
-exports.SourceMap = __webpack_require__(800);
-exports.sourceMapResolve = __webpack_require__(811);
+exports.extend = __webpack_require__(737);
+exports.SourceMap = __webpack_require__(807);
+exports.sourceMapResolve = __webpack_require__(818);
 
 /**
  * Convert backslash in the given string to forward slashes
@@ -91609,7 +93988,7 @@ exports.last = function(arr, n) {
 
 
 /***/ }),
-/* 800 */
+/* 807 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /*
@@ -91617,13 +93996,13 @@ exports.last = function(arr, n) {
  * Licensed under the New BSD license. See LICENSE.txt or:
  * http://opensource.org/licenses/BSD-3-Clause
  */
-exports.SourceMapGenerator = __webpack_require__(801).SourceMapGenerator;
-exports.SourceMapConsumer = __webpack_require__(807).SourceMapConsumer;
-exports.SourceNode = __webpack_require__(810).SourceNode;
+exports.SourceMapGenerator = __webpack_require__(808).SourceMapGenerator;
+exports.SourceMapConsumer = __webpack_require__(814).SourceMapConsumer;
+exports.SourceNode = __webpack_require__(817).SourceNode;
 
 
 /***/ }),
-/* 801 */
+/* 808 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -91633,10 +94012,10 @@ exports.SourceNode = __webpack_require__(810).SourceNode;
  * http://opensource.org/licenses/BSD-3-Clause
  */
 
-var base64VLQ = __webpack_require__(802);
-var util = __webpack_require__(804);
-var ArraySet = __webpack_require__(805).ArraySet;
-var MappingList = __webpack_require__(806).MappingList;
+var base64VLQ = __webpack_require__(809);
+var util = __webpack_require__(811);
+var ArraySet = __webpack_require__(812).ArraySet;
+var MappingList = __webpack_require__(813).MappingList;
 
 /**
  * An instance of the SourceMapGenerator represents a source map which is
@@ -92045,7 +94424,7 @@ exports.SourceMapGenerator = SourceMapGenerator;
 
 
 /***/ }),
-/* 802 */
+/* 809 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92085,7 +94464,7 @@ exports.SourceMapGenerator = SourceMapGenerator;
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var base64 = __webpack_require__(803);
+var base64 = __webpack_require__(810);
 
 // A single base 64 digit can contain 6 bits of data. For the base 64 variable
 // length quantities we use in the source map spec, the first bit is the sign,
@@ -92191,7 +94570,7 @@ exports.decode = function base64VLQ_decode(aStr, aIndex, aOutParam) {
 
 
 /***/ }),
-/* 803 */
+/* 810 */
 /***/ (function(module, exports) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92264,7 +94643,7 @@ exports.decode = function (charCode) {
 
 
 /***/ }),
-/* 804 */
+/* 811 */
 /***/ (function(module, exports) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92687,7 +95066,7 @@ exports.compareByGeneratedPositionsInflated = compareByGeneratedPositionsInflate
 
 
 /***/ }),
-/* 805 */
+/* 812 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92697,7 +95076,7 @@ exports.compareByGeneratedPositionsInflated = compareByGeneratedPositionsInflate
  * http://opensource.org/licenses/BSD-3-Clause
  */
 
-var util = __webpack_require__(804);
+var util = __webpack_require__(811);
 var has = Object.prototype.hasOwnProperty;
 var hasNativeMap = typeof Map !== "undefined";
 
@@ -92814,7 +95193,7 @@ exports.ArraySet = ArraySet;
 
 
 /***/ }),
-/* 806 */
+/* 813 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92824,7 +95203,7 @@ exports.ArraySet = ArraySet;
  * http://opensource.org/licenses/BSD-3-Clause
  */
 
-var util = __webpack_require__(804);
+var util = __webpack_require__(811);
 
 /**
  * Determine whether mappingB is after mappingA with respect to generated
@@ -92899,7 +95278,7 @@ exports.MappingList = MappingList;
 
 
 /***/ }),
-/* 807 */
+/* 814 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -92909,11 +95288,11 @@ exports.MappingList = MappingList;
  * http://opensource.org/licenses/BSD-3-Clause
  */
 
-var util = __webpack_require__(804);
-var binarySearch = __webpack_require__(808);
-var ArraySet = __webpack_require__(805).ArraySet;
-var base64VLQ = __webpack_require__(802);
-var quickSort = __webpack_require__(809).quickSort;
+var util = __webpack_require__(811);
+var binarySearch = __webpack_require__(815);
+var ArraySet = __webpack_require__(812).ArraySet;
+var base64VLQ = __webpack_require__(809);
+var quickSort = __webpack_require__(816).quickSort;
 
 function SourceMapConsumer(aSourceMap) {
   var sourceMap = aSourceMap;
@@ -93987,7 +96366,7 @@ exports.IndexedSourceMapConsumer = IndexedSourceMapConsumer;
 
 
 /***/ }),
-/* 808 */
+/* 815 */
 /***/ (function(module, exports) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -94104,7 +96483,7 @@ exports.search = function search(aNeedle, aHaystack, aCompare, aBias) {
 
 
 /***/ }),
-/* 809 */
+/* 816 */
 /***/ (function(module, exports) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -94224,7 +96603,7 @@ exports.quickSort = function (ary, comparator) {
 
 
 /***/ }),
-/* 810 */
+/* 817 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* -*- Mode: js; js-indent-level: 2; -*- */
@@ -94234,8 +96613,8 @@ exports.quickSort = function (ary, comparator) {
  * http://opensource.org/licenses/BSD-3-Clause
  */
 
-var SourceMapGenerator = __webpack_require__(801).SourceMapGenerator;
-var util = __webpack_require__(804);
+var SourceMapGenerator = __webpack_require__(808).SourceMapGenerator;
+var util = __webpack_require__(811);
 
 // Matches a Windows-style `\r\n` newline or a `\n` newline used by all other
 // operating systems these days (capturing the result).
@@ -94643,17 +97022,17 @@ exports.SourceNode = SourceNode;
 
 
 /***/ }),
-/* 811 */
+/* 818 */
 /***/ (function(module, exports, __webpack_require__) {
 
 // Copyright 2014, 2015, 2016, 2017 Simon Lydell
 // X11 (“MIT”) Licensed. (See LICENSE.)
 
-var sourceMappingURL   = __webpack_require__(812)
-var resolveUrl         = __webpack_require__(813)
-var decodeUriComponent = __webpack_require__(814)
-var urix               = __webpack_require__(816)
-var atob               = __webpack_require__(817)
+var sourceMappingURL   = __webpack_require__(819)
+var resolveUrl         = __webpack_require__(820)
+var decodeUriComponent = __webpack_require__(821)
+var urix               = __webpack_require__(823)
+var atob               = __webpack_require__(824)
 
 
 
@@ -94951,7 +97330,7 @@ module.exports = {
 
 
 /***/ }),
-/* 812 */
+/* 819 */
 /***/ (function(module, exports, __webpack_require__) {
 
 var __WEBPACK_AMD_DEFINE_FACTORY__, __WEBPACK_AMD_DEFINE_RESULT__;// Copyright 2014 Simon Lydell
@@ -95014,7 +97393,7 @@ void (function(root, factory) {
 
 
 /***/ }),
-/* 813 */
+/* 820 */
 /***/ (function(module, exports, __webpack_require__) {
 
 // Copyright 2014 Simon Lydell
@@ -95032,13 +97411,13 @@ module.exports = resolveUrl
 
 
 /***/ }),
-/* 814 */
+/* 821 */
 /***/ (function(module, exports, __webpack_require__) {
 
 // Copyright 2017 Simon Lydell
 // X11 (“MIT”) Licensed. (See LICENSE.)
 
-var decodeUriComponent = __webpack_require__(815)
+var decodeUriComponent = __webpack_require__(822)
 
 function customDecodeUriComponent(string) {
   // `decodeUriComponent` turns `+` into ` `, but that's not wanted.
@@ -95049,7 +97428,7 @@ module.exports = customDecodeUriComponent
 
 
 /***/ }),
-/* 815 */
+/* 822 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -95150,7 +97529,7 @@ module.exports = function (encodedURI) {
 
 
 /***/ }),
-/* 816 */
+/* 823 */
 /***/ (function(module, exports, __webpack_require__) {
 
 // Copyright 2014 Simon Lydell
@@ -95173,7 +97552,7 @@ module.exports = urix
 
 
 /***/ }),
-/* 817 */
+/* 824 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -95187,7 +97566,7 @@ module.exports = atob.atob = atob;
 
 
 /***/ }),
-/* 818 */
+/* 825 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -95195,8 +97574,8 @@ module.exports = atob.atob = atob;
 
 var fs = __webpack_require__(23);
 var path = __webpack_require__(16);
-var define = __webpack_require__(722);
-var utils = __webpack_require__(799);
+var define = __webpack_require__(729);
+var utils = __webpack_require__(806);
 
 /**
  * Expose `mixin()`.
@@ -95339,19 +97718,19 @@ exports.comment = function(node) {
 
 
 /***/ }),
-/* 819 */
+/* 826 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var use = __webpack_require__(791);
+var use = __webpack_require__(798);
 var util = __webpack_require__(29);
-var Cache = __webpack_require__(820);
-var define = __webpack_require__(722);
-var debug = __webpack_require__(793)('snapdragon:parser');
-var Position = __webpack_require__(821);
-var utils = __webpack_require__(799);
+var Cache = __webpack_require__(827);
+var define = __webpack_require__(729);
+var debug = __webpack_require__(800)('snapdragon:parser');
+var Position = __webpack_require__(828);
+var utils = __webpack_require__(806);
 
 /**
  * Create a new `Parser` with the given `input` and `options`.
@@ -95879,7 +98258,7 @@ module.exports = Parser;
 
 
 /***/ }),
-/* 820 */
+/* 827 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -95986,13 +98365,13 @@ MapCache.prototype.del = function mapDelete(key) {
 
 
 /***/ }),
-/* 821 */
+/* 828 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var define = __webpack_require__(722);
+var define = __webpack_require__(729);
 
 /**
  * Store position for a node
@@ -96007,16 +98386,16 @@ module.exports = function Position(start, parser) {
 
 
 /***/ }),
-/* 822 */
+/* 829 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var safe = __webpack_require__(823);
-var define = __webpack_require__(829);
-var extend = __webpack_require__(830);
-var not = __webpack_require__(832);
+var safe = __webpack_require__(830);
+var define = __webpack_require__(836);
+var extend = __webpack_require__(837);
+var not = __webpack_require__(839);
 var MAX_LENGTH = 1024 * 64;
 
 /**
@@ -96169,10 +98548,10 @@ module.exports.makeRe = makeRe;
 
 
 /***/ }),
-/* 823 */
+/* 830 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var parse = __webpack_require__(824);
+var parse = __webpack_require__(831);
 var types = parse.types;
 
 module.exports = function (re, opts) {
@@ -96218,13 +98597,13 @@ function isRegExp (x) {
 
 
 /***/ }),
-/* 824 */
+/* 831 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var util      = __webpack_require__(825);
-var types     = __webpack_require__(826);
-var sets      = __webpack_require__(827);
-var positions = __webpack_require__(828);
+var util      = __webpack_require__(832);
+var types     = __webpack_require__(833);
+var sets      = __webpack_require__(834);
+var positions = __webpack_require__(835);
 
 
 module.exports = function(regexpStr) {
@@ -96506,11 +98885,11 @@ module.exports.types = types;
 
 
 /***/ }),
-/* 825 */
+/* 832 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var types = __webpack_require__(826);
-var sets  = __webpack_require__(827);
+var types = __webpack_require__(833);
+var sets  = __webpack_require__(834);
 
 
 // All of these are private and only used by randexp.
@@ -96623,7 +99002,7 @@ exports.error = function(regexp, msg) {
 
 
 /***/ }),
-/* 826 */
+/* 833 */
 /***/ (function(module, exports) {
 
 module.exports = {
@@ -96639,10 +99018,10 @@ module.exports = {
 
 
 /***/ }),
-/* 827 */
+/* 834 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var types = __webpack_require__(826);
+var types = __webpack_require__(833);
 
 var INTS = function() {
  return [{ type: types.RANGE , from: 48, to: 57 }];
@@ -96727,10 +99106,10 @@ exports.anyChar = function() {
 
 
 /***/ }),
-/* 828 */
+/* 835 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var types = __webpack_require__(826);
+var types = __webpack_require__(833);
 
 exports.wordBoundary = function() {
   return { type: types.POSITION, value: 'b' };
@@ -96750,7 +99129,7 @@ exports.end = function() {
 
 
 /***/ }),
-/* 829 */
+/* 836 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -96763,8 +99142,8 @@ exports.end = function() {
 
 
 
-var isobject = __webpack_require__(740);
-var isDescriptor = __webpack_require__(752);
+var isobject = __webpack_require__(747);
+var isDescriptor = __webpack_require__(759);
 var define = (typeof Reflect !== 'undefined' && Reflect.defineProperty)
   ? Reflect.defineProperty
   : Object.defineProperty;
@@ -96795,14 +99174,14 @@ module.exports = function defineProperty(obj, key, val) {
 
 
 /***/ }),
-/* 830 */
+/* 837 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isExtendable = __webpack_require__(831);
-var assignSymbols = __webpack_require__(741);
+var isExtendable = __webpack_require__(838);
+var assignSymbols = __webpack_require__(748);
 
 module.exports = Object.assign || function(obj/*, objects*/) {
   if (obj === null || typeof obj === 'undefined') {
@@ -96862,7 +99241,7 @@ function isEnum(obj, key) {
 
 
 /***/ }),
-/* 831 */
+/* 838 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -96875,7 +99254,7 @@ function isEnum(obj, key) {
 
 
 
-var isPlainObject = __webpack_require__(739);
+var isPlainObject = __webpack_require__(746);
 
 module.exports = function isExtendable(val) {
   return isPlainObject(val) || typeof val === 'function' || Array.isArray(val);
@@ -96883,14 +99262,14 @@ module.exports = function isExtendable(val) {
 
 
 /***/ }),
-/* 832 */
+/* 839 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var extend = __webpack_require__(830);
-var safe = __webpack_require__(823);
+var extend = __webpack_require__(837);
+var safe = __webpack_require__(830);
 
 /**
  * The main export is a function that takes a `pattern` string and an `options` object.
@@ -96962,14 +99341,14 @@ module.exports = toRegex;
 
 
 /***/ }),
-/* 833 */
+/* 840 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var nanomatch = __webpack_require__(834);
-var extglob = __webpack_require__(849);
+var nanomatch = __webpack_require__(841);
+var extglob = __webpack_require__(856);
 
 module.exports = function(snapdragon) {
   var compilers = snapdragon.compiler.compilers;
@@ -97046,7 +99425,7 @@ function escapeExtglobs(compiler) {
 
 
 /***/ }),
-/* 834 */
+/* 841 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -97057,17 +99436,17 @@ function escapeExtglobs(compiler) {
  */
 
 var util = __webpack_require__(29);
-var toRegex = __webpack_require__(721);
-var extend = __webpack_require__(835);
+var toRegex = __webpack_require__(728);
+var extend = __webpack_require__(842);
 
 /**
  * Local dependencies
  */
 
-var compilers = __webpack_require__(837);
-var parsers = __webpack_require__(838);
-var cache = __webpack_require__(841);
-var utils = __webpack_require__(843);
+var compilers = __webpack_require__(844);
+var parsers = __webpack_require__(845);
+var cache = __webpack_require__(848);
+var utils = __webpack_require__(850);
 var MAX_LENGTH = 1024 * 64;
 
 /**
@@ -97891,14 +100270,14 @@ module.exports = nanomatch;
 
 
 /***/ }),
-/* 835 */
+/* 842 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var isExtendable = __webpack_require__(836);
-var assignSymbols = __webpack_require__(741);
+var isExtendable = __webpack_require__(843);
+var assignSymbols = __webpack_require__(748);
 
 module.exports = Object.assign || function(obj/*, objects*/) {
   if (obj === null || typeof obj === 'undefined') {
@@ -97958,7 +100337,7 @@ function isEnum(obj, key) {
 
 
 /***/ }),
-/* 836 */
+/* 843 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -97971,7 +100350,7 @@ function isEnum(obj, key) {
 
 
 
-var isPlainObject = __webpack_require__(739);
+var isPlainObject = __webpack_require__(746);
 
 module.exports = function isExtendable(val) {
   return isPlainObject(val) || typeof val === 'function' || Array.isArray(val);
@@ -97979,7 +100358,7 @@ module.exports = function isExtendable(val) {
 
 
 /***/ }),
-/* 837 */
+/* 844 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -98325,15 +100704,15 @@ module.exports = function(nanomatch, options) {
 
 
 /***/ }),
-/* 838 */
+/* 845 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var regexNot = __webpack_require__(732);
-var toRegex = __webpack_require__(721);
-var isOdd = __webpack_require__(839);
+var regexNot = __webpack_require__(739);
+var toRegex = __webpack_require__(728);
+var isOdd = __webpack_require__(846);
 
 /**
  * Characters to use in negation regex (we want to "not" match
@@ -98719,7 +101098,7 @@ module.exports.not = NOT_REGEX;
 
 
 /***/ }),
-/* 839 */
+/* 846 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -98732,7 +101111,7 @@ module.exports.not = NOT_REGEX;
 
 
 
-var isNumber = __webpack_require__(840);
+var isNumber = __webpack_require__(847);
 
 module.exports = function isOdd(i) {
   if (!isNumber(i)) {
@@ -98746,7 +101125,7 @@ module.exports = function isOdd(i) {
 
 
 /***/ }),
-/* 840 */
+/* 847 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -98774,14 +101153,14 @@ module.exports = function isNumber(num) {
 
 
 /***/ }),
-/* 841 */
+/* 848 */
 /***/ (function(module, exports, __webpack_require__) {
 
-module.exports = new (__webpack_require__(842))();
+module.exports = new (__webpack_require__(849))();
 
 
 /***/ }),
-/* 842 */
+/* 849 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -98794,7 +101173,7 @@ module.exports = new (__webpack_require__(842))();
 
 
 
-var MapCache = __webpack_require__(820);
+var MapCache = __webpack_require__(827);
 
 /**
  * Create a new `FragmentCache` with an optional object to use for `caches`.
@@ -98916,7 +101295,7 @@ exports = module.exports = FragmentCache;
 
 
 /***/ }),
-/* 843 */
+/* 850 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -98929,14 +101308,14 @@ var path = __webpack_require__(16);
  * Module dependencies
  */
 
-var isWindows = __webpack_require__(844)();
-var Snapdragon = __webpack_require__(760);
-utils.define = __webpack_require__(845);
-utils.diff = __webpack_require__(846);
-utils.extend = __webpack_require__(835);
-utils.pick = __webpack_require__(847);
-utils.typeOf = __webpack_require__(848);
-utils.unique = __webpack_require__(733);
+var isWindows = __webpack_require__(851)();
+var Snapdragon = __webpack_require__(767);
+utils.define = __webpack_require__(852);
+utils.diff = __webpack_require__(853);
+utils.extend = __webpack_require__(842);
+utils.pick = __webpack_require__(854);
+utils.typeOf = __webpack_require__(855);
+utils.unique = __webpack_require__(740);
 
 /**
  * Returns true if the given value is effectively an empty string
@@ -99302,7 +101681,7 @@ utils.unixify = function(options) {
 
 
 /***/ }),
-/* 844 */
+/* 851 */
 /***/ (function(module, exports, __webpack_require__) {
 
 var __WEBPACK_AMD_DEFINE_FACTORY__, __WEBPACK_AMD_DEFINE_ARRAY__, __WEBPACK_AMD_DEFINE_RESULT__;/*!
@@ -99330,7 +101709,7 @@ var __WEBPACK_AMD_DEFINE_FACTORY__, __WEBPACK_AMD_DEFINE_ARRAY__, __WEBPACK_AMD_
 
 
 /***/ }),
-/* 845 */
+/* 852 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -99343,8 +101722,8 @@ var __WEBPACK_AMD_DEFINE_FACTORY__, __WEBPACK_AMD_DEFINE_ARRAY__, __WEBPACK_AMD_
 
 
 
-var isobject = __webpack_require__(740);
-var isDescriptor = __webpack_require__(752);
+var isobject = __webpack_require__(747);
+var isDescriptor = __webpack_require__(759);
 var define = (typeof Reflect !== 'undefined' && Reflect.defineProperty)
   ? Reflect.defineProperty
   : Object.defineProperty;
@@ -99375,7 +101754,7 @@ module.exports = function defineProperty(obj, key, val) {
 
 
 /***/ }),
-/* 846 */
+/* 853 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -99429,7 +101808,7 @@ function diffArray(one, two) {
 
 
 /***/ }),
-/* 847 */
+/* 854 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -99442,7 +101821,7 @@ function diffArray(one, two) {
 
 
 
-var isObject = __webpack_require__(740);
+var isObject = __webpack_require__(747);
 
 module.exports = function pick(obj, keys) {
   if (!isObject(obj) && typeof obj !== 'function') {
@@ -99471,7 +101850,7 @@ module.exports = function pick(obj, keys) {
 
 
 /***/ }),
-/* 848 */
+/* 855 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -99606,7 +101985,7 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 849 */
+/* 856 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -99616,18 +101995,18 @@ function isBuffer(val) {
  * Module dependencies
  */
 
-var extend = __webpack_require__(730);
-var unique = __webpack_require__(733);
-var toRegex = __webpack_require__(721);
+var extend = __webpack_require__(737);
+var unique = __webpack_require__(740);
+var toRegex = __webpack_require__(728);
 
 /**
  * Local dependencies
  */
 
-var compilers = __webpack_require__(850);
-var parsers = __webpack_require__(861);
-var Extglob = __webpack_require__(864);
-var utils = __webpack_require__(863);
+var compilers = __webpack_require__(857);
+var parsers = __webpack_require__(868);
+var Extglob = __webpack_require__(871);
+var utils = __webpack_require__(870);
 var MAX_LENGTH = 1024 * 64;
 
 /**
@@ -99944,13 +102323,13 @@ module.exports = extglob;
 
 
 /***/ }),
-/* 850 */
+/* 857 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var brackets = __webpack_require__(851);
+var brackets = __webpack_require__(858);
 
 /**
  * Extglob compilers
@@ -100120,7 +102499,7 @@ module.exports = function(extglob) {
 
 
 /***/ }),
-/* 851 */
+/* 858 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -100130,17 +102509,17 @@ module.exports = function(extglob) {
  * Local dependencies
  */
 
-var compilers = __webpack_require__(852);
-var parsers = __webpack_require__(854);
+var compilers = __webpack_require__(859);
+var parsers = __webpack_require__(861);
 
 /**
  * Module dependencies
  */
 
-var debug = __webpack_require__(856)('expand-brackets');
-var extend = __webpack_require__(730);
-var Snapdragon = __webpack_require__(760);
-var toRegex = __webpack_require__(721);
+var debug = __webpack_require__(863)('expand-brackets');
+var extend = __webpack_require__(737);
+var Snapdragon = __webpack_require__(767);
+var toRegex = __webpack_require__(728);
 
 /**
  * Parses the given POSIX character class `pattern` and returns a
@@ -100338,13 +102717,13 @@ module.exports = brackets;
 
 
 /***/ }),
-/* 852 */
+/* 859 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var posix = __webpack_require__(853);
+var posix = __webpack_require__(860);
 
 module.exports = function(brackets) {
   brackets.compiler
@@ -100432,7 +102811,7 @@ module.exports = function(brackets) {
 
 
 /***/ }),
-/* 853 */
+/* 860 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -100461,14 +102840,14 @@ module.exports = {
 
 
 /***/ }),
-/* 854 */
+/* 861 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var utils = __webpack_require__(855);
-var define = __webpack_require__(722);
+var utils = __webpack_require__(862);
+var define = __webpack_require__(729);
 
 /**
  * Text regex
@@ -100687,14 +103066,14 @@ module.exports.TEXT_REGEX = TEXT_REGEX;
 
 
 /***/ }),
-/* 855 */
+/* 862 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var toRegex = __webpack_require__(721);
-var regexNot = __webpack_require__(732);
+var toRegex = __webpack_require__(728);
+var regexNot = __webpack_require__(739);
 var cached;
 
 /**
@@ -100728,7 +103107,7 @@ exports.createRegex = function(pattern, include) {
 
 
 /***/ }),
-/* 856 */
+/* 863 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -100737,14 +103116,14 @@ exports.createRegex = function(pattern, include) {
  */
 
 if (typeof process !== 'undefined' && process.type === 'renderer') {
-  module.exports = __webpack_require__(857);
+  module.exports = __webpack_require__(864);
 } else {
-  module.exports = __webpack_require__(860);
+  module.exports = __webpack_require__(867);
 }
 
 
 /***/ }),
-/* 857 */
+/* 864 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -100753,7 +103132,7 @@ if (typeof process !== 'undefined' && process.type === 'renderer') {
  * Expose `debug()` as the module.
  */
 
-exports = module.exports = __webpack_require__(858);
+exports = module.exports = __webpack_require__(865);
 exports.log = log;
 exports.formatArgs = formatArgs;
 exports.save = save;
@@ -100935,7 +103314,7 @@ function localstorage() {
 
 
 /***/ }),
-/* 858 */
+/* 865 */
 /***/ (function(module, exports, __webpack_require__) {
 
 
@@ -100951,7 +103330,7 @@ exports.coerce = coerce;
 exports.disable = disable;
 exports.enable = enable;
 exports.enabled = enabled;
-exports.humanize = __webpack_require__(859);
+exports.humanize = __webpack_require__(866);
 
 /**
  * The currently active debug mode names, and names to skip.
@@ -101143,7 +103522,7 @@ function coerce(val) {
 
 
 /***/ }),
-/* 859 */
+/* 866 */
 /***/ (function(module, exports) {
 
 /**
@@ -101301,7 +103680,7 @@ function plural(ms, n, name) {
 
 
 /***/ }),
-/* 860 */
+/* 867 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /**
@@ -101317,7 +103696,7 @@ var util = __webpack_require__(29);
  * Expose `debug()` as the module.
  */
 
-exports = module.exports = __webpack_require__(858);
+exports = module.exports = __webpack_require__(865);
 exports.init = init;
 exports.log = log;
 exports.formatArgs = formatArgs;
@@ -101496,7 +103875,7 @@ function createWritableStdioStream (fd) {
 
     case 'PIPE':
     case 'TCP':
-      var net = __webpack_require__(798);
+      var net = __webpack_require__(805);
       stream = new net.Socket({
         fd: fd,
         readable: false,
@@ -101555,15 +103934,15 @@ exports.enable(load());
 
 
 /***/ }),
-/* 861 */
+/* 868 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var brackets = __webpack_require__(851);
-var define = __webpack_require__(862);
-var utils = __webpack_require__(863);
+var brackets = __webpack_require__(858);
+var define = __webpack_require__(869);
+var utils = __webpack_require__(870);
 
 /**
  * Characters to use in text regex (we want to "not" match
@@ -101718,7 +104097,7 @@ module.exports = parsers;
 
 
 /***/ }),
-/* 862 */
+/* 869 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -101731,7 +104110,7 @@ module.exports = parsers;
 
 
 
-var isDescriptor = __webpack_require__(752);
+var isDescriptor = __webpack_require__(759);
 
 module.exports = function defineProperty(obj, prop, val) {
   if (typeof obj !== 'object' && typeof obj !== 'function') {
@@ -101756,14 +104135,14 @@ module.exports = function defineProperty(obj, prop, val) {
 
 
 /***/ }),
-/* 863 */
+/* 870 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var regex = __webpack_require__(732);
-var Cache = __webpack_require__(842);
+var regex = __webpack_require__(739);
+var Cache = __webpack_require__(849);
 
 /**
  * Utils
@@ -101832,7 +104211,7 @@ utils.createRegex = function(str) {
 
 
 /***/ }),
-/* 864 */
+/* 871 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -101842,16 +104221,16 @@ utils.createRegex = function(str) {
  * Module dependencies
  */
 
-var Snapdragon = __webpack_require__(760);
-var define = __webpack_require__(862);
-var extend = __webpack_require__(730);
+var Snapdragon = __webpack_require__(767);
+var define = __webpack_require__(869);
+var extend = __webpack_require__(737);
 
 /**
  * Local dependencies
  */
 
-var compilers = __webpack_require__(850);
-var parsers = __webpack_require__(861);
+var compilers = __webpack_require__(857);
+var parsers = __webpack_require__(868);
 
 /**
  * Customize Snapdragon parser and renderer
@@ -101917,16 +104296,16 @@ module.exports = Extglob;
 
 
 /***/ }),
-/* 865 */
+/* 872 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-var extglob = __webpack_require__(849);
-var nanomatch = __webpack_require__(834);
-var regexNot = __webpack_require__(732);
-var toRegex = __webpack_require__(822);
+var extglob = __webpack_require__(856);
+var nanomatch = __webpack_require__(841);
+var regexNot = __webpack_require__(739);
+var toRegex = __webpack_require__(829);
 var not;
 
 /**
@@ -102007,14 +104386,14 @@ function textRegex(pattern) {
 
 
 /***/ }),
-/* 866 */
+/* 873 */
 /***/ (function(module, exports, __webpack_require__) {
 
-module.exports = new (__webpack_require__(842))();
+module.exports = new (__webpack_require__(849))();
 
 
 /***/ }),
-/* 867 */
+/* 874 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -102027,13 +104406,13 @@ var path = __webpack_require__(16);
  * Module dependencies
  */
 
-var Snapdragon = __webpack_require__(760);
-utils.define = __webpack_require__(829);
-utils.diff = __webpack_require__(846);
-utils.extend = __webpack_require__(830);
-utils.pick = __webpack_require__(847);
-utils.typeOf = __webpack_require__(868);
-utils.unique = __webpack_require__(733);
+var Snapdragon = __webpack_require__(767);
+utils.define = __webpack_require__(836);
+utils.diff = __webpack_require__(853);
+utils.extend = __webpack_require__(837);
+utils.pick = __webpack_require__(854);
+utils.typeOf = __webpack_require__(875);
+utils.unique = __webpack_require__(740);
 
 /**
  * Returns true if the platform is windows, or `path.sep` is `\\`.
@@ -102330,7 +104709,7 @@ utils.unixify = function(options) {
 
 
 /***/ }),
-/* 868 */
+/* 875 */
 /***/ (function(module, exports) {
 
 var toString = Object.prototype.toString;
@@ -102465,7 +104844,7 @@ function isBuffer(val) {
 
 
 /***/ }),
-/* 869 */
+/* 876 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -102484,9 +104863,9 @@ var __extends = (this && this.__extends) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-var readdir = __webpack_require__(870);
-var reader_1 = __webpack_require__(883);
-var fs_stream_1 = __webpack_require__(887);
+var readdir = __webpack_require__(877);
+var reader_1 = __webpack_require__(890);
+var fs_stream_1 = __webpack_require__(894);
 var ReaderAsync = /** @class */ (function (_super) {
     __extends(ReaderAsync, _super);
     function ReaderAsync() {
@@ -102547,15 +104926,15 @@ exports.default = ReaderAsync;
 
 
 /***/ }),
-/* 870 */
+/* 877 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-const readdirSync = __webpack_require__(871);
-const readdirAsync = __webpack_require__(879);
-const readdirStream = __webpack_require__(882);
+const readdirSync = __webpack_require__(878);
+const readdirAsync = __webpack_require__(886);
+const readdirStream = __webpack_require__(889);
 
 module.exports = exports = readdirAsyncPath;
 exports.readdir = exports.readdirAsync = exports.async = readdirAsyncPath;
@@ -102639,7 +105018,7 @@ function readdirStreamStat (dir, options) {
 
 
 /***/ }),
-/* 871 */
+/* 878 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -102647,11 +105026,11 @@ function readdirStreamStat (dir, options) {
 
 module.exports = readdirSync;
 
-const DirectoryReader = __webpack_require__(872);
+const DirectoryReader = __webpack_require__(879);
 
 let syncFacade = {
-  fs: __webpack_require__(877),
-  forEach: __webpack_require__(878),
+  fs: __webpack_require__(884),
+  forEach: __webpack_require__(885),
   sync: true
 };
 
@@ -102680,7 +105059,7 @@ function readdirSync (dir, options, internalOptions) {
 
 
 /***/ }),
-/* 872 */
+/* 879 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -102689,9 +105068,9 @@ function readdirSync (dir, options, internalOptions) {
 const Readable = __webpack_require__(27).Readable;
 const EventEmitter = __webpack_require__(379).EventEmitter;
 const path = __webpack_require__(16);
-const normalizeOptions = __webpack_require__(873);
-const stat = __webpack_require__(875);
-const call = __webpack_require__(876);
+const normalizeOptions = __webpack_require__(880);
+const stat = __webpack_require__(882);
+const call = __webpack_require__(883);
 
 /**
  * Asynchronously reads the contents of a directory and streams the results
@@ -103067,14 +105446,14 @@ module.exports = DirectoryReader;
 
 
 /***/ }),
-/* 873 */
+/* 880 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 const path = __webpack_require__(16);
-const globToRegExp = __webpack_require__(874);
+const globToRegExp = __webpack_require__(881);
 
 module.exports = normalizeOptions;
 
@@ -103251,7 +105630,7 @@ function normalizeOptions (options, internalOptions) {
 
 
 /***/ }),
-/* 874 */
+/* 881 */
 /***/ (function(module, exports) {
 
 module.exports = function (glob, opts) {
@@ -103388,13 +105767,13 @@ module.exports = function (glob, opts) {
 
 
 /***/ }),
-/* 875 */
+/* 882 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
-const call = __webpack_require__(876);
+const call = __webpack_require__(883);
 
 module.exports = stat;
 
@@ -103469,7 +105848,7 @@ function symlinkStat (fs, path, lstats, callback) {
 
 
 /***/ }),
-/* 876 */
+/* 883 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103530,14 +105909,14 @@ function callOnce (fn) {
 
 
 /***/ }),
-/* 877 */
+/* 884 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 
 const fs = __webpack_require__(23);
-const call = __webpack_require__(876);
+const call = __webpack_require__(883);
 
 /**
  * A facade around {@link fs.readdirSync} that allows it to be called
@@ -103601,7 +105980,7 @@ exports.lstat = function (path, callback) {
 
 
 /***/ }),
-/* 878 */
+/* 885 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103630,7 +106009,7 @@ function syncForEach (array, iterator, done) {
 
 
 /***/ }),
-/* 879 */
+/* 886 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103638,12 +106017,12 @@ function syncForEach (array, iterator, done) {
 
 module.exports = readdirAsync;
 
-const maybe = __webpack_require__(880);
-const DirectoryReader = __webpack_require__(872);
+const maybe = __webpack_require__(887);
+const DirectoryReader = __webpack_require__(879);
 
 let asyncFacade = {
   fs: __webpack_require__(23),
-  forEach: __webpack_require__(881),
+  forEach: __webpack_require__(888),
   async: true
 };
 
@@ -103685,7 +106064,7 @@ function readdirAsync (dir, options, callback, internalOptions) {
 
 
 /***/ }),
-/* 880 */
+/* 887 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103712,7 +106091,7 @@ module.exports = function maybe (cb, promise) {
 
 
 /***/ }),
-/* 881 */
+/* 888 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103748,7 +106127,7 @@ function asyncForEach (array, iterator, done) {
 
 
 /***/ }),
-/* 882 */
+/* 889 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103756,11 +106135,11 @@ function asyncForEach (array, iterator, done) {
 
 module.exports = readdirStream;
 
-const DirectoryReader = __webpack_require__(872);
+const DirectoryReader = __webpack_require__(879);
 
 let streamFacade = {
   fs: __webpack_require__(23),
-  forEach: __webpack_require__(881),
+  forEach: __webpack_require__(888),
   async: true
 };
 
@@ -103780,16 +106159,16 @@ function readdirStream (dir, options, internalOptions) {
 
 
 /***/ }),
-/* 883 */
+/* 890 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
 var path = __webpack_require__(16);
-var deep_1 = __webpack_require__(884);
-var entry_1 = __webpack_require__(886);
-var pathUtil = __webpack_require__(885);
+var deep_1 = __webpack_require__(891);
+var entry_1 = __webpack_require__(893);
+var pathUtil = __webpack_require__(892);
 var Reader = /** @class */ (function () {
     function Reader(options) {
         this.options = options;
@@ -103855,14 +106234,14 @@ exports.default = Reader;
 
 
 /***/ }),
-/* 884 */
+/* 891 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-var pathUtils = __webpack_require__(885);
-var patternUtils = __webpack_require__(714);
+var pathUtils = __webpack_require__(892);
+var patternUtils = __webpack_require__(721);
 var DeepFilter = /** @class */ (function () {
     function DeepFilter(options, micromatchOptions) {
         this.options = options;
@@ -103945,7 +106324,7 @@ exports.default = DeepFilter;
 
 
 /***/ }),
-/* 885 */
+/* 892 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -103976,14 +106355,14 @@ exports.makeAbsolute = makeAbsolute;
 
 
 /***/ }),
-/* 886 */
+/* 893 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-var pathUtils = __webpack_require__(885);
-var patternUtils = __webpack_require__(714);
+var pathUtils = __webpack_require__(892);
+var patternUtils = __webpack_require__(721);
 var EntryFilter = /** @class */ (function () {
     function EntryFilter(options, micromatchOptions) {
         this.options = options;
@@ -104068,7 +106447,7 @@ exports.default = EntryFilter;
 
 
 /***/ }),
-/* 887 */
+/* 894 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104088,8 +106467,8 @@ var __extends = (this && this.__extends) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 var stream = __webpack_require__(27);
-var fsStat = __webpack_require__(888);
-var fs_1 = __webpack_require__(892);
+var fsStat = __webpack_require__(895);
+var fs_1 = __webpack_require__(899);
 var FileSystemStream = /** @class */ (function (_super) {
     __extends(FileSystemStream, _super);
     function FileSystemStream() {
@@ -104139,14 +106518,14 @@ exports.default = FileSystemStream;
 
 
 /***/ }),
-/* 888 */
+/* 895 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-const optionsManager = __webpack_require__(889);
-const statProvider = __webpack_require__(891);
+const optionsManager = __webpack_require__(896);
+const statProvider = __webpack_require__(898);
 /**
  * Asynchronous API.
  */
@@ -104177,13 +106556,13 @@ exports.statSync = statSync;
 
 
 /***/ }),
-/* 889 */
+/* 896 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", { value: true });
-const fsAdapter = __webpack_require__(890);
+const fsAdapter = __webpack_require__(897);
 function prepare(opts) {
     const options = Object.assign({
         fs: fsAdapter.getFileSystemAdapter(opts ? opts.fs : undefined),
@@ -104196,7 +106575,7 @@ exports.prepare = prepare;
 
 
 /***/ }),
-/* 890 */
+/* 897 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104219,7 +106598,7 @@ exports.getFileSystemAdapter = getFileSystemAdapter;
 
 
 /***/ }),
-/* 891 */
+/* 898 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104271,7 +106650,7 @@ exports.isFollowedSymlink = isFollowedSymlink;
 
 
 /***/ }),
-/* 892 */
+/* 899 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104302,7 +106681,7 @@ exports.default = FileSystem;
 
 
 /***/ }),
-/* 893 */
+/* 900 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104322,9 +106701,9 @@ var __extends = (this && this.__extends) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 var stream = __webpack_require__(27);
-var readdir = __webpack_require__(870);
-var reader_1 = __webpack_require__(883);
-var fs_stream_1 = __webpack_require__(887);
+var readdir = __webpack_require__(877);
+var reader_1 = __webpack_require__(890);
+var fs_stream_1 = __webpack_require__(894);
 var TransformStream = /** @class */ (function (_super) {
     __extends(TransformStream, _super);
     function TransformStream(reader) {
@@ -104392,7 +106771,7 @@ exports.default = ReaderStream;
 
 
 /***/ }),
-/* 894 */
+/* 901 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104411,9 +106790,9 @@ var __extends = (this && this.__extends) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-var readdir = __webpack_require__(870);
-var reader_1 = __webpack_require__(883);
-var fs_sync_1 = __webpack_require__(895);
+var readdir = __webpack_require__(877);
+var reader_1 = __webpack_require__(890);
+var fs_sync_1 = __webpack_require__(902);
 var ReaderSync = /** @class */ (function (_super) {
     __extends(ReaderSync, _super);
     function ReaderSync() {
@@ -104473,7 +106852,7 @@ exports.default = ReaderSync;
 
 
 /***/ }),
-/* 895 */
+/* 902 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104492,8 +106871,8 @@ var __extends = (this && this.__extends) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-var fsStat = __webpack_require__(888);
-var fs_1 = __webpack_require__(892);
+var fsStat = __webpack_require__(895);
+var fs_1 = __webpack_require__(899);
 var FileSystemSync = /** @class */ (function (_super) {
     __extends(FileSystemSync, _super);
     function FileSystemSync() {
@@ -104539,7 +106918,7 @@ exports.default = FileSystemSync;
 
 
 /***/ }),
-/* 896 */
+/* 903 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104555,7 +106934,7 @@ exports.flatten = flatten;
 
 
 /***/ }),
-/* 897 */
+/* 904 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104576,13 +106955,13 @@ exports.merge = merge;
 
 
 /***/ }),
-/* 898 */
+/* 905 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 const path = __webpack_require__(16);
-const pathType = __webpack_require__(899);
+const pathType = __webpack_require__(906);
 
 const getExtensions = extensions => extensions.length > 1 ? `{${extensions.join(',')}}` : extensions[0];
 
@@ -104648,13 +107027,13 @@ module.exports.sync = (input, opts) => {
 
 
 /***/ }),
-/* 899 */
+/* 906 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 const fs = __webpack_require__(23);
-const pify = __webpack_require__(900);
+const pify = __webpack_require__(907);
 
 function type(fn, fn2, fp) {
 	if (typeof fp !== 'string') {
@@ -104697,7 +107076,7 @@ exports.symlinkSync = typeSync.bind(null, 'lstatSync', 'isSymbolicLink');
 
 
 /***/ }),
-/* 900 */
+/* 907 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -104788,17 +107167,17 @@ module.exports = (obj, opts) => {
 
 
 /***/ }),
-/* 901 */
+/* 908 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 const fs = __webpack_require__(23);
 const path = __webpack_require__(16);
-const fastGlob = __webpack_require__(710);
-const gitIgnore = __webpack_require__(902);
-const pify = __webpack_require__(903);
-const slash = __webpack_require__(904);
+const fastGlob = __webpack_require__(717);
+const gitIgnore = __webpack_require__(909);
+const pify = __webpack_require__(910);
+const slash = __webpack_require__(911);
 
 const DEFAULT_IGNORE = [
 	'**/node_modules/**',
@@ -104896,7 +107275,7 @@ module.exports.sync = options => {
 
 
 /***/ }),
-/* 902 */
+/* 909 */
 /***/ (function(module, exports) {
 
 // A simple implementation of make-array
@@ -105365,7 +107744,7 @@ module.exports = options => new IgnoreBase(options)
 
 
 /***/ }),
-/* 903 */
+/* 910 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -105440,7 +107819,7 @@ module.exports = (input, options) => {
 
 
 /***/ }),
-/* 904 */
+/* 911 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -105458,17 +107837,17 @@ module.exports = input => {
 
 
 /***/ }),
-/* 905 */
+/* 912 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 const path = __webpack_require__(16);
 const {constants: fsConstants} = __webpack_require__(23);
-const {Buffer} = __webpack_require__(906);
-const CpFileError = __webpack_require__(907);
-const fs = __webpack_require__(909);
-const ProgressEmitter = __webpack_require__(911);
+const {Buffer} = __webpack_require__(913);
+const CpFileError = __webpack_require__(914);
+const fs = __webpack_require__(918);
+const ProgressEmitter = __webpack_require__(920);
 
 const cpFile = (source, destination, options) => {
 	if (!source || !destination) {
@@ -105622,7 +108001,7 @@ module.exports.sync = (source, destination, options) => {
 
 
 /***/ }),
-/* 906 */
+/* 913 */
 /***/ (function(module, exports, __webpack_require__) {
 
 /* eslint-disable node/no-deprecated-api */
@@ -105690,12 +108069,12 @@ SafeBuffer.allocUnsafeSlow = function (size) {
 
 
 /***/ }),
-/* 907 */
+/* 914 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const NestedError = __webpack_require__(908);
+const NestedError = __webpack_require__(915);
 
 class CpFileError extends NestedError {
 	constructor(message, nested) {
@@ -105709,10 +108088,10 @@ module.exports = CpFileError;
 
 
 /***/ }),
-/* 908 */
+/* 915 */
 /***/ (function(module, exports, __webpack_require__) {
 
-var inherits = __webpack_require__(509);
+var inherits = __webpack_require__(916);
 
 var NestedError = function (message, nested) {
     this.nested = nested;
@@ -105763,15 +108142,57 @@ module.exports = NestedError;
 
 
 /***/ }),
-/* 909 */
+/* 916 */
+/***/ (function(module, exports, __webpack_require__) {
+
+try {
+  var util = __webpack_require__(29);
+  if (typeof util.inherits !== 'function') throw '';
+  module.exports = util.inherits;
+} catch (e) {
+  module.exports = __webpack_require__(917);
+}
+
+
+/***/ }),
+/* 917 */
+/***/ (function(module, exports) {
+
+if (typeof Object.create === 'function') {
+  // implementation from standard node.js 'util' module
+  module.exports = function inherits(ctor, superCtor) {
+    ctor.super_ = superCtor
+    ctor.prototype = Object.create(superCtor.prototype, {
+      constructor: {
+        value: ctor,
+        enumerable: false,
+        writable: true,
+        configurable: true
+      }
+    });
+  };
+} else {
+  // old school shim for old browsers
+  module.exports = function inherits(ctor, superCtor) {
+    ctor.super_ = superCtor
+    var TempCtor = function () {}
+    TempCtor.prototype = superCtor.prototype
+    ctor.prototype = new TempCtor()
+    ctor.prototype.constructor = ctor
+  }
+}
+
+
+/***/ }),
+/* 918 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
 const fs = __webpack_require__(22);
 const makeDir = __webpack_require__(559);
-const pify = __webpack_require__(910);
-const CpFileError = __webpack_require__(907);
+const pify = __webpack_require__(919);
+const CpFileError = __webpack_require__(914);
 
 const fsP = pify(fs);
 
@@ -105916,7 +108337,7 @@ if (fs.copyFileSync) {
 
 
 /***/ }),
-/* 910 */
+/* 919 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -105991,7 +108412,7 @@ module.exports = (input, options) => {
 
 
 /***/ }),
-/* 911 */
+/* 920 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
@@ -106032,12 +108453,12 @@ module.exports = ProgressEmitter;
 
 
 /***/ }),
-/* 912 */
+/* 921 */
 /***/ (function(module, exports, __webpack_require__) {
 
 "use strict";
 
-const NestedError = __webpack_require__(913);
+const NestedError = __webpack_require__(922);
 
 class CpyError extends NestedError {
 	constructor(message, nested) {
@@ -106051,7 +108472,7 @@ module.exports = CpyError;
 
 
 /***/ }),
-/* 913 */
+/* 922 */
 /***/ (function(module, exports, __webpack_require__) {
 
 var inherits = __webpack_require__(29).inherits;
@@ -106107,7 +108528,7 @@ module.exports = NestedError;
 
 
 /***/ }),
-/* 914 */
+/* 923 */
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
diff --git a/packages/kbn-pm/src/utils/scripts.ts b/packages/kbn-pm/src/utils/scripts.ts
index f12aeddec9163..009efa1285c0c 100644
--- a/packages/kbn-pm/src/utils/scripts.ts
+++ b/packages/kbn-pm/src/utils/scripts.ts
@@ -67,11 +67,14 @@ export function runScriptInPackageStreaming(script: string, args: string[], pkg:
 }
 
 export async function yarnWorkspacesInfo(directory: string): Promise<WorkspacesInfo> {
-  const workspacesInfo = await spawn('yarn', ['workspaces', 'info', '--json'], {
+  const { stdout } = await spawn('yarn', ['--json', 'workspaces', 'info'], {
     cwd: directory,
     stdio: 'pipe',
   });
 
-  const stdout = JSON.parse(workspacesInfo.stdout);
-  return JSON.parse(stdout.data);
+  try {
+    return JSON.parse(JSON.parse(stdout).data);
+  } catch (error) {
+    throw new Error(`'yarn workspaces info --json' produced unexpected output: \n${stdout}`);
+  }
 }
diff --git a/packages/kbn-ui-shared-deps/package.json b/packages/kbn-ui-shared-deps/package.json
index ea15d2e34ea3a..fc9d159ea9b95 100644
--- a/packages/kbn-ui-shared-deps/package.json
+++ b/packages/kbn-ui-shared-deps/package.json
@@ -9,12 +9,12 @@
     "kbn:watch": "node scripts/build --watch"
   },
   "devDependencies": {
+    "@elastic/charts": "^17.0.2",
+    "abort-controller": "^3.0.0",
     "@elastic/eui": "18.3.0",
-    "@elastic/charts": "^16.1.0",
     "@kbn/dev-utils": "1.0.0",
     "@kbn/i18n": "1.0.0",
     "@yarnpkg/lockfile": "^1.1.0",
-    "abortcontroller-polyfill": "^1.3.0",
     "angular": "^1.7.9",
     "core-js": "^3.2.1",
     "css-loader": "^2.1.1",
@@ -24,13 +24,13 @@
     "mini-css-extract-plugin": "0.8.0",
     "moment": "^2.24.0",
     "moment-timezone": "^0.5.27",
+    "react": "^16.12.0",
     "react-dom": "^16.12.0",
     "react-intl": "^2.8.0",
-    "react": "^16.12.0",
     "read-pkg": "^5.2.0",
     "regenerator-runtime": "^0.13.3",
     "symbol-observable": "^1.2.0",
     "webpack": "4.41.0",
     "whatwg-fetch": "^3.0.0"
   }
-}
\ No newline at end of file
+}
diff --git a/packages/kbn-ui-shared-deps/polyfills.js b/packages/kbn-ui-shared-deps/polyfills.js
index d2305d643e4d2..612fbb9a78b50 100644
--- a/packages/kbn-ui-shared-deps/polyfills.js
+++ b/packages/kbn-ui-shared-deps/polyfills.js
@@ -21,6 +21,6 @@ require('core-js/stable');
 require('regenerator-runtime/runtime');
 require('custom-event-polyfill');
 require('whatwg-fetch');
-require('abortcontroller-polyfill/dist/polyfill-patch-fetch');
+require('abort-controller/polyfill');
 require('./vendor/childnode_remove_polyfill');
 require('symbol-observable');
diff --git a/rfcs/text/0006_management_section_service.md b/rfcs/text/0006_management_section_service.md
index d9781e85cd8a9..1a52e85a4ff16 100644
--- a/rfcs/text/0006_management_section_service.md
+++ b/rfcs/text/0006_management_section_service.md
@@ -257,15 +257,7 @@ Current public contracts owned by the legacy service:
 ```js
 // ui/management/index
 interface API {
-  PAGE_TITLE_COMPONENT: string; // actually related to advanced settings?
-  PAGE_SUBTITLE_COMPONENT: string; // actually related to advanced settings?
-  PAGE_FOOTER_COMPONENT: string; // actually related to advanced settings?
   SidebarNav: React.FC<any>;
-  registerSettingsComponent: (
-    id: string,
-    component: string | React.FC<any>,
-    allowOverride: boolean
-  ) => void;
   management: new ManagementSection();
   MANAGEMENT_BREADCRUMB: {
     text: string;
diff --git a/src/core/TESTING.md b/src/core/TESTING.md
index 23c0879e4411e..4dfab8830a506 100644
--- a/src/core/TESTING.md
+++ b/src/core/TESTING.md
@@ -548,9 +548,300 @@ _How to test SO operations_
 
 _How to test ES clients_
 
-## Plugin Integrations
+## Plugin integrations
 
-_How to test against specific plugin APIs (eg. data plugin)_
+In the new platform, all plugin's dependencies to other plugins are explicitly declared in their `kibana.json`
+manifest. As for `core`, the dependencies `setup` and `start` contracts are injected in your plugin's respective 
+`setup` and `start` phases. One of the upsides with testing is that every usage of the dependencies is explicit,
+and that the plugin's contracts must be propagated to the parts of the code using them, meaning that isolating a 
+specific logical component for unit testing is way easier than in legacy.
+
+The approach to test parts of a plugin's code that is relying on other plugins is quite similar to testing
+code using `core` APIs: it's expected to mock the dependency, and make it return the value the test is expecting.
+
+Most plugins are defining mocks for their contracts. The convention is to expose them in a `mocks` file  in 
+`my_plugin/server` and/or `my_plugin/public`. For example for the `data` plugin, the client-side mocks are located in 
+`src/plugins/data/public/mocks.ts`. When such mocks are present, it's strongly recommended to use them
+when testing against dependencies. Otherwise, one should create it's own mocked implementation of the dependency's
+contract (and should probably ping the plugin's owner to ask them to add proper contract mocks).
+
+### Preconditions
+
+For these examples, we are going to see how we should test the `myPlugin` plugin.
+ 
+This plugin declares the `data` plugin as  a `required` dependency and the `usageCollection` plugin as an `optional` 
+one. It also exposes a `getSpecialSuggestions` API in it's start contract, which relies on the `data` plugin to retrieve
+data.
+
+`MyPlugin` plugin definition:
+
+```typescript
+// src/plugins/myplugin/public/plugin.ts
+import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { DataPublicPluginSetup, DataPublicPluginStart } from '../../data/public';
+import { UsageCollectionSetup } from '../../usage_collection/public';
+import { SuggestionsService } from './suggestions';
+
+interface MyPluginSetupDeps {
+  data: DataPublicPluginSetup;
+  usageCollection?: UsageCollectionSetup;
+}
+
+interface MyPluginStartDeps {
+  data: DataPublicPluginStart;
+}
+
+export class MyPlugin implements Plugin<MyPluginSetup, MyPluginStart, MyPluginSetupDeps, MyPluginStartDeps> {
+  private suggestionsService = new SuggestionsService();
+
+  public setup(core: CoreSetup, { data, usageCollection }: MyPluginSetupDeps) {
+    // setup our internal service
+    this.suggestionsService.setup(data);
+
+    // an example on using an optional dependency that will be tested
+    if (usageCollection) {
+      usageCollection.allowTrackUserAgent(true);
+    }
+
+    return {};
+  }
+
+  public start(core: CoreStart, { data }: MyPluginStartDeps) {
+    const suggestions = this.suggestionsService.start(data);
+    return {
+      getSpecialSuggestions: (query: string) => suggestions.getSuggestions(query),
+    };
+  }
+
+  public stop() {}
+}
+
+export type MyPluginSetup = ReturnType<MyPlugin['setup']>;
+export type MyPluginStart = ReturnType<MyPlugin['start']>;
+```
+
+The underlying `SuggestionsService` implementation:
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.ts
+import { DataPublicPluginSetup, DataPublicPluginStart } from '../../../data/public';
+
+// stubs for testing purposes
+const suggestDependingOn = (...args: any[]) => [];
+const baseOptions = {} as any;
+export const defaultSuggestions = [
+  {
+    text: 'a default suggestion',
+  },
+] as any[];
+
+export class SuggestionsService {
+  public setup(data: DataPublicPluginSetup) {
+    // register a suggestion provider to the `data` dependency plugin
+    data.autocomplete.addQuerySuggestionProvider('fr', async args => {
+      return suggestDependingOn(args);
+    });
+  }
+
+  public start(data: DataPublicPluginStart) {
+    return {
+      getSuggestions: async (query: string) => {
+        // use the `data` plugin contract to retrieve arbitrary data
+        // note: this logic does not really make any sense and is only here to introduce a behavior to test
+        const baseSuggestions = await data.autocomplete.getQuerySuggestions({
+          ...baseOptions,
+          query,
+        });
+        if (!baseSuggestions || baseSuggestions.length === 0) {
+          return defaultSuggestions;
+        }
+        return baseSuggestions.filter(suggestion => suggestion.type !== 'conjunction');
+      },
+    };
+  }
+}
+```
+
+### Testing dependencies usages
+
+A plugin should test expected usage and calls on it's dependency plugins' API.
+
+Some calls, such as 'registration' APIs exposed from dependency plugins, should be checked,
+to ensure both that they are actually executed, and performed with the correct parameters.
+
+For our example plugin's `SuggestionsService`, we should assert that the suggestion provider is correctly 
+registered to the `data` plugin during the `setup` phase, and that `getSuggestions` calls 
+`autocomplete.getQuerySuggestions` with the correct parameters.
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.test.ts
+import {
+  dataPluginMock,
+  Setup as DataPluginSetupMock,
+  Start as DataPluginStartMock,
+} from '../../../data/public/mocks';
+import { SuggestionsService } from './suggestion_service';
+
+describe('SuggestionsService', () => {
+  let service: SuggestionsService;
+  let dataSetup: DataPluginSetupMock;
+  let dataStart: DataPluginStartMock;
+
+  beforeEach(() => {
+    service = new SuggestionsService();
+    dataSetup = dataPluginMock.createSetupContract();
+    dataStart = dataPluginMock.createStartContract();
+  });
+
+  describe('#setup', () => {
+    it('registers the query suggestion provider to the data plugin', () => {
+      service.setup(dataSetup);
+
+      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledTimes(1);
+      expect(dataSetup.autocomplete.addQuerySuggestionProvider).toHaveBeenCalledWith(
+        'fr',
+        expect.any(Function)
+      );
+    });
+  });
+
+  describe('#start', () => {
+    describe('#getSuggestions', () => {
+      it('calls getQuerySuggestions with the correct query', async () => {
+        service.setup(dataSetup);
+        const serviceStart = service.start(dataStart);
+
+        await serviceStart.getSuggestions('some query');
+
+        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledTimes(1);
+        expect(dataStart.autocomplete.getQuerySuggestions).toHaveBeenCalledWith(
+          expect.objectContaining({
+            query: 'some query',
+          })
+        );
+      });
+    });
+  });
+});
+```
+
+### Testing components consuming the dependencies
+
+When testing parts of your plugin code that depends on the dependency plugin's data, the best approach
+is to mock the dependency to be able to get the behavior expected for the test.
+
+In this example, we are going to mock the results of `autocomplete.getQuerySuggestions` to be able to test 
+the service's `getSuggestions` method.
+
+```typescript
+// src/plugins/myplugin/public/suggestions/suggestion_service.ts
+
+describe('#start', () => {
+  describe('#getSuggestions', () => {
+    it('returns the default suggestions when autocomplete returns no results', async () => {
+      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([]);
+
+      service.setup(dataSetup);
+      const serviceStart = service.start(dataStart);
+
+      const results = await serviceStart.getSuggestions('some query');
+      expect(results).toEqual(defaultSuggestions);
+    });
+
+    it('excludes conjunctions from the autocomplete results', async () => {
+      dataStart.autocomplete.getQuerySuggestions.mockResolvedValue([
+        {
+          type: 'field',
+          text: 'field suggestion',
+        },
+        {
+          type: 'conjunction',
+          text: 'conjunction suggestion',
+        },
+      ]);
+
+      service.setup(dataSetup);
+      const serviceStart = service.start(dataStart);
+
+      const results = await serviceStart.getSuggestions('some query');
+
+      expect(results).toEqual([
+        {
+          type: 'field',
+          text: 'field suggestion',
+        },
+      ]);
+    });
+  });
+});
+```
+
+### Testing optional plugin dependencies
+
+Plugins should test that their behavior remains correct when their optional dependencies are either available or not.
+
+A basic test would be to ensure that the plugin properly initialize without error when the optional
+dependency is missing:
+
+```typescript
+// src/plugins/myplugin/public/plugin.test.ts
+import { coreMock } from '../../../core/public/mocks';
+import { dataPluginMock } from '../../data/public/mocks';
+import { MyPlugin } from './plugin';
+
+describe('Plugin', () => {
+  it('initializes correctly if usageCollection is disabled', () => {
+    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
+    const coreSetup = coreMock.createSetup();
+    const setupDeps = {
+      data: dataPluginMock.createSetupContract(),
+      // optional usageCollector dependency is not available
+    };
+  
+    const coreStart = coreMock.createStart();
+    const startDeps = {
+      data: dataPluginMock.createStartContract(),
+    };
+  
+    expect(() => {
+      plugin.setup(coreSetup, setupDeps);
+    }).not.toThrow();
+    expect(() => {
+      plugin.start(coreStart, startDeps);
+    }).not.toThrow();
+  });
+});
+```
+
+Then we should test that when optional dependency is properly used when present:
+
+```typescript
+// src/plugins/myplugin/public/plugin.test.ts
+import { coreMock } from '../../../core/public/mocks';
+import { dataPluginMock } from '../../data/public/mocks';
+import { usageCollectionPluginMock } from '../../usage_collection/public/mocks';
+
+import { MyPlugin } from './plugin';
+
+describe('Plugin', () => {
+  // [...]
+
+  it('enables trackUserAgent when usageCollection is available', async () => {
+    const plugin = new MyPlugin(coreMock.createPluginInitializerContext());
+    const coreSetup = coreMock.createSetup();
+    const usageCollectionSetup = usageCollectionPluginMock.createSetupContract();
+    const setupDeps = {
+      data: dataPluginMock.createSetupContract(),
+      usageCollection: usageCollectionSetup,
+    };
+
+    plugin.setup(coreSetup, setupDeps);
+
+    expect(usageCollectionSetup.allowTrackUserAgent).toHaveBeenCalledTimes(1);
+    expect(usageCollectionSetup.allowTrackUserAgent).toHaveBeenCalledWith(true);
+  });
+});
+```
 
 ## Plugin Contracts
 
diff --git a/src/core/server/elasticsearch/retry_call_cluster.test.ts b/src/core/server/elasticsearch/retry_call_cluster.test.ts
index 275bda17ab92f..b5a5185ab39d9 100644
--- a/src/core/server/elasticsearch/retry_call_cluster.test.ts
+++ b/src/core/server/elasticsearch/retry_call_cluster.test.ts
@@ -66,6 +66,7 @@ describe('migrationsRetryCallCluster', () => {
     'RequestTimeout',
     'AuthenticationException',
     'AuthorizationException',
+    'Gone',
   ];
 
   const mockLogger = loggingServiceMock.create();
diff --git a/src/core/server/elasticsearch/retry_call_cluster.ts b/src/core/server/elasticsearch/retry_call_cluster.ts
index bd72ecf726461..ea3cc0b90c077 100644
--- a/src/core/server/elasticsearch/retry_call_cluster.ts
+++ b/src/core/server/elasticsearch/retry_call_cluster.ts
@@ -62,7 +62,9 @@ export function migrationsRetryCallCluster(
                     error instanceof esErrors.ServiceUnavailable ||
                     error instanceof esErrors.RequestTimeout ||
                     error instanceof esErrors.AuthenticationException ||
-                    error instanceof esErrors.AuthorizationException
+                    error instanceof esErrors.AuthorizationException ||
+                    // @ts-ignore
+                    error instanceof esErrors.Gone
                   );
                 },
                 timer(delay),
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index c45acd7f0129a..cc838ddd1351d 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -197,6 +197,7 @@ export {
   SavedObjectsImportUnsupportedTypeError,
   SavedObjectsMigrationLogger,
   SavedObjectsRawDoc,
+  SavedObjectSanitizedDoc,
   SavedObjectsRepositoryFactory,
   SavedObjectsResolveImportErrorsOptions,
   SavedObjectsSchema,
@@ -211,6 +212,15 @@ export {
   SavedObjectsRepository,
   SavedObjectsDeleteByNamespaceOptions,
   SavedObjectsIncrementCounterOptions,
+  SavedObjectsComplexFieldMapping,
+  SavedObjectsCoreFieldMapping,
+  SavedObjectsFieldMapping,
+  SavedObjectsTypeMappingDefinition,
+  SavedObjectsMappingProperties,
+  SavedObjectTypeRegistry,
+  SavedObjectsType,
+  SavedObjectMigrationMap,
+  SavedObjectMigrationFn,
 } from './saved_objects';
 
 export {
diff --git a/src/core/server/legacy/legacy_service.mock.ts b/src/core/server/legacy/legacy_service.mock.ts
index 495141cdcb58d..44405dc391d8e 100644
--- a/src/core/server/legacy/legacy_service.mock.ts
+++ b/src/core/server/legacy/legacy_service.mock.ts
@@ -18,13 +18,18 @@
  */
 
 import { LegacyService } from './legacy_service';
-import { LegacyServiceDiscoverPlugins, LegacyServiceSetupDeps } from './types';
+import { LegacyConfig, LegacyServiceDiscoverPlugins, LegacyServiceSetupDeps } from './types';
 
 type LegacyServiceMock = jest.Mocked<PublicMethodsOf<LegacyService> & { legacyId: symbol }>;
 
 const createDiscoverPluginsMock = (): LegacyServiceDiscoverPlugins => ({
   pluginSpecs: [],
-  uiExports: {} as any,
+  uiExports: {
+    savedObjectSchemas: {},
+    savedObjectMappings: [],
+    savedObjectMigrations: {},
+    savedObjectValidations: {},
+  },
   navLinks: [],
   pluginExtendedConfig: {
     get: jest.fn(),
@@ -34,6 +39,7 @@ const createDiscoverPluginsMock = (): LegacyServiceDiscoverPlugins => ({
   disabledPluginSpecs: [],
   settings: {},
 });
+
 const createLegacyServiceMock = (): LegacyServiceMock => ({
   legacyId: Symbol(),
   discoverPlugins: jest.fn().mockResolvedValue(createDiscoverPluginsMock()),
@@ -42,8 +48,15 @@ const createLegacyServiceMock = (): LegacyServiceMock => ({
   stop: jest.fn(),
 });
 
+const createLegacyConfigMock = (): jest.Mocked<LegacyConfig> => ({
+  get: jest.fn(),
+  has: jest.fn(),
+  set: jest.fn(),
+});
+
 export const legacyServiceMock = {
   create: createLegacyServiceMock,
   createSetupContract: (deps: LegacyServiceSetupDeps) => createLegacyServiceMock().setup(deps),
   createDiscoverPlugins: createDiscoverPluginsMock,
+  createLegacyConfig: createLegacyConfigMock,
 };
diff --git a/src/core/server/legacy/legacy_service.test.ts b/src/core/server/legacy/legacy_service.test.ts
index af4db68ee95e1..e8e20580a36db 100644
--- a/src/core/server/legacy/legacy_service.test.ts
+++ b/src/core/server/legacy/legacy_service.test.ts
@@ -83,7 +83,7 @@ beforeEach(() => {
           getAuthHeaders: () => undefined,
         } as any,
       },
-      savedObjects: savedObjectsServiceMock.createSetupContract(),
+      savedObjects: savedObjectsServiceMock.createInternalSetupContract(),
       plugins: {
         contracts: new Map([['plugin-id', 'plugin-value']]),
         uiPlugins: {
@@ -101,7 +101,7 @@ beforeEach(() => {
   startDeps = {
     core: {
       capabilities: capabilitiesServiceMock.createStartContract(),
-      savedObjects: savedObjectsServiceMock.createStartContract(),
+      savedObjects: savedObjectsServiceMock.createInternalStartContract(),
       uiSettings: uiSettingsServiceMock.createStartContract(),
       plugins: { contracts: new Map() },
     },
diff --git a/src/core/server/legacy/legacy_service.ts b/src/core/server/legacy/legacy_service.ts
index f9b18afadc938..b2501496d87ef 100644
--- a/src/core/server/legacy/legacy_service.ts
+++ b/src/core/server/legacy/legacy_service.ts
@@ -262,6 +262,7 @@ export class LegacyService implements CoreService {
         getScopedClient: startDeps.core.savedObjects.getScopedClient,
         createScopedRepository: startDeps.core.savedObjects.createScopedRepository,
         createInternalRepository: startDeps.core.savedObjects.createInternalRepository,
+        createSerializer: startDeps.core.savedObjects.createSerializer,
       },
       uiSettings: { asScopedToClient: startDeps.core.uiSettings.asScopedToClient },
     };
@@ -328,6 +329,7 @@ export class LegacyService implements CoreService {
         __internals: {
           hapiServer: setupDeps.core.http.server,
           kibanaMigrator: startDeps.core.savedObjects.migrator,
+          typeRegistry: startDeps.core.savedObjects.typeRegistry,
           uiPlugins: setupDeps.core.plugins.uiPlugins,
           elasticsearch: setupDeps.core.elasticsearch,
           rendering: setupDeps.core.rendering,
diff --git a/src/core/server/legacy/logging/appenders/__snapshots__/legacy_appender.test.ts.snap b/src/core/server/legacy/logging/appenders/__snapshots__/legacy_appender.test.ts.snap
index 6ffc1ea140beb..3c40362e8211e 100644
--- a/src/core/server/legacy/logging/appenders/__snapshots__/legacy_appender.test.ts.snap
+++ b/src/core/server/legacy/logging/appenders/__snapshots__/legacy_appender.test.ts.snap
@@ -1,127 +1,142 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`\`append()\` correctly pushes records to legacy platform. 1`] = `
-Array [
-  Array [
-    Object {
-      "context": "context-1",
-      "level": LogLevel {
-        "id": "trace",
-        "value": 7,
-      },
-      "message": "message-1",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-2",
-      "level": LogLevel {
-        "id": "debug",
-        "value": 6,
-      },
-      "message": "message-2",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-3.sub-context-3",
-      "level": LogLevel {
-        "id": "info",
-        "value": 5,
-      },
-      "message": "message-3",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-4.sub-context-4",
-      "level": LogLevel {
-        "id": "warn",
-        "value": 4,
-      },
-      "message": "message-4",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-5",
-      "error": [Error: Some Error],
-      "level": LogLevel {
-        "id": "error",
-        "value": 3,
-      },
-      "message": "message-5-with-error",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-6",
-      "level": LogLevel {
-        "id": "error",
-        "value": 3,
-      },
-      "message": "message-6-with-message",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-7.sub-context-7.sub-sub-context-7",
-      "error": [Error: Some Fatal Error],
-      "level": LogLevel {
-        "id": "fatal",
-        "value": 2,
-      },
-      "message": "message-7-with-error",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-8.sub-context-8.sub-sub-context-8",
-      "level": LogLevel {
-        "id": "fatal",
-        "value": 2,
-      },
-      "message": "message-8-with-message",
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-9.sub-context-9",
-      "level": LogLevel {
-        "id": "info",
-        "value": 5,
-      },
-      "message": "message-9-with-message",
-      "meta": Object {
-        "someValue": 3,
-      },
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "context-10.sub-context-10",
-      "level": LogLevel {
-        "id": "info",
-        "value": 5,
-      },
-      "message": "message-10-with-message",
-      "meta": Object {
-        "tags": Array [
-          "tag1",
-          "tag2",
-        ],
-      },
-      "timestamp": 2012-02-01T11:22:33.044Z,
-    },
-  ],
-]
+Object {
+  "context": "context-1",
+  "level": LogLevel {
+    "id": "trace",
+    "value": 7,
+  },
+  "message": "message-1",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 2`] = `
+Object {
+  "context": "context-2",
+  "level": LogLevel {
+    "id": "debug",
+    "value": 6,
+  },
+  "message": "message-2",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 3`] = `
+Object {
+  "context": "context-3.sub-context-3",
+  "level": LogLevel {
+    "id": "info",
+    "value": 5,
+  },
+  "message": "message-3",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 4`] = `
+Object {
+  "context": "context-4.sub-context-4",
+  "level": LogLevel {
+    "id": "warn",
+    "value": 4,
+  },
+  "message": "message-4",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 5`] = `
+Object {
+  "context": "context-5",
+  "error": [Error: Some Error],
+  "level": LogLevel {
+    "id": "error",
+    "value": 3,
+  },
+  "message": "message-5-with-error",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 6`] = `
+Object {
+  "context": "context-6",
+  "level": LogLevel {
+    "id": "error",
+    "value": 3,
+  },
+  "message": "message-6-with-message",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 7`] = `
+Object {
+  "context": "context-7.sub-context-7.sub-sub-context-7",
+  "error": [Error: Some Fatal Error],
+  "level": LogLevel {
+    "id": "fatal",
+    "value": 2,
+  },
+  "message": "message-7-with-error",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 8`] = `
+Object {
+  "context": "context-8.sub-context-8.sub-sub-context-8",
+  "level": LogLevel {
+    "id": "fatal",
+    "value": 2,
+  },
+  "message": "message-8-with-message",
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 9`] = `
+Object {
+  "context": "context-9.sub-context-9",
+  "level": LogLevel {
+    "id": "info",
+    "value": 5,
+  },
+  "message": "message-9-with-message",
+  "meta": Object {
+    "someValue": 3,
+  },
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
+`;
+
+exports[`\`append()\` correctly pushes records to legacy platform. 10`] = `
+Object {
+  "context": "context-10.sub-context-10",
+  "level": LogLevel {
+    "id": "info",
+    "value": 5,
+  },
+  "message": "message-10-with-message",
+  "meta": Object {
+    "tags": Array [
+      "tag1",
+      "tag2",
+    ],
+  },
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T11:22:33.044Z,
+}
 `;
diff --git a/src/core/server/legacy/logging/appenders/legacy_appender.test.ts b/src/core/server/legacy/logging/appenders/legacy_appender.test.ts
index adc5dcae3ec9d..538d987e781d0 100644
--- a/src/core/server/legacy/logging/appenders/legacy_appender.test.ts
+++ b/src/core/server/legacy/logging/appenders/legacy_appender.test.ts
@@ -46,24 +46,28 @@ test('`append()` correctly pushes records to legacy platform.', () => {
       level: LogLevel.Trace,
       message: 'message-1',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-2',
       level: LogLevel.Debug,
       message: 'message-2',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-3.sub-context-3',
       level: LogLevel.Info,
       message: 'message-3',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-4.sub-context-4',
       level: LogLevel.Warn,
       message: 'message-4',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-5',
@@ -71,12 +75,14 @@ test('`append()` correctly pushes records to legacy platform.', () => {
       level: LogLevel.Error,
       message: 'message-5-with-error',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-6',
       level: LogLevel.Error,
       message: 'message-6-with-message',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-7.sub-context-7.sub-sub-context-7',
@@ -84,18 +90,21 @@ test('`append()` correctly pushes records to legacy platform.', () => {
       level: LogLevel.Fatal,
       message: 'message-7-with-error',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-8.sub-context-8.sub-sub-context-8',
       level: LogLevel.Fatal,
       message: 'message-8-with-message',
       timestamp,
+      pid: 5355,
     },
     {
       context: 'context-9.sub-context-9',
       level: LogLevel.Info,
       message: 'message-9-with-message',
       timestamp,
+      pid: 5355,
       meta: { someValue: 3 },
     },
     {
@@ -103,6 +112,7 @@ test('`append()` correctly pushes records to legacy platform.', () => {
       level: LogLevel.Info,
       message: 'message-10-with-message',
       timestamp,
+      pid: 5355,
       meta: { tags: ['tag1', 'tag2'] },
     },
   ];
@@ -113,7 +123,12 @@ test('`append()` correctly pushes records to legacy platform.', () => {
   }
 
   const [mockLegacyLoggingServerInstance] = (LegacyLoggingServer as any).mock.instances;
-  expect(mockLegacyLoggingServerInstance.log.mock.calls).toMatchSnapshot();
+  expect(mockLegacyLoggingServerInstance.log.mock.calls).toHaveLength(records.length);
+  records.forEach((r, idx) => {
+    expect(mockLegacyLoggingServerInstance.log.mock.calls[idx][0]).toMatchSnapshot({
+      pid: expect.any(Number),
+    });
+  });
 });
 
 test('legacy logging server is correctly created and disposed.', async () => {
diff --git a/src/core/server/legacy/logging/legacy_logging_server.test.ts b/src/core/server/legacy/logging/legacy_logging_server.test.ts
index beb2098600ce6..6dca3a199728e 100644
--- a/src/core/server/legacy/logging/legacy_logging_server.test.ts
+++ b/src/core/server/legacy/logging/legacy_logging_server.test.ts
@@ -31,6 +31,7 @@ test('correctly forwards log records.', () => {
   const timestamp = 1554433221100;
   const firstLogRecord = {
     timestamp: new Date(timestamp),
+    pid: 5355,
     level: LogLevel.Info,
     context: 'some-context',
     message: 'some-message',
@@ -38,6 +39,7 @@ test('correctly forwards log records.', () => {
 
   const secondLogRecord = {
     timestamp: new Date(timestamp),
+    pid: 5355,
     level: LogLevel.Error,
     context: 'some-context.sub-context',
     message: 'some-message',
@@ -47,6 +49,7 @@ test('correctly forwards log records.', () => {
 
   const thirdLogRecord = {
     timestamp: new Date(timestamp),
+    pid: 5355,
     level: LogLevel.Trace,
     context: 'some-context.sub-context',
     message: 'some-message',
diff --git a/src/core/server/logging/__snapshots__/logging_service.test.ts.snap b/src/core/server/logging/__snapshots__/logging_service.test.ts.snap
index ffde6cbcdebd1..54c170f523299 100644
--- a/src/core/server/logging/__snapshots__/logging_service.test.ts.snap
+++ b/src/core/server/logging/__snapshots__/logging_service.test.ts.snap
@@ -1,57 +1,71 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`appends records via multiple appenders.: console logs 1`] = `
-Array [
-  Array [
-    "[2012-02-01T00:00:00.000Z][INFO ][some-context] You know, just for your info.",
-  ],
-]
-`;
+exports[`appends records via multiple appenders.: console logs 1`] = `"[2012-02-01T00:00:00.000Z][INFO ][some-context] You know, just for your info."`;
 
 exports[`appends records via multiple appenders.: file logs 1`] = `
-Array [
-  Array [
-    "[2012-02-01T00:00:00.000Z][WARN ][tests] Config is not ready!
-",
-  ],
-  Array [
-    "[2012-02-01T00:00:00.000Z][ERROR][tests.child] Too bad that config is not ready :/
-",
-  ],
-]
+"[2012-02-01T00:00:00.000Z][WARN ][tests] Config is not ready!
+"
+`;
+
+exports[`appends records via multiple appenders.: file logs 2`] = `
+"[2012-02-01T00:00:00.000Z][ERROR][tests.child] Too bad that config is not ready :/
+"
 `;
 
 exports[`asLoggerFactory() only allows to create new loggers. 1`] = `
-Array [
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"TRACE\\",\\"message\\":\\"buffered trace message\\"}",
-  ],
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"INFO\\",\\"message\\":\\"buffered info message\\",\\"meta\\":{\\"some\\":\\"value\\"}}",
-  ],
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"FATAL\\",\\"message\\":\\"buffered fatal message\\"}",
-  ],
-]
+Object {
+  "@timestamp": "2012-02-01T00:00:00.000Z",
+  "context": "test.context",
+  "level": "TRACE",
+  "message": "buffered trace message",
+  "pid": Any<Number>,
+}
+`;
+
+exports[`asLoggerFactory() only allows to create new loggers. 2`] = `
+Object {
+  "@timestamp": "2012-02-01T00:00:00.000Z",
+  "context": "test.context",
+  "level": "INFO",
+  "message": "buffered info message",
+  "meta": Object {
+    "some": "value",
+  },
+  "pid": Any<Number>,
+}
+`;
+
+exports[`asLoggerFactory() only allows to create new loggers. 3`] = `
+Object {
+  "@timestamp": "2012-02-01T00:00:00.000Z",
+  "context": "test.context",
+  "level": "FATAL",
+  "message": "buffered fatal message",
+  "pid": Any<Number>,
+}
 `;
 
 exports[`flushes memory buffer logger and switches to real logger once config is provided: buffered messages 1`] = `
-Array [
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"INFO\\",\\"message\\":\\"buffered info message\\",\\"meta\\":{\\"some\\":\\"value\\"}}",
-  ],
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"FATAL\\",\\"message\\":\\"buffered fatal message\\"}",
-  ],
-]
+Object {
+  "@timestamp": "2012-02-01T00:00:00.000Z",
+  "context": "test.context",
+  "level": "INFO",
+  "message": "buffered info message",
+  "meta": Object {
+    "some": "value",
+  },
+  "pid": Any<Number>,
+}
 `;
 
 exports[`flushes memory buffer logger and switches to real logger once config is provided: new messages 1`] = `
-Array [
-  Array [
-    "{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"test.context\\",\\"level\\":\\"INFO\\",\\"message\\":\\"some new info message\\"}",
-  ],
-]
+Object {
+  "@timestamp": "2012-02-01T00:00:00.000Z",
+  "context": "test.context",
+  "level": "INFO",
+  "message": "some new info message",
+  "pid": Any<Number>,
+}
 `;
 
 exports[`uses \`root\` logger if context is not specified. 1`] = `
@@ -63,32 +77,31 @@ Array [
 `;
 
 exports[`uses default memory buffer logger until config is provided 1`] = `
-Array [
-  Array [
-    Object {
-      "context": "test.context",
-      "level": LogLevel {
-        "id": "trace",
-        "value": 7,
-      },
-      "message": "trace message",
-      "meta": undefined,
-      "timestamp": 2012-02-01T00:00:00.000Z,
-    },
-  ],
-  Array [
-    Object {
-      "context": "test.context2",
-      "level": LogLevel {
-        "id": "fatal",
-        "value": 2,
-      },
-      "message": "fatal message",
-      "meta": Object {
-        "some": "value",
-      },
-      "timestamp": 2012-02-01T00:00:00.000Z,
-    },
-  ],
-]
+Object {
+  "context": "test.context",
+  "level": LogLevel {
+    "id": "trace",
+    "value": 7,
+  },
+  "message": "trace message",
+  "meta": undefined,
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T00:00:00.000Z,
+}
+`;
+
+exports[`uses default memory buffer logger until config is provided 2`] = `
+Object {
+  "context": "test.context2",
+  "level": LogLevel {
+    "id": "fatal",
+    "value": 2,
+  },
+  "message": "fatal message",
+  "meta": Object {
+    "some": "value",
+  },
+  "pid": Any<Number>,
+  "timestamp": 2012-02-01T00:00:00.000Z,
+}
 `;
diff --git a/src/core/server/logging/appenders/buffer/buffer_appender.test.ts b/src/core/server/logging/appenders/buffer/buffer_appender.test.ts
index 453a29271c582..49d70db8d5d43 100644
--- a/src/core/server/logging/appenders/buffer/buffer_appender.test.ts
+++ b/src/core/server/logging/appenders/buffer/buffer_appender.test.ts
@@ -34,12 +34,14 @@ test('`flush()` returns all appended records and cleans internal buffer.', () =>
       level: LogLevel.All,
       message: 'message-1',
       timestamp: new Date(),
+      pid: 5355,
     },
     {
       context: 'context-2',
       level: LogLevel.Trace,
       message: 'message-2',
       timestamp: new Date(),
+      pid: 5355,
     },
   ];
 
@@ -64,6 +66,7 @@ test('`dispose()` flushes internal buffer.', async () => {
     level: LogLevel.All,
     message: 'message-1',
     timestamp: new Date(),
+    pid: 5355,
   });
 
   await appender.dispose();
diff --git a/src/core/server/logging/appenders/console/console_appender.test.ts b/src/core/server/logging/appenders/console/console_appender.test.ts
index 364f0be7fadc3..6e30df1cfb65c 100644
--- a/src/core/server/logging/appenders/console/console_appender.test.ts
+++ b/src/core/server/logging/appenders/console/console_appender.test.ts
@@ -59,12 +59,14 @@ test('`append()` correctly formats records and pushes them to console.', () => {
       level: LogLevel.All,
       message: 'message-1',
       timestamp: new Date(),
+      pid: 5355,
     },
     {
       context: 'context-2',
       level: LogLevel.Trace,
       message: 'message-2',
       timestamp: new Date(),
+      pid: 5355,
     },
     {
       context: 'context-3',
@@ -72,6 +74,7 @@ test('`append()` correctly formats records and pushes them to console.', () => {
       level: LogLevel.Fatal,
       message: 'message-3',
       timestamp: new Date(),
+      pid: 5355,
     },
   ];
 
diff --git a/src/core/server/logging/appenders/file/file_appender.test.ts b/src/core/server/logging/appenders/file/file_appender.test.ts
index fccca629f7d60..0483a06b199b6 100644
--- a/src/core/server/logging/appenders/file/file_appender.test.ts
+++ b/src/core/server/logging/appenders/file/file_appender.test.ts
@@ -70,6 +70,7 @@ test('file stream is created only once and only after first `append()` is called
     level: LogLevel.All,
     message: 'message-1',
     timestamp: new Date(),
+    pid: 5355,
   });
 
   expect(mockCreateWriteStream).toHaveBeenCalledTimes(1);
@@ -84,6 +85,7 @@ test('file stream is created only once and only after first `append()` is called
     level: LogLevel.All,
     message: 'message-2',
     timestamp: new Date(),
+    pid: 5355,
   });
 
   expect(mockCreateWriteStream).not.toHaveBeenCalled();
@@ -99,12 +101,14 @@ test('`append()` correctly formats records and pushes them to the file.', () =>
       level: LogLevel.All,
       message: 'message-1',
       timestamp: new Date(),
+      pid: 5355,
     },
     {
       context: 'context-2',
       level: LogLevel.Trace,
       message: 'message-2',
       timestamp: new Date(),
+      pid: 5355,
     },
     {
       context: 'context-3',
@@ -112,6 +116,7 @@ test('`append()` correctly formats records and pushes them to the file.', () =>
       level: LogLevel.Fatal,
       message: 'message-3',
       timestamp: new Date(),
+      pid: 5355,
     },
   ];
 
@@ -160,6 +165,7 @@ test('`dispose()` closes stream.', async () => {
     level: LogLevel.All,
     message: 'message-1',
     timestamp: new Date(),
+    pid: 5355,
   });
 
   await appender.dispose();
diff --git a/src/core/server/logging/layouts/__snapshots__/json_layout.test.ts.snap b/src/core/server/logging/layouts/__snapshots__/json_layout.test.ts.snap
index d95c3893aa3d8..21cf4302c49dc 100644
--- a/src/core/server/logging/layouts/__snapshots__/json_layout.test.ts.snap
+++ b/src/core/server/logging/layouts/__snapshots__/json_layout.test.ts.snap
@@ -1,13 +1,13 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`\`format()\` correctly formats record. 1`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-1\\",\\"error\\":{\\"message\\":\\"Some error message\\",\\"name\\":\\"Some error name\\",\\"stack\\":\\"Some error stack\\"},\\"level\\":\\"FATAL\\",\\"message\\":\\"message-1\\"}"`;
+exports[`\`format()\` correctly formats record. 1`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-1\\",\\"error\\":{\\"message\\":\\"Some error message\\",\\"name\\":\\"Some error name\\",\\"stack\\":\\"Some error stack\\"},\\"level\\":\\"FATAL\\",\\"message\\":\\"message-1\\",\\"pid\\":5355}"`;
 
-exports[`\`format()\` correctly formats record. 2`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-2\\",\\"level\\":\\"ERROR\\",\\"message\\":\\"message-2\\"}"`;
+exports[`\`format()\` correctly formats record. 2`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-2\\",\\"level\\":\\"ERROR\\",\\"message\\":\\"message-2\\",\\"pid\\":5355}"`;
 
-exports[`\`format()\` correctly formats record. 3`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-3\\",\\"level\\":\\"WARN\\",\\"message\\":\\"message-3\\"}"`;
+exports[`\`format()\` correctly formats record. 3`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-3\\",\\"level\\":\\"WARN\\",\\"message\\":\\"message-3\\",\\"pid\\":5355}"`;
 
-exports[`\`format()\` correctly formats record. 4`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-4\\",\\"level\\":\\"DEBUG\\",\\"message\\":\\"message-4\\"}"`;
+exports[`\`format()\` correctly formats record. 4`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-4\\",\\"level\\":\\"DEBUG\\",\\"message\\":\\"message-4\\",\\"pid\\":5355}"`;
 
-exports[`\`format()\` correctly formats record. 5`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-5\\",\\"level\\":\\"INFO\\",\\"message\\":\\"message-5\\"}"`;
+exports[`\`format()\` correctly formats record. 5`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-5\\",\\"level\\":\\"INFO\\",\\"message\\":\\"message-5\\",\\"pid\\":5355}"`;
 
-exports[`\`format()\` correctly formats record. 6`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-6\\",\\"level\\":\\"TRACE\\",\\"message\\":\\"message-6\\"}"`;
+exports[`\`format()\` correctly formats record. 6`] = `"{\\"@timestamp\\":\\"2012-02-01T00:00:00.000Z\\",\\"context\\":\\"context-6\\",\\"level\\":\\"TRACE\\",\\"message\\":\\"message-6\\",\\"pid\\":5355}"`;
diff --git a/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap b/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap
index b727fc3c478ff..9ff4f7445d043 100644
--- a/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap
+++ b/src/core/server/logging/layouts/__snapshots__/pattern_layout.test.ts.snap
@@ -35,3 +35,15 @@ exports[`\`format()\` correctly formats record with highlighting. 4`] = `"[2012-
 exports[`\`format()\` correctly formats record with highlighting. 5`] = `"[2012-02-01T00:00:00.000Z][INFO ][context-5] message-5"`;
 
 exports[`\`format()\` correctly formats record with highlighting. 6`] = `"[2012-02-01T00:00:00.000Z][TRACE][context-6] message-6"`;
+
+exports[`allows specifying the PID in custom pattern 1`] = `"5355-context-1-Some error stack"`;
+
+exports[`allows specifying the PID in custom pattern 2`] = `"5355-context-2-message-2"`;
+
+exports[`allows specifying the PID in custom pattern 3`] = `"5355-context-3-message-3"`;
+
+exports[`allows specifying the PID in custom pattern 4`] = `"5355-context-4-message-4"`;
+
+exports[`allows specifying the PID in custom pattern 5`] = `"5355-context-5-message-5"`;
+
+exports[`allows specifying the PID in custom pattern 6`] = `"5355-context-6-message-6"`;
diff --git a/src/core/server/logging/layouts/json_layout.test.ts b/src/core/server/logging/layouts/json_layout.test.ts
index 49b8ddef07a63..2e4c5af80dd2e 100644
--- a/src/core/server/logging/layouts/json_layout.test.ts
+++ b/src/core/server/logging/layouts/json_layout.test.ts
@@ -32,36 +32,42 @@ const records: LogRecord[] = [
     level: LogLevel.Fatal,
     message: 'message-1',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-2',
     level: LogLevel.Error,
     message: 'message-2',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-3',
     level: LogLevel.Warn,
     message: 'message-3',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-4',
     level: LogLevel.Debug,
     message: 'message-4',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-5',
     level: LogLevel.Info,
     message: 'message-5',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-6',
     level: LogLevel.Trace,
     message: 'message-6',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
 ];
 
diff --git a/src/core/server/logging/layouts/json_layout.ts b/src/core/server/logging/layouts/json_layout.ts
index 1dcc3fc3ebcf6..8e90b2f7eb782 100644
--- a/src/core/server/logging/layouts/json_layout.ts
+++ b/src/core/server/logging/layouts/json_layout.ts
@@ -58,6 +58,7 @@ export class JsonLayout implements Layout {
       level: record.level.id.toUpperCase(),
       message: record.message,
       meta: record.meta,
+      pid: record.pid,
     });
   }
 }
diff --git a/src/core/server/logging/layouts/pattern_layout.test.ts b/src/core/server/logging/layouts/pattern_layout.test.ts
index ae8b39b9cc99a..23656c5d20510 100644
--- a/src/core/server/logging/layouts/pattern_layout.test.ts
+++ b/src/core/server/logging/layouts/pattern_layout.test.ts
@@ -33,36 +33,42 @@ const records: LogRecord[] = [
     level: LogLevel.Fatal,
     message: 'message-1',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-2',
     level: LogLevel.Error,
     message: 'message-2',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-3',
     level: LogLevel.Warn,
     message: 'message-3',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-4',
     level: LogLevel.Debug,
     message: 'message-4',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-5',
     level: LogLevel.Info,
     message: 'message-5',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
   {
     context: 'context-6',
     level: LogLevel.Trace,
     message: 'message-6',
     timestamp: new Date(Date.UTC(2012, 1, 1)),
+    pid: 5355,
   },
 ];
 
@@ -119,3 +125,11 @@ test('`format()` correctly formats record with highlighting.', () => {
     expect(layout.format(record)).toMatchSnapshot();
   }
 });
+
+test('allows specifying the PID in custom pattern', () => {
+  const layout = new PatternLayout('{pid}-{context}-{message}');
+
+  for (const record of records) {
+    expect(layout.format(record)).toMatchSnapshot();
+  }
+});
diff --git a/src/core/server/logging/layouts/pattern_layout.ts b/src/core/server/logging/layouts/pattern_layout.ts
index 8be47dbcdd095..64424c02268ff 100644
--- a/src/core/server/logging/layouts/pattern_layout.ts
+++ b/src/core/server/logging/layouts/pattern_layout.ts
@@ -32,6 +32,7 @@ const Parameters = Object.freeze({
   Level: '{level}',
   Message: '{message}',
   Timestamp: '{timestamp}',
+  Pid: '{pid}',
 });
 
 /**
@@ -39,7 +40,7 @@ const Parameters = Object.freeze({
  * with the actual data.
  */
 const PATTERN_REGEX = new RegExp(
-  `${Parameters.Timestamp}|${Parameters.Level}|${Parameters.Context}|${Parameters.Message}`,
+  `${Parameters.Timestamp}|${Parameters.Level}|${Parameters.Context}|${Parameters.Message}|${Parameters.Pid}`,
   'gi'
 );
 
@@ -103,6 +104,7 @@ export class PatternLayout implements Layout {
       [Parameters.Level, record.level.id.toUpperCase().padEnd(5)],
       [Parameters.Context, record.context],
       [Parameters.Message, message],
+      [Parameters.Pid, String(record.pid)],
     ]);
 
     if (this.highlight) {
diff --git a/src/core/server/logging/log_record.ts b/src/core/server/logging/log_record.ts
index e7f93f7fc3e14..6286d751bf41f 100644
--- a/src/core/server/logging/log_record.ts
+++ b/src/core/server/logging/log_record.ts
@@ -30,4 +30,5 @@ export interface LogRecord {
   message: string;
   error?: Error;
   meta?: { [name: string]: any };
+  pid: number;
 }
diff --git a/src/core/server/logging/logger.test.ts b/src/core/server/logging/logger.test.ts
index 026e24fc5df54..1cc00a254300b 100644
--- a/src/core/server/logging/logger.test.ts
+++ b/src/core/server/logging/logger.test.ts
@@ -53,6 +53,7 @@ test('`trace()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -66,6 +67,7 @@ test('`trace()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: { trace: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -81,6 +83,7 @@ test('`debug()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -94,6 +97,7 @@ test('`debug()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: { debug: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -109,6 +113,7 @@ test('`info()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -122,6 +127,7 @@ test('`info()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: { info: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -137,6 +143,7 @@ test('`warn()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -151,6 +158,7 @@ test('`warn()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -164,6 +172,7 @@ test('`warn()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-3',
       meta: { warn: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -179,6 +188,7 @@ test('`error()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -193,6 +203,7 @@ test('`error()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -206,6 +217,7 @@ test('`error()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-3',
       meta: { error: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -221,6 +233,7 @@ test('`fatal()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-1',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -235,6 +248,7 @@ test('`fatal()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-2',
       meta: undefined,
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -248,6 +262,7 @@ test('`fatal()` correctly forms `LogRecord` and passes it to all appenders.', ()
       message: 'message-3',
       meta: { fatal: true },
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -258,6 +273,7 @@ test('`log()` just passes the record to all appenders.', () => {
     level: LogLevel.Info,
     message: 'message-1',
     timestamp,
+    pid: 5355,
   };
 
   logger.log(record);
@@ -307,6 +323,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Trace,
       message: 'trace-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -318,6 +335,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Debug,
       message: 'debug-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -329,6 +347,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Info,
       message: 'info-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -340,6 +359,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Warn,
       message: 'warn-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -351,6 +371,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Error,
       message: 'error-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -362,6 +383,7 @@ test('logger with `All` level passes all records to appenders.', () => {
       level: LogLevel.Fatal,
       message: 'fatal-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
@@ -385,6 +407,7 @@ test('passes log record to appenders only if log level is supported.', () => {
       level: LogLevel.Warn,
       message: 'warn-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -396,6 +419,7 @@ test('passes log record to appenders only if log level is supported.', () => {
       level: LogLevel.Error,
       message: 'error-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 
@@ -407,6 +431,7 @@ test('passes log record to appenders only if log level is supported.', () => {
       level: LogLevel.Fatal,
       message: 'fatal-message',
       timestamp,
+      pid: expect.any(Number),
     });
   }
 });
diff --git a/src/core/server/logging/logger.ts b/src/core/server/logging/logger.ts
index ac79c1916c07b..285998c23832c 100644
--- a/src/core/server/logging/logger.ts
+++ b/src/core/server/logging/logger.ts
@@ -162,6 +162,7 @@ export class BaseLogger implements Logger {
         message: errorOrMessage.message,
         meta,
         timestamp: new Date(),
+        pid: process.pid,
       };
     }
 
@@ -171,6 +172,7 @@ export class BaseLogger implements Logger {
       message: errorOrMessage,
       meta,
       timestamp: new Date(),
+      pid: process.pid,
     };
   }
 }
diff --git a/src/core/server/logging/logging_service.test.ts b/src/core/server/logging/logging_service.test.ts
index c58103cca5f8d..51697fd15bebe 100644
--- a/src/core/server/logging/logging_service.test.ts
+++ b/src/core/server/logging/logging_service.test.ts
@@ -23,6 +23,8 @@ jest.mock('fs', () => ({
   createWriteStream: jest.fn(() => ({ write: mockStreamWrite })),
 }));
 
+const dynamicProps = { pid: expect.any(Number) };
+
 jest.mock('../../../legacy/server/logging/rotate', () => ({
   setupLoggingRotate: jest.fn().mockImplementation(() => Promise.resolve({})),
 }));
@@ -58,7 +60,9 @@ test('uses default memory buffer logger until config is provided', () => {
   const anotherLogger = service.get('test', 'context2');
   anotherLogger.fatal('fatal message', { some: 'value' });
 
-  expect(bufferAppendSpy.mock.calls).toMatchSnapshot();
+  expect(bufferAppendSpy).toHaveBeenCalledTimes(2);
+  expect(bufferAppendSpy.mock.calls[0][0]).toMatchSnapshot(dynamicProps);
+  expect(bufferAppendSpy.mock.calls[1][0]).toMatchSnapshot(dynamicProps);
 });
 
 test('flushes memory buffer logger and switches to real logger once config is provided', () => {
@@ -78,12 +82,15 @@ test('flushes memory buffer logger and switches to real logger once config is pr
     })
   );
 
-  expect(mockConsoleLog.mock.calls).toMatchSnapshot('buffered messages');
+  expect(JSON.parse(mockConsoleLog.mock.calls[0][0])).toMatchSnapshot(
+    dynamicProps,
+    'buffered messages'
+  );
   mockConsoleLog.mockClear();
 
   // Now message should go straight to thew newly configured appender, not buffered one.
   logger.info('some new info message');
-  expect(mockConsoleLog.mock.calls).toMatchSnapshot('new messages');
+  expect(JSON.parse(mockConsoleLog.mock.calls[0][0])).toMatchSnapshot(dynamicProps, 'new messages');
   expect(bufferAppendSpy).not.toHaveBeenCalled();
 });
 
@@ -114,8 +121,12 @@ test('appends records via multiple appenders.', () => {
   );
 
   // Now all logs should added to configured appenders.
-  expect(mockConsoleLog.mock.calls).toMatchSnapshot('console logs');
-  expect(mockStreamWrite.mock.calls).toMatchSnapshot('file logs');
+  expect(mockConsoleLog).toHaveBeenCalledTimes(1);
+  expect(mockConsoleLog.mock.calls[0][0]).toMatchSnapshot('console logs');
+
+  expect(mockStreamWrite).toHaveBeenCalledTimes(2);
+  expect(mockStreamWrite.mock.calls[0][0]).toMatchSnapshot('file logs');
+  expect(mockStreamWrite.mock.calls[1][0]).toMatchSnapshot('file logs');
 });
 
 test('uses `root` logger if context is not specified.', () => {
@@ -163,5 +174,9 @@ test('asLoggerFactory() only allows to create new loggers.', () => {
   logger.fatal('buffered fatal message');
 
   expect(Object.keys(service.asLoggerFactory())).toEqual(['get']);
-  expect(mockConsoleLog.mock.calls).toMatchSnapshot();
+
+  expect(mockConsoleLog).toHaveBeenCalledTimes(3);
+  expect(JSON.parse(mockConsoleLog.mock.calls[0][0])).toMatchSnapshot(dynamicProps);
+  expect(JSON.parse(mockConsoleLog.mock.calls[1][0])).toMatchSnapshot(dynamicProps);
+  expect(JSON.parse(mockConsoleLog.mock.calls[2][0])).toMatchSnapshot(dynamicProps);
 });
diff --git a/src/core/server/mocks.ts b/src/core/server/mocks.ts
index 97f836f8ef37d..9a7868d568ea0 100644
--- a/src/core/server/mocks.ts
+++ b/src/core/server/mocks.ts
@@ -38,6 +38,7 @@ export { httpServiceMock } from './http/http_service.mock';
 export { loggingServiceMock } from './logging/logging_service.mock';
 export { savedObjectsClientMock } from './saved_objects/service/saved_objects_client.mock';
 export { savedObjectsRepositoryMock } from './saved_objects/service/lib/repository.mock';
+export { typeRegistryMock as savedObjectsTypeRegistryMock } from './saved_objects/saved_objects_type_registry.mock';
 export { uiSettingsServiceMock } from './ui_settings/ui_settings_service.mock';
 import { uuidServiceMock } from './uuid/uuid_service.mock';
 
@@ -112,12 +113,19 @@ function createCoreSetupMock() {
   const uiSettingsMock = {
     register: uiSettingsServiceMock.createSetupContract().register,
   };
+
+  const savedObjectsService = savedObjectsServiceMock.createSetupContract();
+  const savedObjectMock: jest.Mocked<CoreSetup['savedObjects']> = {
+    addClientWrapper: savedObjectsService.addClientWrapper,
+    setClientFactoryProvider: savedObjectsService.setClientFactoryProvider,
+  };
+
   const mock: CoreSetupMockType = {
     capabilities: capabilitiesServiceMock.createSetupContract(),
     context: contextServiceMock.createSetupContract(),
     elasticsearch: elasticsearchServiceMock.createSetup(),
     http: httpMock,
-    savedObjects: savedObjectsServiceMock.createSetupContract(),
+    savedObjects: savedObjectMock,
     uiSettings: uiSettingsMock,
     uuid: uuidServiceMock.createSetupContract(),
     getStartServices: jest
@@ -145,7 +153,7 @@ function createInternalCoreSetupMock() {
     elasticsearch: elasticsearchServiceMock.createInternalSetup(),
     http: httpServiceMock.createSetupContract(),
     uiSettings: uiSettingsServiceMock.createSetupContract(),
-    savedObjects: savedObjectsServiceMock.createSetupContract(),
+    savedObjects: savedObjectsServiceMock.createInternalSetupContract(),
     uuid: uuidServiceMock.createSetupContract(),
   };
   return setupDeps;
@@ -154,7 +162,7 @@ function createInternalCoreSetupMock() {
 function createInternalCoreStartMock() {
   const startDeps: InternalCoreStart = {
     capabilities: capabilitiesServiceMock.createStartContract(),
-    savedObjects: savedObjectsServiceMock.createStartContract(),
+    savedObjects: savedObjectsServiceMock.createInternalStartContract(),
     uiSettings: uiSettingsServiceMock.createStartContract(),
   };
   return startDeps;
diff --git a/src/core/server/plugins/plugin_context.ts b/src/core/server/plugins/plugin_context.ts
index 77300900e84f3..a7b555a9eba01 100644
--- a/src/core/server/plugins/plugin_context.ts
+++ b/src/core/server/plugins/plugin_context.ts
@@ -205,6 +205,7 @@ export function createPluginStartContext<TPlugin, TPluginDependencies>(
       getScopedClient: deps.savedObjects.getScopedClient,
       createInternalRepository: deps.savedObjects.createInternalRepository,
       createScopedRepository: deps.savedObjects.createScopedRepository,
+      createSerializer: deps.savedObjects.createSerializer,
     },
     uiSettings: {
       asScopedToClient: deps.uiSettings.asScopedToClient,
diff --git a/src/core/server/saved_objects/__snapshots__/utils.test.ts.snap b/src/core/server/saved_objects/__snapshots__/utils.test.ts.snap
new file mode 100644
index 0000000000000..7846e7f1a802a
--- /dev/null
+++ b/src/core/server/saved_objects/__snapshots__/utils.test.ts.snap
@@ -0,0 +1,144 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`convertLegacyTypes converts the legacy mappings using default values if no schemas are specified 1`] = `
+Array [
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "fieldA": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeA",
+    "namespaceAgnostic": false,
+  },
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "fieldB": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeB",
+    "namespaceAgnostic": false,
+  },
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "fieldC": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeC",
+    "namespaceAgnostic": false,
+  },
+]
+`;
+
+exports[`convertLegacyTypes merges everything when all are present 1`] = `
+Array [
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": true,
+    "indexPattern": "myIndex",
+    "mappings": Object {
+      "properties": Object {
+        "fieldA": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {
+      "1.0.0": [MockFunction],
+      "2.0.4": [MockFunction],
+    },
+    "name": "typeA",
+    "namespaceAgnostic": true,
+  },
+  Object {
+    "convertToAliasScript": "some alias script",
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "anotherFieldB": Object {
+          "type": "boolean",
+        },
+        "fieldB": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeB",
+    "namespaceAgnostic": false,
+  },
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "fieldC": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {
+      "1.5.3": [MockFunction],
+    },
+    "name": "typeC",
+    "namespaceAgnostic": false,
+  },
+]
+`;
+
+exports[`convertLegacyTypes merges the mappings and the schema to create the type when schema exists for the type 1`] = `
+Array [
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": true,
+    "indexPattern": "fooBar",
+    "mappings": Object {
+      "properties": Object {
+        "fieldA": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeA",
+    "namespaceAgnostic": true,
+  },
+  Object {
+    "convertToAliasScript": undefined,
+    "hidden": false,
+    "indexPattern": undefined,
+    "mappings": Object {
+      "properties": Object {
+        "fieldC": Object {
+          "type": "text",
+        },
+      },
+    },
+    "migrations": Object {},
+    "name": "typeC",
+    "namespaceAgnostic": false,
+  },
+]
+`;
diff --git a/src/core/server/saved_objects/index.ts b/src/core/server/saved_objects/index.ts
index 181025d73817d..529ee9599f178 100644
--- a/src/core/server/saved_objects/index.ts
+++ b/src/core/server/saved_objects/index.ts
@@ -31,7 +31,12 @@ export {
   SavedObjectsExportResultDetails,
 } from './export';
 
-export { SavedObjectsSerializer, RawDoc as SavedObjectsRawDoc } from './serialization';
+export {
+  SavedObjectsSerializer,
+  SavedObjectsRawDoc,
+  SavedObjectSanitizedDoc,
+  SavedObjectUnsanitizedDoc,
+} from './serialization';
 
 export { SavedObjectsMigrationLogger } from './migrations/core/migration_logger';
 
@@ -50,4 +55,18 @@ export {
   SavedObjectsDeleteByNamespaceOptions,
 } from './service/lib/repository';
 
+export {
+  SavedObjectsCoreFieldMapping,
+  SavedObjectsComplexFieldMapping,
+  SavedObjectsFieldMapping,
+  SavedObjectsMappingProperties,
+  SavedObjectsTypeMappingDefinition,
+  SavedObjectsTypeMappingDefinitions,
+} from './mappings';
+
+export { SavedObjectMigrationMap, SavedObjectMigrationFn } from './migrations';
+
+export { SavedObjectsType } from './types';
+
 export { config } from './saved_objects_config';
+export { SavedObjectTypeRegistry, ISavedObjectTypeRegistry } from './saved_objects_type_registry';
diff --git a/src/core/server/saved_objects/mappings/index.ts b/src/core/server/saved_objects/mappings/index.ts
index 15b0736ca5f1f..e1d718ee454ce 100644
--- a/src/core/server/saved_objects/mappings/index.ts
+++ b/src/core/server/saved_objects/mappings/index.ts
@@ -18,9 +18,12 @@
  */
 export { getTypes, getProperty, getRootProperties, getRootPropertiesObjects } from './lib';
 export {
-  FieldMapping,
-  MappingMeta,
-  MappingProperties,
+  SavedObjectsComplexFieldMapping,
+  SavedObjectsCoreFieldMapping,
+  SavedObjectsTypeMappingDefinition,
+  SavedObjectsTypeMappingDefinitions,
+  SavedObjectsMappingProperties,
+  SavedObjectsFieldMapping,
+  IndexMappingMeta,
   IndexMapping,
-  SavedObjectsMapping,
 } from './types';
diff --git a/src/core/server/saved_objects/mappings/lib/get_property.test.ts b/src/core/server/saved_objects/mappings/lib/get_property.test.ts
index a85697ddd08b8..a271cf3826e5d 100644
--- a/src/core/server/saved_objects/mappings/lib/get_property.test.ts
+++ b/src/core/server/saved_objects/mappings/lib/get_property.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { FieldMapping, IndexMapping } from '../types';
+import { SavedObjectsFieldMapping, IndexMapping } from '../types';
 import { getProperty } from './get_property';
 
 const MAPPINGS = {
@@ -47,7 +47,7 @@ const MAPPINGS = {
   },
 };
 
-function runTest(key: string | string[], mapping: IndexMapping | FieldMapping) {
+function runTest(key: string | string[], mapping: IndexMapping | SavedObjectsFieldMapping) {
   expect(typeof key === 'string' || Array.isArray(key)).toBeTruthy();
   expect(typeof mapping).toBe('object');
 
diff --git a/src/core/server/saved_objects/mappings/lib/get_property.ts b/src/core/server/saved_objects/mappings/lib/get_property.ts
index 4e9ff10fc5d47..a31c9fe0c3ba1 100644
--- a/src/core/server/saved_objects/mappings/lib/get_property.ts
+++ b/src/core/server/saved_objects/mappings/lib/get_property.ts
@@ -18,15 +18,15 @@
  */
 
 import toPath from 'lodash/internal/toPath';
-import { CoreFieldMapping, FieldMapping, IndexMapping } from '../types';
+import { SavedObjectsCoreFieldMapping, SavedObjectsFieldMapping, IndexMapping } from '../types';
 
 function getPropertyMappingFromObjectMapping(
-  mapping: IndexMapping | FieldMapping,
+  mapping: IndexMapping | SavedObjectsFieldMapping,
   path: string[]
-): FieldMapping | undefined {
+): SavedObjectsFieldMapping | undefined {
   const props =
     (mapping && (mapping as IndexMapping).properties) ||
-    (mapping && (mapping as CoreFieldMapping).fields);
+    (mapping && (mapping as SavedObjectsCoreFieldMapping).fields);
 
   if (!props) {
     return undefined;
@@ -39,6 +39,9 @@ function getPropertyMappingFromObjectMapping(
   }
 }
 
-export function getProperty(mappings: IndexMapping | FieldMapping, path: string | string[]) {
+export function getProperty(
+  mappings: IndexMapping | SavedObjectsFieldMapping,
+  path: string | string[]
+) {
   return getPropertyMappingFromObjectMapping(mappings, toPath(path));
 }
diff --git a/src/core/server/saved_objects/mappings/lib/get_root_properties_objects.ts b/src/core/server/saved_objects/mappings/lib/get_root_properties_objects.ts
index 61e4d752445c4..81ba1d8235561 100644
--- a/src/core/server/saved_objects/mappings/lib/get_root_properties_objects.ts
+++ b/src/core/server/saved_objects/mappings/lib/get_root_properties_objects.ts
@@ -17,7 +17,11 @@
  * under the License.
  */
 
-import { ComplexFieldMapping, IndexMapping, MappingProperties } from '../types';
+import {
+  SavedObjectsComplexFieldMapping,
+  IndexMapping,
+  SavedObjectsMappingProperties,
+} from '../types';
 import { getRootProperties } from './get_root_properties';
 
 /**
@@ -43,10 +47,10 @@ export function getRootPropertiesObjects(mappings: IndexMapping) {
     // we consider the existence of the properties or type of object to designate that this is an object datatype
     if (
       !blacklist.includes(key) &&
-      ((value as ComplexFieldMapping).properties || value.type === 'object')
+      ((value as SavedObjectsComplexFieldMapping).properties || value.type === 'object')
     ) {
       acc[key] = value;
     }
     return acc;
-  }, {} as MappingProperties);
+  }, {} as SavedObjectsMappingProperties);
 }
diff --git a/src/core/server/saved_objects/mappings/types.ts b/src/core/server/saved_objects/mappings/types.ts
index 8bb1a69d2eb13..578fdcea3718e 100644
--- a/src/core/server/saved_objects/mappings/types.ts
+++ b/src/core/server/saved_objects/mappings/types.ts
@@ -17,47 +17,133 @@
  * under the License.
  */
 
-// FieldMapping isn't 1:1 with the options available,
-// modify as needed.
-export interface CoreFieldMapping {
-  type: string;
-  fields?: {
-    [subfield: string]: {
-      type: string;
-    };
-  };
+/**
+ * Describe a saved object type mapping.
+ *
+ * @example
+ * ```ts
+ * const typeDefinition: SavedObjectsTypeMappingDefinition = {
+ *   properties: {
+ *     enabled: {
+ *       type: "boolean"
+ *     },
+ *     sendUsageFrom: {
+ *       ignore_above: 256,
+ *       type: "keyword"
+ *     },
+ *     lastReported: {
+ *       type: "date"
+ *     },
+ *     lastVersionChecked: {
+ *       ignore_above: 256,
+ *       type: "keyword"
+ *     },
+ *   }
+ * }
+ * ```
+ *
+ * @public
+ */
+export interface SavedObjectsTypeMappingDefinition {
+  properties: SavedObjectsMappingProperties;
 }
 
-// FieldMapping isn't 1:1 with the options available,
-// modify as needed.
-export interface ComplexFieldMapping {
-  dynamic?: string;
-  type?: string;
-  properties: MappingProperties;
-}
+/**
+ * A map of {@link SavedObjectsTypeMappingDefinition | saved object type mappings}
+ *
+ * @example
+ * ```ts
+ * const mappings: SavedObjectsTypeMappingDefinitions = {
+ *   someType: {
+ *     properties: {
+ *       enabled: {
+ *         type: "boolean"
+ *       },
+ *       field: {
+ *         type: "keyword"
+ *       },
+ *     },
+ *   },
+ *   anotherType: {
+ *     properties: {
+ *       enabled: {
+ *         type: "boolean"
+ *       },
+ *       lastReported: {
+ *         type: "date"
+ *       },
+ *     },
+ *   },
 
-export type FieldMapping = CoreFieldMapping | ComplexFieldMapping;
+ * }
+ * ```
+ * @remark This is the format for the legacy `mappings.json` savedObject mapping file.
+ *
+ * @internal
+ */
+export interface SavedObjectsTypeMappingDefinitions {
+  [type: string]: SavedObjectsTypeMappingDefinition;
+}
 
-export interface MappingProperties {
-  [field: string]: FieldMapping;
+/**
+ * Describe the fields of a {@link SavedObjectsTypeMappingDefinition | saved object type}.
+ *
+ * @public
+ */
+export interface SavedObjectsMappingProperties {
+  [field: string]: SavedObjectsFieldMapping;
 }
 
-export interface SavedObjectsMapping {
-  pluginId: string;
-  properties: MappingProperties;
+/**
+ * Describe a {@link SavedObjectsTypeMappingDefinition | saved object type mapping} field.
+ *
+ * Please refer to {@link https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html | elasticsearch documentation}
+ * For the mapping documentation
+ *
+ * @public
+ */
+export type SavedObjectsFieldMapping =
+  | SavedObjectsCoreFieldMapping
+  | SavedObjectsComplexFieldMapping;
+
+/** @internal */
+export interface IndexMapping {
+  dynamic?: string;
+  properties: SavedObjectsMappingProperties;
+  _meta?: IndexMappingMeta;
 }
 
-export interface MappingMeta {
+/** @internal */
+export interface IndexMappingMeta {
   // A dictionary of key -> md5 hash (e.g. 'dashboard': '24234qdfa3aefa3wa')
   // with each key being a root-level mapping property, and each value being
   // the md5 hash of that mapping's value when the index was created.
   migrationMappingPropertyHashes?: { [k: string]: string };
 }
 
-// IndexMapping isn't 1:1 with the options available,
-// modify as needed.
-export interface IndexMapping {
+/**
+ * See {@link SavedObjectsFieldMapping} for documentation.
+ *
+ * @public
+ */
+export interface SavedObjectsCoreFieldMapping {
+  type: string;
+  index?: boolean;
+  enabled?: boolean;
+  fields?: {
+    [subfield: string]: {
+      type: string;
+    };
+  };
+}
+
+/**
+ * See {@link SavedObjectsFieldMapping} for documentation.
+ *
+ * @public
+ */
+export interface SavedObjectsComplexFieldMapping {
   dynamic?: string;
-  properties: MappingProperties;
-  _meta?: MappingMeta;
+  type?: string;
+  properties: SavedObjectsMappingProperties;
 }
diff --git a/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts b/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts
index 71f589f24369a..821a10353f8ec 100644
--- a/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts
+++ b/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts
@@ -27,21 +27,19 @@ describe('buildActiveMappings', () => {
       bbb: { type: 'long' },
     };
 
-    expect(buildActiveMappings({ properties })).toMatchSnapshot();
+    expect(buildActiveMappings(properties)).toMatchSnapshot();
   });
 
   test('disallows duplicate mappings', () => {
     const properties = { type: { type: 'long' } };
 
-    expect(() => buildActiveMappings({ properties })).toThrow(
-      /Cannot redefine core mapping \"type\"/
-    );
+    expect(() => buildActiveMappings(properties)).toThrow(/Cannot redefine core mapping \"type\"/);
   });
 
   test('disallows mappings with leading underscore', () => {
     const properties = { _hm: { type: 'keyword' } };
 
-    expect(() => buildActiveMappings({ properties })).toThrow(
+    expect(() => buildActiveMappings(properties)).toThrow(
       /Invalid mapping \"_hm\"\. Mappings cannot start with _/
     );
   });
@@ -53,7 +51,7 @@ describe('buildActiveMappings', () => {
       ccc: { fields: { b: { type: 'text' }, a: { type: 'text' } }, type: 'keyword' },
     };
 
-    const mappings = buildActiveMappings({ properties });
+    const mappings = buildActiveMappings(properties);
     const hashes = mappings._meta!.migrationMappingPropertyHashes!;
 
     expect(hashes.aaa).toBeDefined();
diff --git a/src/core/server/saved_objects/migrations/core/build_active_mappings.ts b/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
index 2cf640cceea83..3afe8aae119d9 100644
--- a/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
+++ b/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
@@ -22,31 +22,31 @@
  */
 
 import crypto from 'crypto';
-import _ from 'lodash';
-import { IndexMapping, MappingProperties } from './../../mappings';
+import { cloneDeep, mapValues } from 'lodash';
+import {
+  IndexMapping,
+  SavedObjectsMappingProperties,
+  SavedObjectsTypeMappingDefinitions,
+} from './../../mappings';
 
 /**
  * Creates an index mapping with the core properties required by saved object
  * indices, as well as the specified additional properties.
  *
- * @param {Opts} opts
- * @prop {MappingDefinition} properties - The mapping's properties
- * @returns {IndexMapping}
+ * @param typeDefinitions - the type definitions to build mapping from.
  */
-export function buildActiveMappings({
-  properties,
-}: {
-  properties: MappingProperties;
-}): IndexMapping {
+export function buildActiveMappings(
+  typeDefinitions: SavedObjectsTypeMappingDefinitions | SavedObjectsMappingProperties
+): IndexMapping {
   const mapping = defaultMapping();
 
-  properties = validateAndMerge(mapping.properties, properties);
+  const mergedProperties = validateAndMerge(mapping.properties, typeDefinitions);
 
-  return _.cloneDeep({
+  return cloneDeep({
     ...mapping,
-    properties,
+    properties: mergedProperties,
     _meta: {
-      migrationMappingPropertyHashes: md5Values(properties),
+      migrationMappingPropertyHashes: md5Values(mergedProperties),
     },
   });
 }
@@ -113,7 +113,7 @@ function canonicalStringify(obj: any): string {
 
 // Convert an object's values to md5 hash strings
 function md5Values(obj: any) {
-  return _.mapValues(obj, md5Object);
+  return mapValues(obj, md5Object);
 }
 
 // If something exists in actual, but is missing in expected, we don't
@@ -171,12 +171,14 @@ function defaultMapping(): IndexMapping {
   };
 }
 
-function validateAndMerge(dest: MappingProperties, source: MappingProperties) {
+function validateAndMerge(
+  dest: SavedObjectsMappingProperties,
+  source: SavedObjectsTypeMappingDefinitions | SavedObjectsMappingProperties
+) {
   Object.keys(source).forEach(k => {
     if (k.startsWith('_')) {
       throw new Error(`Invalid mapping "${k}". Mappings cannot start with _.`);
     }
-
     if (dest.hasOwnProperty(k)) {
       throw new Error(`Cannot redefine core mapping "${k}".`);
     }
diff --git a/src/core/server/saved_objects/migrations/core/build_index_map.test.ts b/src/core/server/saved_objects/migrations/core/build_index_map.test.ts
index bdc96323238c0..44add4e977006 100644
--- a/src/core/server/saved_objects/migrations/core/build_index_map.test.ts
+++ b/src/core/server/saved_objects/migrations/core/build_index_map.test.ts
@@ -18,20 +18,30 @@
  */
 
 import { createIndexMap } from './build_index_map';
-import { ObjectToConfigAdapter } from '../../../config';
-import { SavedObjectsSchema } from '../../schema';
-import { LegacyConfig } from '../../../legacy';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
+import { SavedObjectsType } from '../../types';
 
-const config = (new ObjectToConfigAdapter({}) as unknown) as LegacyConfig;
+const createRegistry = (...types: Array<Partial<SavedObjectsType>>) => {
+  const registry = new SavedObjectTypeRegistry();
+  types.forEach(type =>
+    registry.registerType({
+      name: 'unknown',
+      namespaceAgnostic: false,
+      hidden: false,
+      mappings: { properties: {} },
+      migrations: {},
+      ...type,
+    })
+  );
+  return registry;
+};
 
 test('mappings without index pattern goes to default index', () => {
   const result = createIndexMap({
-    config,
     kibanaIndexName: '.kibana',
-    schema: new SavedObjectsSchema({
-      type1: {
-        isNamespaceAgnostic: false,
-      },
+    registry: createRegistry({
+      name: 'type1',
+      namespaceAgnostic: false,
     }),
     indexMap: {
       type1: {
@@ -60,13 +70,11 @@ test('mappings without index pattern goes to default index', () => {
 
 test(`mappings with custom index pattern doesn't go to default index`, () => {
   const result = createIndexMap({
-    config,
     kibanaIndexName: '.kibana',
-    schema: new SavedObjectsSchema({
-      type1: {
-        isNamespaceAgnostic: false,
-        indexPattern: '.other_kibana',
-      },
+    registry: createRegistry({
+      name: 'type1',
+      namespaceAgnostic: false,
+      indexPattern: '.other_kibana',
     }),
     indexMap: {
       type1: {
@@ -95,14 +103,12 @@ test(`mappings with custom index pattern doesn't go to default index`, () => {
 
 test('creating a script gets added to the index pattern', () => {
   const result = createIndexMap({
-    config,
     kibanaIndexName: '.kibana',
-    schema: new SavedObjectsSchema({
-      type1: {
-        isNamespaceAgnostic: false,
-        indexPattern: '.other_kibana',
-        convertToAliasScript: `ctx._id = ctx._source.type + ':' + ctx._id`,
-      },
+    registry: createRegistry({
+      name: 'type1',
+      namespaceAgnostic: false,
+      indexPattern: '.other_kibana',
+      convertToAliasScript: `ctx._id = ctx._source.type + ':' + ctx._id`,
     }),
     indexMap: {
       type1: {
@@ -132,16 +138,19 @@ test('creating a script gets added to the index pattern', () => {
 
 test('throws when two scripts are defined for an index pattern', () => {
   const defaultIndex = '.kibana';
-  const schema = new SavedObjectsSchema({
-    type1: {
-      isNamespaceAgnostic: false,
+  const registry = createRegistry(
+    {
+      name: 'type1',
+      namespaceAgnostic: false,
       convertToAliasScript: `ctx._id = ctx._source.type + ':' + ctx._id`,
     },
-    type2: {
-      isNamespaceAgnostic: false,
+    {
+      name: 'type2',
+      namespaceAgnostic: false,
       convertToAliasScript: `ctx._id = ctx._source.type + ':' + ctx._id`,
-    },
-  });
+    }
+  );
+
   const indexMap = {
     type1: {
       properties: {
@@ -160,9 +169,8 @@ test('throws when two scripts are defined for an index pattern', () => {
   };
   expect(() =>
     createIndexMap({
-      config,
       kibanaIndexName: defaultIndex,
-      schema,
+      registry,
       indexMap,
     })
   ).toThrowErrorMatchingInlineSnapshot(
diff --git a/src/core/server/saved_objects/migrations/core/build_index_map.ts b/src/core/server/saved_objects/migrations/core/build_index_map.ts
index 914447563cc77..8f7fe2f8eac5b 100644
--- a/src/core/server/saved_objects/migrations/core/build_index_map.ts
+++ b/src/core/server/saved_objects/migrations/core/build_index_map.ts
@@ -17,39 +17,32 @@
  * under the License.
  */
 
-import { MappingProperties } from '../../mappings';
-import { SavedObjectsSchema } from '../../schema';
-import { LegacyConfig } from '../../../legacy';
+import { SavedObjectsTypeMappingDefinitions } from '../../mappings';
+import { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 
 export interface CreateIndexMapOptions {
-  config: LegacyConfig;
   kibanaIndexName: string;
-  schema: SavedObjectsSchema;
-  indexMap: MappingProperties;
+  registry: ISavedObjectTypeRegistry;
+  indexMap: SavedObjectsTypeMappingDefinitions;
 }
 
 export interface IndexMap {
   [index: string]: {
-    typeMappings: MappingProperties;
+    typeMappings: SavedObjectsTypeMappingDefinitions;
     script?: string;
   };
 }
 
 /*
- * This file contains logic to convert savedObjectSchemas into a dictonary of indexes and documents
+ * This file contains logic to convert savedObjectSchemas into a dictionary of indexes and documents
  */
-export function createIndexMap({
-  /** @deprecated Remove once savedObjectsSchemas are exposed from Core */
-  config,
-  kibanaIndexName,
-  schema,
-  indexMap,
-}: CreateIndexMapOptions) {
+export function createIndexMap({ kibanaIndexName, registry, indexMap }: CreateIndexMapOptions) {
   const map: IndexMap = {};
   Object.keys(indexMap).forEach(type => {
-    const script = schema.getConvertToAliasScript(type);
+    const typeDef = registry.getType(type);
+    const script = typeDef?.convertToAliasScript;
     // Defaults to kibanaIndexName if indexPattern isn't defined
-    const indexPattern = schema.getIndexForType(config, type) || kibanaIndexName;
+    const indexPattern = typeDef?.indexPattern || kibanaIndexName;
     if (!map.hasOwnProperty(indexPattern as string)) {
       map[indexPattern] = { typeMappings: {} };
     }
diff --git a/src/core/server/saved_objects/migrations/core/document_migrator.test.ts b/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
index 38496a3503833..0e3a4780e12b6 100644
--- a/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
+++ b/src/core/server/saved_objects/migrations/core/document_migrator.test.ts
@@ -18,41 +18,49 @@
  */
 
 import _ from 'lodash';
-import { RawSavedObjectDoc } from '../../serialization';
+import { SavedObjectUnsanitizedDoc } from '../../serialization';
 import { DocumentMigrator } from './document_migrator';
 import { loggingServiceMock } from '../../../logging/logging_service.mock';
+import { SavedObjectsType } from '../../types';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 
 const mockLoggerFactory = loggingServiceMock.create();
 const mockLogger = mockLoggerFactory.get('mock logger');
 
+const createRegistry = (...types: Array<Partial<SavedObjectsType>>) => {
+  const registry = new SavedObjectTypeRegistry();
+  types.forEach(type =>
+    registry.registerType({
+      name: 'unknown',
+      namespaceAgnostic: false,
+      hidden: false,
+      mappings: { properties: {} },
+      migrations: {},
+      ...type,
+    })
+  );
+  return registry;
+};
+
 describe('DocumentMigrator', () => {
   function testOpts() {
     return {
       kibanaVersion: '25.2.3',
-      migrations: {},
+      typeRegistry: createRegistry(),
       validateDoc: _.noop,
       log: mockLogger,
     };
   }
 
-  it('validates the migration definition', () => {
-    const invalidDefinition: any = {
-      kibanaVersion: '3.2.3',
-      migrations: 'hello',
-      validateDoc: _.noop,
-    };
-    expect(() => new DocumentMigrator(invalidDefinition)).toThrow(
-      /Migration definition should be an object/i
-    );
-  });
-
   it('validates individual migration definitions', () => {
-    const invalidDefinition: any = {
+    const invalidDefinition = {
       kibanaVersion: '3.2.3',
-      migrations: {
-        foo: _.noop,
-      },
+      typeRegistry: createRegistry({
+        name: 'foo',
+        migrations: _.noop as any,
+      }),
       validateDoc: _.noop,
+      log: mockLogger,
     };
     expect(() => new DocumentMigrator(invalidDefinition)).toThrow(
       /Migration for type foo should be an object/i
@@ -60,14 +68,16 @@ describe('DocumentMigrator', () => {
   });
 
   it('validates individual migration semvers', () => {
-    const invalidDefinition: any = {
+    const invalidDefinition = {
       kibanaVersion: '3.2.3',
-      migrations: {
-        foo: {
-          bar: _.noop,
+      typeRegistry: createRegistry({
+        name: 'foo',
+        migrations: {
+          bar: doc => doc,
         },
-      },
+      }),
       validateDoc: _.noop,
+      log: mockLogger,
     };
     expect(() => new DocumentMigrator(invalidDefinition)).toThrow(
       /Expected all properties to be semvers/i
@@ -75,14 +85,16 @@ describe('DocumentMigrator', () => {
   });
 
   it('validates the migration function', () => {
-    const invalidDefinition: any = {
+    const invalidDefinition = {
       kibanaVersion: '3.2.3',
-      migrations: {
-        foo: {
-          '1.2.3': 23,
+      typeRegistry: createRegistry({
+        name: 'foo',
+        migrations: {
+          '1.2.3': 23 as any,
         },
-      },
+      }),
       validateDoc: _.noop,
+      log: mockLogger,
     };
     expect(() => new DocumentMigrator(invalidDefinition)).toThrow(
       /expected a function, but got 23/i
@@ -92,11 +104,12 @@ describe('DocumentMigrator', () => {
   it('migrates type and attributes', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        user: {
+      typeRegistry: createRegistry({
+        name: 'user',
+        migrations: {
           '1.2.3': setAttr('attributes.name', 'Chris'),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'me',
@@ -115,14 +128,15 @@ describe('DocumentMigrator', () => {
   it(`doesn't mutate the original document`, () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        user: {
-          '1.2.3': (doc: RawSavedObjectDoc) => {
+      typeRegistry: createRegistry({
+        name: 'user',
+        migrations: {
+          '1.2.3': doc => {
             _.set(doc, 'attributes.name', 'Mike');
             return doc;
           },
         },
-      },
+      }),
     });
     const originalDoc = {
       id: 'me',
@@ -138,11 +152,12 @@ describe('DocumentMigrator', () => {
   it('migrates meta properties', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        acl: {
+      typeRegistry: createRegistry({
+        name: 'acl',
+        migrations: {
           '2.3.5': setAttr('acl', 'admins-only,sucka!'),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'me',
@@ -163,11 +178,26 @@ describe('DocumentMigrator', () => {
   it('does not apply migrations to unrelated docs', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        aaa: { '1.0.0': setAttr('aaa', 'A') },
-        bbb: { '1.0.0': setAttr('bbb', 'B') },
-        ccc: { '1.0.0': setAttr('ccc', 'C') },
-      },
+      typeRegistry: createRegistry(
+        {
+          name: 'aaa',
+          migrations: {
+            '1.0.0': setAttr('aaa', 'A'),
+          },
+        },
+        {
+          name: 'bbb',
+          migrations: {
+            '1.0.0': setAttr('bbb', 'B'),
+          },
+        },
+        {
+          name: 'ccc',
+          migrations: {
+            '1.0.0': setAttr('ccc', 'C'),
+          },
+        }
+      ),
     });
     const actual = migrator.migrate({
       id: 'me',
@@ -185,11 +215,26 @@ describe('DocumentMigrator', () => {
   it('assumes documents w/ undefined migrationVersion are up to date', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        user: { '1.0.0': setAttr('aaa', 'A') },
-        bbb: { '2.3.4': setAttr('bbb', 'B') },
-        ccc: { '1.0.0': setAttr('ccc', 'C') },
-      },
+      typeRegistry: createRegistry(
+        {
+          name: 'user',
+          migrations: {
+            '1.0.0': setAttr('aaa', 'A'),
+          },
+        },
+        {
+          name: 'bbb',
+          migrations: {
+            '2.3.4': setAttr('bbb', 'B'),
+          },
+        },
+        {
+          name: 'ccc',
+          migrations: {
+            '1.0.0': setAttr('ccc', 'C'),
+          },
+        }
+      ),
     });
     const actual = migrator.migrate({
       id: 'me',
@@ -212,13 +257,14 @@ describe('DocumentMigrator', () => {
   it('only applies migrations that are more recent than the doc', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        dog: {
+      typeRegistry: createRegistry({
+        name: 'dog',
+        migrations: {
           '1.2.3': setAttr('attributes.a', 'A'),
           '1.2.4': setAttr('attributes.b', 'B'),
           '2.0.1': setAttr('attributes.c', 'C'),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -254,11 +300,12 @@ describe('DocumentMigrator', () => {
   it('rejects docs that belong to a newer plugin', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        dawg: {
+      typeRegistry: createRegistry({
+        name: 'dawg',
+        migrations: {
           '1.2.3': setAttr('attributes.a', 'A'),
         },
-      },
+      }),
     });
     expect(() =>
       migrator.migrate({
@@ -276,13 +323,14 @@ describe('DocumentMigrator', () => {
     let count = 0;
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        dog: {
+      typeRegistry: createRegistry({
+        name: 'dog',
+        migrations: {
           '2.2.4': setAttr('attributes.b', () => ++count),
           '10.0.1': setAttr('attributes.c', () => ++count),
           '1.2.3': setAttr('attributes.a', () => ++count),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -301,14 +349,20 @@ describe('DocumentMigrator', () => {
   it('allows props to be added', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        animal: {
-          '1.0.0': setAttr('animal', (name: string) => `Animal: ${name}`),
-        },
-        dog: {
-          '2.2.4': setAttr('animal', 'Doggie'),
+      typeRegistry: createRegistry(
+        {
+          name: 'animal',
+          migrations: {
+            '1.0.0': setAttr('animal', (name: string) => `Animal: ${name}`),
+          },
         },
-      },
+        {
+          name: 'dog',
+          migrations: {
+            '2.2.4': setAttr('animal', 'Doggie'),
+          },
+        }
+      ),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -328,16 +382,22 @@ describe('DocumentMigrator', () => {
   it('allows props to be renamed', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        animal: {
-          '1.0.0': setAttr('animal', (name: string) => `Animal: ${name}`),
-          '3.2.1': renameAttr('animal', 'dawg'),
-        },
-        dawg: {
-          '2.2.4': renameAttr('dawg', 'animal'),
-          '3.2.0': setAttr('dawg', (name: string) => `Dawg3.x: ${name}`),
+      typeRegistry: createRegistry(
+        {
+          name: 'animal',
+          migrations: {
+            '1.0.0': setAttr('animal', (name: string) => `Animal: ${name}`),
+            '3.2.1': renameAttr('animal', 'dawg'),
+          },
         },
-      },
+        {
+          name: 'dawg',
+          migrations: {
+            '2.2.4': renameAttr('dawg', 'animal'),
+            '3.2.0': setAttr('dawg', (name: string) => `Dawg3.x: ${name}`),
+          },
+        }
+      ),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -358,14 +418,20 @@ describe('DocumentMigrator', () => {
   it('allows changing type', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        cat: {
-          '1.0.0': setAttr('attributes.name', (name: string) => `Kitty ${name}`),
-        },
-        dog: {
-          '2.2.4': setAttr('type', 'cat'),
+      typeRegistry: createRegistry(
+        {
+          name: 'cat',
+          migrations: {
+            '1.0.0': setAttr('attributes.name', (name: string) => `Kitty ${name}`),
+          },
         },
-      },
+        {
+          name: 'dog',
+          migrations: {
+            '2.2.4': setAttr('type', 'cat'),
+          },
+        }
+      ),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -384,11 +450,12 @@ describe('DocumentMigrator', () => {
   it('disallows updating a migrationVersion prop to a lower version', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        cat: {
+      typeRegistry: createRegistry({
+        name: 'cat',
+        migrations: {
           '1.0.0': setAttr('migrationVersion.foo', '3.2.1'),
         },
-      },
+      }),
     });
 
     expect(() =>
@@ -406,11 +473,12 @@ describe('DocumentMigrator', () => {
   it('disallows removing a migrationVersion prop', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        cat: {
+      typeRegistry: createRegistry({
+        name: 'cat',
+        migrations: {
           '1.0.0': setAttr('migrationVersion', {}),
         },
-      },
+      }),
     });
     expect(() =>
       migrator.migrate({
@@ -427,8 +495,9 @@ describe('DocumentMigrator', () => {
   it('allows updating a migrationVersion prop to a later version', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        cat: {
+      typeRegistry: createRegistry({
+        name: 'cat',
+        migrations: {
           '1.0.0': setAttr('migrationVersion.cat', '2.9.1'),
           '2.0.0': () => {
             throw new Error('POW!');
@@ -438,7 +507,7 @@ describe('DocumentMigrator', () => {
           },
           '3.0.0': setAttr('attributes.name', 'Shiny'),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -457,11 +526,12 @@ describe('DocumentMigrator', () => {
   it('allows adding props to migrationVersion', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        cat: {
+      typeRegistry: createRegistry({
+        name: 'cat',
+        migrations: {
           '1.0.0': setAttr('migrationVersion.foo', '5.6.7'),
         },
-      },
+      }),
     });
     const actual = migrator.migrate({
       id: 'smelly',
@@ -481,13 +551,14 @@ describe('DocumentMigrator', () => {
     const log = mockLogger;
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        dog: {
+      typeRegistry: createRegistry({
+        name: 'dog',
+        migrations: {
           '1.2.3': () => {
             throw new Error('Dang diggity!');
           },
         },
-      },
+      }),
       log,
     });
     const failedDoc = {
@@ -511,15 +582,16 @@ describe('DocumentMigrator', () => {
     const logTestMsg = '...said the joker to the thief';
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        dog: {
+      typeRegistry: createRegistry({
+        name: 'dog',
+        migrations: {
           '1.2.3': (doc, log) => {
             log.info(logTestMsg);
             log.warning(logTestMsg);
             return doc;
           },
         },
-      },
+      }),
       log: mockLogger,
     });
     const doc = {
@@ -536,17 +608,23 @@ describe('DocumentMigrator', () => {
   test('extracts the latest migration version info', () => {
     const { migrationVersion } = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        aaa: {
-          '1.2.3': (doc: RawSavedObjectDoc) => doc,
-          '10.4.0': (doc: RawSavedObjectDoc) => doc,
-          '2.2.1': (doc: RawSavedObjectDoc) => doc,
-        },
-        bbb: {
-          '3.2.3': (doc: RawSavedObjectDoc) => doc,
-          '2.0.0': (doc: RawSavedObjectDoc) => doc,
+      typeRegistry: createRegistry(
+        {
+          name: 'aaa',
+          migrations: {
+            '1.2.3': (doc: SavedObjectUnsanitizedDoc) => doc,
+            '10.4.0': (doc: SavedObjectUnsanitizedDoc) => doc,
+            '2.2.1': (doc: SavedObjectUnsanitizedDoc) => doc,
+          },
         },
-      },
+        {
+          name: 'bbb',
+          migrations: {
+            '3.2.3': (doc: SavedObjectUnsanitizedDoc) => doc,
+            '2.0.0': (doc: SavedObjectUnsanitizedDoc) => doc,
+          },
+        }
+      ),
     });
 
     expect(migrationVersion).toEqual({
@@ -558,11 +636,12 @@ describe('DocumentMigrator', () => {
   test('fails if the validate doc throws', () => {
     const migrator = new DocumentMigrator({
       ...testOpts(),
-      migrations: {
-        aaa: {
+      typeRegistry: createRegistry({
+        name: 'aaa',
+        migrations: {
           '2.3.4': d => _.set(d, 'attributes.counter', 42),
         },
-      },
+      }),
       validateDoc: d => {
         if ((d.attributes as any).counter === 42) {
           throw new Error('Meaningful!');
@@ -577,11 +656,15 @@ describe('DocumentMigrator', () => {
 });
 
 function renameAttr(path: string, newPath: string) {
-  return (doc: RawSavedObjectDoc) =>
-    _.omit(_.set(doc, newPath, _.get(doc, path)) as {}, path) as RawSavedObjectDoc;
+  return (doc: SavedObjectUnsanitizedDoc) =>
+    _.omit(_.set(doc, newPath, _.get(doc, path)) as {}, path) as SavedObjectUnsanitizedDoc;
 }
 
 function setAttr(path: string, value: any) {
-  return (doc: RawSavedObjectDoc) =>
-    _.set(doc, path, _.isFunction(value) ? value(_.get(doc, path)) : value) as RawSavedObjectDoc;
+  return (doc: SavedObjectUnsanitizedDoc) =>
+    _.set(
+      doc,
+      path,
+      _.isFunction(value) ? value(_.get(doc, path)) : value
+    ) as SavedObjectUnsanitizedDoc;
 }
diff --git a/src/core/server/saved_objects/migrations/core/document_migrator.ts b/src/core/server/saved_objects/migrations/core/document_migrator.ts
index 563d978dcc1f1..b5019b2874bec 100644
--- a/src/core/server/saved_objects/migrations/core/document_migrator.ts
+++ b/src/core/server/saved_objects/migrations/core/document_migrator.ts
@@ -65,23 +65,19 @@ import _ from 'lodash';
 import cloneDeep from 'lodash.clonedeep';
 import Semver from 'semver';
 import { Logger } from '../../../logging';
-import { RawSavedObjectDoc } from '../../serialization';
+import { SavedObjectUnsanitizedDoc } from '../../serialization';
 import { SavedObjectsMigrationVersion } from '../../types';
-import { MigrationLogger, SavedObjectsMigrationLogger } from './migration_logger';
+import { MigrationLogger } from './migration_logger';
+import { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
+import { SavedObjectMigrationFn } from '../types';
 
-export type TransformFn = (doc: RawSavedObjectDoc) => RawSavedObjectDoc;
+export type TransformFn = (doc: SavedObjectUnsanitizedDoc) => SavedObjectUnsanitizedDoc;
 
-type MigrationFn = (doc: RawSavedObjectDoc, log: SavedObjectsMigrationLogger) => RawSavedObjectDoc;
+type ValidateDoc = (doc: SavedObjectUnsanitizedDoc) => void;
 
-type ValidateDoc = (doc: RawSavedObjectDoc) => void;
-
-export interface MigrationDefinition {
-  [type: string]: { [version: string]: MigrationFn };
-}
-
-interface Opts {
+interface DocumentMigratorOptions {
   kibanaVersion: string;
-  migrations: MigrationDefinition;
+  typeRegistry: ISavedObjectTypeRegistry;
   validateDoc: ValidateDoc;
   log: Logger;
 }
@@ -114,22 +110,22 @@ export class DocumentMigrator implements VersionedTransformer {
   /**
    * Creates an instance of DocumentMigrator.
    *
-   * @param {Opts} opts
+   * @param {DocumentMigratorOptions} opts
    * @prop {string} kibanaVersion - The current version of Kibana
-   * @prop {MigrationDefinition} migrations - The migrations that will be used to migrate documents
+   * @prop {SavedObjectTypeRegistry} typeRegistry - The type registry to get type migrations from
    * @prop {ValidateDoc} validateDoc - A function which, given a document throws an error if it is
    *   not up to date. This is used to ensure we don't let unmigrated documents slip through.
    * @prop {Logger} log - The migration logger
    * @memberof DocumentMigrator
    */
-  constructor(opts: Opts) {
-    validateMigrationDefinition(opts.migrations);
+  constructor({ typeRegistry, kibanaVersion, log, validateDoc }: DocumentMigratorOptions) {
+    validateMigrationDefinition(typeRegistry);
 
-    this.migrations = buildActiveMigrations(opts.migrations, opts.log);
+    this.migrations = buildActiveMigrations(typeRegistry, log);
     this.transformDoc = buildDocumentTransform({
-      kibanaVersion: opts.kibanaVersion,
+      kibanaVersion,
       migrations: this.migrations,
-      validateDoc: opts.validateDoc,
+      validateDoc,
     });
   }
 
@@ -147,11 +143,11 @@ export class DocumentMigrator implements VersionedTransformer {
   /**
    * Migrates a document to the latest version.
    *
-   * @param {RawSavedObjectDoc} doc
-   * @returns {RawSavedObjectDoc}
+   * @param {SavedObjectUnsanitizedDoc} doc
+   * @returns {SavedObjectUnsanitizedDoc}
    * @memberof DocumentMigrator
    */
-  public migrate = (doc: RawSavedObjectDoc): RawSavedObjectDoc => {
+  public migrate = (doc: SavedObjectUnsanitizedDoc): SavedObjectUnsanitizedDoc => {
     // Clone the document to prevent accidental mutations on the original data
     // Ex: Importing sample data that is cached at import level, migrations would
     // execute on mutated data the second time.
@@ -166,7 +162,7 @@ export class DocumentMigrator implements VersionedTransformer {
  * language. So, this is just to provide a little developer-friendly error messaging. Joi was
  * giving weird errors, so we're just doing manual validation.
  */
-function validateMigrationDefinition(migrations: MigrationDefinition) {
+function validateMigrationDefinition(registry: ISavedObjectTypeRegistry) {
   function assertObject(obj: any, prefix: string) {
     if (!obj || typeof obj !== 'object') {
       throw new Error(`${prefix} Got ${obj}.`);
@@ -187,17 +183,17 @@ function validateMigrationDefinition(migrations: MigrationDefinition) {
     }
   }
 
-  assertObject(migrations, 'Migration definition should be an object.');
-
-  Object.entries(migrations).forEach(([type, versions]: any) => {
-    assertObject(
-      versions,
-      `Migration for type ${type} should be an object like { '2.0.0': (doc) => doc }.`
-    );
-    Object.entries(versions).forEach(([version, fn]) => {
-      assertValidSemver(version, type);
-      assertValidTransform(fn, version, type);
-    });
+  registry.getAllTypes().forEach(type => {
+    if (type.migrations) {
+      assertObject(
+        type.migrations,
+        `Migration for type ${type.name} should be an object like { '2.0.0': (doc) => doc }.`
+      );
+      Object.entries(type.migrations).forEach(([version, fn]) => {
+        assertValidSemver(version, type.name);
+        assertValidTransform(fn, version, type.name);
+      });
+    }
   });
 }
 
@@ -207,19 +203,28 @@ function validateMigrationDefinition(migrations: MigrationDefinition) {
  * From: { type: { version: fn } }
  * To:   { type: { latestVersion: string, transforms: [{ version: string, transform: fn }] } }
  */
-function buildActiveMigrations(migrations: MigrationDefinition, log: Logger): ActiveMigrations {
-  return _.mapValues(migrations, (versions, prop) => {
-    const transforms = Object.entries(versions)
-      .map(([version, transform]) => ({
-        version,
-        transform: wrapWithTry(version, prop!, transform, log),
-      }))
-      .sort((a, b) => Semver.compare(a.version, b.version));
-    return {
-      latestVersion: _.last(transforms).version,
-      transforms,
-    };
-  });
+function buildActiveMigrations(
+  typeRegistry: ISavedObjectTypeRegistry,
+  log: Logger
+): ActiveMigrations {
+  return typeRegistry
+    .getAllTypes()
+    .filter(type => type.migrations && Object.keys(type.migrations).length > 0)
+    .reduce((migrations, type) => {
+      const transforms = Object.entries(type.migrations!)
+        .map(([version, transform]) => ({
+          version,
+          transform: wrapWithTry(version, type.name, transform, log),
+        }))
+        .sort((a, b) => Semver.compare(a.version, b.version));
+      return {
+        ...migrations,
+        [type.name]: {
+          latestVersion: _.last(transforms).version,
+          transforms,
+        },
+      };
+    }, {} as ActiveMigrations);
 }
 
 /**
@@ -234,7 +239,7 @@ function buildDocumentTransform({
   migrations: ActiveMigrations;
   validateDoc: ValidateDoc;
 }): TransformFn {
-  return function transformAndValidate(doc: RawSavedObjectDoc) {
+  return function transformAndValidate(doc: SavedObjectUnsanitizedDoc) {
     const result = doc.migrationVersion
       ? applyMigrations(doc, migrations)
       : markAsUpToDate(doc, migrations);
@@ -252,7 +257,7 @@ function buildDocumentTransform({
   };
 }
 
-function applyMigrations(doc: RawSavedObjectDoc, migrations: ActiveMigrations) {
+function applyMigrations(doc: SavedObjectUnsanitizedDoc, migrations: ActiveMigrations) {
   while (true) {
     const prop = nextUnmigratedProp(doc, migrations);
     if (!prop) {
@@ -265,14 +270,14 @@ function applyMigrations(doc: RawSavedObjectDoc, migrations: ActiveMigrations) {
 /**
  * Gets the doc's props, handling the special case of "type".
  */
-function props(doc: RawSavedObjectDoc) {
+function props(doc: SavedObjectUnsanitizedDoc) {
   return Object.keys(doc).concat(doc.type);
 }
 
 /**
  * Looks up the prop version in a saved object document or in our latest migrations.
  */
-function propVersion(doc: RawSavedObjectDoc | ActiveMigrations, prop: string) {
+function propVersion(doc: SavedObjectUnsanitizedDoc | ActiveMigrations, prop: string) {
   return (
     (doc[prop] && doc[prop].latestVersion) ||
     (doc.migrationVersion && (doc as any).migrationVersion[prop])
@@ -282,7 +287,7 @@ function propVersion(doc: RawSavedObjectDoc | ActiveMigrations, prop: string) {
 /**
  * Sets the doc's migrationVersion to be the most recent version
  */
-function markAsUpToDate(doc: RawSavedObjectDoc, migrations: ActiveMigrations) {
+function markAsUpToDate(doc: SavedObjectUnsanitizedDoc, migrations: ActiveMigrations) {
   return {
     ...doc,
     migrationVersion: props(doc).reduce((acc, prop) => {
@@ -296,20 +301,25 @@ function markAsUpToDate(doc: RawSavedObjectDoc, migrations: ActiveMigrations) {
  * If a specific transform function fails, this tacks on a bit of information
  * about the document and transform that caused the failure.
  */
-function wrapWithTry(version: string, prop: string, transform: MigrationFn, log: Logger) {
-  return function tryTransformDoc(doc: RawSavedObjectDoc) {
+function wrapWithTry(
+  version: string,
+  type: string,
+  migrationFn: SavedObjectMigrationFn,
+  log: Logger
+) {
+  return function tryTransformDoc(doc: SavedObjectUnsanitizedDoc) {
     try {
-      const result = transform(doc, new MigrationLogger(log));
+      const result = migrationFn(doc, new MigrationLogger(log));
 
       // A basic sanity check to help migration authors detect basic errors
       // (e.g. forgetting to return the transformed doc)
       if (!result || !result.type) {
-        throw new Error(`Invalid saved object returned from migration ${prop}:${version}.`);
+        throw new Error(`Invalid saved object returned from migration ${type}:${version}.`);
       }
 
       return result;
     } catch (error) {
-      const failedTransform = `${prop}:${version}`;
+      const failedTransform = `${type}:${version}`;
       const failedDoc = JSON.stringify(doc);
       log.warn(
         `Failed to transform document ${doc}. Transform: ${failedTransform}\nDoc: ${failedDoc}`
@@ -322,7 +332,7 @@ function wrapWithTry(version: string, prop: string, transform: MigrationFn, log:
 /**
  * Finds the first unmigrated property in the specified document.
  */
-function nextUnmigratedProp(doc: RawSavedObjectDoc, migrations: ActiveMigrations) {
+function nextUnmigratedProp(doc: SavedObjectUnsanitizedDoc, migrations: ActiveMigrations) {
   return props(doc).find(p => {
     const latestVersion = propVersion(migrations, p);
     const docVersion = propVersion(doc, p);
@@ -352,10 +362,10 @@ function nextUnmigratedProp(doc: RawSavedObjectDoc, migrations: ActiveMigrations
  * Applies any relevent migrations to the document for the specified property.
  */
 function migrateProp(
-  doc: RawSavedObjectDoc,
+  doc: SavedObjectUnsanitizedDoc,
   prop: string,
   migrations: ActiveMigrations
-): RawSavedObjectDoc {
+): SavedObjectUnsanitizedDoc {
   const originalType = doc.type;
   let migrationVersion = _.clone(doc.migrationVersion) || {};
   const typeChanged = () => !doc.hasOwnProperty(prop) || doc.type !== originalType;
@@ -376,7 +386,11 @@ function migrateProp(
 /**
  * Retrieves any prop transforms that have not been applied to doc.
  */
-function applicableTransforms(migrations: ActiveMigrations, doc: RawSavedObjectDoc, prop: string) {
+function applicableTransforms(
+  migrations: ActiveMigrations,
+  doc: SavedObjectUnsanitizedDoc,
+  prop: string
+) {
   const minVersion = propVersion(doc, prop);
   const { transforms } = migrations[prop];
   return minVersion
@@ -389,7 +403,7 @@ function applicableTransforms(migrations: ActiveMigrations, doc: RawSavedObjectD
  * has not mutated migrationVersion in an unsupported way.
  */
 function updateMigrationVersion(
-  doc: RawSavedObjectDoc,
+  doc: SavedObjectUnsanitizedDoc,
   migrationVersion: SavedObjectsMigrationVersion,
   prop: string,
   version: string
@@ -405,7 +419,7 @@ function updateMigrationVersion(
  * as this could get us into an infinite loop. So, we explicitly check for that here.
  */
 function assertNoDowngrades(
-  doc: RawSavedObjectDoc,
+  doc: SavedObjectUnsanitizedDoc,
   migrationVersion: SavedObjectsMigrationVersion,
   prop: string,
   version: string
diff --git a/src/core/server/saved_objects/migrations/core/index_migrator.test.ts b/src/core/server/saved_objects/migrations/core/index_migrator.test.ts
index 2fc65f6e475d8..a9d0a339c229f 100644
--- a/src/core/server/saved_objects/migrations/core/index_migrator.test.ts
+++ b/src/core/server/saved_objects/migrations/core/index_migrator.test.ts
@@ -18,8 +18,8 @@
  */
 
 import _ from 'lodash';
-import { SavedObjectsSchema } from '../../schema';
-import { RawSavedObjectDoc, SavedObjectsSerializer } from '../../serialization';
+import { SavedObjectUnsanitizedDoc, SavedObjectsSerializer } from '../../serialization';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { IndexMigrator } from './index_migrator';
 import { loggingServiceMock } from '../../../logging/logging_service.mock';
 
@@ -39,7 +39,7 @@ describe('IndexMigrator', () => {
         migrationVersion: {},
         migrate: _.identity,
       },
-      serializer: new SavedObjectsSerializer(new SavedObjectsSchema()),
+      serializer: new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
     };
   });
 
@@ -254,7 +254,7 @@ describe('IndexMigrator', () => {
   test('transforms all docs from the original index', async () => {
     let count = 0;
     const { callCluster } = testOpts;
-    const migrateDoc = jest.fn((doc: RawSavedObjectDoc) => {
+    const migrateDoc = jest.fn((doc: SavedObjectUnsanitizedDoc) => {
       return {
         ...doc,
         attributes: { name: ++count },
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
index aa208a23954f0..89f3fde384848 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.test.ts
@@ -18,17 +18,21 @@
  */
 
 import _ from 'lodash';
-import { SavedObjectsSchema } from '../../schema';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { SavedObjectsSerializer } from '../../serialization';
 import { migrateRawDocs } from './migrate_raw_docs';
 
 describe('migrateRawDocs', () => {
   test('converts raw docs to saved objects', async () => {
     const transform = jest.fn<any, any>((doc: any) => _.set(doc, 'attributes.name', 'HOI!'));
-    const result = migrateRawDocs(new SavedObjectsSerializer(new SavedObjectsSchema()), transform, [
-      { _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } },
-      { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
-    ]);
+    const result = migrateRawDocs(
+      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      transform,
+      [
+        { _id: 'a:b', _source: { type: 'a', a: { name: 'AAA' } } },
+        { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
+      ]
+    );
 
     expect(result).toEqual([
       {
@@ -48,10 +52,14 @@ describe('migrateRawDocs', () => {
     const transform = jest.fn<any, any>((doc: any) =>
       _.set(_.cloneDeep(doc), 'attributes.name', 'TADA')
     );
-    const result = migrateRawDocs(new SavedObjectsSerializer(new SavedObjectsSchema()), transform, [
-      { _id: 'foo:b', _source: { type: 'a', a: { name: 'AAA' } } },
-      { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
-    ]);
+    const result = migrateRawDocs(
+      new SavedObjectsSerializer(new SavedObjectTypeRegistry()),
+      transform,
+      [
+        { _id: 'foo:b', _source: { type: 'a', a: { name: 'AAA' } } },
+        { _id: 'c:d', _source: { type: 'c', c: { name: 'DDD' } } },
+      ]
+    );
 
     expect(result).toEqual([
       { _id: 'foo:b', _source: { type: 'a', a: { name: 'AAA' } } },
diff --git a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
index c008b18619629..5fe15f40db8ec 100644
--- a/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
+++ b/src/core/server/saved_objects/migrations/core/migrate_raw_docs.ts
@@ -21,7 +21,7 @@
  * This file provides logic for migrating raw documents.
  */
 
-import { RawDoc, SavedObjectsSerializer } from '../../serialization';
+import { SavedObjectsRawDoc, SavedObjectsSerializer } from '../../serialization';
 import { TransformFn } from './document_migrator';
 
 /**
@@ -29,14 +29,14 @@ import { TransformFn } from './document_migrator';
  * of raw docs. Any raw docs that are not valid saved objects will simply be passed through.
  *
  * @param {TransformFn} migrateDoc
- * @param {RawDoc[]} rawDocs
- * @returns {RawDoc[]}
+ * @param {SavedObjectsRawDoc[]} rawDocs
+ * @returns {SavedObjectsRawDoc[]}
  */
 export function migrateRawDocs(
   serializer: SavedObjectsSerializer,
   migrateDoc: TransformFn,
-  rawDocs: RawDoc[]
-): RawDoc[] {
+  rawDocs: SavedObjectsRawDoc[]
+): SavedObjectsRawDoc[] {
   return rawDocs.map(raw => {
     if (serializer.isRawSavedObject(raw)) {
       const savedObject = serializer.rawToSavedObject(raw);
diff --git a/src/core/server/saved_objects/migrations/core/migration_context.ts b/src/core/server/saved_objects/migrations/core/migration_context.ts
index d4e97ee6c5747..3a6145f5d9623 100644
--- a/src/core/server/saved_objects/migrations/core/migration_context.ts
+++ b/src/core/server/saved_objects/migrations/core/migration_context.ts
@@ -26,7 +26,7 @@
 
 import { Logger } from 'src/core/server/logging';
 import { SavedObjectsSerializer } from '../../serialization';
-import { MappingProperties } from '../../mappings';
+import { SavedObjectsTypeMappingDefinitions } from '../../mappings';
 import { buildActiveMappings } from './build_active_mappings';
 import { CallCluster } from './call_cluster';
 import { VersionedTransformer } from './document_migrator';
@@ -40,7 +40,7 @@ export interface MigrationOpts {
   callCluster: CallCluster;
   index: string;
   log: Logger;
-  mappingProperties: MappingProperties;
+  mappingProperties: SavedObjectsTypeMappingDefinitions;
   documentMigrator: VersionedTransformer;
   serializer: SavedObjectsSerializer;
   convertToAliasScript?: string;
@@ -107,9 +107,9 @@ function createSourceContext(source: FullIndexInfo, alias: string) {
 function createDestContext(
   source: FullIndexInfo,
   alias: string,
-  mappingProperties: MappingProperties
+  mappingProperties: SavedObjectsTypeMappingDefinitions
 ): FullIndexInfo {
-  const activeMappings = buildActiveMappings({ properties: mappingProperties });
+  const activeMappings = buildActiveMappings(mappingProperties);
 
   return {
     aliases: {},
@@ -133,6 +133,5 @@ function createDestContext(
 function nextIndexName(indexName: string, alias: string) {
   const indexSuffix = (indexName.match(/[\d]+$/) || [])[0];
   const indexNum = parseInt(indexSuffix, 10) || 0;
-
   return `${alias}_${indexNum + 1}`;
 }
diff --git a/src/core/server/saved_objects/migrations/core/migration_coordinator.test.ts b/src/core/server/saved_objects/migrations/core/migration_coordinator.test.ts
index 818ca73b37189..800edaeaa5885 100644
--- a/src/core/server/saved_objects/migrations/core/migration_coordinator.test.ts
+++ b/src/core/server/saved_objects/migrations/core/migration_coordinator.test.ts
@@ -24,6 +24,7 @@ describe('coordinateMigration', () => {
   const log = {
     debug: jest.fn(),
     warning: jest.fn(),
+    warn: jest.fn(),
     info: jest.fn(),
   };
 
diff --git a/src/core/server/saved_objects/migrations/core/migration_logger.ts b/src/core/server/saved_objects/migrations/core/migration_logger.ts
index 7c61d0c48d9bd..9dfb3abc8e72d 100644
--- a/src/core/server/saved_objects/migrations/core/migration_logger.ts
+++ b/src/core/server/saved_objects/migrations/core/migration_logger.ts
@@ -30,7 +30,11 @@ export type LogFn = (path: string[], message: string) => void;
 export interface SavedObjectsMigrationLogger {
   debug: (msg: string) => void;
   info: (msg: string) => void;
+  /**
+   * @deprecated Use `warn` instead.
+   */
   warning: (msg: string) => void;
+  warn: (msg: string) => void;
 }
 
 export class MigrationLogger implements SavedObjectsMigrationLogger {
@@ -43,4 +47,5 @@ export class MigrationLogger implements SavedObjectsMigrationLogger {
   public info = (msg: string) => this.logger.info(msg);
   public debug = (msg: string) => this.logger.debug(msg);
   public warning = (msg: string) => this.logger.warn(msg);
+  public warn = (msg: string) => this.logger.warn(msg);
 }
diff --git a/src/core/server/saved_objects/migrations/index.ts b/src/core/server/saved_objects/migrations/index.ts
index 6cb7ecac92ab9..e96986bd702e6 100644
--- a/src/core/server/saved_objects/migrations/index.ts
+++ b/src/core/server/saved_objects/migrations/index.ts
@@ -18,3 +18,4 @@
  */
 
 export { KibanaMigrator, IKibanaMigrator } from './kibana';
+export { SavedObjectMigrationFn, SavedObjectMigrationMap } from './types';
diff --git a/src/core/server/saved_objects/migrations/kibana/__snapshots__/kibana_migrator.test.ts.snap b/src/core/server/saved_objects/migrations/kibana/__snapshots__/kibana_migrator.test.ts.snap
index 792b2063fc86d..37a73b11bbc48 100644
--- a/src/core/server/saved_objects/migrations/kibana/__snapshots__/kibana_migrator.test.ts.snap
+++ b/src/core/server/saved_objects/migrations/kibana/__snapshots__/kibana_migrator.test.ts.snap
@@ -4,8 +4,8 @@ exports[`KibanaMigrator getActiveMappings returns full index mappings w/ core pr
 Object {
   "_meta": Object {
     "migrationMappingPropertyHashes": Object {
-      "amap": "625b32086eb1d1203564cf85062dd22e",
-      "bmap": "625b32086eb1d1203564cf85062dd22e",
+      "amap": "510f1f0adb69830cf8a1c5ce2923ed82",
+      "bmap": "510f1f0adb69830cf8a1c5ce2923ed82",
       "config": "87aca8fdb053154f11383fce3dbf3edf",
       "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
       "namespace": "2f4316de49999235636386fe51dc06c1",
@@ -17,10 +17,18 @@ Object {
   "dynamic": "strict",
   "properties": Object {
     "amap": Object {
-      "type": "text",
+      "properties": Object {
+        "field": Object {
+          "type": "text",
+        },
+      },
     },
     "bmap": Object {
-      "type": "text",
+      "properties": Object {
+        "field": Object {
+          "type": "text",
+        },
+      },
     },
     "config": Object {
       "dynamic": "true",
diff --git a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.mock.ts b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.mock.ts
index c1021018538d5..2ee656721abd0 100644
--- a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.mock.ts
+++ b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.mock.ts
@@ -19,28 +19,29 @@
 
 import { KibanaMigrator } from './kibana_migrator';
 import { buildActiveMappings } from '../core';
-import { SavedObjectsMapping } from '../../mappings';
-const { mergeProperties } = jest.requireActual('./kibana_migrator');
+const { mergeTypes } = jest.requireActual('./kibana_migrator');
+import { SavedObjectsType } from '../../types';
 
-const defaultSavedObjectMappings = [
+const defaultSavedObjectTypes: SavedObjectsType[] = [
   {
-    pluginId: 'testplugin',
-    properties: {
-      testtype: {
-        properties: {
-          name: { type: 'keyword' },
-        },
+    name: 'testtype',
+    hidden: false,
+    namespaceAgnostic: false,
+    mappings: {
+      properties: {
+        name: { type: 'keyword' },
       },
     },
+    migrations: {},
   },
 ];
 
 const createMigrator = (
   {
-    savedObjectMappings,
+    types,
   }: {
-    savedObjectMappings: SavedObjectsMapping[];
-  } = { savedObjectMappings: defaultSavedObjectMappings }
+    types: SavedObjectsType[];
+  } = { types: defaultSavedObjectTypes }
 ) => {
   const mockMigrator: jest.Mocked<PublicMethodsOf<KibanaMigrator>> = {
     runMigrations: jest.fn(),
@@ -48,9 +49,7 @@ const createMigrator = (
     migrateDocument: jest.fn(),
   };
 
-  mockMigrator.getActiveMappings.mockReturnValue(
-    buildActiveMappings({ properties: mergeProperties(savedObjectMappings) })
-  );
+  mockMigrator.getActiveMappings.mockReturnValue(buildActiveMappings(mergeTypes(types)));
   mockMigrator.migrateDocument.mockImplementation(doc => doc);
   return mockMigrator;
 };
diff --git a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.test.ts b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.test.ts
index c6a72eb53d6c4..fd82bf282266e 100644
--- a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.test.ts
+++ b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.test.ts
@@ -17,45 +17,49 @@
  * under the License.
  */
 
-import _ from 'lodash';
 import { KibanaMigratorOptions, KibanaMigrator } from './kibana_migrator';
 import { loggingServiceMock } from '../../../logging/logging_service.mock';
-import { SavedObjectsSchema } from '../../schema';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
+import { SavedObjectsType } from '../../types';
+
+const createRegistry = (types: Array<Partial<SavedObjectsType>>) => {
+  const registry = new SavedObjectTypeRegistry();
+  types.forEach(type =>
+    registry.registerType({
+      name: 'unknown',
+      namespaceAgnostic: false,
+      hidden: false,
+      mappings: { properties: {} },
+      migrations: {},
+      ...type,
+    })
+  );
+  return registry;
+};
 
 describe('KibanaMigrator', () => {
   describe('getActiveMappings', () => {
     it('returns full index mappings w/ core properties', () => {
       const options = mockOptions();
-      options.savedObjectMappings = [
+      options.typeRegistry = createRegistry([
         {
-          pluginId: 'aaa',
-          properties: { amap: { type: 'text' } },
+          name: 'amap',
+          mappings: {
+            properties: { field: { type: 'text' } },
+          },
         },
         {
-          pluginId: 'bbb',
-          properties: { bmap: { type: 'text' } },
+          name: 'bmap',
+          indexPattern: 'other-index',
+          mappings: {
+            properties: { field: { type: 'text' } },
+          },
         },
-      ];
+      ]);
+
       const mappings = new KibanaMigrator(options).getActiveMappings();
       expect(mappings).toMatchSnapshot();
     });
-
-    it('Fails if duplicate mappings are defined', () => {
-      const options = mockOptions();
-      options.savedObjectMappings = [
-        {
-          pluginId: 'aaa',
-          properties: { amap: { type: 'text' } },
-        },
-        {
-          pluginId: 'bbb',
-          properties: { amap: { type: 'long' } },
-        },
-      ];
-      expect(() => new KibanaMigrator(options).getActiveMappings()).toThrow(
-        /Plugin bbb is attempting to redefine mapping "amap"/
-      );
-    });
   });
 
   describe('runMigrations', () => {
@@ -78,41 +82,37 @@ describe('KibanaMigrator', () => {
   });
 });
 
-function mockOptions({ configValues }: { configValues?: any } = {}): KibanaMigratorOptions {
+function mockOptions(): KibanaMigratorOptions {
   const callCluster = jest.fn();
   return {
     logger: loggingServiceMock.create().get(),
     kibanaVersion: '8.2.3',
     savedObjectValidations: {},
-    savedObjectMigrations: {},
-    savedObjectMappings: [
+    typeRegistry: createRegistry([
       {
-        pluginId: 'testtype',
-        properties: {
-          testtype: {
-            properties: {
-              name: { type: 'keyword' },
-            },
+        name: 'testtype',
+        hidden: false,
+        namespaceAgnostic: false,
+        mappings: {
+          properties: {
+            name: { type: 'keyword' },
           },
         },
+        migrations: {},
       },
       {
-        pluginId: 'testtype2',
-        properties: {
-          testtype2: {
-            properties: {
-              name: { type: 'keyword' },
-            },
+        name: 'testtype2',
+        hidden: false,
+        namespaceAgnostic: false,
+        indexPattern: 'other-index',
+        mappings: {
+          properties: {
+            name: { type: 'keyword' },
           },
         },
+        migrations: {},
       },
-    ],
-    savedObjectSchemas: new SavedObjectsSchema({
-      testtype2: {
-        isNamespaceAgnostic: false,
-        indexPattern: 'other-index',
-      },
-    }),
+    ]),
     kibanaConfig: {
       enabled: true,
       index: '.my-index',
@@ -123,15 +123,6 @@ function mockOptions({ configValues }: { configValues?: any } = {}): KibanaMigra
       scrollDuration: '10m',
       skip: false,
     },
-    config: {
-      get: (name: string) => {
-        if (configValues && configValues[name]) {
-          return configValues[name];
-        } else {
-          throw new Error(`Unexpected config ${name}`);
-        }
-      },
-    } as KibanaMigratorOptions['config'],
     callCluster,
   };
 }
diff --git a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
index 747b48a540109..9b4fe10a35100 100644
--- a/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
+++ b/src/core/server/saved_objects/migrations/kibana/kibana_migrator.ts
@@ -24,30 +24,23 @@
 
 import { Logger } from 'src/core/server/logging';
 import { KibanaConfigType } from 'src/core/server/kibana_config';
-import { MappingProperties, SavedObjectsMapping, IndexMapping } from '../../mappings';
-import { SavedObjectsSchema } from '../../schema';
-import { RawSavedObjectDoc, SavedObjectsSerializer } from '../../serialization';
+import { IndexMapping, SavedObjectsTypeMappingDefinitions } from '../../mappings';
+import { SavedObjectUnsanitizedDoc, SavedObjectsSerializer } from '../../serialization';
 import { docValidator, PropertyValidators } from '../../validation';
 import { buildActiveMappings, CallCluster, IndexMigrator } from '../core';
-import {
-  DocumentMigrator,
-  VersionedTransformer,
-  MigrationDefinition,
-} from '../core/document_migrator';
+import { DocumentMigrator, VersionedTransformer } from '../core/document_migrator';
 import { createIndexMap } from '../core/build_index_map';
 import { SavedObjectsConfigType } from '../../saved_objects_config';
-import { LegacyConfig } from '../../../legacy';
+import { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
+import { SavedObjectsType } from '../../types';
 
 export interface KibanaMigratorOptions {
   callCluster: CallCluster;
-  config: LegacyConfig;
+  typeRegistry: ISavedObjectTypeRegistry;
   savedObjectsConfig: SavedObjectsConfigType;
   kibanaConfig: KibanaConfigType;
   kibanaVersion: string;
   logger: Logger;
-  savedObjectMappings: SavedObjectsMapping[];
-  savedObjectMigrations: MigrationDefinition;
-  savedObjectSchemas: SavedObjectsSchema;
   savedObjectValidations: PropertyValidators;
 }
 
@@ -58,13 +51,12 @@ export type IKibanaMigrator = Pick<KibanaMigrator, keyof KibanaMigrator>;
  */
 export class KibanaMigrator {
   private readonly callCluster: CallCluster;
-  private readonly config: LegacyConfig;
   private readonly savedObjectsConfig: SavedObjectsConfigType;
   private readonly documentMigrator: VersionedTransformer;
   private readonly kibanaConfig: KibanaConfigType;
   private readonly log: Logger;
-  private readonly mappingProperties: MappingProperties;
-  private readonly schema: SavedObjectsSchema;
+  private readonly mappingProperties: SavedObjectsTypeMappingDefinitions;
+  private readonly typeRegistry: ISavedObjectTypeRegistry;
   private readonly serializer: SavedObjectsSerializer;
   private migrationResult?: Promise<Array<{ status: string }>>;
 
@@ -73,27 +65,23 @@ export class KibanaMigrator {
    */
   constructor({
     callCluster,
-    config,
+    typeRegistry,
     kibanaConfig,
     savedObjectsConfig,
+    savedObjectValidations,
     kibanaVersion,
     logger,
-    savedObjectMappings,
-    savedObjectMigrations,
-    savedObjectSchemas,
-    savedObjectValidations,
   }: KibanaMigratorOptions) {
-    this.config = config;
     this.callCluster = callCluster;
     this.kibanaConfig = kibanaConfig;
     this.savedObjectsConfig = savedObjectsConfig;
-    this.schema = savedObjectSchemas;
-    this.serializer = new SavedObjectsSerializer(this.schema);
-    this.mappingProperties = mergeProperties(savedObjectMappings || []);
+    this.typeRegistry = typeRegistry;
+    this.serializer = new SavedObjectsSerializer(this.typeRegistry);
+    this.mappingProperties = mergeTypes(this.typeRegistry.getAllTypes());
     this.log = logger;
     this.documentMigrator = new DocumentMigrator({
       kibanaVersion,
-      migrations: savedObjectMigrations || {},
+      typeRegistry,
       validateDoc: docValidator(savedObjectValidations || {}),
       log: this.log,
     });
@@ -118,10 +106,9 @@ export class KibanaMigrator {
   private runMigrationsInternal() {
     const kibanaIndexName = this.kibanaConfig.index;
     const indexMap = createIndexMap({
-      config: this.config,
       kibanaIndexName,
       indexMap: this.mappingProperties,
-      schema: this.schema,
+      registry: this.typeRegistry,
     });
 
     const migrators = Object.keys(indexMap).map(index => {
@@ -150,7 +137,7 @@ export class KibanaMigrator {
    *
    */
   public getActiveMappings(): IndexMapping {
-    return buildActiveMappings({ properties: this.mappingProperties });
+    return buildActiveMappings(this.mappingProperties);
   }
 
   /**
@@ -159,7 +146,7 @@ export class KibanaMigrator {
    * @param doc - The saved object to migrate
    * @returns `doc` with all registered migrations applied.
    */
-  public migrateDocument(doc: RawSavedObjectDoc): RawSavedObjectDoc {
+  public migrateDocument(doc: SavedObjectUnsanitizedDoc): SavedObjectUnsanitizedDoc {
     return this.documentMigrator.migrate(doc);
   }
 }
@@ -168,12 +155,15 @@ export class KibanaMigrator {
  * Merges savedObjectMappings properties into a single object, verifying that
  * no mappings are redefined.
  */
-export function mergeProperties(mappings: SavedObjectsMapping[]): MappingProperties {
-  return mappings.reduce((acc, { pluginId, properties }) => {
-    const duplicate = Object.keys(properties).find(k => acc.hasOwnProperty(k));
+export function mergeTypes(types: SavedObjectsType[]): SavedObjectsTypeMappingDefinitions {
+  return types.reduce((acc, { name: type, mappings }) => {
+    const duplicate = acc.hasOwnProperty(type);
     if (duplicate) {
-      throw new Error(`Plugin ${pluginId} is attempting to redefine mapping "${duplicate}".`);
+      throw new Error(`Type ${type} is already defined.`);
     }
-    return Object.assign(acc, properties);
+    return {
+      ...acc,
+      [type]: mappings,
+    };
   }, {});
 }
diff --git a/src/core/server/saved_objects/migrations/types.ts b/src/core/server/saved_objects/migrations/types.ts
new file mode 100644
index 0000000000000..01741dd2ded1a
--- /dev/null
+++ b/src/core/server/saved_objects/migrations/types.ts
@@ -0,0 +1,51 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectUnsanitizedDoc } from '../serialization';
+import { SavedObjectsMigrationLogger } from './core/migration_logger';
+
+/**
+ * A migration function defined for a {@link SavedObjectsType | saved objects type}
+ * used to migrate it's {@link SavedObjectUnsanitizedDoc | documents}
+ */
+export type SavedObjectMigrationFn = (
+  doc: SavedObjectUnsanitizedDoc,
+  log: SavedObjectsMigrationLogger
+) => SavedObjectUnsanitizedDoc;
+
+/**
+ * A map of {@link SavedObjectMigrationFn | migration functions} to be used for a given type.
+ * The map's keys must be valid semver versions.
+ *
+ * For a given document, only migrations with a higher version number than that of the document will be applied.
+ * Migrations are executed in order, starting from the lowest version and ending with the highest one.
+ *
+ * @example
+ * ```typescript
+ * const migrations: SavedObjectMigrationMap = {
+ *   '1.0.0': migrateToV1,
+ *   '2.1.0': migrateToV21
+ * }
+ * ```
+ *
+ * @public
+ */
+export interface SavedObjectMigrationMap {
+  [version: string]: SavedObjectMigrationFn;
+}
diff --git a/src/core/server/saved_objects/saved_objects_service.mock.ts b/src/core/server/saved_objects/saved_objects_service.mock.ts
index a15d1f5b864b7..70f3d5a5b18e4 100644
--- a/src/core/server/saved_objects/saved_objects_service.mock.ts
+++ b/src/core/server/saved_objects/saved_objects_service.mock.ts
@@ -21,38 +21,60 @@ import {
   SavedObjectsService,
   InternalSavedObjectsServiceSetup,
   InternalSavedObjectsServiceStart,
+  SavedObjectsServiceSetup,
+  SavedObjectsServiceStart,
 } from './saved_objects_service';
 import { mockKibanaMigrator } from './migrations/kibana/kibana_migrator.mock';
 import { savedObjectsClientProviderMock } from './service/lib/scoped_client_provider.mock';
 import { savedObjectsRepositoryMock } from './service/lib/repository.mock';
 import { savedObjectsClientMock } from './service/saved_objects_client.mock';
+import { typeRegistryMock } from './saved_objects_type_registry.mock';
 
 type SavedObjectsServiceContract = PublicMethodsOf<SavedObjectsService>;
 
 const createStartContractMock = () => {
-  const startContract: jest.Mocked<InternalSavedObjectsServiceStart> = {
-    clientProvider: savedObjectsClientProviderMock.create(),
+  const startContrat: jest.Mocked<SavedObjectsServiceStart> = {
     getScopedClient: jest.fn(),
     createInternalRepository: jest.fn(),
     createScopedRepository: jest.fn(),
-    migrator: mockKibanaMigrator.create(),
+    createSerializer: jest.fn(),
   };
 
-  startContract.getScopedClient.mockReturnValue(savedObjectsClientMock.create());
-  startContract.createInternalRepository.mockReturnValue(savedObjectsRepositoryMock.create());
-  startContract.createScopedRepository.mockReturnValue(savedObjectsRepositoryMock.create());
+  startContrat.getScopedClient.mockReturnValue(savedObjectsClientMock.create());
+  startContrat.createInternalRepository.mockReturnValue(savedObjectsRepositoryMock.create());
+  startContrat.createScopedRepository.mockReturnValue(savedObjectsRepositoryMock.create());
+
+  return startContrat;
+};
+
+const createInternalStartContractMock = () => {
+  const internalStartContract: jest.Mocked<InternalSavedObjectsServiceStart> = {
+    ...createStartContractMock(),
+    clientProvider: savedObjectsClientProviderMock.create(),
+    migrator: mockKibanaMigrator.create(),
+    typeRegistry: typeRegistryMock.create(),
+  };
 
-  return startContract;
+  return internalStartContract;
 };
 
 const createSetupContractMock = () => {
-  const setupContract: jest.Mocked<InternalSavedObjectsServiceSetup> = {
+  const setupContract: jest.Mocked<SavedObjectsServiceSetup> = {
     setClientFactoryProvider: jest.fn(),
     addClientWrapper: jest.fn(),
   };
+
   return setupContract;
 };
 
+const createInternalSetupContractMock = () => {
+  const internalSetupContract: jest.Mocked<InternalSavedObjectsServiceSetup> = {
+    ...createSetupContractMock(),
+    registerType: jest.fn(),
+  };
+  return internalSetupContract;
+};
+
 const createSavedObjectsServiceMock = () => {
   const mocked: jest.Mocked<SavedObjectsServiceContract> = {
     setup: jest.fn(),
@@ -60,14 +82,16 @@ const createSavedObjectsServiceMock = () => {
     stop: jest.fn(),
   };
 
-  mocked.setup.mockResolvedValue(createSetupContractMock());
-  mocked.start.mockResolvedValue(createStartContractMock());
+  mocked.setup.mockResolvedValue(createInternalSetupContractMock());
+  mocked.start.mockResolvedValue(createInternalStartContractMock());
   mocked.stop.mockResolvedValue();
   return mocked;
 };
 
 export const savedObjectsServiceMock = {
   create: createSavedObjectsServiceMock,
+  createInternalSetupContract: createInternalSetupContractMock,
   createSetupContract: createSetupContractMock,
+  createInternalStartContract: createInternalStartContractMock,
   createStartContract: createStartContractMock,
 };
diff --git a/src/core/server/saved_objects/saved_objects_service.test.mocks.ts b/src/core/server/saved_objects/saved_objects_service.test.mocks.ts
index a9ad0778d4757..8c1cd3411203a 100644
--- a/src/core/server/saved_objects/saved_objects_service.test.mocks.ts
+++ b/src/core/server/saved_objects/saved_objects_service.test.mocks.ts
@@ -19,6 +19,7 @@
 
 import { mockKibanaMigrator } from './migrations/kibana/kibana_migrator.mock';
 import { savedObjectsClientProviderMock } from './service/lib/scoped_client_provider.mock';
+import { typeRegistryMock } from './saved_objects_type_registry.mock';
 
 export const migratorInstanceMock = mockKibanaMigrator.create();
 export const KibanaMigratorMock = jest.fn().mockImplementation(() => migratorInstanceMock);
@@ -30,3 +31,8 @@ export const clientProviderInstanceMock = savedObjectsClientProviderMock.create(
 jest.doMock('./service/lib/scoped_client_provider', () => ({
   SavedObjectsClientProvider: jest.fn().mockImplementation(() => clientProviderInstanceMock),
 }));
+
+export const typeRegistryInstanceMock = typeRegistryMock.create();
+jest.doMock('./saved_objects_type_registry', () => ({
+  SavedObjectTypeRegistry: jest.fn().mockImplementation(() => typeRegistryInstanceMock),
+}));
diff --git a/src/core/server/saved_objects/saved_objects_service.test.ts b/src/core/server/saved_objects/saved_objects_service.test.ts
index 19798aa68928d..07e7d8db8b25c 100644
--- a/src/core/server/saved_objects/saved_objects_service.test.ts
+++ b/src/core/server/saved_objects/saved_objects_service.test.ts
@@ -21,6 +21,7 @@ import {
   KibanaMigratorMock,
   migratorInstanceMock,
   clientProviderInstanceMock,
+  typeRegistryInstanceMock,
 } from './saved_objects_service.test.mocks';
 
 import { SavedObjectsService } from './saved_objects_service';
@@ -108,6 +109,25 @@ describe('SavedObjectsService', () => {
         );
       });
     });
+
+    describe('registerType', () => {
+      it('registers the type to the internal typeRegistry', async () => {
+        const coreContext = mockCoreContext.create();
+        const soService = new SavedObjectsService(coreContext);
+        const setup = await soService.setup(createSetupDeps());
+
+        const type = {
+          name: 'someType',
+          hidden: false,
+          namespaceAgnostic: false,
+          mappings: { properties: {} },
+        };
+        setup.registerType(type);
+
+        expect(typeRegistryInstanceMock.registerType).toHaveBeenCalledTimes(1);
+        expect(typeRegistryInstanceMock.registerType).toHaveBeenCalledWith(type);
+      });
+    });
   });
 
   describe('#start()', () => {
diff --git a/src/core/server/saved_objects/saved_objects_service.ts b/src/core/server/saved_objects/saved_objects_service.ts
index 0c985c71c7e2f..2f07dbe51a09e 100644
--- a/src/core/server/saved_objects/saved_objects_service.ts
+++ b/src/core/server/saved_objects/saved_objects_service.ts
@@ -21,7 +21,6 @@ import { CoreService } from 'src/core/types';
 import { first, filter, take } from 'rxjs/operators';
 import {
   SavedObjectsClient,
-  SavedObjectsSchema,
   SavedObjectsClientProvider,
   ISavedObjectsClientProvider,
   SavedObjectsClientProviderOptions,
@@ -34,17 +33,17 @@ import { KibanaConfigType } from '../kibana_config';
 import { migrationsRetryCallCluster } from '../elasticsearch/retry_call_cluster';
 import { SavedObjectsConfigType } from './saved_objects_config';
 import { KibanaRequest } from '../http';
-import { SavedObjectsClientContract } from './types';
+import { SavedObjectsClientContract, SavedObjectsType } from './types';
 import { ISavedObjectsRepository, SavedObjectsRepository } from './service/lib/repository';
 import {
   SavedObjectsClientFactoryProvider,
   SavedObjectsClientWrapperFactory,
 } from './service/lib/scoped_client_provider';
 import { Logger } from '../logging';
-import { SavedObjectsMapping } from './mappings';
-import { MigrationDefinition } from './migrations/core/document_migrator';
-import { SavedObjectsSchemaDefinition } from './schema';
+import { convertLegacyTypes } from './utils';
+import { SavedObjectTypeRegistry, ISavedObjectTypeRegistry } from './saved_objects_type_registry';
 import { PropertyValidators } from './validation';
+import { SavedObjectsSerializer } from './serialization';
 
 /**
  * Saved Objects is Kibana's data persistence mechanism allowing plugins to
@@ -70,6 +69,7 @@ import { PropertyValidators } from './validation';
  * constructor.
  *
  * @example
+ * ```ts
  * import { SavedObjectsClient, CoreSetup } from 'src/core/server';
  *
  * export class Plugin() {
@@ -79,6 +79,7 @@ import { PropertyValidators } from './validation';
  *     })
  *   }
  * }
+ * ```
  *
  * @public
  */
@@ -102,7 +103,9 @@ export interface SavedObjectsServiceSetup {
 /**
  * @internal
  */
-export type InternalSavedObjectsServiceSetup = SavedObjectsServiceSetup;
+export interface InternalSavedObjectsServiceSetup extends SavedObjectsServiceSetup {
+  registerType: (type: SavedObjectsType) => void;
+}
 
 /**
  * Saved Objects is Kibana's data persisentence mechanism allowing plugins to
@@ -146,6 +149,10 @@ export interface SavedObjectsServiceStart {
    * @param extraTypes - A list of additional hidden types the repository should have access to.
    */
   createInternalRepository: (extraTypes?: string[]) => ISavedObjectsRepository;
+  /**
+   * Creates a {@link SavedObjectsSerializer | serializer} that is aware of all registered types.
+   */
+  createSerializer: () => SavedObjectsSerializer;
 }
 
 export interface InternalSavedObjectsServiceStart extends SavedObjectsServiceStart {
@@ -157,6 +164,10 @@ export interface InternalSavedObjectsServiceStart extends SavedObjectsServiceSta
    * @deprecated Exposed only for injecting into Legacy
    */
   clientProvider: ISavedObjectsClientProvider;
+  /**
+   * @deprecated Exposed only for injecting into Legacy
+   */
+  typeRegistry: ISavedObjectTypeRegistry;
 }
 
 /**
@@ -207,9 +218,7 @@ export class SavedObjectsService
   private clientFactoryProvider?: SavedObjectsClientFactoryProvider;
   private clientFactoryWrappers: WrappedClientFactoryWrapper[] = [];
 
-  private mappings: SavedObjectsMapping[] = [];
-  private migrations: MigrationDefinition = {};
-  private schemas: SavedObjectsSchemaDefinition = {};
+  private typeRegistry = new SavedObjectTypeRegistry();
   private validations: PropertyValidators = {};
 
   constructor(private readonly coreContext: CoreContext) {
@@ -221,16 +230,12 @@ export class SavedObjectsService
 
     this.setupDeps = setupDeps;
 
-    const {
-      savedObjectSchemas: savedObjectsSchemasDefinition,
-      savedObjectMappings,
-      savedObjectMigrations,
-      savedObjectValidations,
-    } = setupDeps.legacyPlugins.uiExports;
-    this.mappings = savedObjectMappings;
-    this.migrations = savedObjectMigrations;
-    this.schemas = savedObjectsSchemasDefinition;
-    this.validations = savedObjectValidations;
+    const legacyTypes = convertLegacyTypes(
+      setupDeps.legacyPlugins.uiExports,
+      setupDeps.legacyPlugins.pluginExtendedConfig
+    );
+    legacyTypes.forEach(type => this.typeRegistry.registerType(type));
+    this.validations = setupDeps.legacyPlugins.uiExports.savedObjectValidations || {};
 
     return {
       setClientFactoryProvider: provider => {
@@ -246,6 +251,9 @@ export class SavedObjectsService
           factory,
         });
       },
+      registerType: type => {
+        this.typeRegistry.registerType(type);
+      },
     };
   }
 
@@ -303,8 +311,7 @@ export class SavedObjectsService
     const createRepository = (callCluster: APICaller, extraTypes: string[] = []) => {
       return SavedObjectsRepository.createRepository(
         migrator,
-        new SavedObjectsSchema(this.schemas),
-        this.setupDeps!.legacyPlugins.pluginExtendedConfig,
+        this.typeRegistry,
         kibanaConfig.index,
         callCluster,
         extraTypes
@@ -335,9 +342,11 @@ export class SavedObjectsService
     return {
       migrator,
       clientProvider,
+      typeRegistry: this.typeRegistry,
       getScopedClient: clientProvider.getClient.bind(clientProvider),
       createScopedRepository: repositoryFactory.createScopedRepository,
       createInternalRepository: repositoryFactory.createInternalRepository,
+      createSerializer: () => new SavedObjectsSerializer(this.typeRegistry),
     };
   }
 
@@ -348,18 +357,14 @@ export class SavedObjectsService
     savedObjectsConfig: SavedObjectsConfigType,
     migrationsRetryDelay?: number
   ): KibanaMigrator {
-    const savedObjectSchemas = new SavedObjectsSchema(this.schemas);
     const adminClient = this.setupDeps!.elasticsearch.adminClient;
 
     return new KibanaMigrator({
-      savedObjectSchemas,
-      savedObjectMappings: this.mappings,
-      savedObjectMigrations: this.migrations,
-      savedObjectValidations: this.validations,
+      typeRegistry: this.typeRegistry,
       logger: this.logger,
       kibanaVersion: this.coreContext.env.packageInfo.version,
-      config: this.setupDeps!.legacyPlugins.pluginExtendedConfig,
       savedObjectsConfig,
+      savedObjectValidations: this.validations,
       kibanaConfig,
       callCluster: migrationsRetryCallCluster(
         adminClient.callAsInternalUser,
diff --git a/src/core/server/saved_objects/saved_objects_type_registry.mock.ts b/src/core/server/saved_objects/saved_objects_type_registry.mock.ts
new file mode 100644
index 0000000000000..6e11920db6b7d
--- /dev/null
+++ b/src/core/server/saved_objects/saved_objects_type_registry.mock.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ISavedObjectTypeRegistry } from './saved_objects_type_registry';
+
+const createRegistryMock = (): jest.Mocked<ISavedObjectTypeRegistry> => {
+  const mock = {
+    registerType: jest.fn(),
+    getType: jest.fn(),
+    getAllTypes: jest.fn(),
+    isNamespaceAgnostic: jest.fn(),
+    isHidden: jest.fn(),
+    getIndex: jest.fn(),
+  };
+
+  mock.getIndex.mockReturnValue('.kibana-test');
+  mock.isHidden.mockReturnValue(false);
+  mock.isNamespaceAgnostic.mockImplementation((type: string) => type === 'global');
+
+  return mock;
+};
+
+export const typeRegistryMock = {
+  create: createRegistryMock,
+};
diff --git a/src/core/server/saved_objects/saved_objects_type_registry.test.ts b/src/core/server/saved_objects/saved_objects_type_registry.test.ts
new file mode 100644
index 0000000000000..4268ab7718f8d
--- /dev/null
+++ b/src/core/server/saved_objects/saved_objects_type_registry.test.ts
@@ -0,0 +1,215 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectTypeRegistry } from './saved_objects_type_registry';
+import { SavedObjectsType } from './types';
+
+const createType = (type: Partial<SavedObjectsType>): SavedObjectsType => ({
+  name: 'unknown',
+  hidden: false,
+  namespaceAgnostic: false,
+  mappings: { properties: {} },
+  migrations: {},
+  ...type,
+});
+
+describe('SavedObjectTypeRegistry', () => {
+  let registry: SavedObjectTypeRegistry;
+
+  beforeEach(() => {
+    registry = new SavedObjectTypeRegistry();
+  });
+
+  it('allows to register types', () => {
+    registry.registerType(createType({ name: 'typeA' }));
+    registry.registerType(createType({ name: 'typeB' }));
+    registry.registerType(createType({ name: 'typeC' }));
+
+    expect(
+      registry
+        .getAllTypes()
+        .map(type => type.name)
+        .sort()
+    ).toEqual(['typeA', 'typeB', 'typeC']);
+  });
+
+  it('throws when trying to register the same type twice', () => {
+    registry.registerType(createType({ name: 'typeA' }));
+    registry.registerType(createType({ name: 'typeB' }));
+    expect(() => {
+      registry.registerType(createType({ name: 'typeA' }));
+    }).toThrowErrorMatchingInlineSnapshot(`"Type 'typeA' is already registered"`);
+  });
+
+  describe('#getType', () => {
+    it(`retrieve a type by it's name`, () => {
+      const typeA = createType({ name: 'typeA' });
+      const typeB = createType({ name: 'typeB' });
+      registry.registerType(typeA);
+      registry.registerType(typeB);
+      registry.registerType(createType({ name: 'typeC' }));
+
+      expect(registry.getType('typeA')).toEqual(typeA);
+      expect(registry.getType('typeB')).toEqual(typeB);
+      expect(registry.getType('unknownType')).toBeUndefined();
+    });
+
+    it('forbids to mutate the registered types', () => {
+      registry.registerType(
+        createType({
+          name: 'typeA',
+          mappings: {
+            properties: {
+              someField: { type: 'text' },
+            },
+          },
+        })
+      );
+
+      const typeA = registry.getType('typeA')!;
+
+      expect(() => {
+        typeA.migrations = {};
+      }).toThrow();
+      expect(() => {
+        typeA.name = 'foo';
+      }).toThrow();
+      expect(() => {
+        typeA.mappings.properties = {};
+      }).toThrow();
+      expect(() => {
+        typeA.indexPattern = '.overrided';
+      }).toThrow();
+    });
+  });
+
+  describe('#getAllTypes', () => {
+    it('returns all registered types', () => {
+      const typeA = createType({ name: 'typeA' });
+      const typeB = createType({ name: 'typeB' });
+      const typeC = createType({ name: 'typeC' });
+      registry.registerType(typeA);
+      registry.registerType(typeB);
+
+      const registered = registry.getAllTypes();
+      expect(registered.length).toEqual(2);
+      expect(registered).toContainEqual(typeA);
+      expect(registered).toContainEqual(typeB);
+      expect(registered).not.toContainEqual(typeC);
+    });
+
+    it('forbids to mutate the registered types', () => {
+      registry.registerType(
+        createType({
+          name: 'typeA',
+          mappings: {
+            properties: {
+              someField: { type: 'text' },
+            },
+          },
+        })
+      );
+      registry.registerType(
+        createType({
+          name: 'typeB',
+          migrations: {
+            '1.0.0': jest.fn(),
+          },
+        })
+      );
+
+      const typeA = registry.getType('typeA')!;
+      const typeB = registry.getType('typeB')!;
+
+      expect(() => {
+        typeA.migrations = {};
+      }).toThrow();
+      expect(() => {
+        typeA.name = 'foo';
+      }).toThrow();
+      expect(() => {
+        typeB.mappings.properties = {};
+      }).toThrow();
+      expect(() => {
+        typeB.indexPattern = '.overrided';
+      }).toThrow();
+    });
+
+    it('does not mutate the registered types when altering the list', () => {
+      registry.registerType(createType({ name: 'typeA' }));
+      registry.registerType(createType({ name: 'typeB' }));
+      registry.registerType(createType({ name: 'typeC' }));
+
+      const types = registry.getAllTypes();
+      types.splice(0, 3);
+
+      expect(registry.getAllTypes().length).toEqual(3);
+    });
+  });
+
+  describe('#isNamespaceAgnostic', () => {
+    it('returns correct value for the type', () => {
+      registry.registerType(createType({ name: 'typeA', namespaceAgnostic: true }));
+      registry.registerType(createType({ name: 'typeB', namespaceAgnostic: false }));
+
+      expect(registry.isNamespaceAgnostic('typeA')).toEqual(true);
+      expect(registry.isNamespaceAgnostic('typeB')).toEqual(false);
+    });
+    it('returns false when the type is not registered', () => {
+      registry.registerType(createType({ name: 'typeA', namespaceAgnostic: true }));
+      registry.registerType(createType({ name: 'typeB', namespaceAgnostic: false }));
+
+      expect(registry.isNamespaceAgnostic('unknownType')).toEqual(false);
+    });
+  });
+
+  describe('#isHidden', () => {
+    it('returns correct value for the type', () => {
+      registry.registerType(createType({ name: 'typeA', hidden: true }));
+      registry.registerType(createType({ name: 'typeB', hidden: false }));
+
+      expect(registry.isHidden('typeA')).toEqual(true);
+      expect(registry.isHidden('typeB')).toEqual(false);
+    });
+    it('returns false when the type is not registered', () => {
+      registry.registerType(createType({ name: 'typeA', hidden: true }));
+      registry.registerType(createType({ name: 'typeB', hidden: false }));
+
+      expect(registry.isHidden('unknownType')).toEqual(false);
+    });
+  });
+
+  describe('#getIndex', () => {
+    it('returns correct value for the type', () => {
+      registry.registerType(createType({ name: 'typeA', indexPattern: '.custom-index' }));
+      registry.registerType(createType({ name: 'typeB', indexPattern: '.another-index' }));
+      registry.registerType(createType({ name: 'typeWithNoIndex' }));
+
+      expect(registry.getIndex('typeA')).toEqual('.custom-index');
+      expect(registry.getIndex('typeB')).toEqual('.another-index');
+      expect(registry.getIndex('typeWithNoIndex')).toBeUndefined();
+    });
+    it('returns undefined when the type is not registered', () => {
+      registry.registerType(createType({ name: 'typeA', namespaceAgnostic: true }));
+      registry.registerType(createType({ name: 'typeB', namespaceAgnostic: false }));
+
+      expect(registry.getIndex('unknownType')).toBeUndefined();
+    });
+  });
+});
diff --git a/src/core/server/saved_objects/saved_objects_type_registry.ts b/src/core/server/saved_objects/saved_objects_type_registry.ts
new file mode 100644
index 0000000000000..3f26d696831fd
--- /dev/null
+++ b/src/core/server/saved_objects/saved_objects_type_registry.ts
@@ -0,0 +1,86 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { deepFreeze } from '../../utils';
+import { SavedObjectsType } from './types';
+
+/**
+ * See {@link SavedObjectTypeRegistry} for documentation.
+ *
+ * @internal
+ * */
+export type ISavedObjectTypeRegistry = PublicMethodsOf<SavedObjectTypeRegistry>;
+
+/**
+ * Registry holding information about all the registered {@link SavedObjectsType | savedObject types}.
+ *
+ * @internal
+ */
+export class SavedObjectTypeRegistry {
+  private readonly types = new Map<string, SavedObjectsType>();
+
+  /**
+   * Register a {@link SavedObjectsType | type} inside the registry.
+   * A type can only be registered once. subsequent calls with the same type name will throw an error.
+   */
+  public registerType(type: SavedObjectsType) {
+    if (this.types.has(type.name)) {
+      throw new Error(`Type '${type.name}' is already registered`);
+    }
+    this.types.set(type.name, deepFreeze(type));
+  }
+
+  /**
+   * Return the {@link SavedObjectsType | type} definition for given type name.
+   */
+  public getType(type: string) {
+    return this.types.get(type);
+  }
+
+  /**
+   * Return all {@link SavedObjectsType | types} currently registered.
+   */
+  public getAllTypes() {
+    return [...this.types.values()];
+  }
+
+  /**
+   * Returns the `namespaceAgnostic` property for given type, or `false` if
+   * the type is not registered.
+   */
+  public isNamespaceAgnostic(type: string) {
+    return this.types.get(type)?.namespaceAgnostic ?? false;
+  }
+
+  /**
+   * Returns the `hidden` property for given type, or `false` if
+   * the type is not registered.
+   */
+  public isHidden(type: string) {
+    return this.types.get(type)?.hidden ?? false;
+  }
+
+  /**
+   * Returns the `indexPattern` property for given type, or `undefined` if
+   * the type is not registered.
+   */
+  public getIndex(type: string) {
+    return this.types.get(type)?.indexPattern;
+  }
+}
diff --git a/src/core/server/saved_objects/schema/schema.ts b/src/core/server/saved_objects/schema/schema.ts
index 00c4939233318..17ca406ea109a 100644
--- a/src/core/server/saved_objects/schema/schema.ts
+++ b/src/core/server/saved_objects/schema/schema.ts
@@ -19,6 +19,10 @@
 
 import { LegacyConfig } from '../../legacy';
 
+/**
+ * @deprecated
+ * @internal
+ **/
 interface SavedObjectsSchemaTypeDefinition {
   isNamespaceAgnostic: boolean;
   hidden?: boolean;
@@ -26,12 +30,18 @@ interface SavedObjectsSchemaTypeDefinition {
   convertToAliasScript?: string;
 }
 
-/** @internal */
+/**
+ * @deprecated
+ * @internal
+ **/
 export interface SavedObjectsSchemaDefinition {
-  [key: string]: SavedObjectsSchemaTypeDefinition;
+  [type: string]: SavedObjectsSchemaTypeDefinition;
 }
 
-/** @internal */
+/**
+ * @deprecated This is only used by the {@link SavedObjectsLegacyService | legacy savedObjects service}
+ * @internal
+ **/
 export class SavedObjectsSchema {
   private readonly definition?: SavedObjectsSchemaDefinition;
   constructor(schemaDefinition?: SavedObjectsSchemaDefinition) {
@@ -46,7 +56,6 @@ export class SavedObjectsSchema {
     return false;
   }
 
-  // TODO: Remove dependency on config when we move SavedObjectsSchema to NP
   public getIndexForType(config: LegacyConfig, type: string): string | undefined {
     if (this.definition != null && this.definition.hasOwnProperty(type)) {
       const { indexPattern } = this.definition[type];
diff --git a/src/core/server/saved_objects/serialization/index.ts b/src/core/server/saved_objects/serialization/index.ts
index 217ffe7129e94..f7f4e75704341 100644
--- a/src/core/server/saved_objects/serialization/index.ts
+++ b/src/core/server/saved_objects/serialization/index.ts
@@ -22,167 +22,5 @@
  * the raw document format as stored in ElasticSearch.
  */
 
-/* eslint-disable @typescript-eslint/camelcase */
-
-import uuid from 'uuid';
-import { SavedObjectsSchema } from '../schema';
-import { decodeVersion, encodeVersion } from '../version';
-import { SavedObjectsMigrationVersion, SavedObjectReference } from '../types';
-
-/**
- * A raw document as represented directly in the saved object index.
- */
-export interface RawDoc {
-  _id: string;
-  _source: any;
-  _type?: string;
-  _seq_no?: number;
-  _primary_term?: number;
-}
-
-/**
- * A saved object type definition that allows for miscellaneous, unknown
- * properties, as current discussions around security, ACLs, etc indicate
- * that future props are likely to be added. Migrations support this
- * scenario out of the box.
- */
-interface SavedObjectDoc {
-  attributes: object;
-  id?: string; // NOTE: SavedObjectDoc is used for uncreated objects where `id` is optional
-  type: string;
-  namespace?: string;
-  migrationVersion?: SavedObjectsMigrationVersion;
-  version?: string;
-  updated_at?: string;
-
-  [rootProp: string]: any;
-}
-
-interface Referencable {
-  references: SavedObjectReference[];
-}
-
-/**
- * We want to have two types, one that guarantees a "references" attribute
- * will exist and one that allows it to be null. Since we're not migrating
- * all the saved objects to have a "references" array, we need to support
- * the scenarios where it may be missing (ex migrations).
- */
-export type RawSavedObjectDoc = SavedObjectDoc & Partial<Referencable>;
-export type SanitizedSavedObjectDoc = SavedObjectDoc & Referencable;
-
-function assertNonEmptyString(value: string, name: string) {
-  if (!value || typeof value !== 'string') {
-    throw new TypeError(`Expected "${value}" to be a ${name}`);
-  }
-}
-
-/** @internal */
-export class SavedObjectsSerializer {
-  private readonly schema: SavedObjectsSchema;
-
-  constructor(schema: SavedObjectsSchema) {
-    this.schema = schema;
-  }
-  /**
-   * Determines whether or not the raw document can be converted to a saved object.
-   *
-   * @param {RawDoc} rawDoc - The raw ES document to be tested
-   */
-  public isRawSavedObject(rawDoc: RawDoc) {
-    const { type, namespace } = rawDoc._source;
-    const namespacePrefix =
-      namespace && !this.schema.isNamespaceAgnostic(type) ? `${namespace}:` : '';
-    return (
-      type &&
-      rawDoc._id.startsWith(`${namespacePrefix}${type}:`) &&
-      rawDoc._source.hasOwnProperty(type)
-    );
-  }
-
-  /**
-   * Converts a document from the format that is stored in elasticsearch to the saved object client format.
-   *
-   *  @param {RawDoc} rawDoc - The raw ES document to be converted to saved object format.
-   */
-  public rawToSavedObject(doc: RawDoc): SanitizedSavedObjectDoc {
-    const { _id, _source, _seq_no, _primary_term } = doc;
-    const { type, namespace } = _source;
-
-    const version =
-      _seq_no != null || _primary_term != null
-        ? encodeVersion(_seq_no!, _primary_term!)
-        : undefined;
-
-    return {
-      type,
-      id: this.trimIdPrefix(namespace, type, _id),
-      ...(namespace && !this.schema.isNamespaceAgnostic(type) && { namespace }),
-      attributes: _source[type],
-      references: _source.references || [],
-      ...(_source.migrationVersion && { migrationVersion: _source.migrationVersion }),
-      ...(_source.updated_at && { updated_at: _source.updated_at }),
-      ...(version && { version }),
-    };
-  }
-
-  /**
-   * Converts a document from the saved object client format to the format that is stored in elasticsearch.
-   *
-   * @param {SanitizedSavedObjectDoc} savedObj - The saved object to be converted to raw ES format.
-   */
-  public savedObjectToRaw(savedObj: SanitizedSavedObjectDoc): RawDoc {
-    const {
-      id,
-      type,
-      namespace,
-      attributes,
-      migrationVersion,
-      updated_at,
-      version,
-      references,
-    } = savedObj;
-    const source = {
-      [type]: attributes,
-      type,
-      references,
-      ...(namespace && !this.schema.isNamespaceAgnostic(type) && { namespace }),
-      ...(migrationVersion && { migrationVersion }),
-      ...(updated_at && { updated_at }),
-    };
-
-    return {
-      _id: this.generateRawId(namespace, type, id),
-      _source: source,
-      ...(version != null && decodeVersion(version)),
-    };
-  }
-
-  /**
-   * Given a saved object type and id, generates the compound id that is stored in the raw document.
-   *
-   * @param {string} namespace - The namespace of the saved object
-   * @param {string} type - The saved object type
-   * @param {string} id - The id of the saved object
-   */
-  public generateRawId(namespace: string | undefined, type: string, id?: string) {
-    const namespacePrefix =
-      namespace && !this.schema.isNamespaceAgnostic(type) ? `${namespace}:` : '';
-    return `${namespacePrefix}${type}:${id || uuid.v1()}`;
-  }
-
-  private trimIdPrefix(namespace: string | undefined, type: string, id: string) {
-    assertNonEmptyString(id, 'document id');
-    assertNonEmptyString(type, 'saved object type');
-
-    const namespacePrefix =
-      namespace && !this.schema.isNamespaceAgnostic(type) ? `${namespace}:` : '';
-    const prefix = `${namespacePrefix}${type}:`;
-
-    if (!id.startsWith(prefix)) {
-      return id;
-    }
-
-    return id.slice(prefix.length);
-  }
-}
+export { SavedObjectUnsanitizedDoc, SavedObjectSanitizedDoc, SavedObjectsRawDoc } from './types';
+export { SavedObjectsSerializer } from './serializer';
diff --git a/src/core/server/saved_objects/serialization/serialization.test.ts b/src/core/server/saved_objects/serialization/serializer.test.ts
similarity index 79%
rename from src/core/server/saved_objects/serialization/serialization.test.ts
rename to src/core/server/saved_objects/serialization/serializer.test.ts
index e8bcdde73fcf4..8f09b25bb3908 100644
--- a/src/core/server/saved_objects/serialization/serialization.test.ts
+++ b/src/core/server/saved_objects/serialization/serializer.test.ts
@@ -18,14 +18,21 @@
  */
 
 import _ from 'lodash';
-import { SavedObjectsSerializer } from '.';
-import { SavedObjectsSchema } from '../schema';
+import { SavedObjectsSerializer } from './serializer';
+import { typeRegistryMock } from '../saved_objects_type_registry.mock';
 import { encodeVersion } from '../version';
 
 describe('saved object conversion', () => {
+  let typeRegistry: ReturnType<typeof typeRegistryMock.create>;
+
+  beforeEach(() => {
+    typeRegistry = typeRegistryMock.create();
+    typeRegistry.isNamespaceAgnostic.mockReturnValue(false);
+  });
+
   describe('#rawToSavedObject', () => {
     test('it copies the _source.type property to type', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -36,7 +43,7 @@ describe('saved object conversion', () => {
     });
 
     test('it copies the _source.references property to references', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -54,7 +61,7 @@ describe('saved object conversion', () => {
     });
 
     test('if specified it copies the _source.migrationVersion property to migrationVersion', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -72,7 +79,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if _source.migrationVersion is unspecified it doesn't set migrationVersion`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -83,8 +90,8 @@ describe('saved object conversion', () => {
     });
 
     test('it converts the id and type properties, and retains migrationVersion', () => {
-      const now = new Date();
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const now = String(new Date());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'hello:world',
         _seq_no: 3,
@@ -121,7 +128,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if version is unspecified it doesn't set version`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -133,7 +140,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if specified it encodes _seq_no and _primary_term to version`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _seq_no: 4,
@@ -147,7 +154,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if only _seq_no is specified it throws`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       expect(() =>
         serializer.rawToSavedObject({
           _id: 'foo:bar',
@@ -161,7 +168,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if only _primary_term is throws`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       expect(() =>
         serializer.rawToSavedObject({
           _id: 'foo:bar',
@@ -175,7 +182,7 @@ describe('saved object conversion', () => {
     });
 
     test('if specified it copies the _source.updated_at property to updated_at', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const now = Date();
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
@@ -188,7 +195,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if _source.updated_at is unspecified it doesn't set updated_at`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'foo:bar',
         _source: {
@@ -199,7 +206,7 @@ describe('saved object conversion', () => {
     });
 
     test('it does not pass unknown properties through', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'universe',
         _source: {
@@ -221,7 +228,7 @@ describe('saved object conversion', () => {
     });
 
     test('it does not create attributes if [type] is missing', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'universe',
         _source: {
@@ -236,7 +243,7 @@ describe('saved object conversion', () => {
     });
 
     test('it fails for documents which do not specify a type', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       expect(() =>
         serializer.rawToSavedObject({
           _id: 'universe',
@@ -244,13 +251,13 @@ describe('saved object conversion', () => {
             hello: {
               world: 'earth',
             },
-          },
+          } as any,
         })
       ).toThrow(/Expected "undefined" to be a saved object type/);
     });
 
     test('it is complimentary with savedObjectToRaw', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const raw = {
         _id: 'foo-namespace:foo:bar',
         _primary_term: 24,
@@ -266,7 +273,7 @@ describe('saved object conversion', () => {
             bar: '9.8.7',
           },
           namespace: 'foo-namespace',
-          updated_at: new Date(),
+          updated_at: String(new Date()),
           references: [],
         },
       };
@@ -277,7 +284,7 @@ describe('saved object conversion', () => {
     });
 
     test('it handles unprefixed ids', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.rawToSavedObject({
         _id: 'universe',
         _source: {
@@ -290,7 +297,7 @@ describe('saved object conversion', () => {
 
     describe('namespaced type without a namespace', () => {
       test(`removes type prefix from _id`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'foo:bar',
           _source: {
@@ -302,7 +309,7 @@ describe('saved object conversion', () => {
       });
 
       test(`if prefixed by random prefix and type it copies _id to id`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'random:foo:bar',
           _source: {
@@ -314,7 +321,7 @@ describe('saved object conversion', () => {
       });
 
       test(`doesn't specify namespace`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'foo:bar',
           _source: {
@@ -328,7 +335,7 @@ describe('saved object conversion', () => {
 
     describe('namespaced type with a namespace', () => {
       test(`removes type and namespace prefix from _id`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'baz:foo:bar',
           _source: {
@@ -341,7 +348,7 @@ describe('saved object conversion', () => {
       });
 
       test(`if prefixed by only type it copies _id to id`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'foo:bar',
           _source: {
@@ -354,7 +361,7 @@ describe('saved object conversion', () => {
       });
 
       test(`if prefixed by random prefix and type it copies _id to id`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'random:foo:bar',
           _source: {
@@ -367,7 +374,7 @@ describe('saved object conversion', () => {
       });
 
       test(`copies _source.namespace to namespace`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'baz:foo:bar',
           _source: {
@@ -381,10 +388,12 @@ describe('saved object conversion', () => {
     });
 
     describe('namespace agnostic type with a namespace', () => {
+      beforeEach(() => {
+        typeRegistry.isNamespaceAgnostic.mockReturnValue(true);
+      });
+
       test(`removes type prefix from _id`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'foo:bar',
           _source: {
@@ -397,9 +406,7 @@ describe('saved object conversion', () => {
       });
 
       test(`if prefixed by namespace and type it copies _id to id`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'baz:foo:bar',
           _source: {
@@ -412,9 +419,7 @@ describe('saved object conversion', () => {
       });
 
       test(`doesn't copy _source.namespace to namespace`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.rawToSavedObject({
           _id: 'baz:foo:bar',
           _source: {
@@ -430,7 +435,7 @@ describe('saved object conversion', () => {
 
   describe('#savedObjectToRaw', () => {
     test('it copies the type property to _source.type and uses the ROOT_TYPE as _type', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: 'foo',
         attributes: {},
@@ -440,7 +445,7 @@ describe('saved object conversion', () => {
     });
 
     test('it copies the references property to _source.references', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         id: '1',
         type: 'foo',
@@ -457,7 +462,7 @@ describe('saved object conversion', () => {
     });
 
     test('if specified it copies the updated_at property to _source.updated_at', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const now = new Date();
       const actual = serializer.savedObjectToRaw({
         type: '',
@@ -469,7 +474,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if unspecified it doesn't add updated_at property to _source`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: '',
         attributes: {},
@@ -479,7 +484,7 @@ describe('saved object conversion', () => {
     });
 
     test('it copies the migrationVersion property to _source.migrationVersion', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: '',
         attributes: {},
@@ -496,7 +501,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if unspecified it doesn't add migrationVersion property to _source`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: '',
         attributes: {},
@@ -506,7 +511,7 @@ describe('saved object conversion', () => {
     });
 
     test('it decodes the version property to _seq_no and _primary_term', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: '',
         attributes: {},
@@ -518,7 +523,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if unspecified it doesn't add _seq_no or _primary_term properties`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: '',
         attributes: {},
@@ -529,7 +534,7 @@ describe('saved object conversion', () => {
     });
 
     test(`if version invalid it throws`, () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       expect(() =>
         serializer.savedObjectToRaw({
           type: '',
@@ -540,7 +545,7 @@ describe('saved object conversion', () => {
     });
 
     test('it copies attributes to _source[type]', () => {
-      const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+      const serializer = new SavedObjectsSerializer(typeRegistry);
       const actual = serializer.savedObjectToRaw({
         type: 'foo',
         attributes: {
@@ -557,7 +562,7 @@ describe('saved object conversion', () => {
 
     describe('namespaced type without a namespace', () => {
       test('generates an id prefixed with type, if no id is specified', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const v1 = serializer.savedObjectToRaw({
           type: 'foo',
           attributes: {
@@ -577,7 +582,7 @@ describe('saved object conversion', () => {
       });
 
       test(`doesn't specify _source.namespace`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.savedObjectToRaw({
           type: '',
           attributes: {},
@@ -589,7 +594,7 @@ describe('saved object conversion', () => {
 
     describe('namespaced type with a namespace', () => {
       test('generates an id prefixed with namespace and type, if no id is specified', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const v1 = serializer.savedObjectToRaw({
           type: 'foo',
           namespace: 'bar',
@@ -611,7 +616,7 @@ describe('saved object conversion', () => {
       });
 
       test(`it copies namespace to _source.namespace`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.savedObjectToRaw({
           type: 'foo',
           attributes: {},
@@ -623,10 +628,12 @@ describe('saved object conversion', () => {
     });
 
     describe('namespace agnostic type with a namespace', () => {
+      beforeEach(() => {
+        typeRegistry.isNamespaceAgnostic.mockReturnValue(true);
+      });
+
       test('generates an id prefixed with type, if no id is specified', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const v1 = serializer.savedObjectToRaw({
           type: 'foo',
           namespace: 'bar',
@@ -648,9 +655,7 @@ describe('saved object conversion', () => {
       });
 
       test(`doesn't specify _source.namespace`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const actual = serializer.savedObjectToRaw({
           type: 'foo',
           namespace: 'bar',
@@ -665,7 +670,7 @@ describe('saved object conversion', () => {
   describe('#isRawSavedObject', () => {
     describe('namespaced type without a namespace', () => {
       test('is true if the id is prefixed and the type matches', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -678,7 +683,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is not prefixed', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'world',
@@ -691,19 +696,19 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the type attribute is missing', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
             _source: {
               hello: {},
-            },
+            } as any,
           })
         ).toBeFalsy();
       });
 
       test(`is false if the type prefix omits the :`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'helloworld',
@@ -716,7 +721,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the type attribute does not match the id', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -730,7 +735,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if there is no [type] attribute', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -745,7 +750,7 @@ describe('saved object conversion', () => {
 
     describe('namespaced type with a namespace', () => {
       test('is true if the id is prefixed with type and namespace and the type matches', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:hello:world',
@@ -759,7 +764,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is not prefixed by anything', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'world',
@@ -773,7 +778,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is prefixed only with type and the type matches', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -787,7 +792,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is prefixed only with namespace and the namespace matches', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:world',
@@ -801,7 +806,7 @@ describe('saved object conversion', () => {
       });
 
       test(`is false if the id prefix omits the trailing :`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:helloworld',
@@ -815,20 +820,20 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the type attribute is missing', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:hello:world',
             _source: {
               hello: {},
               namespace: 'foo',
-            },
+            } as any,
           })
         ).toBeFalsy();
       });
 
       test('is false if the type attribute does not match the id', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:hello:world',
@@ -843,7 +848,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the namespace attribute does not match the id', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'bar:jam:world',
@@ -858,7 +863,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if there is no [type] attribute', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -872,11 +877,13 @@ describe('saved object conversion', () => {
       });
     });
 
-    describe('namespace agonstic type with a namespace', () => {
+    describe('namespace agnostic type with a namespace', () => {
+      beforeEach(() => {
+        typeRegistry.isNamespaceAgnostic.mockReturnValue(true);
+      });
+
       test('is true if the id is prefixed with type and the type matches', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -890,9 +897,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is not prefixed', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'world',
@@ -906,9 +911,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the id is prefixed with type and namespace', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'foo:hello:world',
@@ -922,9 +925,7 @@ describe('saved object conversion', () => {
       });
 
       test(`is false if the type prefix omits the :`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'helloworld',
@@ -938,24 +939,20 @@ describe('saved object conversion', () => {
       });
 
       test('is false if the type attribute is missing', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
             _source: {
               hello: {},
               namespace: 'foo',
-            },
+            } as any,
           })
         ).toBeFalsy();
       });
 
       test('is false if the type attribute does not match the id', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -970,9 +967,7 @@ describe('saved object conversion', () => {
       });
 
       test('is false if there is no [type] attribute', () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ hello: { isNamespaceAgnostic: true } })
-        );
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         expect(
           serializer.isRawSavedObject({
             _id: 'hello:world',
@@ -990,13 +985,13 @@ describe('saved object conversion', () => {
   describe('#generateRawId', () => {
     describe('namespaced type without a namespace', () => {
       test('generates an id if none is specified', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('', 'goodbye');
         expect(id).toMatch(/goodbye\:[\w-]+$/);
       });
 
       test('uses the id that is specified', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('', 'hello', 'world');
         expect(id).toMatch('hello:world');
       });
@@ -1004,13 +999,13 @@ describe('saved object conversion', () => {
 
     describe('namespaced type with a namespace', () => {
       test('generates an id if none is specified and prefixes namespace', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('foo', 'goodbye');
         expect(id).toMatch(/foo:goodbye\:[\w-]+$/);
       });
 
       test('uses the id that is specified and prefixes the namespace', () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('foo', 'hello', 'world');
         expect(id).toMatch('foo:hello:world');
       });
@@ -1018,15 +1013,15 @@ describe('saved object conversion', () => {
 
     describe('namespace agnostic type with a namespace', () => {
       test(`generates an id if none is specified and doesn't prefix namespace`, () => {
-        const serializer = new SavedObjectsSerializer(
-          new SavedObjectsSchema({ foo: { isNamespaceAgnostic: true } })
-        );
+        typeRegistry.isNamespaceAgnostic.mockReturnValue(true);
+
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('foo', 'goodbye');
         expect(id).toMatch(/goodbye\:[\w-]+$/);
       });
 
       test(`uses the id that is specified and doesn't prefix the namespace`, () => {
-        const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+        const serializer = new SavedObjectsSerializer(typeRegistry);
         const id = serializer.generateRawId('foo', 'hello', 'world');
         expect(id).toMatch('hello:world');
       });
diff --git a/src/core/server/saved_objects/serialization/serializer.ts b/src/core/server/saved_objects/serialization/serializer.ts
new file mode 100644
index 0000000000000..99d6b0c6b59f9
--- /dev/null
+++ b/src/core/server/saved_objects/serialization/serializer.ts
@@ -0,0 +1,151 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import uuid from 'uuid';
+import { decodeVersion, encodeVersion } from '../version';
+import { ISavedObjectTypeRegistry } from '../saved_objects_type_registry';
+import { SavedObjectsRawDoc, SavedObjectSanitizedDoc } from './types';
+
+/**
+ * A serializer that can be used to manually convert {@link SavedObjectsRawDoc | raw} or
+ * {@link SavedObjectSanitizedDoc | sanitized} documents to the other kind.
+ *
+ * @remarks Serializer instances should only be created and accessed by calling {@link SavedObjectsServiceStart.createSerializer}
+ *
+ * @public
+ */
+export class SavedObjectsSerializer {
+  private readonly registry: ISavedObjectTypeRegistry;
+
+  /**
+   * @internal
+   */
+  constructor(registry: ISavedObjectTypeRegistry) {
+    this.registry = registry;
+  }
+  /**
+   * Determines whether or not the raw document can be converted to a saved object.
+   *
+   * @param {SavedObjectsRawDoc} rawDoc - The raw ES document to be tested
+   */
+  public isRawSavedObject(rawDoc: SavedObjectsRawDoc) {
+    const { type, namespace } = rawDoc._source;
+    const namespacePrefix =
+      namespace && !this.registry.isNamespaceAgnostic(type) ? `${namespace}:` : '';
+    return Boolean(
+      type &&
+        rawDoc._id.startsWith(`${namespacePrefix}${type}:`) &&
+        rawDoc._source.hasOwnProperty(type)
+    );
+  }
+
+  /**
+   * Converts a document from the format that is stored in elasticsearch to the saved object client format.
+   *
+   *  @param {SavedObjectsRawDoc} doc - The raw ES document to be converted to saved object format.
+   */
+  public rawToSavedObject(doc: SavedObjectsRawDoc): SavedObjectSanitizedDoc {
+    const { _id, _source, _seq_no, _primary_term } = doc;
+    const { type, namespace } = _source;
+
+    const version =
+      _seq_no != null || _primary_term != null
+        ? encodeVersion(_seq_no!, _primary_term!)
+        : undefined;
+
+    return {
+      type,
+      id: this.trimIdPrefix(namespace, type, _id),
+      ...(namespace && !this.registry.isNamespaceAgnostic(type) && { namespace }),
+      attributes: _source[type],
+      references: _source.references || [],
+      ...(_source.migrationVersion && { migrationVersion: _source.migrationVersion }),
+      ...(_source.updated_at && { updated_at: _source.updated_at }),
+      ...(version && { version }),
+    };
+  }
+
+  /**
+   * Converts a document from the saved object client format to the format that is stored in elasticsearch.
+   *
+   * @param {SavedObjectSanitizedDoc} savedObj - The saved object to be converted to raw ES format.
+   */
+  public savedObjectToRaw(savedObj: SavedObjectSanitizedDoc): SavedObjectsRawDoc {
+    const {
+      id,
+      type,
+      namespace,
+      attributes,
+      migrationVersion,
+      updated_at,
+      version,
+      references,
+    } = savedObj;
+    const source = {
+      [type]: attributes,
+      type,
+      references,
+      ...(namespace && !this.registry.isNamespaceAgnostic(type) && { namespace }),
+      ...(migrationVersion && { migrationVersion }),
+      ...(updated_at && { updated_at }),
+    };
+
+    return {
+      _id: this.generateRawId(namespace, type, id),
+      _source: source,
+      ...(version != null && decodeVersion(version)),
+    };
+  }
+
+  /**
+   * Given a saved object type and id, generates the compound id that is stored in the raw document.
+   *
+   * @param {string} namespace - The namespace of the saved object
+   * @param {string} type - The saved object type
+   * @param {string} id - The id of the saved object
+   */
+  public generateRawId(namespace: string | undefined, type: string, id?: string) {
+    const namespacePrefix =
+      namespace && !this.registry.isNamespaceAgnostic(type) ? `${namespace}:` : '';
+    return `${namespacePrefix}${type}:${id || uuid.v1()}`;
+  }
+
+  private trimIdPrefix(namespace: string | undefined, type: string, id: string) {
+    assertNonEmptyString(id, 'document id');
+    assertNonEmptyString(type, 'saved object type');
+
+    const namespacePrefix =
+      namespace && !this.registry.isNamespaceAgnostic(type) ? `${namespace}:` : '';
+    const prefix = `${namespacePrefix}${type}:`;
+
+    if (!id.startsWith(prefix)) {
+      return id;
+    }
+
+    return id.slice(prefix.length);
+  }
+}
+
+function assertNonEmptyString(value: string, name: string) {
+  if (!value || typeof value !== 'string') {
+    throw new TypeError(`Expected "${value}" to be a ${name}`);
+  }
+}
diff --git a/src/core/server/saved_objects/serialization/types.ts b/src/core/server/saved_objects/serialization/types.ts
new file mode 100644
index 0000000000000..aaf6f45c244ec
--- /dev/null
+++ b/src/core/server/saved_objects/serialization/types.ts
@@ -0,0 +1,79 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectsMigrationVersion, SavedObjectReference } from '../types';
+
+/**
+ * A raw document as represented directly in the saved object index.
+ *
+ * @public
+ */
+export interface SavedObjectsRawDoc {
+  _id: string;
+  _source: SavedObjectsRawDocSource;
+  _type?: string;
+  _seq_no?: number;
+  _primary_term?: number;
+}
+
+/** @public */
+export interface SavedObjectsRawDocSource {
+  type: string;
+  namespace?: string;
+  migrationVersion?: SavedObjectsMigrationVersion;
+  updated_at?: string;
+  references?: SavedObjectReference[];
+
+  [typeMapping: string]: any;
+}
+
+/**
+ * A saved object type definition that allows for miscellaneous, unknown
+ * properties, as current discussions around security, ACLs, etc indicate
+ * that future props are likely to be added. Migrations support this
+ * scenario out of the box.
+ */
+interface SavedObjectDoc {
+  attributes: object;
+  id?: string; // NOTE: SavedObjectDoc is used for uncreated objects where `id` is optional
+  type: string;
+  namespace?: string;
+  migrationVersion?: SavedObjectsMigrationVersion;
+  version?: string;
+  updated_at?: string;
+
+  [rootProp: string]: any;
+}
+
+interface Referencable {
+  references: SavedObjectReference[];
+}
+
+/**
+ * We want to have two types, one that guarantees a "references" attribute
+ * will exist and one that allows it to be null. Since we're not migrating
+ * all the saved objects to have a "references" array, we need to support
+ * the scenarios where it may be missing (ex migrations).
+ *
+ * @public
+ */
+export type SavedObjectUnsanitizedDoc = SavedObjectDoc & Partial<Referencable>;
+
+/** @public */
+export type SavedObjectSanitizedDoc = SavedObjectDoc & Referencable;
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index 6171faa7a617c..2e5eeec04e0a8 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -21,10 +21,9 @@ import _ from 'lodash';
 import { SavedObjectsRepository } from './repository';
 import * as getSearchDslNS from './search_dsl/search_dsl';
 import { SavedObjectsErrorHelpers } from './errors';
-import { SavedObjectsSchema } from '../../schema';
 import { SavedObjectsSerializer } from '../../serialization';
-import { getRootPropertiesObjects } from '../../mappings/lib/get_root_properties_objects';
 import { encodeHitVersion } from '../../version';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 
 jest.mock('./search_dsl/search_dsl', () => ({ getSearchDsl: jest.fn() }));
 
@@ -35,6 +34,7 @@ describe('SavedObjectsRepository', () => {
   let callAdminCluster;
   let savedObjectsRepository;
   let migrator;
+
   const mockTimestamp = '2017-08-14T15:49:14.886Z';
   const mockTimestampFields = { updated_at: mockTimestamp };
   const mockVersionProps = { _seq_no: 1, _primary_term: 1 };
@@ -240,12 +240,95 @@ describe('SavedObjectsRepository', () => {
     },
   };
 
-  const schema = new SavedObjectsSchema({
-    globaltype: { isNamespaceAgnostic: true },
-    foo: { isNamespaceAgnostic: true },
-    bar: { isNamespaceAgnostic: true },
-    baz: { indexPattern: 'beats' },
-    hiddenType: { isNamespaceAgnostic: true, hidden: true },
+  const typeRegistry = new SavedObjectTypeRegistry();
+  typeRegistry.registerType({
+    name: 'config',
+    hidden: false,
+    namespaceAgnostic: false,
+    mappings: {
+      properties: {
+        type: 'keyword',
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'index-pattern',
+    hidden: false,
+    namespaceAgnostic: false,
+    mappings: {
+      properties: {
+        someField: {
+          type: 'keyword',
+        },
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'dashboard',
+    hidden: false,
+    namespaceAgnostic: false,
+    mappings: {
+      properties: {
+        otherField: {
+          type: 'keyword',
+        },
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'globaltype',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        yetAnotherField: {
+          type: 'keyword',
+        },
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'foo',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        type: 'keyword',
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'bar',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        type: 'keyword',
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'baz',
+    hidden: false,
+    namespaceAgnostic: false,
+    indexPattern: 'beats',
+    mappings: {
+      properties: {
+        type: 'keyword',
+      },
+    },
+  });
+  typeRegistry.registerType({
+    name: 'hiddenType',
+    hidden: true,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        someField: {
+          type: 'keyword',
+        },
+      },
+    },
   });
 
   beforeEach(() => {
@@ -255,16 +338,16 @@ describe('SavedObjectsRepository', () => {
       runMigrations: async () => ({ status: 'skipped' }),
     };
 
-    const serializer = new SavedObjectsSerializer(schema);
-    const allTypes = Object.keys(getRootPropertiesObjects(mappings));
-    const allowedTypes = [...new Set(allTypes.filter(type => !schema.isHiddenType(type)))];
+    const serializer = new SavedObjectsSerializer(typeRegistry);
+    const allTypes = typeRegistry.getAllTypes().map(type => type.name);
+    const allowedTypes = [...new Set(allTypes.filter(type => !typeRegistry.isHidden(type)))];
 
     savedObjectsRepository = new SavedObjectsRepository({
       index: '.kibana-test',
       mappings,
       callCluster: callAdminCluster,
       migrator,
-      schema,
+      typeRegistry,
       serializer,
       allowedTypes,
     });
@@ -1171,7 +1254,7 @@ describe('SavedObjectsRepository', () => {
       expect(result).toEqual(deleteByQueryResults);
       expect(callAdminCluster).toHaveBeenCalledTimes(1);
 
-      expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(mappings, schema, {
+      expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(mappings, typeRegistry, {
         namespace: 'my-namespace',
         type: ['config', 'baz', 'index-pattern', 'dashboard'],
       });
@@ -1261,7 +1344,11 @@ describe('SavedObjectsRepository', () => {
 
       await savedObjectsRepository.find(relevantOpts);
       expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledTimes(1);
-      expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(mappings, schema, relevantOpts);
+      expect(getSearchDslNS.getSearchDsl).toHaveBeenCalledWith(
+        mappings,
+        typeRegistry,
+        relevantOpts
+      );
     });
 
     it('accepts KQL filter and passes keuryNode to getSearchDsl', async () => {
diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
index 70b8b2878c15b..b485b8dfe398c 100644
--- a/src/core/server/saved_objects/service/lib/repository.ts
+++ b/src/core/server/saved_objects/service/lib/repository.ts
@@ -27,9 +27,12 @@ import { includedFields } from './included_fields';
 import { decorateEsError } from './decorate_es_error';
 import { SavedObjectsErrorHelpers } from './errors';
 import { decodeRequestVersion, encodeVersion, encodeHitVersion } from '../../version';
-import { SavedObjectsSchema } from '../../schema';
 import { KibanaMigrator } from '../../migrations';
-import { SavedObjectsSerializer, SanitizedSavedObjectDoc, RawDoc } from '../../serialization';
+import {
+  SavedObjectsSerializer,
+  SavedObjectSanitizedDoc,
+  SavedObjectsRawDoc,
+} from '../../serialization';
 import {
   SavedObjectsBulkCreateObject,
   SavedObjectsBulkGetObject,
@@ -51,8 +54,8 @@ import {
   SavedObjectsMigrationVersion,
   MutatingOperationRefreshSetting,
 } from '../../types';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import { validateConvertFilterToKueryNode } from './filter_utils';
-import { LegacyConfig } from '../../../legacy';
 
 // BEWARE: The SavedObjectClient depends on the implementation details of the SavedObjectsRepository
 // so any breaking changes to this repository are considered breaking changes to the SavedObjectsClient.
@@ -75,11 +78,9 @@ const isLeft = <L, R>(either: Either<L, R>): either is Left<L> => {
 
 export interface SavedObjectsRepositoryOptions {
   index: string;
-  /** @deprecated Will be removed once SavedObjectsSchema is exposed from Core */
-  config: LegacyConfig;
   mappings: IndexMapping;
   callCluster: APICaller;
-  schema: SavedObjectsSchema;
+  typeRegistry: SavedObjectTypeRegistry;
   serializer: SavedObjectsSerializer;
   migrator: KibanaMigrator;
   allowedTypes: string[];
@@ -118,9 +119,8 @@ export type ISavedObjectsRepository = Pick<SavedObjectsRepository, keyof SavedOb
 export class SavedObjectsRepository {
   private _migrator: KibanaMigrator;
   private _index: string;
-  private _config: LegacyConfig;
   private _mappings: IndexMapping;
-  private _schema: SavedObjectsSchema;
+  private _registry: SavedObjectTypeRegistry;
   private _allowedTypes: string[];
   private _unwrappedCallCluster: APICaller;
   private _serializer: SavedObjectsSerializer;
@@ -135,8 +135,7 @@ export class SavedObjectsRepository {
    */
   public static createRepository(
     migrator: KibanaMigrator,
-    schema: SavedObjectsSchema,
-    config: LegacyConfig,
+    typeRegistry: SavedObjectTypeRegistry,
     indexName: string,
     callCluster: APICaller,
     extraTypes: string[] = [],
@@ -144,8 +143,8 @@ export class SavedObjectsRepository {
   ): ISavedObjectsRepository {
     const mappings = migrator.getActiveMappings();
     const allTypes = Object.keys(getRootPropertiesObjects(mappings));
-    const serializer = new SavedObjectsSerializer(schema);
-    const visibleTypes = allTypes.filter(type => !schema.isHiddenType(type));
+    const serializer = new SavedObjectsSerializer(typeRegistry);
+    const visibleTypes = allTypes.filter(type => !typeRegistry.isHidden(type));
 
     const missingTypeMappings = extraTypes.filter(type => !allTypes.includes(type));
     if (missingTypeMappings.length > 0) {
@@ -158,10 +157,9 @@ export class SavedObjectsRepository {
 
     return new injectedConstructor({
       index: indexName,
-      config,
       migrator,
       mappings,
-      schema,
+      typeRegistry,
       serializer,
       allowedTypes,
       callCluster: retryCallCluster(callCluster),
@@ -171,10 +169,9 @@ export class SavedObjectsRepository {
   private constructor(options: SavedObjectsRepositoryOptions) {
     const {
       index,
-      config,
       mappings,
       callCluster,
-      schema,
+      typeRegistry,
       serializer,
       migrator,
       allowedTypes = [],
@@ -189,9 +186,8 @@ export class SavedObjectsRepository {
     // to returning them.
     this._migrator = migrator;
     this._index = index;
-    this._config = config;
     this._mappings = mappings;
-    this._schema = schema;
+    this._registry = typeRegistry;
     if (allowedTypes.length === 0) {
       throw new Error('Empty or missing types for saved object repository!');
     }
@@ -201,7 +197,6 @@ export class SavedObjectsRepository {
       await migrator.runMigrations();
       return callCluster(...args);
     };
-    this._schema = schema;
     this._serializer = serializer;
   }
 
@@ -250,7 +245,7 @@ export class SavedObjectsRepository {
         references,
       });
 
-      const raw = this._serializer.savedObjectToRaw(migrated as SanitizedSavedObjectDoc);
+      const raw = this._serializer.savedObjectToRaw(migrated as SavedObjectSanitizedDoc);
 
       const response = await this._writeToCluster(method, {
         id: raw._id,
@@ -316,7 +311,7 @@ export class SavedObjectsRepository {
             namespace,
             updated_at: time,
             references: object.references || [],
-          }) as SanitizedSavedObjectDoc
+          }) as SavedObjectSanitizedDoc
         ),
       };
 
@@ -435,7 +430,7 @@ export class SavedObjectsRepository {
 
     const allTypes = Object.keys(getRootPropertiesObjects(this._mappings));
 
-    const typesToDelete = allTypes.filter(type => !this._schema.isNamespaceAgnostic(type));
+    const typesToDelete = allTypes.filter(type => !this._registry.isNamespaceAgnostic(type));
 
     const esOptions = {
       index: this.getIndicesForTypes(typesToDelete),
@@ -443,7 +438,7 @@ export class SavedObjectsRepository {
       refresh,
       body: {
         conflicts: 'proceed',
-        ...getSearchDsl(this._mappings, this._schema, {
+        ...getSearchDsl(this._mappings, this._registry, {
           namespace,
           type: typesToDelete,
         }),
@@ -531,7 +526,7 @@ export class SavedObjectsRepository {
       rest_total_hits_as_int: true,
       body: {
         seq_no_primary_term: true,
-        ...getSearchDsl(this._mappings, this._schema, {
+        ...getSearchDsl(this._mappings, this._registry, {
           search,
           defaultSearchOperator,
           searchFields,
@@ -562,7 +557,9 @@ export class SavedObjectsRepository {
       page,
       per_page: perPage,
       total: response.hits.total,
-      saved_objects: response.hits.hits.map((hit: RawDoc) => this._rawToSavedObject(hit)),
+      saved_objects: response.hits.hits.map((hit: SavedObjectsRawDoc) =>
+        this._rawToSavedObject(hit)
+      ),
     };
   }
 
@@ -890,7 +887,7 @@ export class SavedObjectsRepository {
       updated_at: time,
     });
 
-    const raw = this._serializer.savedObjectToRaw(migrated as SanitizedSavedObjectDoc);
+    const raw = this._serializer.savedObjectToRaw(migrated as SavedObjectSanitizedDoc);
 
     const response = await this._writeToCluster('update', {
       id: this._serializer.generateRawId(namespace, type, id),
@@ -952,7 +949,7 @@ export class SavedObjectsRepository {
    * @param type - the type
    */
   private getIndexForType(type: string) {
-    return this._schema.getIndexForType(this._config, type) || this._index;
+    return this._registry.getIndex(type) || this._index;
   }
 
   /**
@@ -964,7 +961,7 @@ export class SavedObjectsRepository {
    */
   private getIndicesForTypes(types: string[]) {
     const unique = (array: string[]) => [...new Set(array)];
-    return unique(types.map(t => this._schema.getIndexForType(this._config, t) || this._index));
+    return unique(types.map(t => this.getIndexForType(t)));
   }
 
   private _getCurrentTime() {
@@ -975,7 +972,7 @@ export class SavedObjectsRepository {
   // includes the namespace, and we use this for migrating documents. However, we don't
   // want the namespace to be returned from the repository, as the repository scopes each
   // method transparently to the specified namespace.
-  private _rawToSavedObject(raw: RawDoc): SavedObject {
+  private _rawToSavedObject(raw: SavedObjectsRawDoc): SavedObject {
     const savedObject = this._serializer.rawToSavedObject(raw);
     return omit(savedObject, 'namespace');
   }
diff --git a/src/core/server/saved_objects/service/lib/repository_create_repository.test.ts b/src/core/server/saved_objects/service/lib/repository_create_repository.test.ts
index b3ea056484760..4a87bb1043ca2 100644
--- a/src/core/server/saved_objects/service/lib/repository_create_repository.test.ts
+++ b/src/core/server/saved_objects/service/lib/repository_create_repository.test.ts
@@ -18,43 +18,54 @@
  */
 import { SavedObjectsRepository } from './repository';
 import { mockKibanaMigrator } from '../../migrations/kibana/kibana_migrator.mock';
-import { SavedObjectsSchema } from '../../schema';
 import { KibanaMigrator } from '../../migrations';
-import { LegacyConfig } from '../../../legacy';
+import { SavedObjectTypeRegistry } from '../../saved_objects_type_registry';
+
 jest.mock('./repository');
 
 const { SavedObjectsRepository: originalRepository } = jest.requireActual('./repository');
 
 describe('SavedObjectsRepository#createRepository', () => {
   const callAdminCluster = jest.fn();
-  const schema = new SavedObjectsSchema({
-    nsAgnosticType: { isNamespaceAgnostic: true },
-    nsType: { indexPattern: 'beats', isNamespaceAgnostic: false },
-    hiddenType: { isNamespaceAgnostic: true, hidden: true },
+
+  const typeRegistry = new SavedObjectTypeRegistry();
+  typeRegistry.registerType({
+    name: 'nsAgnosticType',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        name: { type: 'keyword' },
+      },
+    },
+    migrations: {},
+  });
+
+  typeRegistry.registerType({
+    name: 'nsType',
+    hidden: false,
+    namespaceAgnostic: false,
+    indexPattern: 'beats',
+    mappings: {
+      properties: {
+        name: { type: 'keyword' },
+      },
+    },
+    migrations: {},
   });
-  const mappings = [
-    {
-      pluginId: 'testplugin',
+  typeRegistry.registerType({
+    name: 'hiddenType',
+    hidden: true,
+    namespaceAgnostic: true,
+    mappings: {
       properties: {
-        nsAgnosticType: {
-          properties: {
-            name: { type: 'keyword' },
-          },
-        },
-        nsType: {
-          properties: {
-            name: { type: 'keyword' },
-          },
-        },
-        hiddenType: {
-          properties: {
-            name: { type: 'keyword' },
-          },
-        },
+        name: { type: 'keyword' },
       },
     },
-  ];
-  const migrator = mockKibanaMigrator.create({ savedObjectMappings: mappings });
+    migrations: {},
+  });
+
+  const migrator = mockKibanaMigrator.create({ types: typeRegistry.getAllTypes() });
   const RepositoryConstructor = (SavedObjectsRepository as unknown) as jest.Mock<
     SavedObjectsRepository
   >;
@@ -67,8 +78,7 @@ describe('SavedObjectsRepository#createRepository', () => {
     try {
       originalRepository.createRepository(
         (migrator as unknown) as KibanaMigrator,
-        schema,
-        {} as LegacyConfig,
+        typeRegistry,
         '.kibana-test',
         callAdminCluster,
         ['unMappedType1', 'unmappedType2']
@@ -83,8 +93,7 @@ describe('SavedObjectsRepository#createRepository', () => {
   it('should create a repository without hidden types', () => {
     const repository = originalRepository.createRepository(
       (migrator as unknown) as KibanaMigrator,
-      schema,
-      {} as LegacyConfig,
+      typeRegistry,
       '.kibana-test',
       callAdminCluster,
       [],
@@ -103,8 +112,7 @@ describe('SavedObjectsRepository#createRepository', () => {
   it('should create a repository with a unique list of hidden types', () => {
     const repository = originalRepository.createRepository(
       (migrator as unknown) as KibanaMigrator,
-      schema,
-      {} as LegacyConfig,
+      typeRegistry,
       '.kibana-test',
       callAdminCluster,
       ['hiddenType', 'hiddenType', 'hiddenType'],
diff --git a/src/core/server/saved_objects/service/lib/search_dsl/query_params.test.ts b/src/core/server/saved_objects/service/lib/search_dsl/query_params.test.ts
index e585953109d2c..b2129765ee426 100644
--- a/src/core/server/saved_objects/service/lib/search_dsl/query_params.test.ts
+++ b/src/core/server/saved_objects/service/lib/search_dsl/query_params.test.ts
@@ -17,10 +17,11 @@
  * under the License.
  */
 
-import { schemaMock } from '../../../schema/schema.mock';
+import { typeRegistryMock } from '../../../saved_objects_type_registry.mock';
 import { getQueryParams } from './query_params';
 
-const SCHEMA = schemaMock.create();
+const registry = typeRegistryMock.create();
+
 const MAPPINGS = {
   properties: {
     type: {
@@ -85,7 +86,7 @@ const createTypeClause = (type: string, namespace?: string) => {
 describe('searchDsl/queryParams', () => {
   describe('no parameters', () => {
     it('searches for all known types without a namespace specified', () => {
-      expect(getQueryParams({ mappings: MAPPINGS, schema: SCHEMA })).toEqual({
+      expect(getQueryParams({ mappings: MAPPINGS, registry })).toEqual({
         query: {
           bool: {
             filter: [
@@ -108,9 +109,7 @@ describe('searchDsl/queryParams', () => {
 
   describe('namespace', () => {
     it('filters namespaced types for namespace, and ensures namespace agnostic types have no namespace', () => {
-      expect(
-        getQueryParams({ mappings: MAPPINGS, schema: SCHEMA, namespace: 'foo-namespace' })
-      ).toEqual({
+      expect(getQueryParams({ mappings: MAPPINGS, registry, namespace: 'foo-namespace' })).toEqual({
         query: {
           bool: {
             filter: [
@@ -134,7 +133,7 @@ describe('searchDsl/queryParams', () => {
   describe('type (singular, namespaced)', () => {
     it('includes a terms filter for type and namespace not being specified', () => {
       expect(
-        getQueryParams({ mappings: MAPPINGS, schema: SCHEMA, namespace: undefined, type: 'saved' })
+        getQueryParams({ mappings: MAPPINGS, registry, namespace: undefined, type: 'saved' })
       ).toEqual({
         query: {
           bool: {
@@ -155,7 +154,7 @@ describe('searchDsl/queryParams', () => {
   describe('type (singular, global)', () => {
     it('includes a terms filter for type and namespace not being specified', () => {
       expect(
-        getQueryParams({ mappings: MAPPINGS, schema: SCHEMA, namespace: undefined, type: 'global' })
+        getQueryParams({ mappings: MAPPINGS, registry, namespace: undefined, type: 'global' })
       ).toEqual({
         query: {
           bool: {
@@ -178,7 +177,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: ['saved', 'global'],
         })
@@ -204,7 +203,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
         })
@@ -230,7 +229,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: undefined,
           search: 'us*',
@@ -270,7 +269,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: undefined,
           search: 'us*',
@@ -310,7 +309,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: ['saved', 'global'],
           search: 'us*',
@@ -346,7 +345,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: 'us*',
@@ -382,7 +381,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: undefined,
           search: 'y*',
@@ -419,7 +418,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: undefined,
           search: 'y*',
@@ -456,7 +455,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: undefined,
           search: 'y*',
@@ -503,7 +502,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: undefined,
           search: 'y*',
@@ -540,7 +539,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: undefined,
           search: 'y*',
@@ -577,7 +576,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: undefined,
           search: 'y*',
@@ -624,7 +623,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: ['saved', 'global'],
           search: 'y*',
@@ -657,7 +656,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: ['saved', 'global'],
           search: 'y*',
@@ -690,7 +689,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: undefined,
           type: ['saved', 'global'],
           search: 'y*',
@@ -726,7 +725,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: 'y*',
@@ -759,7 +758,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: 'y*',
@@ -792,7 +791,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: 'y*',
@@ -828,7 +827,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: 'foo',
@@ -902,7 +901,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           type: ['saved', 'global'],
           search: undefined,
@@ -958,7 +957,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           kueryNode: {
             type: 'function',
@@ -1052,7 +1051,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           kueryNode: {
             type: 'function',
@@ -1189,7 +1188,7 @@ describe('searchDsl/queryParams', () => {
       expect(
         getQueryParams({
           mappings: MAPPINGS,
-          schema: SCHEMA,
+          registry,
           namespace: 'foo-namespace',
           search: 'y*',
           searchFields: ['title'],
diff --git a/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts b/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
index a1e3ae9620299..3fabad6af08ff 100644
--- a/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
+++ b/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
@@ -20,7 +20,7 @@
 import { esKuery } from '../../../../../../plugins/data/server';
 
 import { getRootPropertiesObjects, IndexMapping } from '../../../mappings';
-import { SavedObjectsSchema } from '../../../schema';
+import { ISavedObjectTypeRegistry } from '../../../saved_objects_type_registry';
 
 /**
  * Gets the types based on the type. Uses mappings to support
@@ -61,8 +61,12 @@ function getFieldsForTypes(types: string[], searchFields?: string[]) {
  *  Gets the clause that will filter for the type in the namespace.
  *  Some types are namespace agnostic, so they must be treated differently.
  */
-function getClauseForType(schema: SavedObjectsSchema, namespace: string | undefined, type: string) {
-  if (namespace && !schema.isNamespaceAgnostic(type)) {
+function getClauseForType(
+  registry: ISavedObjectTypeRegistry,
+  namespace: string | undefined,
+  type: string
+) {
+  if (namespace && !registry.isNamespaceAgnostic(type)) {
     return {
       bool: {
         must: [{ term: { type } }, { term: { namespace } }],
@@ -85,7 +89,7 @@ interface HasReferenceQueryParams {
 
 interface QueryParams {
   mappings: IndexMapping;
-  schema: SavedObjectsSchema;
+  registry: ISavedObjectTypeRegistry;
   namespace?: string;
   type?: string | string[];
   search?: string;
@@ -100,7 +104,7 @@ interface QueryParams {
  */
 export function getQueryParams({
   mappings,
-  schema,
+  registry,
   namespace,
   type,
   search,
@@ -140,7 +144,7 @@ export function getQueryParams({
                 },
               ]
             : undefined,
-          should: types.map(shouldType => getClauseForType(schema, namespace, shouldType)),
+          should: types.map(shouldType => getClauseForType(registry, namespace, shouldType)),
           minimum_should_match: 1,
         },
       },
diff --git a/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.test.ts b/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.test.ts
index 97cab3e566d5e..95b7ffd117ee9 100644
--- a/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.test.ts
+++ b/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.test.ts
@@ -20,7 +20,7 @@
 jest.mock('./query_params');
 jest.mock('./sorting_params');
 
-import { schemaMock } from '../../../schema/schema.mock';
+import { typeRegistryMock } from '../../../saved_objects_type_registry.mock';
 import * as queryParamsNS from './query_params';
 import { getSearchDsl } from './search_dsl';
 import * as sortParamsNS from './sorting_params';
@@ -28,8 +28,8 @@ import * as sortParamsNS from './sorting_params';
 const getQueryParams = queryParamsNS.getQueryParams as jest.Mock;
 const getSortingParams = sortParamsNS.getSortingParams as jest.Mock;
 
-const SCHEMA = schemaMock.create();
-const MAPPINGS = { properties: {} };
+const registry = typeRegistryMock.create();
+const mappings = { properties: {} };
 
 describe('getSearchDsl', () => {
   afterEach(() => {
@@ -40,7 +40,7 @@ describe('getSearchDsl', () => {
   describe('validation', () => {
     it('throws when type is not specified', () => {
       expect(() => {
-        getSearchDsl(MAPPINGS, SCHEMA, {
+        getSearchDsl(mappings, registry, {
           type: undefined as any,
           sortField: 'title',
         });
@@ -48,7 +48,7 @@ describe('getSearchDsl', () => {
     });
     it('throws when sortOrder without sortField', () => {
       expect(() => {
-        getSearchDsl(MAPPINGS, SCHEMA, {
+        getSearchDsl(mappings, registry, {
           type: 'foo',
           sortOrder: 'desc',
         });
@@ -70,11 +70,11 @@ describe('getSearchDsl', () => {
         },
       };
 
-      getSearchDsl(MAPPINGS, SCHEMA, opts);
+      getSearchDsl(mappings, registry, opts);
       expect(getQueryParams).toHaveBeenCalledTimes(1);
       expect(getQueryParams).toHaveBeenCalledWith({
-        mappings: MAPPINGS,
-        schema: SCHEMA,
+        mappings,
+        registry,
         namespace: opts.namespace,
         type: opts.type,
         search: opts.search,
@@ -92,10 +92,10 @@ describe('getSearchDsl', () => {
         sortOrder: 'baz',
       };
 
-      getSearchDsl(MAPPINGS, SCHEMA, opts);
+      getSearchDsl(mappings, registry, opts);
       expect(getSortingParams).toHaveBeenCalledTimes(1);
       expect(getSortingParams).toHaveBeenCalledWith(
-        MAPPINGS,
+        mappings,
         opts.type,
         opts.sortField,
         opts.sortOrder
@@ -105,7 +105,7 @@ describe('getSearchDsl', () => {
     it('returns combination of getQueryParams and getSortingParams', () => {
       getQueryParams.mockReturnValue({ a: 'a' });
       getSortingParams.mockReturnValue({ b: 'b' });
-      expect(getSearchDsl(MAPPINGS, SCHEMA, { type: 'foo' })).toEqual({ a: 'a', b: 'b' });
+      expect(getSearchDsl(mappings, registry, { type: 'foo' })).toEqual({ a: 'a', b: 'b' });
     });
   });
 });
diff --git a/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts b/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts
index 1b6e1361bb92a..75ab058a38be9 100644
--- a/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts
+++ b/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts
@@ -20,11 +20,11 @@
 import Boom from 'boom';
 
 import { IndexMapping } from '../../../mappings';
-import { SavedObjectsSchema } from '../../../schema';
 import { getQueryParams } from './query_params';
 import { getSortingParams } from './sorting_params';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { esKuery } from '../../../../../../plugins/data/server';
+import { ISavedObjectTypeRegistry } from '../../../saved_objects_type_registry';
 
 interface GetSearchDslOptions {
   type: string | string[];
@@ -43,7 +43,7 @@ interface GetSearchDslOptions {
 
 export function getSearchDsl(
   mappings: IndexMapping,
-  schema: SavedObjectsSchema,
+  registry: ISavedObjectTypeRegistry,
   options: GetSearchDslOptions
 ) {
   const {
@@ -69,7 +69,7 @@ export function getSearchDsl(
   return {
     ...getQueryParams({
       mappings,
-      schema,
+      registry,
       namespace,
       type,
       search,
diff --git a/src/core/server/saved_objects/types.ts b/src/core/server/saved_objects/types.ts
index a3fe2b937635b..980ba005e0eeb 100644
--- a/src/core/server/saved_objects/types.ts
+++ b/src/core/server/saved_objects/types.ts
@@ -18,9 +18,8 @@
  */
 
 import { SavedObjectsClient } from './service/saved_objects_client';
-import { SavedObjectsMapping } from './mappings';
-import { MigrationDefinition } from './migrations/core/document_migrator';
-import { SavedObjectsSchemaDefinition } from './schema';
+import { SavedObjectsTypeMappingDefinition, SavedObjectsTypeMappingDefinitions } from './mappings';
+import { SavedObjectMigrationMap } from './migrations';
 import { PropertyValidators } from './validation';
 
 export {
@@ -34,6 +33,7 @@ export {
 } from './import/types';
 
 import { SavedObjectAttributes } from '../../types';
+import { LegacyConfig } from '../legacy';
 export {
   SavedObjectAttributes,
   SavedObjectAttribute,
@@ -208,13 +208,88 @@ export type MutatingOperationRefreshSetting = boolean | 'wait_for';
  */
 export type SavedObjectsClientContract = Pick<SavedObjectsClient, keyof SavedObjectsClient>;
 
+/**
+ * @remarks This is only internal for now, and will only be public when we expose the registerType API
+ *
+ * @public
+ */
+export interface SavedObjectsType {
+  /**
+   * The name of the type, which is also used as the internal id.
+   */
+  name: string;
+  /**
+   * Is the type hidden by default. If true, repositories will not have access to this type unless explicitly
+   * declared as an `extraType` when creating the repository.
+   *
+   * See {@link SavedObjectsServiceStart.createInternalRepository | createInternalRepository}.
+   */
+  hidden: boolean;
+  /**
+   * Is the type global (true), or namespaced (false).
+   */
+  namespaceAgnostic: boolean;
+  /**
+   * If defined, the type instances will be stored in the given index instead of the default one.
+   */
+  indexPattern?: string;
+  /**
+   * If defined, will be used to convert the type to an alias.
+   */
+  convertToAliasScript?: string;
+  /**
+   * The {@link SavedObjectsTypeMappingDefinition | mapping definition} for the type.
+   */
+  mappings: SavedObjectsTypeMappingDefinition;
+  /**
+   * An optional map of {@link SavedObjectMigrationFn | migrations} to be used to migrate the type.
+   */
+  migrations?: SavedObjectMigrationMap;
+}
+
 /**
  * @internal
  * @deprecated
  */
 export interface SavedObjectsLegacyUiExports {
-  savedObjectMappings: SavedObjectsMapping[];
-  savedObjectMigrations: MigrationDefinition;
-  savedObjectSchemas: SavedObjectsSchemaDefinition;
+  savedObjectMappings: SavedObjectsLegacyMapping[];
+  savedObjectMigrations: SavedObjectsLegacyMigrationDefinitions;
+  savedObjectSchemas: SavedObjectsLegacySchemaDefinitions;
   savedObjectValidations: PropertyValidators;
 }
+
+/**
+ * @internal
+ * @deprecated
+ */
+export interface SavedObjectsLegacyMapping {
+  pluginId: string;
+  properties: SavedObjectsTypeMappingDefinitions;
+}
+
+/**
+ * @internal
+ * @deprecated
+ */
+export interface SavedObjectsLegacyMigrationDefinitions {
+  [type: string]: SavedObjectMigrationMap;
+}
+
+/**
+ * @internal
+ * @deprecated
+ */
+interface SavedObjectsLegacyTypeSchema {
+  isNamespaceAgnostic?: boolean;
+  hidden?: boolean;
+  indexPattern?: ((config: LegacyConfig) => string) | string;
+  convertToAliasScript?: string;
+}
+
+/**
+ * @internal
+ * @deprecated
+ */
+export interface SavedObjectsLegacySchemaDefinitions {
+  [type: string]: SavedObjectsLegacyTypeSchema;
+}
diff --git a/src/core/server/saved_objects/utils.test.ts b/src/core/server/saved_objects/utils.test.ts
new file mode 100644
index 0000000000000..d1c15517e94a6
--- /dev/null
+++ b/src/core/server/saved_objects/utils.test.ts
@@ -0,0 +1,285 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { legacyServiceMock } from '../legacy/legacy_service.mock';
+import { convertLegacyTypes, convertTypesToLegacySchema } from './utils';
+import { SavedObjectsLegacyUiExports, SavedObjectsType } from './types';
+import { LegacyConfig } from 'kibana/server';
+
+describe('convertLegacyTypes', () => {
+  let legacyConfig: ReturnType<typeof legacyServiceMock.createLegacyConfig>;
+
+  beforeEach(() => {
+    legacyConfig = legacyServiceMock.createLegacyConfig();
+  });
+
+  it('converts the legacy mappings using default values if no schemas are specified', () => {
+    const uiExports: SavedObjectsLegacyUiExports = {
+      savedObjectMappings: [
+        {
+          pluginId: 'pluginA',
+          properties: {
+            typeA: {
+              properties: {
+                fieldA: { type: 'text' },
+              },
+            },
+            typeB: {
+              properties: {
+                fieldB: { type: 'text' },
+              },
+            },
+          },
+        },
+        {
+          pluginId: 'pluginB',
+          properties: {
+            typeC: {
+              properties: {
+                fieldC: { type: 'text' },
+              },
+            },
+          },
+        },
+      ],
+      savedObjectMigrations: {},
+      savedObjectSchemas: {},
+      savedObjectValidations: {},
+    };
+
+    const converted = convertLegacyTypes(uiExports, legacyConfig);
+    expect(converted).toMatchSnapshot();
+  });
+
+  it('merges the mappings and the schema to create the type when schema exists for the type', () => {
+    const uiExports: SavedObjectsLegacyUiExports = {
+      savedObjectMappings: [
+        {
+          pluginId: 'pluginA',
+          properties: {
+            typeA: {
+              properties: {
+                fieldA: { type: 'text' },
+              },
+            },
+          },
+        },
+        {
+          pluginId: 'pluginB',
+          properties: {
+            typeC: {
+              properties: {
+                fieldC: { type: 'text' },
+              },
+            },
+          },
+        },
+      ],
+      savedObjectMigrations: {},
+      savedObjectSchemas: {
+        typeA: {
+          indexPattern: 'fooBar',
+          hidden: true,
+          isNamespaceAgnostic: true,
+        },
+      },
+      savedObjectValidations: {},
+    };
+
+    const converted = convertLegacyTypes(uiExports, legacyConfig);
+    expect(converted).toMatchSnapshot();
+  });
+
+  it('invokes indexPattern to retrieve the index when it is a function', () => {
+    const indexPatternAccessor: (config: LegacyConfig) => string = jest.fn(config => {
+      config.get('foo.bar');
+      return 'myIndex';
+    });
+
+    const uiExports: SavedObjectsLegacyUiExports = {
+      savedObjectMappings: [
+        {
+          pluginId: 'pluginA',
+          properties: {
+            typeA: {
+              properties: {
+                fieldA: { type: 'text' },
+              },
+            },
+          },
+        },
+      ],
+      savedObjectMigrations: {},
+      savedObjectSchemas: {
+        typeA: {
+          indexPattern: indexPatternAccessor,
+          hidden: true,
+          isNamespaceAgnostic: true,
+        },
+      },
+      savedObjectValidations: {},
+    };
+
+    const converted = convertLegacyTypes(uiExports, legacyConfig);
+
+    expect(indexPatternAccessor).toHaveBeenCalledWith(legacyConfig);
+    expect(legacyConfig.get).toHaveBeenCalledWith('foo.bar');
+    expect(converted.length).toEqual(1);
+    expect(converted[0].indexPattern).toEqual('myIndex');
+  });
+
+  it('import migrations from the uiExports', () => {
+    const migrationsA = {
+      '1.0.0': jest.fn(),
+      '2.0.4': jest.fn(),
+    };
+    const migrationsB = {
+      '1.5.3': jest.fn(),
+    };
+
+    const uiExports: SavedObjectsLegacyUiExports = {
+      savedObjectMappings: [
+        {
+          pluginId: 'pluginA',
+          properties: {
+            typeA: {
+              properties: {
+                fieldA: { type: 'text' },
+              },
+            },
+          },
+        },
+        {
+          pluginId: 'pluginB',
+          properties: {
+            typeB: {
+              properties: {
+                fieldC: { type: 'text' },
+              },
+            },
+          },
+        },
+      ],
+      savedObjectMigrations: {
+        typeA: migrationsA,
+        typeB: migrationsB,
+      },
+      savedObjectSchemas: {},
+      savedObjectValidations: {},
+    };
+
+    const converted = convertLegacyTypes(uiExports, legacyConfig);
+    expect(converted.length).toEqual(2);
+    expect(converted[0].migrations).toEqual(migrationsA);
+    expect(converted[1].migrations).toEqual(migrationsB);
+  });
+
+  it('merges everything when all are present', () => {
+    const uiExports: SavedObjectsLegacyUiExports = {
+      savedObjectMappings: [
+        {
+          pluginId: 'pluginA',
+          properties: {
+            typeA: {
+              properties: {
+                fieldA: { type: 'text' },
+              },
+            },
+            typeB: {
+              properties: {
+                fieldB: { type: 'text' },
+                anotherFieldB: { type: 'boolean' },
+              },
+            },
+          },
+        },
+        {
+          pluginId: 'pluginB',
+          properties: {
+            typeC: {
+              properties: {
+                fieldC: { type: 'text' },
+              },
+            },
+          },
+        },
+      ],
+      savedObjectMigrations: {
+        typeA: {
+          '1.0.0': jest.fn(),
+          '2.0.4': jest.fn(),
+        },
+        typeC: {
+          '1.5.3': jest.fn(),
+        },
+      },
+      savedObjectSchemas: {
+        typeA: {
+          indexPattern: jest.fn(config => {
+            config.get('foo.bar');
+            return 'myIndex';
+          }),
+          hidden: true,
+          isNamespaceAgnostic: true,
+        },
+        typeB: {
+          convertToAliasScript: 'some alias script',
+          hidden: false,
+        },
+      },
+      savedObjectValidations: {},
+    };
+
+    const converted = convertLegacyTypes(uiExports, legacyConfig);
+    expect(converted).toMatchSnapshot();
+  });
+});
+
+describe('convertTypesToLegacySchema', () => {
+  it('converts types to the legacy schema format', () => {
+    const types: SavedObjectsType[] = [
+      {
+        name: 'typeA',
+        hidden: false,
+        namespaceAgnostic: true,
+        mappings: { properties: {} },
+        convertToAliasScript: 'some script',
+      },
+      {
+        name: 'typeB',
+        hidden: true,
+        namespaceAgnostic: false,
+        indexPattern: 'myIndex',
+        mappings: { properties: {} },
+      },
+    ];
+    expect(convertTypesToLegacySchema(types)).toEqual({
+      typeA: {
+        hidden: false,
+        isNamespaceAgnostic: true,
+        convertToAliasScript: 'some script',
+      },
+      typeB: {
+        hidden: true,
+        isNamespaceAgnostic: false,
+        indexPattern: 'myIndex',
+      },
+    });
+  });
+});
diff --git a/src/core/server/saved_objects/utils.ts b/src/core/server/saved_objects/utils.ts
new file mode 100644
index 0000000000000..5c4d0ccb84b25
--- /dev/null
+++ b/src/core/server/saved_objects/utils.ts
@@ -0,0 +1,76 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { LegacyConfig } from '../legacy';
+import { SavedObjectsType, SavedObjectsLegacyUiExports } from './types';
+import { SavedObjectsSchemaDefinition } from './schema';
+
+/**
+ * Converts the legacy savedObjects mappings, schema, and migrations
+ * to actual {@link SavedObjectsType | saved object types}
+ */
+export const convertLegacyTypes = (
+  {
+    savedObjectMappings = [],
+    savedObjectMigrations = {},
+    savedObjectSchemas = {},
+  }: SavedObjectsLegacyUiExports,
+  legacyConfig: LegacyConfig
+): SavedObjectsType[] => {
+  return savedObjectMappings.reduce((types, { pluginId, properties }) => {
+    return [
+      ...types,
+      ...Object.entries(properties).map(([type, mappings]) => {
+        const schema = savedObjectSchemas[type];
+        const migrations = savedObjectMigrations[type];
+        return {
+          name: type,
+          hidden: schema?.hidden ?? false,
+          namespaceAgnostic: schema?.isNamespaceAgnostic ?? false,
+          mappings,
+          indexPattern:
+            typeof schema?.indexPattern === 'function'
+              ? schema.indexPattern(legacyConfig)
+              : schema?.indexPattern,
+          convertToAliasScript: schema?.convertToAliasScript,
+          migrations: migrations ?? {},
+        };
+      }),
+    ];
+  }, [] as SavedObjectsType[]);
+};
+
+/**
+ * Convert {@link SavedObjectsType | saved object types} to the legacy {@link SavedObjectsSchemaDefinition | schema} format
+ */
+export const convertTypesToLegacySchema = (
+  types: SavedObjectsType[]
+): SavedObjectsSchemaDefinition => {
+  return types.reduce((schema, type) => {
+    return {
+      ...schema,
+      [type.name]: {
+        isNamespaceAgnostic: type.namespaceAgnostic,
+        hidden: type.hidden,
+        indexPattern: type.indexPattern,
+        convertToAliasScript: type.convertToAliasScript,
+      },
+    };
+  }, {} as SavedObjectsSchemaDefinition);
+};
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index fb27fcccc2abe..cf8fafd7ea7c4 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -1102,6 +1102,8 @@ export interface LogRecord {
         [name: string]: any;
     };
     // (undocumented)
+    pid: number;
+    // (undocumented)
     timestamp: Date;
 }
 
@@ -1421,6 +1423,19 @@ export interface SavedObjectAttributes {
 // @public
 export type SavedObjectAttributeSingle = string | number | boolean | null | undefined | SavedObjectAttributes;
 
+// Warning: (ae-forgotten-export) The symbol "SavedObjectUnsanitizedDoc" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "SavedObjectMigrationFn" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+// Warning: (ae-unresolved-link) The @link reference could not be resolved: The package "kibana" does not have an export "SavedObjectUnsanitizedDoc"
+//
+// @public
+export type SavedObjectMigrationFn = (doc: SavedObjectUnsanitizedDoc, log: SavedObjectsMigrationLogger) => SavedObjectUnsanitizedDoc;
+
+// @public
+export interface SavedObjectMigrationMap {
+    // (undocumented)
+    [version: string]: SavedObjectMigrationFn;
+}
+
 // @public
 export interface SavedObjectReference {
     // (undocumented)
@@ -1431,6 +1446,12 @@ export interface SavedObjectReference {
     type: string;
 }
 
+// Warning: (ae-forgotten-export) The symbol "SavedObjectDoc" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "Referencable" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type SavedObjectSanitizedDoc = SavedObjectDoc & Referencable;
+
 // @public (undocumented)
 export interface SavedObjectsBaseOptions {
     namespace?: string;
@@ -1534,6 +1555,32 @@ export interface SavedObjectsClientWrapperOptions {
     request: KibanaRequest;
 }
 
+// @public
+export interface SavedObjectsComplexFieldMapping {
+    // (undocumented)
+    dynamic?: string;
+    // (undocumented)
+    properties: SavedObjectsMappingProperties;
+    // (undocumented)
+    type?: string;
+}
+
+// @public
+export interface SavedObjectsCoreFieldMapping {
+    // (undocumented)
+    enabled?: boolean;
+    // (undocumented)
+    fields?: {
+        [subfield: string]: {
+            type: string;
+        };
+    };
+    // (undocumented)
+    index?: boolean;
+    // (undocumented)
+    type: string;
+}
+
 // @public (undocumented)
 export interface SavedObjectsCreateOptions extends SavedObjectsBaseOptions {
     id?: string;
@@ -1629,6 +1676,9 @@ export interface SavedObjectsExportResultDetails {
     }>;
 }
 
+// @public
+export type SavedObjectsFieldMapping = SavedObjectsCoreFieldMapping | SavedObjectsComplexFieldMapping;
+
 // @public (undocumented)
 export interface SavedObjectsFindOptions extends SavedObjectsBaseOptions {
     // (undocumented)
@@ -1793,6 +1843,12 @@ export interface SavedObjectsLegacyService {
     types: string[];
 }
 
+// @public
+export interface SavedObjectsMappingProperties {
+    // (undocumented)
+    [field: string]: SavedObjectsFieldMapping;
+}
+
 // @public (undocumented)
 export interface SavedObjectsMigrationLogger {
     // (undocumented)
@@ -1800,6 +1856,8 @@ export interface SavedObjectsMigrationLogger {
     // (undocumented)
     info: (msg: string) => void;
     // (undocumented)
+    warn: (msg: string) => void;
+    // @deprecated (undocumented)
     warning: (msg: string) => void;
 }
 
@@ -1809,8 +1867,6 @@ export interface SavedObjectsMigrationVersion {
     [pluginName: string]: string;
 }
 
-// Warning: (ae-missing-release-tag) "RawDoc" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
 // @public
 export interface SavedObjectsRawDoc {
     // (undocumented)
@@ -1819,8 +1875,10 @@ export interface SavedObjectsRawDoc {
     _primary_term?: number;
     // (undocumented)
     _seq_no?: number;
+    // Warning: (ae-forgotten-export) The symbol "SavedObjectsRawDocSource" needs to be exported by the entry point index.d.ts
+    //
     // (undocumented)
-    _source: any;
+    _source: SavedObjectsRawDocSource;
     // (undocumented)
     _type?: string;
 }
@@ -1834,7 +1892,7 @@ export class SavedObjectsRepository {
     // Warning: (ae-forgotten-export) The symbol "KibanaMigrator" needs to be exported by the entry point index.d.ts
     //
     // @internal
-    static createRepository(migrator: KibanaMigrator, schema: SavedObjectsSchema, config: LegacyConfig, indexName: string, callCluster: APICaller, extraTypes?: string[], injectedConstructor?: any): ISavedObjectsRepository;
+    static createRepository(migrator: KibanaMigrator, typeRegistry: SavedObjectTypeRegistry, indexName: string, callCluster: APICaller, extraTypes?: string[], injectedConstructor?: any): ISavedObjectsRepository;
     delete(type: string, id: string, options?: SavedObjectsDeleteOptions): Promise<{}>;
     deleteByNamespace(namespace: string, options?: SavedObjectsDeleteByNamespaceOptions): Promise<any>;
     // (undocumented)
@@ -1873,7 +1931,7 @@ export interface SavedObjectsResolveImportErrorsOptions {
     supportedTypes: string[];
 }
 
-// @internal (undocumented)
+// @internal @deprecated (undocumented)
 export class SavedObjectsSchema {
     // Warning: (ae-forgotten-export) The symbol "SavedObjectsSchemaDefinition" needs to be exported by the entry point index.d.ts
     constructor(schemaDefinition?: SavedObjectsSchemaDefinition);
@@ -1887,14 +1945,16 @@ export class SavedObjectsSchema {
     isNamespaceAgnostic(type: string): boolean;
 }
 
-// @internal (undocumented)
+// @public
 export class SavedObjectsSerializer {
-    constructor(schema: SavedObjectsSchema);
+    // Warning: (ae-forgotten-export) The symbol "ISavedObjectTypeRegistry" needs to be exported by the entry point index.d.ts
+    //
+    // @internal
+    constructor(registry: ISavedObjectTypeRegistry);
     generateRawId(namespace: string | undefined, type: string, id?: string): string;
-    isRawSavedObject(rawDoc: SavedObjectsRawDoc): any;
-    // Warning: (ae-forgotten-export) The symbol "SanitizedSavedObjectDoc" needs to be exported by the entry point index.d.ts
-    rawToSavedObject(doc: SavedObjectsRawDoc): SanitizedSavedObjectDoc;
-    savedObjectToRaw(savedObj: SanitizedSavedObjectDoc): SavedObjectsRawDoc;
+    isRawSavedObject(rawDoc: SavedObjectsRawDoc): boolean;
+    rawToSavedObject(doc: SavedObjectsRawDoc): SavedObjectSanitizedDoc;
+    savedObjectToRaw(savedObj: SavedObjectSanitizedDoc): SavedObjectsRawDoc;
     }
 
 // @public
@@ -1907,9 +1967,27 @@ export interface SavedObjectsServiceSetup {
 export interface SavedObjectsServiceStart {
     createInternalRepository: (extraTypes?: string[]) => ISavedObjectsRepository;
     createScopedRepository: (req: KibanaRequest, extraTypes?: string[]) => ISavedObjectsRepository;
+    createSerializer: () => SavedObjectsSerializer;
     getScopedClient: (req: KibanaRequest, options?: SavedObjectsClientProviderOptions) => SavedObjectsClientContract;
 }
 
+// @public (undocumented)
+export interface SavedObjectsType {
+    convertToAliasScript?: string;
+    hidden: boolean;
+    indexPattern?: string;
+    mappings: SavedObjectsTypeMappingDefinition;
+    migrations?: SavedObjectMigrationMap;
+    name: string;
+    namespaceAgnostic: boolean;
+}
+
+// @public
+export interface SavedObjectsTypeMappingDefinition {
+    // (undocumented)
+    properties: SavedObjectsMappingProperties;
+}
+
 // @public (undocumented)
 export interface SavedObjectsUpdateOptions extends SavedObjectsBaseOptions {
     references?: SavedObjectReference[];
@@ -1925,6 +2003,16 @@ export interface SavedObjectsUpdateResponse<T extends SavedObjectAttributes = an
     references: SavedObjectReference[] | undefined;
 }
 
+// @internal
+export class SavedObjectTypeRegistry {
+    getAllTypes(): SavedObjectsType[];
+    getIndex(type: string): string | undefined;
+    getType(type: string): SavedObjectsType | undefined;
+    isHidden(type: string): boolean;
+    isNamespaceAgnostic(type: string): boolean;
+    registerType(type: SavedObjectsType): void;
+    }
+
 // @public
 export type ScopeableRequest = KibanaRequest | LegacyRequest | FakeRequest;
 
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.js b/src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.js
index 6ad34c439a233..5832d00162b20 100755
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.js
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.js
@@ -102,6 +102,9 @@ function generator({
   RUN chmod g+ws /usr/share/kibana && \\
       find /usr/share/kibana -gid 0 -and -not -perm /g+w -exec chmod g+w {} \\;
 
+  # Remove the suid bit everywhere to mitigate "Stack Clash"
+  RUN find / -xdev -perm -4000 -exec chmod u-s {} +
+
   # Provide a non-root user to run the process.
   RUN groupadd --gid 1000 kibana && \\
       useradd --uid 1000 --gid 1000 \\
diff --git a/src/es_archiver/lib/indices/kibana_index.ts b/src/es_archiver/lib/indices/kibana_index.ts
index de67ba7c4e31e..56be86a23eda0 100644
--- a/src/es_archiver/lib/indices/kibana_index.ts
+++ b/src/es_archiver/lib/indices/kibana_index.ts
@@ -28,7 +28,9 @@ import { ToolingLog } from '@kbn/dev-utils';
 import { Stats } from '../stats';
 import { deleteIndex } from './delete_index';
 import { KibanaMigrator } from '../../../core/server/saved_objects/migrations';
-import { SavedObjectsSchema } from '../../../core/server/saved_objects';
+import { LegacyConfig } from '../../../core/server';
+import { convertLegacyTypes } from '../../../core/server/saved_objects/utils';
+import { SavedObjectTypeRegistry } from '../../../core/server/saved_objects';
 // @ts-ignore
 import { collectUiExports } from '../../../legacy/ui/ui_exports';
 // @ts-ignore
@@ -101,9 +103,14 @@ export async function migrateKibanaIndex({
   const uiExports = await getUiExports(kibanaPluginIds);
   const kibanaVersion = await loadKibanaVersion();
 
-  const config: Record<string, string> = {
+  const configKeys: Record<string, string> = {
     'xpack.task_manager.index': '.kibana_task_manager',
   };
+  const config = { get: (path: string) => configKeys[path] };
+
+  const savedObjectTypes = convertLegacyTypes(uiExports, config as LegacyConfig);
+  const typeRegistry = new SavedObjectTypeRegistry();
+  savedObjectTypes.forEach(type => typeRegistry.registerType(type));
 
   const logger = {
     trace: log.verbose.bind(log),
@@ -117,7 +124,6 @@ export async function migrateKibanaIndex({
   };
 
   const migratorOptions = {
-    config: { get: (path: string) => config[path] } as any,
     savedObjectsConfig: {
       scrollDuration: '5m',
       batchSize: 100,
@@ -129,9 +135,7 @@ export async function migrateKibanaIndex({
     } as any,
     logger,
     kibanaVersion,
-    savedObjectSchemas: new SavedObjectsSchema(uiExports.savedObjectSchemas),
-    savedObjectMappings: uiExports.savedObjectMappings,
-    savedObjectMigrations: uiExports.savedObjectMigrations,
+    typeRegistry,
     savedObjectValidations: uiExports.savedObjectValidations,
     callCluster: (path: string, ...args: any[]) =>
       (get(client, path) as Function).call(client, ...args),
diff --git a/src/legacy/core_plugins/console_legacy/public/styles/_app.scss b/src/legacy/core_plugins/console_legacy/public/styles/_app.scss
index 3b6297f9cdbff..865a4fc7fafb0 100644
--- a/src/legacy/core_plugins/console_legacy/public/styles/_app.scss
+++ b/src/legacy/core_plugins/console_legacy/public/styles/_app.scss
@@ -48,6 +48,7 @@
   button {
     line-height: inherit;
   }
+
   position: absolute;
   z-index: $euiZLevel1;
   top: 0;
@@ -89,3 +90,12 @@
 .conApp__settingsModal {
   min-width: 460px;
 }
+
+.conApp__requestProgressBarContainer {
+  position: relative;
+  z-index: $euiZLevel2;
+}
+
+.conApp__tabsExtension {
+  border-bottom: $euiBorderThin;
+}
diff --git a/src/legacy/core_plugins/data/public/actions/filters/brush_event.test.js b/src/legacy/core_plugins/data/public/actions/filters/brush_event.test.js
index a6fe58503cd02..743f6caee4edd 100644
--- a/src/legacy/core_plugins/data/public/actions/filters/brush_event.test.js
+++ b/src/legacy/core_plugins/data/public/actions/filters/brush_event.test.js
@@ -21,7 +21,7 @@ import _ from 'lodash';
 import moment from 'moment';
 import expect from '@kbn/expect';
 
-jest.mock('../../../../../ui/public/agg_types/agg_configs', () => ({
+jest.mock('../../search/aggs', () => ({
   AggConfigs: function AggConfigs() {
     return {
       createAggConfig: ({ params }) => ({
diff --git a/src/legacy/core_plugins/data/public/actions/select_range_action.ts b/src/legacy/core_plugins/data/public/actions/select_range_action.ts
index 4ea5c78a9fd2b..7e1135ca96f9e 100644
--- a/src/legacy/core_plugins/data/public/actions/select_range_action.ts
+++ b/src/legacy/core_plugins/data/public/actions/select_range_action.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 import {
-  IAction,
+  Action,
   createAction,
   IncompatibleActionError,
 } from '../../../../../plugins/ui_actions/public';
@@ -55,7 +55,7 @@ async function isCompatible(context: ActionContext) {
 export function selectRangeAction(
   filterManager: FilterManager,
   timeFilter: TimefilterContract
-): IAction<ActionContext> {
+): Action<ActionContext> {
   return createAction<ActionContext>({
     type: SELECT_RANGE_ACTION,
     id: SELECT_RANGE_ACTION,
diff --git a/src/legacy/core_plugins/data/public/actions/value_click_action.ts b/src/legacy/core_plugins/data/public/actions/value_click_action.ts
index 2f622eb1eb669..1e474b8f9355c 100644
--- a/src/legacy/core_plugins/data/public/actions/value_click_action.ts
+++ b/src/legacy/core_plugins/data/public/actions/value_click_action.ts
@@ -20,7 +20,7 @@
 import { i18n } from '@kbn/i18n';
 import { toMountPoint } from '../../../../../plugins/kibana_react/public';
 import {
-  IAction,
+  Action,
   createAction,
   IncompatibleActionError,
 } from '../../../../../plugins/ui_actions/public';
@@ -58,7 +58,7 @@ async function isCompatible(context: ActionContext) {
 export function valueClickAction(
   filterManager: FilterManager,
   timeFilter: TimefilterContract
-): IAction<ActionContext> {
+): Action<ActionContext> {
   return createAction<ActionContext>({
     type: VALUE_CLICK_ACTION,
     id: VALUE_CLICK_ACTION,
diff --git a/src/legacy/core_plugins/data/public/index.ts b/src/legacy/core_plugins/data/public/index.ts
index 7fe487667f94e..50120292a627a 100644
--- a/src/legacy/core_plugins/data/public/index.ts
+++ b/src/legacy/core_plugins/data/public/index.ts
@@ -18,7 +18,7 @@
  */
 
 // /// Define plugin function
-import { DataPlugin as Plugin, DataStart } from './plugin';
+import { DataPlugin as Plugin } from './plugin';
 
 export function plugin() {
   return new Plugin();
@@ -27,14 +27,58 @@ export function plugin() {
 // /// Export types & static code
 
 /** @public types */
-export { DataStart };
+export { DataSetup, DataStart } from './plugin';
 export {
   SavedQueryAttributes,
   SavedQuery,
   SavedQueryTimeFilter,
 } from '../../../../plugins/data/public';
+export {
+  // agg_types
+  AggParam,
+  AggParamOption,
+  DateRangeKey,
+  IAggConfig,
+  IAggConfigs,
+  IAggType,
+  IFieldParamType,
+  IMetricAggType,
+  IpRangeKey,
+  ISchemas,
+  OptionedParamEditorProps,
+  OptionedValueProp,
+} from './search/types';
 
 /** @public static code */
 export * from '../common';
 export { FilterStateManager } from './filter/filter_manager';
-export { getRequestInspectorStats, getResponseInspectorStats } from './search';
+export {
+  // agg_types TODO need to group these under a namespace or prefix
+  AggParamType,
+  AggTypeFilters, // TODO convert to interface
+  aggTypeFilters,
+  AggTypeFieldFilters, // TODO convert to interface
+  AggGroupNames,
+  aggGroupNamesMap,
+  BUCKET_TYPES,
+  CidrMask,
+  convertDateRangeToString,
+  convertIPRangeToString,
+  intervalOptions, // only used in Discover
+  isDateHistogramBucketAggConfig,
+  isStringType,
+  isType,
+  isValidInterval,
+  isValidJson,
+  METRIC_TYPES,
+  OptionedParamType,
+  parentPipelineType,
+  propFilter,
+  Schema,
+  Schemas,
+  siblingPipelineType,
+  termsAggFilter,
+  // search_source
+  getRequestInspectorStats,
+  getResponseInspectorStats,
+} from './search';
diff --git a/src/legacy/core_plugins/data/public/plugin.ts b/src/legacy/core_plugins/data/public/plugin.ts
index da35366cdff31..e13e8e34eaebe 100644
--- a/src/legacy/core_plugins/data/public/plugin.ts
+++ b/src/legacy/core_plugins/data/public/plugin.ts
@@ -43,17 +43,28 @@ import {
   VALUE_CLICK_TRIGGER,
   // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 } from '../../../../plugins/embeddable/public/lib/triggers';
-import { IUiActionsSetup, IUiActionsStart } from '../../../../plugins/ui_actions/public';
+import { UiActionsSetup, UiActionsStart } from '../../../../plugins/ui_actions/public';
+
+import { SearchSetup, SearchStart, SearchService } from './search/search_service';
 
 export interface DataPluginSetupDependencies {
   data: DataPublicPluginSetup;
   expressions: ExpressionsSetup;
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
 }
 
 export interface DataPluginStartDependencies {
   data: DataPublicPluginStart;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
+}
+
+/**
+ * Interface for this plugin's returned `setup` contract.
+ *
+ * @public
+ */
+export interface DataSetup {
+  search: SearchSetup;
 }
 
 /**
@@ -61,7 +72,9 @@ export interface DataPluginStartDependencies {
  *
  * @public
  */
-export interface DataStart {} // eslint-disable-line @typescript-eslint/no-empty-interface
+export interface DataStart {
+  search: SearchStart;
+}
 
 /**
  * Data Plugin - public
@@ -76,7 +89,10 @@ export interface DataStart {} // eslint-disable-line @typescript-eslint/no-empty
  */
 
 export class DataPlugin
-  implements Plugin<void, DataStart, DataPluginSetupDependencies, DataPluginStartDependencies> {
+  implements
+    Plugin<DataSetup, DataStart, DataPluginSetupDependencies, DataPluginStartDependencies> {
+  private readonly search = new SearchService();
+
   public setup(core: CoreSetup, { data, uiActions }: DataPluginSetupDependencies) {
     setInjectedMetadata(core.injectedMetadata);
 
@@ -89,6 +105,10 @@ export class DataPlugin
     uiActions.registerAction(
       valueClickAction(data.query.filterManager, data.query.timefilter.timefilter)
     );
+
+    return {
+      search: this.search.setup(core),
+    };
   }
 
   public start(core: CoreStart, { data, uiActions }: DataPluginStartDependencies): DataStart {
@@ -102,7 +122,9 @@ export class DataPlugin
     uiActions.attachAction(SELECT_RANGE_TRIGGER, SELECT_RANGE_ACTION);
     uiActions.attachAction(VALUE_CLICK_TRIGGER, VALUE_CLICK_ACTION);
 
-    return {};
+    return {
+      search: this.search.start(core),
+    };
   }
 
   public stop() {}
diff --git a/src/legacy/ui/public/agg_types/__tests__/buckets/_terms_other_bucket_helper.js b/src/legacy/core_plugins/data/public/search/aggs/__tests__/buckets/_terms_other_bucket_helper.js
similarity index 99%
rename from src/legacy/ui/public/agg_types/__tests__/buckets/_terms_other_bucket_helper.js
rename to src/legacy/core_plugins/data/public/search/aggs/__tests__/buckets/_terms_other_bucket_helper.js
index acf932c1fb451..247290731df57 100644
--- a/src/legacy/ui/public/agg_types/__tests__/buckets/_terms_other_bucket_helper.js
+++ b/src/legacy/core_plugins/data/public/search/aggs/__tests__/buckets/_terms_other_bucket_helper.js
@@ -24,7 +24,7 @@ import {
   mergeOtherBucketAggResponse,
   updateMissingBucket,
 } from '../../buckets/_terms_other_bucket_helper';
-import { Vis } from '../../../../../core_plugins/visualizations/public';
+import { Vis } from '../../../../../../../core_plugins/visualizations/public';
 import FixturesStubbedLogstashIndexPatternProvider from 'fixtures/stubbed_logstash_index_pattern';
 
 const visConfigSingleTerm = {
diff --git a/src/legacy/ui/public/agg_types/agg_config.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_config.ts
similarity index 92%
rename from src/legacy/ui/public/agg_types/agg_config.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_config.ts
index 17a8b14b57d02..ba7faf8c34b59 100644
--- a/src/legacy/ui/public/agg_types/agg_config.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_config.ts
@@ -27,17 +27,17 @@
 import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { npStart } from 'ui/new_platform';
-import { AggType } from './agg_type';
+import { IAggType } from './agg_type';
 import { AggGroupNames } from './agg_groups';
 import { writeParams } from './agg_params';
-import { AggConfigs } from './agg_configs';
+import { IAggConfigs } from './agg_configs';
 import { Schema } from './schemas';
 import {
   ISearchSource,
   FetchOptions,
   fieldFormats,
   KBN_FIELD_TYPES,
-} from '../../../../plugins/data/public';
+} from '../../../../../../plugins/data/public';
 
 export interface AggConfigOptions {
   enabled: boolean;
@@ -58,15 +58,20 @@ const unknownSchema: Schema = {
   defaults: {},
   editor: false,
   group: AggGroupNames.Metrics,
+  aggSettings: {
+    top_hits: {
+      allowStrings: true,
+    },
+  },
 };
 
-const getTypeFromRegistry = (type: string): AggType => {
+const getTypeFromRegistry = (type: string): IAggType => {
   // We need to inline require here, since we're having a cyclic dependency
   // from somewhere inside agg_types back to AggConfig.
-  const aggTypes = require('./agg_types').aggTypes;
+  const aggTypes = require('../aggs').aggTypes;
   const registeredType =
-    aggTypes.metrics.find((agg: AggType) => agg.name === type) ||
-    aggTypes.buckets.find((agg: AggType) => agg.name === type);
+    aggTypes.metrics.find((agg: IAggType) => agg.name === type) ||
+    aggTypes.buckets.find((agg: IAggType) => agg.name === type);
 
   if (!registeredType) {
     throw new Error('unknown type');
@@ -85,6 +90,9 @@ const getSchemaFromRegistry = (schemas: any, schema: string): Schema => {
   return registeredSchema;
 };
 
+// TODO need to make a more explicit interface for this
+export type IAggConfig = AggConfig;
+
 export class AggConfig {
   /**
    * Ensure that all of the objects in the list have ids, the objects
@@ -122,19 +130,19 @@ export class AggConfig {
     );
   }
 
-  public aggConfigs: AggConfigs;
+  public aggConfigs: IAggConfigs;
   public id: string;
   public enabled: boolean;
   public params: any;
-  public parent?: AggConfigs;
+  public parent?: IAggConfigs;
   public brandNew?: boolean;
 
   private __schema: Schema;
-  private __type: AggType;
+  private __type: IAggType;
   private __typeDecorations: any;
   private subAggs: AggConfig[] = [];
 
-  constructor(aggConfigs: AggConfigs, opts: AggConfigOptions) {
+  constructor(aggConfigs: IAggConfigs, opts: AggConfigOptions) {
     this.aggConfigs = aggConfigs;
     this.id = String(opts.id || AggConfig.nextId(aggConfigs.aggs as any));
     this.enabled = typeof opts.enabled === 'boolean' ? opts.enabled : true;
@@ -207,7 +215,7 @@ export class AggConfig {
     return _.get(this.params, key);
   }
 
-  write(aggs?: AggConfigs) {
+  write(aggs?: IAggConfigs) {
     return writeParams<AggConfig>(this.type.params, this, aggs);
   }
 
@@ -262,7 +270,7 @@ export class AggConfig {
    * @return {void|Object} - if the config has a dsl representation, it is
    *                         returned, else undefined is returned
    */
-  toDsl(aggConfigs?: AggConfigs) {
+  toDsl(aggConfigs?: IAggConfigs) {
     if (this.type.hasNoDsl) return;
     const output = this.write(aggConfigs) as any;
 
@@ -360,7 +368,7 @@ export class AggConfig {
 
     if (!this.type) return '';
     return percentageMode
-      ? i18n.translate('common.ui.vis.aggConfig.percentageOfLabel', {
+      ? i18n.translate('data.search.aggs.percentageOfLabel', {
           defaultMessage: 'Percentage of {label}',
           values: { label: this.type.makeLabel(this) },
         })
@@ -435,7 +443,7 @@ export class AggConfig {
 
     if (fieldParam) {
       // @ts-ignore
-      availableFields = fieldParam.getAvailableFields(this.getIndexPattern().fields);
+      availableFields = fieldParam.getAvailableFields(this);
     }
 
     // clear out the previous params except for a few special ones
@@ -448,7 +456,7 @@ export class AggConfig {
     });
   }
 
-  public setType(type: string | AggType) {
+  public setType(type: string | IAggType) {
     this.type = typeof type === 'string' ? getTypeFromRegistry(type) : type;
   }
 
diff --git a/src/legacy/ui/public/agg_types/agg_configs.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_configs.ts
similarity index 98%
rename from src/legacy/ui/public/agg_types/agg_configs.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_configs.ts
index 47e2222abe1e8..7e7e4944b00da 100644
--- a/src/legacy/ui/public/agg_types/agg_configs.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_configs.ts
@@ -35,7 +35,7 @@ import {
   ISearchSource,
   FetchOptions,
   TimeRange,
-} from '../../../../plugins/data/public';
+} from '../../../../../../plugins/data/public';
 
 type Schemas = Record<string, any>;
 
@@ -55,6 +55,9 @@ function parseParentAggs(dslLvlCursor: any, dsl: any) {
   }
 }
 
+// TODO need to make a more explicit interface for this
+export type IAggConfigs = AggConfigs;
+
 export class AggConfigs {
   public indexPattern: IndexPattern;
   public schemas: any;
diff --git a/src/legacy/ui/public/agg_types/agg_groups.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_groups.ts
similarity index 87%
rename from src/legacy/ui/public/agg_types/agg_groups.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_groups.ts
index d08e875bf213e..d21f5c8968840 100644
--- a/src/legacy/ui/public/agg_types/agg_groups.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_groups.ts
@@ -28,10 +28,10 @@ export const AggGroupNames = Object.freeze({
 export type AggGroupNames = $Values<typeof AggGroupNames>;
 
 export const aggGroupNamesMap = () => ({
-  [AggGroupNames.Metrics]: i18n.translate('common.ui.aggTypes.aggGroups.metricsText', {
+  [AggGroupNames.Metrics]: i18n.translate('data.search.aggs.aggGroups.metricsText', {
     defaultMessage: 'Metrics',
   }),
-  [AggGroupNames.Buckets]: i18n.translate('common.ui.aggTypes.aggGroups.bucketsText', {
+  [AggGroupNames.Buckets]: i18n.translate('data.search.aggs.aggGroups.bucketsText', {
     defaultMessage: 'Buckets',
   }),
 });
diff --git a/src/legacy/ui/public/agg_types/agg_params.test.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_params.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/agg_params.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_params.test.ts
index 25e62e06d52d7..30ab272537dad 100644
--- a/src/legacy/ui/public/agg_types/agg_params.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_params.test.ts
@@ -21,7 +21,7 @@ import { initParams } from './agg_params';
 import { BaseParamType } from './param_types/base';
 import { FieldParamType } from './param_types/field';
 import { OptionedParamType } from './param_types/optioned';
-import { AggParamType } from '../agg_types/param_types/agg';
+import { AggParamType } from '../aggs/param_types/agg';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/agg_params.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_params.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/agg_params.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_params.ts
index 262a57f4a5aa3..34727ff4614b9 100644
--- a/src/legacy/ui/public/agg_types/agg_params.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_params.ts
@@ -25,7 +25,7 @@ import { JsonParamType } from './param_types/json';
 import { BaseParamType } from './param_types/base';
 
 import { AggConfig } from './agg_config';
-import { AggConfigs } from './agg_configs';
+import { IAggConfigs } from './agg_configs';
 
 const paramTypeMap = {
   field: FieldParamType,
@@ -73,7 +73,7 @@ export const writeParams = <
 >(
   params: Array<Partial<TAggParam>> = [],
   aggConfig: TAggConfig,
-  aggs?: AggConfigs,
+  aggs?: IAggConfigs,
   locals?: Record<string, any>
 ) => {
   const output = { params: {} as Record<string, any> };
diff --git a/src/legacy/ui/public/agg_types/agg_type.test.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_type.test.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/agg_type.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_type.test.ts
index 9b34910e81e88..6d4c2d1317f50 100644
--- a/src/legacy/ui/public/agg_types/agg_type.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_type.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { AggType, AggTypeConfig } from './agg_type';
-import { AggConfig } from './agg_config';
+import { IAggConfig } from './agg_config';
 import { npStart } from 'ui/new_platform';
 
 jest.mock('ui/new_platform');
@@ -48,7 +48,7 @@ describe('AggType Class', () => {
       describe('makeLabel', () => {
         it('makes a function when the makeLabel config is not specified', () => {
           const makeLabel = () => 'label';
-          const aggConfig = {} as AggConfig;
+          const aggConfig = {} as IAggConfig;
           const config: AggTypeConfig = {
             name: 'name',
             title: 'title',
@@ -64,7 +64,7 @@ describe('AggType Class', () => {
 
       describe('getResponseAggs/getRequestAggs', () => {
         it('copies the value', () => {
-          const testConfig = (aggConfig: AggConfig) => [aggConfig];
+          const testConfig = (aggConfig: IAggConfig) => [aggConfig];
 
           const aggType = new AggType({
             name: 'name',
@@ -78,7 +78,7 @@ describe('AggType Class', () => {
         });
 
         it('defaults to noop', () => {
-          const aggConfig = {} as AggConfig;
+          const aggConfig = {} as IAggConfig;
           const aggType = new AggType({
             name: 'name',
             title: 'title',
@@ -130,13 +130,13 @@ describe('AggType Class', () => {
     });
 
     describe('getFormat', function() {
-      let aggConfig: AggConfig;
+      let aggConfig: IAggConfig;
       let field: any;
 
       beforeEach(() => {
         aggConfig = ({
           getField: jest.fn(() => field),
-        } as unknown) as AggConfig;
+        } as unknown) as IAggConfig;
       });
 
       it('returns the formatter for the aggConfig', () => {
diff --git a/src/legacy/ui/public/agg_types/agg_type.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_type.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/agg_type.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_type.ts
index 7ec688277b9c4..56299839d0a6d 100644
--- a/src/legacy/ui/public/agg_types/agg_type.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_type.ts
@@ -23,11 +23,15 @@ import { npStart } from 'ui/new_platform';
 import { initParams } from './agg_params';
 
 import { AggConfig } from './agg_config';
-import { AggConfigs } from './agg_configs';
-import { Adapters } from '../../../../plugins/inspector/public';
+import { IAggConfigs } from './agg_configs';
+import { Adapters } from '../../../../../../plugins/inspector/public';
 import { BaseParamType } from './param_types/base';
-import { AggParamType } from '../agg_types/param_types/agg';
-import { KBN_FIELD_TYPES, fieldFormats, ISearchSource } from '../../../../plugins/data/public';
+import { AggParamType } from './param_types/agg';
+import {
+  KBN_FIELD_TYPES,
+  fieldFormats,
+  ISearchSource,
+} from '../../../../../../plugins/data/public';
 
 export interface AggTypeConfig<
   TAggConfig extends AggConfig = AggConfig,
@@ -48,7 +52,7 @@ export interface AggTypeConfig<
   decorateAggConfig?: () => any;
   postFlightRequest?: (
     resp: any,
-    aggConfigs: AggConfigs,
+    aggConfigs: IAggConfigs,
     aggConfig: TAggConfig,
     searchSource: ISearchSource,
     inspectorAdapters: Adapters,
@@ -66,6 +70,9 @@ const getFormat = (agg: AggConfig) => {
   return field ? field.format : fieldFormatsService.getDefaultInstance(KBN_FIELD_TYPES.STRING);
 };
 
+// TODO need to make a more explicit interface for this
+export type IAggType = AggType;
+
 export class AggType<
   TAggConfig extends AggConfig = AggConfig,
   TParam extends AggParamType<TAggConfig> = AggParamType<TAggConfig>
@@ -178,7 +185,7 @@ export class AggType<
    */
   postFlightRequest: (
     resp: any,
-    aggConfigs: AggConfigs,
+    aggConfigs: IAggConfigs,
     aggConfig: TAggConfig,
     searchSource: ISearchSource,
     inspectorAdapters: Adapters,
@@ -239,7 +246,7 @@ export class AggType<
       if (config.customLabels !== false) {
         params.push({
           name: 'customLabel',
-          displayName: i18n.translate('common.ui.aggTypes.string.customLabel', {
+          displayName: i18n.translate('data.search.aggs.string.customLabel', {
             defaultMessage: 'Custom label',
           }),
           type: 'string',
diff --git a/src/legacy/ui/public/agg_types/agg_types.ts b/src/legacy/core_plugins/data/public/search/aggs/agg_types.ts
similarity index 73%
rename from src/legacy/ui/public/agg_types/agg_types.ts
rename to src/legacy/core_plugins/data/public/search/aggs/agg_types.ts
index 1b05f5926ebfc..c16eb06eeb116 100644
--- a/src/legacy/ui/public/agg_types/agg_types.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/agg_types.ts
@@ -50,8 +50,6 @@ import { bucketAvgMetricAgg } from './metrics/bucket_avg';
 import { bucketMinMetricAgg } from './metrics/bucket_min';
 import { bucketMaxMetricAgg } from './metrics/bucket_max';
 
-export { AggType } from './agg_type';
-
 export const aggTypes = {
   metrics: [
     countMetricAgg,
@@ -90,3 +88,27 @@ export const aggTypes = {
     geoTileBucketAgg,
   ],
 };
+
+export { AggType } from './agg_type';
+export { AggConfig } from './agg_config';
+export { AggConfigs } from './agg_configs';
+export { FieldParamType } from './param_types';
+export { aggTypeFieldFilters } from './param_types/filter';
+export { parentPipelineAggHelper } from './metrics/lib/parent_pipeline_agg_helper';
+
+// static code
+export { AggParamType } from './param_types/agg';
+export { AggGroupNames, aggGroupNamesMap } from './agg_groups';
+export { intervalOptions } from './buckets/_interval_options'; // only used in Discover
+export { isDateHistogramBucketAggConfig, setBounds } from './buckets/date_histogram';
+export { termsAggFilter } from './buckets/terms';
+export { isType, isStringType } from './buckets/migrate_include_exclude_format';
+export { CidrMask } from './buckets/lib/cidr_mask';
+export { convertDateRangeToString } from './buckets/date_range';
+export { convertIPRangeToString } from './buckets/ip_range';
+export { aggTypeFilters, propFilter } from './filter';
+export { OptionedParamType } from './param_types/optioned';
+export { isValidJson, isValidInterval } from './utils';
+export { BUCKET_TYPES } from './buckets/bucket_agg_types';
+export { METRIC_TYPES } from './metrics/metric_agg_types';
+export { ISchemas, Schema, Schemas } from './schemas';
diff --git a/src/legacy/ui/public/agg_types/buckets/_bucket_agg_type.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/_bucket_agg_type.ts
similarity index 96%
rename from src/legacy/ui/public/agg_types/buckets/_bucket_agg_type.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/_bucket_agg_type.ts
index 9b7c97a8f11b6..546d054c5af97 100644
--- a/src/legacy/ui/public/agg_types/buckets/_bucket_agg_type.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/_bucket_agg_type.ts
@@ -18,7 +18,7 @@
  */
 
 import { AggConfig } from '../agg_config';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 import { AggType, AggTypeConfig } from '../agg_type';
 import { AggParamType } from '../param_types/agg';
 
diff --git a/src/legacy/ui/public/agg_types/buckets/_interval_options.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/_interval_options.ts
similarity index 66%
rename from src/legacy/ui/public/agg_types/buckets/_interval_options.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/_interval_options.ts
index 01d0abb7a366c..e196687607d19 100644
--- a/src/legacy/ui/public/agg_types/buckets/_interval_options.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/_interval_options.ts
@@ -21,7 +21,7 @@ import { IBucketAggConfig } from './_bucket_agg_type';
 
 export const intervalOptions = [
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.autoDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.autoDisplayName', {
       defaultMessage: 'Auto',
     }),
     val: 'auto',
@@ -32,49 +32,49 @@ export const intervalOptions = [
     },
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.millisecondDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.millisecondDisplayName', {
       defaultMessage: 'Millisecond',
     }),
     val: 'ms',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.secondDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.secondDisplayName', {
       defaultMessage: 'Second',
     }),
     val: 's',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.minuteDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.minuteDisplayName', {
       defaultMessage: 'Minute',
     }),
     val: 'm',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.hourlyDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.hourlyDisplayName', {
       defaultMessage: 'Hourly',
     }),
     val: 'h',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.dailyDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.dailyDisplayName', {
       defaultMessage: 'Daily',
     }),
     val: 'd',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.weeklyDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.weeklyDisplayName', {
       defaultMessage: 'Weekly',
     }),
     val: 'w',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.monthlyDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.monthlyDisplayName', {
       defaultMessage: 'Monthly',
     }),
     val: 'M',
   },
   {
-    display: i18n.translate('common.ui.aggTypes.buckets.intervalOptions.yearlyDisplayName', {
+    display: i18n.translate('data.search.aggs.buckets.intervalOptions.yearlyDisplayName', {
       defaultMessage: 'Yearly',
     }),
     val: 'y',
diff --git a/src/legacy/ui/public/agg_types/buckets/_terms_other_bucket_helper.js b/src/legacy/core_plugins/data/public/search/aggs/buckets/_terms_other_bucket_helper.js
similarity index 99%
rename from src/legacy/ui/public/agg_types/buckets/_terms_other_bucket_helper.js
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/_terms_other_bucket_helper.js
index c8580183756f4..ddab360161744 100644
--- a/src/legacy/ui/public/agg_types/buckets/_terms_other_bucket_helper.js
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/_terms_other_bucket_helper.js
@@ -18,7 +18,7 @@
  */
 
 import _ from 'lodash';
-import { esFilters, esQuery } from '../../../../../plugins/data/public';
+import { esFilters, esQuery } from '../../../../../../../plugins/data/public';
 import { AggGroupNames } from '../agg_groups';
 
 /**
diff --git a/src/legacy/ui/public/agg_types/buckets/bucket_agg_types.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/bucket_agg_types.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/bucket_agg_types.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/bucket_agg_types.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.test.ts
similarity index 98%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.test.ts
index 9426df7d34c29..e212132257ef6 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.test.ts
@@ -23,7 +23,7 @@ import { intervalOptions } from '../_interval_options';
 import { AggConfigs } from '../../agg_configs';
 import { IBucketDateHistogramAggConfig } from '../date_histogram';
 import { BUCKET_TYPES } from '../bucket_agg_types';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.ts
index f91a92eab1c33..e634b5daf0ac3 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/date_histogram.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_histogram.ts
@@ -19,7 +19,7 @@
 
 import moment from 'moment';
 import { IBucketDateHistogramAggConfig } from '../date_histogram';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterDateHistogram = (
   agg: IBucketDateHistogramAggConfig,
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/date_range.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/date_range.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.test.ts
index 9c2c4f72704f4..e224253a6e314 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/date_range.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.test.ts
@@ -19,7 +19,7 @@
 
 import moment from 'moment';
 import { createFilterDateRange } from './date_range';
-import { fieldFormats } from '../../../../../../plugins/data/public';
+import { fieldFormats } from '../../../../../../../../plugins/data/public';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/date_range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/date_range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.ts
index 01689d954a072..f7f2cfdb7bb61 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/date_range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.ts
@@ -20,7 +20,7 @@
 import moment from 'moment';
 import { IBucketAggConfig } from '../_bucket_agg_type';
 import { DateRangeKey } from '../date_range';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterDateRange = (agg: IBucketAggConfig, { from, to }: DateRangeKey) => {
   const filter: esFilters.RangeFilterParams = {};
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/filters.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/filters.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/filters.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/filters.test.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/filters.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/filters.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/filters.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/filters.ts
index 6b614514580b6..715f6895374e6 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/filters.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/filters.ts
@@ -19,7 +19,7 @@
 
 import { get } from 'lodash';
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterFilters = (aggConfig: IBucketAggConfig, key: string) => {
   // have the aggConfig write agg dsl params
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/histogram.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/histogram.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.test.ts
index ef49636f9e0c1..1a78967261fa6 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/histogram.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.test.ts
@@ -20,7 +20,7 @@ import { createFilterHistogram } from './histogram';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { fieldFormats } from '../../../../../../plugins/data/public';
+import { fieldFormats } from '../../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/histogram.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/histogram.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.ts
index fc587fa9ecdb6..820f3de5ae9f0 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/histogram.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.ts
@@ -18,7 +18,7 @@
  */
 
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterHistogram = (aggConfig: IBucketAggConfig, key: string) => {
   const value = parseInt(key, 10);
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.test.ts
index a9eca3bbb7a56..e92ba5cb2852a 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.test.ts
@@ -19,7 +19,7 @@
 
 import { createFilterIpRange } from './ip_range';
 import { AggConfigs } from '../../agg_configs';
-import { fieldFormats } from '../../../../../../plugins/data/public';
+import { fieldFormats } from '../../../../../../../../plugins/data/public';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
 
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.ts
index a513b8c782739..d78f4579cd713 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/ip_range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/ip_range.ts
@@ -20,7 +20,7 @@
 import { CidrMask } from '../lib/cidr_mask';
 import { IBucketAggConfig } from '../_bucket_agg_type';
 import { IpRangeKey } from '../ip_range';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterIpRange = (aggConfig: IBucketAggConfig, key: IpRangeKey) => {
   let range: esFilters.RangeFilterParams;
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/range.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/range.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.test.ts
index 720e952c28821..2f74f23721813 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/range.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { createFilterRange } from './range';
-import { fieldFormats } from '../../../../../../plugins/data/public';
+import { fieldFormats } from '../../../../../../../../plugins/data/public';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.ts
similarity index 93%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.ts
index 929827c6e3fec..125a30a1ab1dd 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/range.ts
@@ -18,7 +18,7 @@
  */
 
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterRange = (aggConfig: IBucketAggConfig, params: any) => {
   return esFilters.buildRangeFilter(
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/terms.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.test.ts
similarity index 98%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/terms.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.test.ts
index 86c0aa24f529a..d5fd1337f2cb2 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/terms.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.test.ts
@@ -21,7 +21,7 @@ import { createFilterTerms } from './terms';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/buckets/create_filter/terms.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/buckets/create_filter/terms.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.ts
index 5bd770e672786..e0d1f91c1e16a 100644
--- a/src/legacy/ui/public/agg_types/buckets/create_filter/terms.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/terms.ts
@@ -18,7 +18,7 @@
  */
 
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { esFilters } from '../../../../../../plugins/data/public';
+import { esFilters } from '../../../../../../../../plugins/data/public';
 
 export const createFilterTerms = (aggConfig: IBucketAggConfig, key: string, params: any) => {
   const field = aggConfig.params.field;
diff --git a/src/legacy/ui/public/agg_types/buckets/date_histogram.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/date_histogram.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/buckets/date_histogram.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/date_histogram.ts
index 33672b54b1f2e..dc0f9baa6d0cc 100644
--- a/src/legacy/ui/public/agg_types/buckets/date_histogram.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/date_histogram.ts
@@ -22,19 +22,17 @@ import moment from 'moment-timezone';
 import { i18n } from '@kbn/i18n';
 
 import { npStart } from 'ui/new_platform';
+import { timefilter } from 'ui/timefilter';
+import { TimeBuckets } from 'ui/time_buckets';
 import { BucketAggType, IBucketAggConfig } from './_bucket_agg_type';
 import { BUCKET_TYPES } from './bucket_agg_types';
 import { createFilterDateHistogram } from './create_filter/date_histogram';
 import { intervalOptions } from './_interval_options';
-import { timefilter } from '../../timefilter';
-import { dateHistogramInterval } from '../../../../core_plugins/data/public';
+import { dateHistogramInterval } from '../../../../common';
 import { writeParams } from '../agg_params';
 import { isMetricAggType } from '../metrics/metric_agg_type';
 
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
-
-// @ts-ignore
-import { TimeBuckets } from '../../time_buckets';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 const detectedTimezone = moment.tz.guess();
 const tzOffset = moment().format('Z');
@@ -67,7 +65,7 @@ export function isDateHistogramBucketAggConfig(agg: any): agg is IBucketDateHist
 
 export const dateHistogramBucketAgg = new BucketAggType<IBucketDateHistogramAggConfig>({
   name: BUCKET_TYPES.DATE_HISTOGRAM,
-  title: i18n.translate('common.ui.aggTypes.buckets.dateHistogramTitle', {
+  title: i18n.translate('data.search.aggs.buckets.dateHistogramTitle', {
     defaultMessage: 'Date Histogram',
   }),
   ordered: {
@@ -81,7 +79,7 @@ export const dateHistogramBucketAgg = new BucketAggType<IBucketDateHistogramAggC
     }
 
     const field = agg.getFieldDisplayName();
-    return i18n.translate('common.ui.aggTypes.buckets.dateHistogramLabel', {
+    return i18n.translate('data.search.aggs.buckets.dateHistogramLabel', {
       defaultMessage: '{fieldName} per {intervalDescription}',
       values: {
         fieldName: field,
diff --git a/src/legacy/ui/public/agg_types/buckets/date_range.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/date_range.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/date_range.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/date_range.test.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/date_range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/date_range.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/buckets/date_range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/date_range.ts
index ee04e0657f317..40ef7329dee6b 100644
--- a/src/legacy/ui/public/agg_types/buckets/date_range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/date_range.ts
@@ -24,9 +24,9 @@ import { BUCKET_TYPES } from './bucket_agg_types';
 import { BucketAggType, IBucketAggConfig } from './_bucket_agg_type';
 import { createFilterDateRange } from './create_filter/date_range';
 
-import { KBN_FIELD_TYPES, fieldFormats } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES, fieldFormats } from '../../../../../../../plugins/data/public';
 
-const dateRangeTitle = i18n.translate('common.ui.aggTypes.buckets.dateRangeTitle', {
+const dateRangeTitle = i18n.translate('data.search.aggs.buckets.dateRangeTitle', {
   defaultMessage: 'Date Range',
 });
 
diff --git a/src/legacy/ui/public/agg_types/buckets/filter.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/filter.ts
similarity index 93%
rename from src/legacy/ui/public/agg_types/buckets/filter.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/filter.ts
index 3f8a898f4c963..b52e2d6cfd4df 100644
--- a/src/legacy/ui/public/agg_types/buckets/filter.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/filter.ts
@@ -20,7 +20,7 @@ import { i18n } from '@kbn/i18n';
 import { BucketAggType } from './_bucket_agg_type';
 import { BUCKET_TYPES } from './bucket_agg_types';
 
-const filterTitle = i18n.translate('common.ui.aggTypes.buckets.filterTitle', {
+const filterTitle = i18n.translate('data.search.aggs.buckets.filterTitle', {
   defaultMessage: 'Filter',
 });
 
diff --git a/src/legacy/ui/public/agg_types/buckets/filters.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/filters.ts
similarity index 93%
rename from src/legacy/ui/public/agg_types/buckets/filters.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/filters.ts
index d9b78b3063e23..6eaf788b83c04 100644
--- a/src/legacy/ui/public/agg_types/buckets/filters.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/filters.ts
@@ -25,14 +25,14 @@ import { i18n } from '@kbn/i18n';
 import chrome from 'ui/chrome';
 import { createFilterFilters } from './create_filter/filters';
 import { BucketAggType } from './_bucket_agg_type';
-import { Storage } from '../../../../../plugins/kibana_utils/public';
-import { getQueryLog, esQuery, Query } from '../../../../../plugins/data/public';
+import { Storage } from '../../../../../../../plugins/kibana_utils/public';
+import { getQueryLog, esQuery, Query } from '../../../../../../../plugins/data/public';
 import { BUCKET_TYPES } from './bucket_agg_types';
 
 const config = chrome.getUiSettingsClient();
 const storage = new Storage(window.localStorage);
 
-const filtersTitle = i18n.translate('common.ui.aggTypes.buckets.filtersTitle', {
+const filtersTitle = i18n.translate('data.search.aggs.buckets.filtersTitle', {
   defaultMessage: 'Filters',
   description:
     'The name of an aggregation, that allows to specify multiple individual filters to group data by.',
diff --git a/src/legacy/ui/public/agg_types/buckets/geo_hash.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.test.ts
similarity index 98%
rename from src/legacy/ui/public/agg_types/buckets/geo_hash.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.test.ts
index effa49f0ade6b..5ff68c5426e34 100644
--- a/src/legacy/ui/public/agg_types/buckets/geo_hash.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { geoHashBucketAgg, IBucketGeoHashGridAggConfig } from './geo_hash';
-import { AggConfigs } from '../agg_configs';
+import { AggConfigs, IAggConfigs } from '../agg_configs';
 import { BUCKET_TYPES } from './bucket_agg_types';
 
 jest.mock('ui/new_platform');
@@ -121,7 +121,7 @@ describe('Geohash Agg', () => {
 
   describe('getRequestAggs', () => {
     describe('initial aggregation creation', () => {
-      let aggConfigs: AggConfigs;
+      let aggConfigs: IAggConfigs;
       let geoHashGridAgg: IBucketGeoHashGridAggConfig;
 
       beforeEach(() => {
diff --git a/src/legacy/ui/public/agg_types/buckets/geo_hash.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.ts
similarity index 96%
rename from src/legacy/ui/public/agg_types/buckets/geo_hash.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.ts
index b2519df6fb175..afd4e18dd266c 100644
--- a/src/legacy/ui/public/agg_types/buckets/geo_hash.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_hash.ts
@@ -19,9 +19,9 @@
 
 import { i18n } from '@kbn/i18n';
 import { geohashColumns } from 'ui/vis/map/decode_geo_hash';
-import chrome from '../../chrome';
+import chrome from 'ui/chrome';
 import { BucketAggType, IBucketAggConfig } from './_bucket_agg_type';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 import { geoContains, scaleBounds, GeoBoundingBox } from './lib/geo_utils';
 import { BUCKET_TYPES } from './bucket_agg_types';
@@ -68,7 +68,7 @@ function getPrecision(val: string) {
 const isOutsideCollar = (bounds: GeoBoundingBox, collar: MapCollar) =>
   bounds && collar && !geoContains(collar, bounds);
 
-const geohashGridTitle = i18n.translate('common.ui.aggTypes.buckets.geohashGridTitle', {
+const geohashGridTitle = i18n.translate('data.search.aggs.buckets.geohashGridTitle', {
   defaultMessage: 'Geohash',
 });
 
diff --git a/src/legacy/ui/public/agg_types/buckets/geo_tile.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_tile.ts
similarity index 92%
rename from src/legacy/ui/public/agg_types/buckets/geo_tile.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/geo_tile.ts
index ef71e3947566a..57e8f6e8c5ded 100644
--- a/src/legacy/ui/public/agg_types/buckets/geo_tile.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/geo_tile.ts
@@ -23,11 +23,11 @@ import { AggConfigOptions } from '../agg_config';
 
 import { BucketAggType } from './_bucket_agg_type';
 import { BUCKET_TYPES } from './bucket_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 import { IBucketAggConfig } from './_bucket_agg_type';
 import { METRIC_TYPES } from '../metrics/metric_agg_types';
 
-const geotileGridTitle = i18n.translate('common.ui.aggTypes.buckets.geotileGridTitle', {
+const geotileGridTitle = i18n.translate('data.search.aggs.buckets.geotileGridTitle', {
   defaultMessage: 'Geotile',
 });
 
diff --git a/src/legacy/ui/public/agg_types/buckets/histogram.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/histogram.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/histogram.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/histogram.test.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/histogram.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/histogram.ts
similarity index 96%
rename from src/legacy/ui/public/agg_types/buckets/histogram.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/histogram.ts
index 44327c7c19e6d..f7e9ef45961e0 100644
--- a/src/legacy/ui/public/agg_types/buckets/histogram.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/histogram.ts
@@ -24,7 +24,7 @@ import { toastNotifications } from 'ui/notify';
 import { npStart } from 'ui/new_platform';
 import { BucketAggType, IBucketAggConfig } from './_bucket_agg_type';
 import { createFilterHistogram } from './create_filter/histogram';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 import { BUCKET_TYPES } from './bucket_agg_types';
 
 export interface AutoBounds {
@@ -41,7 +41,7 @@ const getUIConfig = () => npStart.core.uiSettings;
 
 export const histogramBucketAgg = new BucketAggType<IBucketHistogramAggConfig>({
   name: BUCKET_TYPES.HISTOGRAM,
-  title: i18n.translate('common.ui.aggTypes.buckets.histogramTitle', {
+  title: i18n.translate('data.search.aggs.buckets.histogramTitle', {
     defaultMessage: 'Histogram',
   }),
   ordered: {},
@@ -117,7 +117,7 @@ export const histogramBucketAgg = new BucketAggType<IBucketHistogramAggConfig>({
           .catch((e: Error) => {
             if (e.name === 'AbortError') return;
             toastNotifications.addWarning(
-              i18n.translate('common.ui.aggTypes.histogram.missingMaxMinValuesWarning', {
+              i18n.translate('data.search.aggs.histogram.missingMaxMinValuesWarning', {
                 defaultMessage:
                   'Unable to retrieve max and min values to auto-scale histogram buckets. This may lead to poor visualization performance.',
               })
diff --git a/src/legacy/ui/public/agg_types/buckets/ip_range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/ip_range.ts
similarity index 93%
rename from src/legacy/ui/public/agg_types/buckets/ip_range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/ip_range.ts
index 41141dabf507c..e5497bef49165 100644
--- a/src/legacy/ui/public/agg_types/buckets/ip_range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/ip_range.ts
@@ -25,9 +25,9 @@ import { BUCKET_TYPES } from './bucket_agg_types';
 
 // @ts-ignore
 import { createFilterIpRange } from './create_filter/ip_range';
-import { KBN_FIELD_TYPES, fieldFormats } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES, fieldFormats } from '../../../../../../../plugins/data/public';
 
-const ipRangeTitle = i18n.translate('common.ui.aggTypes.buckets.ipRangeTitle', {
+const ipRangeTitle = i18n.translate('data.search.aggs.buckets.ipRangeTitle', {
   defaultMessage: 'IPv4 Range',
 });
 
@@ -57,7 +57,7 @@ export const ipRangeBucketAgg = new BucketAggType({
     return new IpRangeFormat();
   },
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.buckets.ipRangeLabel', {
+    return i18n.translate('data.search.aggs.buckets.ipRangeLabel', {
       defaultMessage: '{fieldName} IP ranges',
       values: {
         fieldName: aggConfig.getFieldDisplayName(),
diff --git a/src/legacy/ui/public/agg_types/buckets/lib/cidr_mask.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/lib/cidr_mask.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/lib/cidr_mask.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/lib/cidr_mask.test.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/lib/cidr_mask.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/lib/cidr_mask.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/buckets/lib/cidr_mask.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/lib/cidr_mask.ts
index aadbbc8c82276..30c4e400fb806 100644
--- a/src/legacy/ui/public/agg_types/buckets/lib/cidr_mask.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/lib/cidr_mask.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { Ipv4Address } from '../../../../../../plugins/kibana_utils/public';
+import { Ipv4Address } from '../../../../../../../../plugins/kibana_utils/public';
 
 const NUM_BITS = 32;
 
diff --git a/src/legacy/ui/public/agg_types/buckets/lib/geo_utils.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/lib/geo_utils.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/lib/geo_utils.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/lib/geo_utils.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/migrate_include_exclude_format.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/migrate_include_exclude_format.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/migrate_include_exclude_format.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/migrate_include_exclude_format.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/range.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/range.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/buckets/range.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/range.test.ts
index dd85c3b31939f..4c0fa7311461e 100644
--- a/src/legacy/ui/public/agg_types/buckets/range.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/range.test.ts
@@ -19,7 +19,7 @@
 
 import { AggConfigs } from '../agg_configs';
 import { BUCKET_TYPES } from './bucket_agg_types';
-import { fieldFormats } from '../../../../../plugins/data/public';
+import { fieldFormats } from '../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/buckets/range.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/range.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/buckets/range.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/range.ts
index f24473e0c68aa..f35db2cc759bd 100644
--- a/src/legacy/ui/public/agg_types/buckets/range.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/range.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { BucketAggType } from './_bucket_agg_type';
-import { fieldFormats, KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { fieldFormats, KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 import { RangeKey } from './range_key';
 import { createFilterRange } from './create_filter/range';
 import { BUCKET_TYPES } from './bucket_agg_types';
@@ -27,7 +27,7 @@ import { BUCKET_TYPES } from './bucket_agg_types';
 const keyCaches = new WeakMap();
 const formats = new WeakMap();
 
-const rangeTitle = i18n.translate('common.ui.aggTypes.buckets.rangeTitle', {
+const rangeTitle = i18n.translate('data.search.aggs.buckets.rangeTitle', {
   defaultMessage: 'Range',
 });
 
@@ -36,7 +36,7 @@ export const rangeBucketAgg = new BucketAggType({
   title: rangeTitle,
   createFilter: createFilterRange,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.buckets.rangesLabel', {
+    return i18n.translate('data.search.aggs.aggTypesLabel', {
       defaultMessage: '{fieldName} ranges',
       values: {
         fieldName: aggConfig.getFieldDisplayName(),
@@ -69,7 +69,7 @@ export const rangeBucketAgg = new BucketAggType({
       const format = agg.fieldOwnFormatter();
       const gte = '\u2265';
       const lt = '\u003c';
-      return i18n.translate('common.ui.aggTypes.buckets.ranges.rangesFormatMessage', {
+      return i18n.translate('data.search.aggs.aggTypes.rangesFormatMessage', {
         defaultMessage: '{gte} {from} and {lt} {to}',
         values: {
           gte,
diff --git a/src/legacy/ui/public/agg_types/buckets/range_key.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/range_key.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/range_key.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/range_key.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/significant_terms.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.test.ts
similarity index 96%
rename from src/legacy/ui/public/agg_types/buckets/significant_terms.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.test.ts
index 8db9226e41eec..37b829bfc20fb 100644
--- a/src/legacy/ui/public/agg_types/buckets/significant_terms.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.test.ts
@@ -18,6 +18,7 @@
  */
 
 import { AggConfigs } from '../index';
+import { IAggConfigs } from '../types';
 import { BUCKET_TYPES } from './bucket_agg_types';
 import { significantTermsBucketAgg } from './significant_terms';
 import { IBucketAggConfig } from './_bucket_agg_type';
@@ -56,7 +57,7 @@ describe('Significant Terms Agg', () => {
         );
       };
 
-      const testSerializeAndWrite = (aggs: AggConfigs) => {
+      const testSerializeAndWrite = (aggs: IAggConfigs) => {
         const agg = aggs.aggs[0];
         const { [BUCKET_TYPES.SIGNIFICANT_TERMS]: params } = agg.toDsl();
 
diff --git a/src/legacy/ui/public/agg_types/buckets/significant_terms.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.ts
similarity index 82%
rename from src/legacy/ui/public/agg_types/buckets/significant_terms.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.ts
index 38ca0768d3bc1..bc6c63d569b11 100644
--- a/src/legacy/ui/public/agg_types/buckets/significant_terms.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/significant_terms.ts
@@ -22,9 +22,9 @@ import { BucketAggType } from './_bucket_agg_type';
 import { createFilterTerms } from './create_filter/terms';
 import { isStringType, migrateIncludeExcludeFormat } from './migrate_include_exclude_format';
 import { BUCKET_TYPES } from './bucket_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const significantTermsTitle = i18n.translate('common.ui.aggTypes.buckets.significantTermsTitle', {
+const significantTermsTitle = i18n.translate('data.search.aggs.buckets.significantTermsTitle', {
   defaultMessage: 'Significant Terms',
 });
 
@@ -32,7 +32,7 @@ export const significantTermsBucketAgg = new BucketAggType({
   name: BUCKET_TYPES.SIGNIFICANT_TERMS,
   title: significantTermsTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.buckets.significantTermsLabel', {
+    return i18n.translate('data.search.aggs.buckets.significantTermsLabel', {
       defaultMessage: 'Top {size} unusual terms in {fieldName}',
       values: {
         size: aggConfig.params.size,
@@ -54,7 +54,7 @@ export const significantTermsBucketAgg = new BucketAggType({
     },
     {
       name: 'exclude',
-      displayName: i18n.translate('common.ui.aggTypes.buckets.significantTerms.excludeLabel', {
+      displayName: i18n.translate('data.search.aggs.buckets.significantTerms.excludeLabel', {
         defaultMessage: 'Exclude',
       }),
       type: 'string',
@@ -64,7 +64,7 @@ export const significantTermsBucketAgg = new BucketAggType({
     },
     {
       name: 'include',
-      displayName: i18n.translate('common.ui.aggTypes.buckets.significantTerms.includeLabel', {
+      displayName: i18n.translate('data.search.aggs.buckets.significantTerms.includeLabel', {
         defaultMessage: 'Include',
       }),
       type: 'string',
diff --git a/src/legacy/ui/public/agg_types/buckets/terms.test.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/terms.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/buckets/terms.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/terms.test.ts
diff --git a/src/legacy/ui/public/agg_types/buckets/terms.ts b/src/legacy/core_plugins/data/public/search/aggs/buckets/terms.ts
similarity index 85%
rename from src/legacy/ui/public/agg_types/buckets/terms.ts
rename to src/legacy/core_plugins/data/public/search/aggs/buckets/terms.ts
index 4ced1417402b5..b41b16af122fa 100644
--- a/src/legacy/ui/public/agg_types/buckets/terms.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/buckets/terms.ts
@@ -19,19 +19,20 @@
 
 import { noop } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import {
-  getRequestInspectorStats,
-  getResponseInspectorStats,
-} from '../../../../core_plugins/data/public';
+import { getRequestInspectorStats, getResponseInspectorStats } from '../../../index';
 import { BucketAggType } from './_bucket_agg_type';
 import { BUCKET_TYPES } from './bucket_agg_types';
 import { IBucketAggConfig } from './_bucket_agg_type';
 import { createFilterTerms } from './create_filter/terms';
 import { isStringType, migrateIncludeExcludeFormat } from './migrate_include_exclude_format';
-import { AggConfigs } from '../agg_configs';
+import { IAggConfigs } from '../agg_configs';
 
-import { Adapters } from '../../../../../plugins/inspector/public';
-import { ISearchSource, fieldFormats, KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { Adapters } from '../../../../../../../plugins/inspector/public';
+import {
+  ISearchSource,
+  fieldFormats,
+  KBN_FIELD_TYPES,
+} from '../../../../../../../plugins/data/public';
 
 import {
   buildOtherBucketAgg,
@@ -68,7 +69,7 @@ const [orderAggSchema] = new Schemas([
   },
 ]).all;
 
-const termsTitle = i18n.translate('common.ui.aggTypes.buckets.termsTitle', {
+const termsTitle = i18n.translate('data.search.aggs.buckets.termsTitle', {
   defaultMessage: 'Terms',
 });
 
@@ -98,7 +99,7 @@ export const termsBucketAgg = new BucketAggType({
   createFilter: createFilterTerms,
   postFlightRequest: async (
     resp: any,
-    aggConfigs: AggConfigs,
+    aggConfigs: IAggConfigs,
     aggConfig: IBucketAggConfig,
     searchSource: ISearchSource,
     inspectorAdapters: Adapters,
@@ -113,11 +114,11 @@ export const termsBucketAgg = new BucketAggType({
       nestedSearchSource.setField('aggs', filterAgg);
 
       const request = inspectorAdapters.requests.start(
-        i18n.translate('common.ui.aggTypes.buckets.terms.otherBucketTitle', {
+        i18n.translate('data.search.aggs.buckets.terms.otherBucketTitle', {
           defaultMessage: 'Other bucket',
         }),
         {
-          description: i18n.translate('common.ui.aggTypes.buckets.terms.otherBucketDescription', {
+          description: i18n.translate('data.search.aggs.buckets.terms.otherBucketDescription', {
             defaultMessage:
               'This request counts the number of documents that fall ' +
               'outside the criterion of the data buckets.',
@@ -212,13 +213,13 @@ export const termsBucketAgg = new BucketAggType({
       default: 'desc',
       options: [
         {
-          text: i18n.translate('common.ui.aggTypes.buckets.terms.orderDescendingTitle', {
+          text: i18n.translate('data.search.aggs.buckets.terms.orderDescendingTitle', {
             defaultMessage: 'Descending',
           }),
           value: 'desc',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.buckets.terms.orderAscendingTitle', {
+          text: i18n.translate('data.search.aggs.buckets.terms.orderAscendingTitle', {
             defaultMessage: 'Ascending',
           }),
           value: 'asc',
@@ -238,10 +239,10 @@ export const termsBucketAgg = new BucketAggType({
     {
       name: 'otherBucketLabel',
       type: 'string',
-      default: i18n.translate('common.ui.aggTypes.buckets.terms.otherBucketLabel', {
+      default: i18n.translate('data.search.aggs.buckets.terms.otherBucketLabel', {
         defaultMessage: 'Other',
       }),
-      displayName: i18n.translate('common.ui.aggTypes.otherBucket.labelForOtherBucketLabel', {
+      displayName: i18n.translate('data.search.aggs.otherBucket.labelForOtherBucketLabel', {
         defaultMessage: 'Label for other bucket',
       }),
       shouldShow: agg => agg.getParam('otherBucket'),
@@ -254,13 +255,13 @@ export const termsBucketAgg = new BucketAggType({
     },
     {
       name: 'missingBucketLabel',
-      default: i18n.translate('common.ui.aggTypes.buckets.terms.missingBucketLabel', {
+      default: i18n.translate('data.search.aggs.buckets.terms.missingBucketLabel', {
         defaultMessage: 'Missing',
         description: `Default label used in charts when documents are missing a field.
           Visible when you create a chart with a terms aggregation and enable "Show missing values"`,
       }),
       type: 'string',
-      displayName: i18n.translate('common.ui.aggTypes.otherBucket.labelForMissingValuesLabel', {
+      displayName: i18n.translate('data.search.aggs.otherBucket.labelForMissingValuesLabel', {
         defaultMessage: 'Label for missing values',
       }),
       shouldShow: agg => agg.getParam('missingBucket'),
@@ -268,7 +269,7 @@ export const termsBucketAgg = new BucketAggType({
     },
     {
       name: 'exclude',
-      displayName: i18n.translate('common.ui.aggTypes.buckets.terms.excludeLabel', {
+      displayName: i18n.translate('data.search.aggs.buckets.terms.excludeLabel', {
         defaultMessage: 'Exclude',
       }),
       type: 'string',
@@ -278,7 +279,7 @@ export const termsBucketAgg = new BucketAggType({
     },
     {
       name: 'include',
-      displayName: i18n.translate('common.ui.aggTypes.buckets.terms.includeLabel', {
+      displayName: i18n.translate('data.search.aggs.buckets.terms.includeLabel', {
         defaultMessage: 'Include',
       }),
       type: 'string',
diff --git a/src/legacy/ui/public/agg_types/filter/agg_type_filters.test.ts b/src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.test.ts
similarity index 88%
rename from src/legacy/ui/public/agg_types/filter/agg_type_filters.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.test.ts
index 0344f304877f2..cc1288d339692 100644
--- a/src/legacy/ui/public/agg_types/filter/agg_type_filters.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.test.ts
@@ -17,9 +17,10 @@
  * under the License.
  */
 
-import { IndexPattern } from '../../../../../plugins/data/public';
+import { IndexPattern } from '../../../../../../../plugins/data/public';
 import { AggTypeFilters } from './agg_type_filters';
-import { AggConfig, AggType } from '..';
+import { AggConfig } from '..';
+import { IAggType } from '../types';
 
 describe('AggTypeFilters', () => {
   let registry: AggTypeFilters;
@@ -31,13 +32,13 @@ describe('AggTypeFilters', () => {
   });
 
   it('should filter nothing without registered filters', async () => {
-    const aggTypes = [{ name: 'count' }, { name: 'sum' }] as AggType[];
+    const aggTypes = [{ name: 'count' }, { name: 'sum' }] as IAggType[];
     const filtered = registry.filter(aggTypes, indexPattern, aggConfig);
     expect(filtered).toEqual(aggTypes);
   });
 
   it('should pass all aggTypes to the registered filter', async () => {
-    const aggTypes = [{ name: 'count' }, { name: 'sum' }] as AggType[];
+    const aggTypes = [{ name: 'count' }, { name: 'sum' }] as IAggType[];
     const filter = jest.fn();
     registry.addFilter(filter);
     registry.filter(aggTypes, indexPattern, aggConfig);
@@ -46,7 +47,7 @@ describe('AggTypeFilters', () => {
   });
 
   it('should allow registered filters to filter out aggTypes', async () => {
-    const aggTypes = [{ name: 'count' }, { name: 'sum' }, { name: 'avg' }] as AggType[];
+    const aggTypes = [{ name: 'count' }, { name: 'sum' }, { name: 'avg' }] as IAggType[];
     let filtered = registry.filter(aggTypes, indexPattern, aggConfig);
     expect(filtered).toEqual(aggTypes);
 
diff --git a/src/legacy/ui/public/agg_types/filter/agg_type_filters.ts b/src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.ts
similarity index 92%
rename from src/legacy/ui/public/agg_types/filter/agg_type_filters.ts
rename to src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.ts
index 2cc4a6e962214..d3b38ce041d7e 100644
--- a/src/legacy/ui/public/agg_types/filter/agg_type_filters.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/filter/agg_type_filters.ts
@@ -17,12 +17,12 @@
  * under the License.
  */
 import { IndexPattern } from 'src/plugins/data/public';
-import { AggType, AggConfig } from '..';
+import { IAggConfig, IAggType } from '../types';
 
 type AggTypeFilter = (
-  aggType: AggType,
+  aggType: IAggType,
   indexPattern: IndexPattern,
-  aggConfig: AggConfig
+  aggConfig: IAggConfig
 ) => boolean;
 
 /**
@@ -49,7 +49,7 @@ class AggTypeFilters {
    * @param aggConfig The aggConfig for which the returning list will be used.
    * @return A filtered list of the passed aggTypes.
    */
-  public filter(aggTypes: AggType[], indexPattern: IndexPattern, aggConfig: AggConfig) {
+  public filter(aggTypes: IAggType[], indexPattern: IndexPattern, aggConfig: IAggConfig) {
     const allFilters = Array.from(this.filters);
     const allowedAggTypes = aggTypes.filter(aggType => {
       const isAggTypeAllowed = allFilters.every(filter => filter(aggType, indexPattern, aggConfig));
diff --git a/src/legacy/ui/public/agg_types/filter/index.ts b/src/legacy/core_plugins/data/public/search/aggs/filter/index.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/filter/index.ts
rename to src/legacy/core_plugins/data/public/search/aggs/filter/index.ts
diff --git a/src/legacy/ui/public/agg_types/filter/prop_filter.test.ts b/src/legacy/core_plugins/data/public/search/aggs/filter/prop_filter.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/filter/prop_filter.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/filter/prop_filter.test.ts
diff --git a/src/legacy/ui/public/agg_types/filter/prop_filter.ts b/src/legacy/core_plugins/data/public/search/aggs/filter/prop_filter.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/filter/prop_filter.ts
rename to src/legacy/core_plugins/data/public/search/aggs/filter/prop_filter.ts
diff --git a/src/legacy/ui/public/agg_types/index.test.ts b/src/legacy/core_plugins/data/public/search/aggs/index.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/index.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/index.test.ts
diff --git a/src/legacy/core_plugins/data/public/search/aggs/index.ts b/src/legacy/core_plugins/data/public/search/aggs/index.ts
new file mode 100644
index 0000000000000..0fef7f38aae74
--- /dev/null
+++ b/src/legacy/core_plugins/data/public/search/aggs/index.ts
@@ -0,0 +1,52 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { aggTypes } from './agg_types';
+export { AggType } from './agg_type';
+export { AggConfig } from './agg_config';
+export { AggConfigs } from './agg_configs';
+export { FieldParamType } from './param_types';
+export { MetricAggType } from './metrics/metric_agg_type';
+export { AggTypeFilters } from './filter';
+export { aggTypeFieldFilters, AggTypeFieldFilters } from './param_types/filter';
+export {
+  parentPipelineAggHelper,
+  parentPipelineType,
+} from './metrics/lib/parent_pipeline_agg_helper';
+export {
+  siblingPipelineAggHelper,
+  siblingPipelineType,
+} from './metrics/lib/sibling_pipeline_agg_helper';
+
+// static code
+export { AggParamType } from './param_types/agg';
+export { AggGroupNames, aggGroupNamesMap } from './agg_groups';
+export { intervalOptions } from './buckets/_interval_options'; // only used in Discover
+export { isDateHistogramBucketAggConfig, setBounds } from './buckets/date_histogram';
+export { termsAggFilter } from './buckets/terms';
+export { isType, isStringType } from './buckets/migrate_include_exclude_format';
+export { CidrMask } from './buckets/lib/cidr_mask';
+export { convertDateRangeToString } from './buckets/date_range';
+export { convertIPRangeToString } from './buckets/ip_range';
+export { aggTypeFilters, propFilter } from './filter';
+export { OptionedParamType } from './param_types/optioned';
+export { isValidJson, isValidInterval } from './utils';
+export { BUCKET_TYPES } from './buckets/bucket_agg_types';
+export { METRIC_TYPES } from './metrics/metric_agg_types';
+export { ISchemas, Schema, Schemas } from './schemas';
diff --git a/src/legacy/ui/public/agg_types/metrics/avg.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/avg.ts
similarity index 85%
rename from src/legacy/ui/public/agg_types/metrics/avg.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/avg.ts
index 0222a8e543223..b80671a43d2af 100644
--- a/src/legacy/ui/public/agg_types/metrics/avg.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/avg.ts
@@ -20,9 +20,9 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const averageTitle = i18n.translate('common.ui.aggTypes.metrics.averageTitle', {
+const averageTitle = i18n.translate('data.search.aggs.metrics.averageTitle', {
   defaultMessage: 'Average',
 });
 
@@ -30,7 +30,7 @@ export const avgMetricAgg = new MetricAggType({
   name: METRIC_TYPES.AVG,
   title: averageTitle,
   makeLabel: aggConfig => {
-    return i18n.translate('common.ui.aggTypes.metrics.averageLabel', {
+    return i18n.translate('data.search.aggs.metrics.averageLabel', {
       defaultMessage: 'Average {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/bucket_avg.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_avg.ts
similarity index 91%
rename from src/legacy/ui/public/agg_types/metrics/bucket_avg.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_avg.ts
index 7142546dbd494..9fb28f8631bc6 100644
--- a/src/legacy/ui/public/agg_types/metrics/bucket_avg.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_avg.ts
@@ -25,11 +25,11 @@ import { makeNestedLabel } from './lib/make_nested_label';
 import { siblingPipelineAggHelper } from './lib/sibling_pipeline_agg_helper';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const overallAverageLabel = i18n.translate('common.ui.aggTypes.metrics.overallAverageLabel', {
+const overallAverageLabel = i18n.translate('data.search.aggs.metrics.overallAverageLabel', {
   defaultMessage: 'overall average',
 });
 
-const averageBucketTitle = i18n.translate('common.ui.aggTypes.metrics.averageBucketTitle', {
+const averageBucketTitle = i18n.translate('data.search.aggs.metrics.averageBucketTitle', {
   defaultMessage: 'Average Bucket',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/bucket_max.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_max.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/bucket_max.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_max.ts
index aa5b0521709a5..83837f0de5114 100644
--- a/src/legacy/ui/public/agg_types/metrics/bucket_max.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_max.ts
@@ -24,11 +24,11 @@ import { makeNestedLabel } from './lib/make_nested_label';
 import { siblingPipelineAggHelper } from './lib/sibling_pipeline_agg_helper';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const overallMaxLabel = i18n.translate('common.ui.aggTypes.metrics.overallMaxLabel', {
+const overallMaxLabel = i18n.translate('data.search.aggs.metrics.overallMaxLabel', {
   defaultMessage: 'overall max',
 });
 
-const maxBucketTitle = i18n.translate('common.ui.aggTypes.metrics.maxBucketTitle', {
+const maxBucketTitle = i18n.translate('data.search.aggs.metrics.maxBucketTitle', {
   defaultMessage: 'Max Bucket',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/bucket_min.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_min.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/bucket_min.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_min.ts
index b5c0b8865e106..d96197693dc2e 100644
--- a/src/legacy/ui/public/agg_types/metrics/bucket_min.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_min.ts
@@ -22,11 +22,11 @@ import { makeNestedLabel } from './lib/make_nested_label';
 import { siblingPipelineAggHelper } from './lib/sibling_pipeline_agg_helper';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const overallMinLabel = i18n.translate('common.ui.aggTypes.metrics.overallMinLabel', {
+const overallMinLabel = i18n.translate('data.search.aggs.metrics.overallMinLabel', {
   defaultMessage: 'overall min',
 });
 
-const minBucketTitle = i18n.translate('common.ui.aggTypes.metrics.minBucketTitle', {
+const minBucketTitle = i18n.translate('data.search.aggs.metrics.minBucketTitle', {
   defaultMessage: 'Min Bucket',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/bucket_sum.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_sum.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/bucket_sum.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_sum.ts
index d4faa81c4041c..1f9392c5bec35 100644
--- a/src/legacy/ui/public/agg_types/metrics/bucket_sum.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/bucket_sum.ts
@@ -23,11 +23,11 @@ import { makeNestedLabel } from './lib/make_nested_label';
 import { siblingPipelineAggHelper } from './lib/sibling_pipeline_agg_helper';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const overallSumLabel = i18n.translate('common.ui.aggTypes.metrics.overallSumLabel', {
+const overallSumLabel = i18n.translate('data.search.aggs.metrics.overallSumLabel', {
   defaultMessage: 'overall sum',
 });
 
-const sumBucketTitle = i18n.translate('common.ui.aggTypes.metrics.sumBucketTitle', {
+const sumBucketTitle = i18n.translate('data.search.aggs.metrics.sumBucketTitle', {
   defaultMessage: 'Sum Bucket',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/cardinality.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/cardinality.ts
similarity index 86%
rename from src/legacy/ui/public/agg_types/metrics/cardinality.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/cardinality.ts
index c69ffae3b4871..147e925521088 100644
--- a/src/legacy/ui/public/agg_types/metrics/cardinality.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/cardinality.ts
@@ -21,9 +21,9 @@ import { i18n } from '@kbn/i18n';
 import { npStart } from 'ui/new_platform';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const uniqueCountTitle = i18n.translate('common.ui.aggTypes.metrics.uniqueCountTitle', {
+const uniqueCountTitle = i18n.translate('data.search.aggs.metrics.uniqueCountTitle', {
   defaultMessage: 'Unique Count',
 });
 
@@ -31,7 +31,7 @@ export const cardinalityMetricAgg = new MetricAggType({
   name: METRIC_TYPES.CARDINALITY,
   title: uniqueCountTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.metrics.uniqueCountLabel', {
+    return i18n.translate('data.search.aggs.metrics.uniqueCountLabel', {
       defaultMessage: 'Unique count of {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/count.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/count.ts
similarity index 87%
rename from src/legacy/ui/public/agg_types/metrics/count.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/count.ts
index 22a939cd9a3fd..14a9bd073ff2b 100644
--- a/src/legacy/ui/public/agg_types/metrics/count.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/count.ts
@@ -19,18 +19,18 @@
 
 import { i18n } from '@kbn/i18n';
 import { npStart } from 'ui/new_platform';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
 
 export const countMetricAgg = new MetricAggType({
   name: METRIC_TYPES.COUNT,
-  title: i18n.translate('common.ui.aggTypes.metrics.countTitle', {
+  title: i18n.translate('data.search.aggs.metrics.countTitle', {
     defaultMessage: 'Count',
   }),
   hasNoDsl: true,
   makeLabel() {
-    return i18n.translate('common.ui.aggTypes.metrics.countLabel', {
+    return i18n.translate('data.search.aggs.metrics.countLabel', {
       defaultMessage: 'Count',
     });
   },
diff --git a/src/legacy/ui/public/agg_types/metrics/cumulative_sum.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/cumulative_sum.ts
similarity index 88%
rename from src/legacy/ui/public/agg_types/metrics/cumulative_sum.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/cumulative_sum.ts
index bad2de8cb16dc..a5d02459900bb 100644
--- a/src/legacy/ui/public/agg_types/metrics/cumulative_sum.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/cumulative_sum.ts
@@ -23,11 +23,11 @@ import { parentPipelineAggHelper } from './lib/parent_pipeline_agg_helper';
 import { makeNestedLabel } from './lib/make_nested_label';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const cumulativeSumLabel = i18n.translate('common.ui.aggTypes.metrics.cumulativeSumLabel', {
+const cumulativeSumLabel = i18n.translate('data.search.aggs.metrics.cumulativeSumLabel', {
   defaultMessage: 'cumulative sum',
 });
 
-const cumulativeSumTitle = i18n.translate('common.ui.aggTypes.metrics.cumulativeSumTitle', {
+const cumulativeSumTitle = i18n.translate('data.search.aggs.metrics.cumulativeSumTitle', {
   defaultMessage: 'Cumulative Sum',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/derivative.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/derivative.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/derivative.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/derivative.ts
index 42921621a2933..1169a527b0668 100644
--- a/src/legacy/ui/public/agg_types/metrics/derivative.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/derivative.ts
@@ -23,11 +23,11 @@ import { parentPipelineAggHelper } from './lib/parent_pipeline_agg_helper';
 import { makeNestedLabel } from './lib/make_nested_label';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const derivativeLabel = i18n.translate('common.ui.aggTypes.metrics.derivativeLabel', {
+const derivativeLabel = i18n.translate('data.search.aggs.metrics.derivativeLabel', {
   defaultMessage: 'derivative',
 });
 
-const derivativeTitle = i18n.translate('common.ui.aggTypes.metrics.derivativeTitle', {
+const derivativeTitle = i18n.translate('data.search.aggs.metrics.derivativeTitle', {
   defaultMessage: 'Derivative',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/geo_bounds.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/geo_bounds.ts
similarity index 84%
rename from src/legacy/ui/public/agg_types/metrics/geo_bounds.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/geo_bounds.ts
index b8ce03cdf11ec..53bc72f9ce1da 100644
--- a/src/legacy/ui/public/agg_types/metrics/geo_bounds.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/geo_bounds.ts
@@ -20,13 +20,13 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const geoBoundsTitle = i18n.translate('common.ui.aggTypes.metrics.geoBoundsTitle', {
+const geoBoundsTitle = i18n.translate('data.search.aggs.metrics.geoBoundsTitle', {
   defaultMessage: 'Geo Bounds',
 });
 
-const geoBoundsLabel = i18n.translate('common.ui.aggTypes.metrics.geoBoundsLabel', {
+const geoBoundsLabel = i18n.translate('data.search.aggs.metrics.geoBoundsLabel', {
   defaultMessage: 'Geo Bounds',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/geo_centroid.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/geo_centroid.ts
similarity index 84%
rename from src/legacy/ui/public/agg_types/metrics/geo_centroid.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/geo_centroid.ts
index 5313e31796a5b..a79b2b34ad1ca 100644
--- a/src/legacy/ui/public/agg_types/metrics/geo_centroid.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/geo_centroid.ts
@@ -20,13 +20,13 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const geoCentroidTitle = i18n.translate('common.ui.aggTypes.metrics.geoCentroidTitle', {
+const geoCentroidTitle = i18n.translate('data.search.aggs.metrics.geoCentroidTitle', {
   defaultMessage: 'Geo Centroid',
 });
 
-const geoCentroidLabel = i18n.translate('common.ui.aggTypes.metrics.geoCentroidLabel', {
+const geoCentroidLabel = i18n.translate('data.search.aggs.metrics.geoCentroidLabel', {
   defaultMessage: 'Geo Centroid',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/get_response_agg_config_class.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/get_response_agg_config_class.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/get_response_agg_config_class.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/get_response_agg_config_class.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/make_nested_label.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/make_nested_label.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/make_nested_label.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/make_nested_label.test.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/make_nested_label.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/make_nested_label.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/make_nested_label.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/make_nested_label.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/nested_agg_helpers.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/nested_agg_helpers.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/nested_agg_helpers.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/nested_agg_helpers.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/ordinal_suffix.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/ordinal_suffix.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/ordinal_suffix.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/ordinal_suffix.test.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/ordinal_suffix.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/ordinal_suffix.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/ordinal_suffix.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/ordinal_suffix.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_helper.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_helper.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_helper.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_helper.ts
index 4d558e50304e6..0d1b2472bb8e2 100644
--- a/src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_helper.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_helper.ts
@@ -36,7 +36,7 @@ const metricAggFilter = [
   '!geo_centroid',
 ];
 
-const metricAggTitle = i18n.translate('common.ui.aggTypes.metrics.metricAggTitle', {
+const metricAggTitle = i18n.translate('data.search.aggs.metrics.metricAggTitle', {
   defaultMessage: 'Metric agg',
 });
 
@@ -51,7 +51,7 @@ const [metricAggSchema] = new Schemas([
 ]).all;
 
 const parentPipelineType = i18n.translate(
-  'common.ui.aggTypes.metrics.parentPipelineAggregationsSubtypeTitle',
+  'data.search.aggs.metrics.parentPipelineAggregationsSubtypeTitle',
   {
     defaultMessage: 'Parent Pipeline Aggregations',
   }
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_writer.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_writer.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_writer.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_writer.ts
index 684fe721a754a..bc0359b2a213d 100644
--- a/src/legacy/ui/public/agg_types/metrics/lib/parent_pipeline_agg_writer.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/parent_pipeline_agg_writer.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { AggConfigs } from '../../agg_configs';
+import { IAggConfigs } from '../../agg_configs';
 import { IMetricAggConfig } from '../metric_agg_type';
 
 export const parentPipelineAggWriter = (
   agg: IMetricAggConfig,
   output: Record<string, any>,
-  aggConfigs?: AggConfigs
+  aggConfigs?: IAggConfigs
 ): void => {
   const customMetric = agg.getParam('customMetric');
   const metricAgg = agg.getParam('metricAgg');
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/sibling_pipeline_agg_helper.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/sibling_pipeline_agg_helper.ts
similarity index 93%
rename from src/legacy/ui/public/agg_types/metrics/lib/sibling_pipeline_agg_helper.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/sibling_pipeline_agg_helper.ts
index 9dd737bd6708e..3956bda1812ad 100644
--- a/src/legacy/ui/public/agg_types/metrics/lib/sibling_pipeline_agg_helper.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/sibling_pipeline_agg_helper.ts
@@ -47,7 +47,7 @@ const [metricAggSchema] = new Schemas([
   {
     group: 'none',
     name: 'metricAgg',
-    title: i18n.translate('common.ui.aggTypes.metrics.metricAggTitle', {
+    title: i18n.translate('data.search.aggs.metrics.metricAggTitle', {
       defaultMessage: 'Metric agg',
     }),
     aggFilter: metricAggFilter,
@@ -57,7 +57,7 @@ const [metricAggSchema] = new Schemas([
 const [bucketAggSchema] = new Schemas([
   {
     group: 'none',
-    title: i18n.translate('common.ui.aggTypes.metrics.bucketAggTitle', {
+    title: i18n.translate('data.search.aggs.metrics.bucketAggTitle', {
       defaultMessage: 'Bucket agg',
     }),
     name: 'bucketAgg',
@@ -66,7 +66,7 @@ const [bucketAggSchema] = new Schemas([
 ]).all;
 
 const siblingPipelineType = i18n.translate(
-  'common.ui.aggTypes.metrics.siblingPipelineAggregationsSubtypeTitle',
+  'data.search.aggs.metrics.siblingPipelineAggregationsSubtypeTitle',
   {
     defaultMessage: 'Sibling pipeline aggregations',
   }
diff --git a/src/legacy/ui/public/agg_types/metrics/lib/sibling_pipeline_agg_writer.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/lib/sibling_pipeline_agg_writer.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/lib/sibling_pipeline_agg_writer.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/lib/sibling_pipeline_agg_writer.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/max.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/max.ts
similarity index 86%
rename from src/legacy/ui/public/agg_types/metrics/max.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/max.ts
index 5c43511acee72..d561788936b51 100644
--- a/src/legacy/ui/public/agg_types/metrics/max.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/max.ts
@@ -20,9 +20,9 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const maxTitle = i18n.translate('common.ui.aggTypes.metrics.maxTitle', {
+const maxTitle = i18n.translate('data.search.aggs.metrics.maxTitle', {
   defaultMessage: 'Max',
 });
 
@@ -30,7 +30,7 @@ export const maxMetricAgg = new MetricAggType({
   name: METRIC_TYPES.MAX,
   title: maxTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.metrics.maxLabel', {
+    return i18n.translate('data.search.aggs.metrics.maxLabel', {
       defaultMessage: 'Max {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/median.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/median.test.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/metrics/median.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/median.test.ts
index 819c24f135cdc..9affb0e3b2814 100644
--- a/src/legacy/ui/public/agg_types/metrics/median.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/median.test.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { AggConfigs } from '../agg_configs';
+import { AggConfigs, IAggConfigs } from '../agg_configs';
 import { METRIC_TYPES } from './metric_agg_types';
 
 jest.mock('ui/new_platform');
 
 describe('AggTypeMetricMedianProvider class', () => {
-  let aggConfigs: AggConfigs;
+  let aggConfigs: IAggConfigs;
 
   beforeEach(() => {
     const field = {
diff --git a/src/legacy/ui/public/agg_types/metrics/median.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/median.ts
similarity index 88%
rename from src/legacy/ui/public/agg_types/metrics/median.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/median.ts
index 5792d4a7c2ba3..be080aaa5ee6f 100644
--- a/src/legacy/ui/public/agg_types/metrics/median.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/median.ts
@@ -22,9 +22,9 @@ import { METRIC_TYPES } from './metric_agg_types';
 
 // @ts-ignore
 import { percentilesMetricAgg } from './percentiles';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const medianTitle = i18n.translate('common.ui.aggTypes.metrics.medianTitle', {
+const medianTitle = i18n.translate('data.search.aggs.metrics.medianTitle', {
   defaultMessage: 'Median',
 });
 
@@ -33,7 +33,7 @@ export const medianMetricAgg = new MetricAggType({
   dslName: 'percentiles',
   title: medianTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.metrics.medianLabel', {
+    return i18n.translate('data.search.aggs.metrics.medianLabel', {
       defaultMessage: 'Median {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/metric_agg_type.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/metric_agg_type.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/metric_agg_type.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/metric_agg_type.ts
index 5cd3dffb10b9d..3bae7b92618dc 100644
--- a/src/legacy/ui/public/agg_types/metrics/metric_agg_type.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/metric_agg_type.ts
@@ -23,7 +23,8 @@ import { AggType, AggTypeConfig } from '../agg_type';
 import { AggParamType } from '../param_types/agg';
 import { AggConfig } from '../agg_config';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
+import { FilterFieldTypes } from '../param_types/field';
 
 export interface IMetricAggConfig extends AggConfig {
   type: InstanceType<typeof MetricAggType>;
@@ -31,7 +32,7 @@ export interface IMetricAggConfig extends AggConfig {
 
 export interface MetricAggParam<TMetricAggConfig extends AggConfig>
   extends AggParamType<TMetricAggConfig> {
-  filterFieldTypes?: KBN_FIELD_TYPES | KBN_FIELD_TYPES[] | '*';
+  filterFieldTypes?: FilterFieldTypes;
   onlyAggregatable?: boolean;
 }
 
@@ -43,6 +44,9 @@ interface MetricAggTypeConfig<TMetricAggConfig extends AggConfig>
   subtype?: string;
 }
 
+// TODO need to make a more explicit interface for this
+export type IMetricAggType = MetricAggType;
+
 export class MetricAggType<TMetricAggConfig extends AggConfig = IMetricAggConfig> extends AggType<
   TMetricAggConfig,
   MetricAggParam<TMetricAggConfig>
@@ -83,7 +87,7 @@ export class MetricAggType<TMetricAggConfig extends AggConfig = IMetricAggConfig
 
     this.subtype =
       config.subtype ||
-      i18n.translate('common.ui.aggTypes.metrics.metricAggregationsSubtypeTitle', {
+      i18n.translate('data.search.aggs.metrics.metricAggregationsSubtypeTitle', {
         defaultMessage: 'Metric Aggregations',
       });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/metric_agg_types.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/metric_agg_types.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/metric_agg_types.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/metric_agg_types.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/min.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/min.ts
similarity index 86%
rename from src/legacy/ui/public/agg_types/metrics/min.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/min.ts
index 5f8ca72954cc2..4885105163435 100644
--- a/src/legacy/ui/public/agg_types/metrics/min.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/min.ts
@@ -19,9 +19,9 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const minTitle = i18n.translate('common.ui.aggTypes.metrics.minTitle', {
+const minTitle = i18n.translate('data.search.aggs.metrics.minTitle', {
   defaultMessage: 'Min',
 });
 
@@ -29,7 +29,7 @@ export const minMetricAgg = new MetricAggType({
   name: METRIC_TYPES.MIN,
   title: minTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.metrics.minLabel', {
+    return i18n.translate('data.search.aggs.metrics.minLabel', {
       defaultMessage: 'Min {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/moving_avg.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/moving_avg.ts
similarity index 92%
rename from src/legacy/ui/public/agg_types/metrics/moving_avg.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/moving_avg.ts
index b6a8e7a5d6a99..cb733507858bc 100644
--- a/src/legacy/ui/public/agg_types/metrics/moving_avg.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/moving_avg.ts
@@ -23,11 +23,11 @@ import { parentPipelineAggHelper } from './lib/parent_pipeline_agg_helper';
 import { makeNestedLabel } from './lib/make_nested_label';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const movingAvgTitle = i18n.translate('common.ui.aggTypes.metrics.movingAvgTitle', {
+const movingAvgTitle = i18n.translate('data.search.aggs.metrics.movingAvgTitle', {
   defaultMessage: 'Moving Avg',
 });
 
-const movingAvgLabel = i18n.translate('common.ui.aggTypes.metrics.movingAvgLabel', {
+const movingAvgLabel = i18n.translate('data.search.aggs.metrics.movingAvgLabel', {
   defaultMessage: 'moving avg',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/parent_pipeline.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/parent_pipeline.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/parent_pipeline.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/parent_pipeline.test.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/percentile_ranks.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.test.ts
similarity index 96%
rename from src/legacy/ui/public/agg_types/metrics/percentile_ranks.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.test.ts
index 7461b5cf07ee7..655e918ce07de 100644
--- a/src/legacy/ui/public/agg_types/metrics/percentile_ranks.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.test.ts
@@ -18,13 +18,13 @@
  */
 
 import { IPercentileRanksAggConfig, percentileRanksMetricAgg } from './percentile_ranks';
-import { AggConfigs } from '../agg_configs';
+import { AggConfigs, IAggConfigs } from '../agg_configs';
 import { METRIC_TYPES } from './metric_agg_types';
 
 jest.mock('ui/new_platform');
 
 describe('AggTypesMetricsPercentileRanksProvider class', function() {
-  let aggConfigs: AggConfigs;
+  let aggConfigs: IAggConfigs;
 
   beforeEach(() => {
     const field = {
diff --git a/src/legacy/ui/public/agg_types/metrics/percentile_ranks.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/percentile_ranks.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.ts
index cbd46e3f5b28d..38b47a7e97d2f 100644
--- a/src/legacy/ui/public/agg_types/metrics/percentile_ranks.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentile_ranks.ts
@@ -24,7 +24,7 @@ import { getResponseAggConfigClass, IResponseAggConfig } from './lib/get_respons
 
 import { getPercentileValue } from './percentiles_get_value';
 import { METRIC_TYPES } from './metric_agg_types';
-import { fieldFormats, KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { fieldFormats, KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 // required by the values editor
 
@@ -41,7 +41,7 @@ const valueProps = {
     const customLabel = this.getParam('customLabel');
     const label = customLabel || this.getFieldDisplayName();
 
-    return i18n.translate('common.ui.aggTypes.metrics.percentileRanks.valuePropsLabel', {
+    return i18n.translate('data.search.aggs.metrics.percentileRanks.valuePropsLabel', {
       defaultMessage: 'Percentile rank {format} of "{label}"',
       values: { format: format.convert(this.key, 'text'), label },
     });
@@ -50,11 +50,11 @@ const valueProps = {
 
 export const percentileRanksMetricAgg = new MetricAggType<IPercentileRanksAggConfig>({
   name: METRIC_TYPES.PERCENTILE_RANKS,
-  title: i18n.translate('common.ui.aggTypes.metrics.percentileRanksTitle', {
+  title: i18n.translate('data.search.aggs.metrics.percentileRanksTitle', {
     defaultMessage: 'Percentile Ranks',
   }),
   makeLabel(agg) {
-    return i18n.translate('common.ui.aggTypes.metrics.percentileRanksLabel', {
+    return i18n.translate('data.search.aggs.metrics.percentileRanksLabel', {
       defaultMessage: 'Percentile ranks of {field}',
       values: { field: agg.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/percentiles.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.test.ts
similarity index 95%
rename from src/legacy/ui/public/agg_types/metrics/percentiles.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.test.ts
index c9f4bcc3862a0..dd1aaca973e47 100644
--- a/src/legacy/ui/public/agg_types/metrics/percentiles.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.test.ts
@@ -18,13 +18,13 @@
  */
 
 import { IPercentileAggConfig, percentilesMetricAgg } from './percentiles';
-import { AggConfigs } from '../agg_configs';
+import { AggConfigs, IAggConfigs } from '../agg_configs';
 import { METRIC_TYPES } from './metric_agg_types';
 
 jest.mock('ui/new_platform');
 
 describe('AggTypesMetricsPercentilesProvider class', () => {
-  let aggConfigs: AggConfigs;
+  let aggConfigs: IAggConfigs;
 
   beforeEach(() => {
     const field = {
diff --git a/src/legacy/ui/public/agg_types/metrics/percentiles.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.ts
similarity index 88%
rename from src/legacy/ui/public/agg_types/metrics/percentiles.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.ts
index 040324d8da5df..39dc0d0f181e9 100644
--- a/src/legacy/ui/public/agg_types/metrics/percentiles.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles.ts
@@ -21,7 +21,7 @@ import { i18n } from '@kbn/i18n';
 
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 import { getResponseAggConfigClass, IResponseAggConfig } from './lib/get_response_agg_config_class';
 import { getPercentileValue } from './percentiles_get_value';
@@ -36,7 +36,7 @@ const valueProps = {
     const customLabel = this.getParam('customLabel');
     const label = customLabel || this.getFieldDisplayName();
 
-    return i18n.translate('common.ui.aggTypes.metrics.percentiles.valuePropsLabel', {
+    return i18n.translate('data.search.aggs.metrics.percentiles.valuePropsLabel', {
       defaultMessage: '{percentile} percentile of {label}',
       values: { percentile: ordinalSuffix(this.key), label },
     });
@@ -45,11 +45,11 @@ const valueProps = {
 
 export const percentilesMetricAgg = new MetricAggType<IPercentileAggConfig>({
   name: METRIC_TYPES.PERCENTILES,
-  title: i18n.translate('common.ui.aggTypes.metrics.percentilesTitle', {
+  title: i18n.translate('data.search.aggs.metrics.percentilesTitle', {
     defaultMessage: 'Percentiles',
   }),
   makeLabel(agg) {
-    return i18n.translate('common.ui.aggTypes.metrics.percentilesLabel', {
+    return i18n.translate('data.search.aggs.metrics.percentilesLabel', {
       defaultMessage: 'Percentiles of {field}',
       values: { field: agg.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/percentiles_get_value.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles_get_value.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/percentiles_get_value.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/percentiles_get_value.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/serial_diff.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/serial_diff.ts
similarity index 89%
rename from src/legacy/ui/public/agg_types/metrics/serial_diff.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/serial_diff.ts
index bb5431fbbefd9..5af6e1952d135 100644
--- a/src/legacy/ui/public/agg_types/metrics/serial_diff.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/serial_diff.ts
@@ -23,11 +23,11 @@ import { parentPipelineAggHelper } from './lib/parent_pipeline_agg_helper';
 import { makeNestedLabel } from './lib/make_nested_label';
 import { METRIC_TYPES } from './metric_agg_types';
 
-const serialDiffTitle = i18n.translate('common.ui.aggTypes.metrics.serialDiffTitle', {
+const serialDiffTitle = i18n.translate('data.search.aggs.metrics.serialDiffTitle', {
   defaultMessage: 'Serial Diff',
 });
 
-const serialDiffLabel = i18n.translate('common.ui.aggTypes.metrics.serialDiffLabel', {
+const serialDiffLabel = i18n.translate('data.search.aggs.metrics.serialDiffLabel', {
   defaultMessage: 'serial diff',
 });
 
diff --git a/src/legacy/ui/public/agg_types/metrics/sibling_pipeline.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/sibling_pipeline.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/sibling_pipeline.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/sibling_pipeline.test.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/std_deviation.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/std_deviation.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/metrics/std_deviation.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/std_deviation.test.ts
diff --git a/src/legacy/ui/public/agg_types/metrics/std_deviation.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/std_deviation.ts
similarity index 85%
rename from src/legacy/ui/public/agg_types/metrics/std_deviation.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/std_deviation.ts
index b2e6d3b3ca4d0..caf3bb71dd89a 100644
--- a/src/legacy/ui/public/agg_types/metrics/std_deviation.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/std_deviation.ts
@@ -22,7 +22,7 @@ import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
 import { getResponseAggConfigClass, IResponseAggConfig } from './lib/get_response_agg_config_class';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 interface ValProp {
   valProp: string[];
@@ -51,7 +51,7 @@ const responseAggConfigProps = {
   keyedDetails(this: IStdDevAggConfig, customLabel: string, fieldDisplayName: string) {
     const label =
       customLabel ||
-      i18n.translate('common.ui.aggTypes.metrics.standardDeviation.keyDetailsLabel', {
+      i18n.translate('data.search.aggs.metrics.standardDeviation.keyDetailsLabel', {
         defaultMessage: 'Standard Deviation of {fieldDisplayName}',
         values: { fieldDisplayName },
       });
@@ -59,14 +59,14 @@ const responseAggConfigProps = {
     return {
       std_lower: {
         valProp: ['std_deviation_bounds', 'lower'],
-        title: i18n.translate('common.ui.aggTypes.metrics.standardDeviation.lowerKeyDetailsTitle', {
+        title: i18n.translate('data.search.aggs.metrics.standardDeviation.lowerKeyDetailsTitle', {
           defaultMessage: 'Lower {label}',
           values: { label },
         }),
       },
       std_upper: {
         valProp: ['std_deviation_bounds', 'upper'],
-        title: i18n.translate('common.ui.aggTypes.metrics.standardDeviation.upperKeyDetailsTitle', {
+        title: i18n.translate('data.search.aggs.metrics.standardDeviation.upperKeyDetailsTitle', {
           defaultMessage: 'Upper {label}',
           values: { label },
         }),
@@ -78,11 +78,11 @@ const responseAggConfigProps = {
 export const stdDeviationMetricAgg = new MetricAggType<IStdDevAggConfig>({
   name: METRIC_TYPES.STD_DEV,
   dslName: 'extended_stats',
-  title: i18n.translate('common.ui.aggTypes.metrics.standardDeviationTitle', {
+  title: i18n.translate('data.search.aggs.metrics.standardDeviationTitle', {
     defaultMessage: 'Standard Deviation',
   }),
   makeLabel(agg) {
-    return i18n.translate('common.ui.aggTypes.metrics.standardDeviationLabel', {
+    return i18n.translate('data.search.aggs.metrics.standardDeviationLabel', {
       defaultMessage: 'Standard Deviation of {field}',
       values: { field: agg.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/sum.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/sum.ts
similarity index 86%
rename from src/legacy/ui/public/agg_types/metrics/sum.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/sum.ts
index ce79c761ce799..f3450ba1700c8 100644
--- a/src/legacy/ui/public/agg_types/metrics/sum.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/sum.ts
@@ -20,9 +20,9 @@
 import { i18n } from '@kbn/i18n';
 import { MetricAggType } from './metric_agg_type';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
-const sumTitle = i18n.translate('common.ui.aggTypes.metrics.sumTitle', {
+const sumTitle = i18n.translate('data.search.aggs.metrics.sumTitle', {
   defaultMessage: 'Sum',
 });
 
@@ -30,7 +30,7 @@ export const sumMetricAgg = new MetricAggType({
   name: METRIC_TYPES.SUM,
   title: sumTitle,
   makeLabel(aggConfig) {
-    return i18n.translate('common.ui.aggTypes.metrics.sumLabel', {
+    return i18n.translate('data.search.aggs.metrics.sumLabel', {
       defaultMessage: 'Sum of {field}',
       values: { field: aggConfig.getFieldDisplayName() },
     });
diff --git a/src/legacy/ui/public/agg_types/metrics/top_hit.test.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.test.ts
similarity index 99%
rename from src/legacy/ui/public/agg_types/metrics/top_hit.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.test.ts
index 3e861c052d367..a973de4fe8659 100644
--- a/src/legacy/ui/public/agg_types/metrics/top_hit.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.test.ts
@@ -21,7 +21,7 @@ import { dropRight, last } from 'lodash';
 import { topHitMetricAgg } from './top_hit';
 import { AggConfigs } from '../agg_configs';
 import { IMetricAggConfig } from './metric_agg_type';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
diff --git a/src/legacy/ui/public/agg_types/metrics/top_hit.ts b/src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.ts
similarity index 82%
rename from src/legacy/ui/public/agg_types/metrics/top_hit.ts
rename to src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.ts
index 43fe33bdebeb9..3112d882bb87e 100644
--- a/src/legacy/ui/public/agg_types/metrics/top_hit.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/metrics/top_hit.ts
@@ -20,9 +20,8 @@
 import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { IMetricAggConfig, MetricAggType } from './metric_agg_type';
-import { aggTypeFieldFilters } from '../param_types/filter';
 import { METRIC_TYPES } from './metric_agg_types';
-import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 // @ts-ignore
 import { wrapWithInlineComp } from '../buckets/inline_comp_wrapper';
@@ -33,27 +32,16 @@ const isNumericFieldSelected = (agg: IMetricAggConfig) => {
   return field && field.type && field.type === KBN_FIELD_TYPES.NUMBER;
 };
 
-aggTypeFieldFilters.addFilter((field, aggConfig) => {
-  if (
-    aggConfig.type.name !== METRIC_TYPES.TOP_HITS ||
-    _.get(aggConfig.schema, 'aggSettings.top_hits.allowStrings', false)
-  ) {
-    return true;
-  }
-
-  return field.type === KBN_FIELD_TYPES.NUMBER;
-});
-
 export const topHitMetricAgg = new MetricAggType({
   name: METRIC_TYPES.TOP_HITS,
-  title: i18n.translate('common.ui.aggTypes.metrics.topHitTitle', {
+  title: i18n.translate('data.search.aggs.metrics.topHitTitle', {
     defaultMessage: 'Top Hit',
   }),
   makeLabel(aggConfig) {
-    const lastPrefixLabel = i18n.translate('common.ui.aggTypes.metrics.topHit.lastPrefixLabel', {
+    const lastPrefixLabel = i18n.translate('data.search.aggs.metrics.topHit.lastPrefixLabel', {
       defaultMessage: 'Last',
     });
-    const firstPrefixLabel = i18n.translate('common.ui.aggTypes.metrics.topHit.firstPrefixLabel', {
+    const firstPrefixLabel = i18n.translate('data.search.aggs.metrics.topHit.firstPrefixLabel', {
       defaultMessage: 'First',
     });
 
@@ -75,7 +63,10 @@ export const topHitMetricAgg = new MetricAggType({
       name: 'field',
       type: 'field',
       onlyAggregatable: false,
-      filterFieldTypes: '*',
+      filterFieldTypes: (aggConfig: IMetricAggConfig) =>
+        _.get(aggConfig.schema, 'aggSettings.top_hits.allowStrings', false)
+          ? '*'
+          : KBN_FIELD_TYPES.NUMBER,
       write(agg, output) {
         const field = agg.getParam('field');
         output.params = {};
@@ -106,7 +97,7 @@ export const topHitMetricAgg = new MetricAggType({
       type: 'optioned',
       options: [
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.minLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.minLabel', {
             defaultMessage: 'Min',
           }),
           isCompatible: isNumericFieldSelected,
@@ -114,7 +105,7 @@ export const topHitMetricAgg = new MetricAggType({
           value: 'min',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.maxLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.maxLabel', {
             defaultMessage: 'Max',
           }),
           isCompatible: isNumericFieldSelected,
@@ -122,7 +113,7 @@ export const topHitMetricAgg = new MetricAggType({
           value: 'max',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.sumLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.sumLabel', {
             defaultMessage: 'Sum',
           }),
           isCompatible: isNumericFieldSelected,
@@ -130,7 +121,7 @@ export const topHitMetricAgg = new MetricAggType({
           value: 'sum',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.averageLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.averageLabel', {
             defaultMessage: 'Average',
           }),
           isCompatible: isNumericFieldSelected,
@@ -138,7 +129,7 @@ export const topHitMetricAgg = new MetricAggType({
           value: 'average',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.concatenateLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.concatenateLabel', {
             defaultMessage: 'Concatenate',
           }),
           isCompatible(aggConfig: IMetricAggConfig) {
@@ -174,13 +165,13 @@ export const topHitMetricAgg = new MetricAggType({
       default: 'desc',
       options: [
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.descendingLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.descendingLabel', {
             defaultMessage: 'Descending',
           }),
           value: 'desc',
         },
         {
-          text: i18n.translate('common.ui.aggTypes.metrics.topHit.ascendingLabel', {
+          text: i18n.translate('data.search.aggs.metrics.topHit.ascendingLabel', {
             defaultMessage: 'Ascending',
           }),
           value: 'asc',
diff --git a/src/legacy/ui/public/agg_types/param_types/agg.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/agg.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/agg.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/agg.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/base.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/base.ts
similarity index 94%
rename from src/legacy/ui/public/agg_types/param_types/base.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/base.ts
index 15ec44e2ca5ae..1523cb03eb966 100644
--- a/src/legacy/ui/public/agg_types/param_types/base.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/param_types/base.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { AggConfigs } from '../agg_configs';
+import { IAggConfigs } from '../agg_configs';
 import { AggConfig } from '../agg_config';
-import { FetchOptions, ISearchSource } from '../../../../../plugins/data/public';
+import { FetchOptions, ISearchSource } from '../../../../../../../plugins/data/public';
 
 export class BaseParamType<TAggConfig extends AggConfig = AggConfig> {
   name: string;
@@ -31,7 +31,7 @@ export class BaseParamType<TAggConfig extends AggConfig = AggConfig> {
   write: (
     aggConfig: TAggConfig,
     output: Record<string, any>,
-    aggConfigs?: AggConfigs,
+    aggConfigs?: IAggConfigs,
     locals?: Record<string, any>
   ) => void;
   serialize: (value: any, aggConfig?: TAggConfig) => any;
diff --git a/src/legacy/ui/public/agg_types/param_types/field.test.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/field.test.ts
similarity index 54%
rename from src/legacy/ui/public/agg_types/param_types/field.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/field.test.ts
index 9cea2934d7459..fa88754ac60b9 100644
--- a/src/legacy/ui/public/agg_types/param_types/field.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/param_types/field.test.ts
@@ -17,9 +17,13 @@
  * under the License.
  */
 
+import { get } from 'lodash';
 import { BaseParamType } from './base';
 import { FieldParamType } from './field';
-import { ES_FIELD_TYPES, KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
+import { ES_FIELD_TYPES, KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
+import { IAggConfig } from '../agg_config';
+import { IMetricAggConfig } from '../metrics/metric_agg_type';
+import { Schema } from '../schemas';
 
 jest.mock('ui/new_platform');
 
@@ -45,7 +49,11 @@ describe('Field', () => {
         searchable: true,
       },
     ],
-  } as any;
+  };
+
+  const agg = ({
+    getIndexPattern: jest.fn(() => indexPattern),
+  } as unknown) as IAggConfig;
 
   describe('constructor', () => {
     it('it is an instance of BaseParamType', () => {
@@ -65,7 +73,7 @@ describe('Field', () => {
         type: 'field',
       });
 
-      const fields = aggParam.getAvailableFields(indexPattern.fields);
+      const fields = aggParam.getAvailableFields(agg);
 
       expect(fields.length).toBe(1);
 
@@ -82,7 +90,58 @@ describe('Field', () => {
 
       aggParam.onlyAggregatable = false;
 
-      const fields = aggParam.getAvailableFields(indexPattern.fields);
+      const fields = aggParam.getAvailableFields(agg);
+
+      expect(fields.length).toBe(2);
+    });
+
+    it('should return all fields if filterFieldTypes was not specified', () => {
+      const aggParam = new FieldParamType({
+        name: 'field',
+        type: 'field',
+      });
+
+      indexPattern.fields[1].aggregatable = true;
+
+      const fields = aggParam.getAvailableFields(agg);
+
+      expect(fields.length).toBe(2);
+    });
+
+    it('should return only numeric fields if filterFieldTypes was specified as a function', () => {
+      const aggParam = new FieldParamType({
+        name: 'field',
+        type: 'field',
+        filterFieldTypes: (aggConfig: IMetricAggConfig) =>
+          get(aggConfig.schema, 'aggSettings.top_hits.allowStrings', false)
+            ? '*'
+            : KBN_FIELD_TYPES.NUMBER,
+      });
+      const fields = aggParam.getAvailableFields(agg);
+
+      expect(fields.length).toBe(1);
+      expect(fields[0].type).toBe(KBN_FIELD_TYPES.NUMBER);
+    });
+
+    it('should return all fields if filterFieldTypes was specified as a function and aggSettings allow string type fields', () => {
+      const aggParam = new FieldParamType({
+        name: 'field',
+        type: 'field',
+        filterFieldTypes: (aggConfig: IMetricAggConfig) =>
+          get(aggConfig.schema, 'aggSettings.top_hits.allowStrings', false)
+            ? '*'
+            : KBN_FIELD_TYPES.NUMBER,
+      });
+
+      agg.schema = {
+        aggSettings: {
+          top_hits: {
+            allowStrings: true,
+          },
+        },
+      } as Schema;
+
+      const fields = aggParam.getAvailableFields(agg);
 
       expect(fields.length).toBe(2);
     });
diff --git a/src/legacy/ui/public/agg_types/param_types/field.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/field.ts
similarity index 65%
rename from src/legacy/ui/public/agg_types/param_types/field.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/field.ts
index d01e059c6c616..9a204bb151e2d 100644
--- a/src/legacy/ui/public/agg_types/param_types/field.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/param_types/field.ts
@@ -17,22 +17,27 @@
  * under the License.
  */
 
-// @ts-ignore
 import { i18n } from '@kbn/i18n';
-import { AggConfig } from '../agg_config';
-import { SavedObjectNotFound } from '../../../../../plugins/kibana_utils/public';
+import { isFunction } from 'lodash';
+import { npStart } from 'ui/new_platform';
+import { IAggConfig } from '../agg_config';
+import { SavedObjectNotFound } from '../../../../../../../plugins/kibana_utils/public';
 import { BaseParamType } from './base';
-import { npStart } from '../../new_platform';
 import { propFilter } from '../filter';
-import { Field, IFieldList } from '../../../../../plugins/data/public';
-import { isNestedField } from '../../../../../plugins/data/public';
+import { IMetricAggConfig } from '../metrics/metric_agg_type';
+import { Field, isNestedField, KBN_FIELD_TYPES } from '../../../../../../../plugins/data/public';
 
 const filterByType = propFilter('type');
 
+type FieldTypes = KBN_FIELD_TYPES | KBN_FIELD_TYPES[] | '*';
+export type FilterFieldTypes = ((aggConfig: IMetricAggConfig) => FieldTypes) | FieldTypes;
+// TODO need to make a more explicit interface for this
+export type IFieldParamType = FieldParamType;
+
 export class FieldParamType extends BaseParamType {
   required = true;
   scriptable = true;
-  filterFieldTypes: string;
+  filterFieldTypes: FilterFieldTypes;
   onlyAggregatable: boolean;
 
   constructor(config: Record<string, any>) {
@@ -42,20 +47,17 @@ export class FieldParamType extends BaseParamType {
     this.onlyAggregatable = config.onlyAggregatable !== false;
 
     if (!config.write) {
-      this.write = (aggConfig: AggConfig, output: Record<string, any>) => {
+      this.write = (aggConfig: IAggConfig, output: Record<string, any>) => {
         const field = aggConfig.getField();
 
         if (!field) {
           throw new TypeError(
-            i18n.translate(
-              'common.ui.aggTypes.paramTypes.field.requiredFieldParameterErrorMessage',
-              {
-                defaultMessage: '{fieldParameter} is a required parameter',
-                values: {
-                  fieldParameter: '"field"',
-                },
-              }
-            )
+            i18n.translate('data.search.aggs.paramTypes.field.requiredFieldParameterErrorMessage', {
+              defaultMessage: '{fieldParameter} is a required parameter',
+              values: {
+                fieldParameter: '"field"',
+              },
+            })
           );
         }
 
@@ -74,7 +76,7 @@ export class FieldParamType extends BaseParamType {
       return field.name;
     };
 
-    this.deserialize = (fieldName: string, aggConfig?: AggConfig) => {
+    this.deserialize = (fieldName: string, aggConfig?: IAggConfig) => {
       if (!aggConfig) {
         throw new Error('aggConfig was not provided to FieldParamType deserialize function');
       }
@@ -85,13 +87,11 @@ export class FieldParamType extends BaseParamType {
       }
 
       // @ts-ignore
-      const validField = this.getAvailableFields(aggConfig.getIndexPattern().fields).find(
-        (f: any) => f.name === fieldName
-      );
+      const validField = this.getAvailableFields(aggConfig).find((f: any) => f.name === fieldName);
       if (!validField) {
         npStart.core.notifications.toasts.addDanger(
           i18n.translate(
-            'common.ui.aggTypes.paramTypes.field.invalidSavedFieldParameterErrorMessage',
+            'data.search.aggs.paramTypes.field.invalidSavedFieldParameterErrorMessage',
             {
               defaultMessage:
                 'Saved {fieldParameter} parameter is now invalid. Please select a new field.',
@@ -110,7 +110,8 @@ export class FieldParamType extends BaseParamType {
   /**
    * filter the fields to the available ones
    */
-  getAvailableFields = (fields: IFieldList) => {
+  getAvailableFields = (aggConfig: IAggConfig) => {
+    const fields = aggConfig.getIndexPattern().fields;
     const filteredFields = fields.filter((field: Field) => {
       const { onlyAggregatable, scriptable, filterFieldTypes } = this;
 
@@ -121,8 +122,10 @@ export class FieldParamType extends BaseParamType {
         return false;
       }
 
-      if (!filterFieldTypes) {
-        return true;
+      if (isFunction(filterFieldTypes)) {
+        const filter = filterFieldTypes(aggConfig as IMetricAggConfig);
+
+        return filterByType([field], filter).length !== 0;
       }
 
       return filterByType([field], filterFieldTypes).length !== 0;
diff --git a/src/legacy/ui/public/agg_types/param_types/filter/field_filters.test.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/filter/field_filters.test.ts
similarity index 97%
rename from src/legacy/ui/public/agg_types/param_types/filter/field_filters.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/filter/field_filters.test.ts
index 384c142408012..fb53e72b85c60 100644
--- a/src/legacy/ui/public/agg_types/param_types/filter/field_filters.test.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/param_types/filter/field_filters.test.ts
@@ -20,7 +20,7 @@
 import { IndexedArray } from 'ui/indexed_array';
 import { AggTypeFieldFilters } from './field_filters';
 import { AggConfig } from '../../agg_config';
-import { Field } from '../../../../../../plugins/data/public';
+import { Field } from '../../../../../../../../plugins/data/public';
 
 describe('AggTypeFieldFilters', () => {
   let registry: AggTypeFieldFilters;
diff --git a/src/legacy/ui/public/agg_types/param_types/filter/field_filters.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/filter/field_filters.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/filter/field_filters.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/filter/field_filters.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/filter/index.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/filter/index.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/filter/index.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/filter/index.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/index.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/index.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/index.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/index.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/json.test.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/json.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/json.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/json.test.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/json.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/json.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/json.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/json.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/optioned.test.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/optioned.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/optioned.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/optioned.test.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/optioned.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/optioned.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/optioned.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/optioned.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/string.test.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/string.test.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/string.test.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/string.test.ts
diff --git a/src/legacy/ui/public/agg_types/param_types/string.ts b/src/legacy/core_plugins/data/public/search/aggs/param_types/string.ts
similarity index 100%
rename from src/legacy/ui/public/agg_types/param_types/string.ts
rename to src/legacy/core_plugins/data/public/search/aggs/param_types/string.ts
diff --git a/src/legacy/ui/public/agg_types/schemas.ts b/src/legacy/core_plugins/data/public/search/aggs/schemas.ts
similarity index 98%
rename from src/legacy/ui/public/agg_types/schemas.ts
rename to src/legacy/core_plugins/data/public/search/aggs/schemas.ts
index 05723cac1869d..1aa5ebe08656b 100644
--- a/src/legacy/ui/public/agg_types/schemas.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/schemas.ts
@@ -45,7 +45,7 @@ export interface Schema {
   aggSettings?: any;
 }
 
-class Schemas {
+export class Schemas {
   // @ts-ignore
   all: IndexedArray<Schema>;
 
@@ -103,5 +103,3 @@ class Schemas {
       .commit();
   }
 }
-
-export { Schemas };
diff --git a/src/core/server/saved_objects/schema/schema.mock.ts b/src/legacy/core_plugins/data/public/search/aggs/types.ts
similarity index 60%
rename from src/core/server/saved_objects/schema/schema.mock.ts
rename to src/legacy/core_plugins/data/public/search/aggs/types.ts
index 89c318f087ab0..2c918abf99fca 100644
--- a/src/core/server/saved_objects/schema/schema.mock.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/types.ts
@@ -17,19 +17,13 @@
  * under the License.
  */
 
-import { SavedObjectsSchema } from './schema';
-
-type Schema = PublicMethodsOf<SavedObjectsSchema>;
-const createSchemaMock = () => {
-  const mocked: jest.Mocked<Schema> = {
-    getIndexForType: jest.fn().mockReturnValue('.kibana-test'),
-    isHiddenType: jest.fn().mockReturnValue(false),
-    isNamespaceAgnostic: jest.fn((type: string) => type === 'global'),
-    getConvertToAliasScript: jest.fn().mockReturnValue(undefined),
-  };
-  return mocked;
-};
-
-export const schemaMock = {
-  create: createSchemaMock,
-};
+export { IAggConfig } from './agg_config';
+export { IAggConfigs } from './agg_configs';
+export { IAggType } from './agg_type';
+export { AggParam, AggParamOption } from './agg_params';
+export { IFieldParamType } from './param_types';
+export { IMetricAggType } from './metrics/metric_agg_type';
+export { DateRangeKey } from './buckets/date_range';
+export { IpRangeKey } from './buckets/ip_range';
+export { OptionedValueProp, OptionedParamEditorProps } from './param_types/optioned';
+export { ISchemas } from './schemas';
diff --git a/src/legacy/ui/public/agg_types/utils.test.tsx b/src/legacy/core_plugins/data/public/search/aggs/utils.test.tsx
similarity index 100%
rename from src/legacy/ui/public/agg_types/utils.test.tsx
rename to src/legacy/core_plugins/data/public/search/aggs/utils.test.tsx
diff --git a/src/legacy/ui/public/agg_types/utils.ts b/src/legacy/core_plugins/data/public/search/aggs/utils.ts
similarity index 92%
rename from src/legacy/ui/public/agg_types/utils.ts
rename to src/legacy/core_plugins/data/public/search/aggs/utils.ts
index e382f821b31a9..62f07ce44ab46 100644
--- a/src/legacy/ui/public/agg_types/utils.ts
+++ b/src/legacy/core_plugins/data/public/search/aggs/utils.ts
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { isValidEsInterval } from '../../../core_plugins/data/common/parse_es_interval/is_valid_es_interval';
-import { leastCommonInterval } from '../vis/lib/least_common_interval';
+import { leastCommonInterval } from 'ui/vis/lib/least_common_interval';
+import { isValidEsInterval } from '../../../common';
 
 /**
  * Check a string if it's a valid JSON.
diff --git a/src/legacy/core_plugins/data/public/search/expressions/esaggs.ts b/src/legacy/core_plugins/data/public/search/expressions/esaggs.ts
index b4ea2cd378d61..43927337ce574 100644
--- a/src/legacy/core_plugins/data/public/search/expressions/esaggs.ts
+++ b/src/legacy/core_plugins/data/public/search/expressions/esaggs.ts
@@ -19,7 +19,7 @@
 
 import { get, has } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { AggConfigs } from 'ui/agg_types/agg_configs';
+import { AggConfigs, IAggConfigs } from 'ui/agg_types';
 import { createFormat } from 'ui/visualize/loader/pipeline_helpers/utilities';
 import {
   KibanaContext,
@@ -50,7 +50,7 @@ import { serializeAggConfig } from './utils';
 
 export interface RequestHandlerParams {
   searchSource: ISearchSource;
-  aggs: AggConfigs;
+  aggs: IAggConfigs;
   timeRange?: TimeRange;
   query?: Query;
   filters?: esFilters.Filter[];
diff --git a/src/legacy/core_plugins/data/public/search/expressions/utils.ts b/src/legacy/core_plugins/data/public/search/expressions/utils.ts
index 4f104f2569a98..f0958ba20820f 100644
--- a/src/legacy/core_plugins/data/public/search/expressions/utils.ts
+++ b/src/legacy/core_plugins/data/public/search/expressions/utils.ts
@@ -17,12 +17,12 @@
  * under the License.
  */
 
-import { AggConfig } from 'ui/agg_types/agg_config';
-import { AggConfigs } from '../../../../../ui/public/agg_types/agg_configs';
+import { AggConfigs } from '../aggs';
+import { IAggConfig } from '../aggs/types';
 import { KibanaDatatableColumnMeta } from '../../../../../../plugins/expressions/common/expression_types';
 import { IndexPattern } from '../../../../../../plugins/data/public';
 
-export const serializeAggConfig = (aggConfig: AggConfig): KibanaDatatableColumnMeta => {
+export const serializeAggConfig = (aggConfig: IAggConfig): KibanaDatatableColumnMeta => {
   return {
     type: aggConfig.type.name,
     indexPatternId: aggConfig.getIndexPattern().id,
diff --git a/src/legacy/core_plugins/data/public/search/index.ts b/src/legacy/core_plugins/data/public/search/index.ts
index c975d5772e0a8..90e191b769a8d 100644
--- a/src/legacy/core_plugins/data/public/search/index.ts
+++ b/src/legacy/core_plugins/data/public/search/index.ts
@@ -17,5 +17,6 @@
  * under the License.
  */
 
+export * from './aggs';
 export { getRequestInspectorStats, getResponseInspectorStats } from './utils';
 export { serializeAggConfig } from './expressions/utils';
diff --git a/src/legacy/core_plugins/data/public/search/search_service.ts b/src/legacy/core_plugins/data/public/search/search_service.ts
new file mode 100644
index 0000000000000..45f9ff17328ad
--- /dev/null
+++ b/src/legacy/core_plugins/data/public/search/search_service.ts
@@ -0,0 +1,93 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, CoreStart } from '../../../../../core/public';
+import {
+  aggTypes,
+  AggType,
+  AggConfig,
+  AggConfigs,
+  FieldParamType,
+  MetricAggType,
+  aggTypeFieldFilters,
+  setBounds,
+  parentPipelineAggHelper,
+  siblingPipelineAggHelper,
+} from './aggs';
+
+interface AggsSetup {
+  types: typeof aggTypes;
+}
+
+interface AggsStart {
+  types: typeof aggTypes;
+  AggConfig: typeof AggConfig;
+  AggConfigs: typeof AggConfigs;
+  AggType: typeof AggType;
+  aggTypeFieldFilters: typeof aggTypeFieldFilters;
+  FieldParamType: typeof FieldParamType;
+  MetricAggType: typeof MetricAggType;
+  parentPipelineAggHelper: typeof parentPipelineAggHelper;
+  siblingPipelineAggHelper: typeof siblingPipelineAggHelper;
+  setBounds: typeof setBounds;
+}
+
+export interface SearchSetup {
+  aggs: AggsSetup;
+}
+
+export interface SearchStart {
+  aggs: AggsStart;
+}
+
+/**
+ * The contract provided here is a new platform shim for ui/agg_types.
+ *
+ * Once it has been refactored to work with new platform services,
+ * it will move into the existing search service in src/plugins/data/public/search
+ */
+export class SearchService {
+  public setup(core: CoreSetup): SearchSetup {
+    return {
+      aggs: {
+        types: aggTypes, // TODO convert to registry
+        // TODO add other items as needed
+      },
+    };
+  }
+
+  public start(core: CoreStart): SearchStart {
+    return {
+      aggs: {
+        types: aggTypes, // TODO convert to registry
+        AggConfig, // TODO make static
+        AggConfigs,
+        AggType,
+        aggTypeFieldFilters,
+        FieldParamType,
+        MetricAggType,
+        parentPipelineAggHelper, // TODO make static
+        siblingPipelineAggHelper, // TODO make static
+        setBounds, // TODO make static
+      },
+    };
+  }
+
+  public stop() {}
+}
diff --git a/src/legacy/core_plugins/data/public/search/types.ts b/src/legacy/core_plugins/data/public/search/types.ts
index 140ceea487099..47ea1d168f379 100644
--- a/src/legacy/core_plugins/data/public/search/types.ts
+++ b/src/legacy/core_plugins/data/public/search/types.ts
@@ -17,4 +17,5 @@
  * under the License.
  */
 
+export * from './aggs/types';
 export * from './utils/types';
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js
index 0b8786f0c2841..68216b92840fc 100644
--- a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js
+++ b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.js
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { AbortController } from 'abortcontroller-polyfill/dist/cjs-ponyfill';
+import { AbortController } from 'abort-controller';
 
 /*
  * A simple utility for generating a handler that provides a signal to the handler that signals when
diff --git a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js
index d79dd4ae4e449..1c154370d1674 100644
--- a/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js
+++ b/src/legacy/core_plugins/elasticsearch/server/lib/abortable_request_handler.test.js
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { AbortSignal } from 'abortcontroller-polyfill/dist/cjs-ponyfill';
+import { AbortSignal } from 'abort-controller';
 import { abortableRequestHandler } from './abortable_request_handler';
 
 describe('abortableRequestHandler', () => {
diff --git a/src/legacy/core_plugins/kibana/index.js b/src/legacy/core_plugins/kibana/index.js
index 8c35044b52c9e..395e0da218307 100644
--- a/src/legacy/core_plugins/kibana/index.js
+++ b/src/legacy/core_plugins/kibana/index.js
@@ -97,13 +97,8 @@ export default function(kibana) {
           }),
           order: -1001,
           url: `${kbnBaseUrl}#/dashboards`,
-          // The subUrlBase is the common substring of all urls for this app. If not given, it defaults to the url
-          // above. This app has to use a different subUrlBase, in addition to the url above, because "#/dashboard"
-          // routes to a page that creates a new dashboard. When we introduced a landing page, we needed to change
-          // the url above in order to preserve the original url for BWC. The subUrlBase helps the Chrome api nav
-          // to determine what url to use for the app link.
-          subUrlBase: `${kbnBaseUrl}#/dashboard`,
           euiIconType: 'dashboardApp',
+          disableSubUrlTracking: true,
           category: DEFAULT_APP_CATEGORIES.analyze,
         },
         {
diff --git a/src/legacy/core_plugins/kibana/public/.eslintrc.js b/src/legacy/core_plugins/kibana/public/.eslintrc.js
index 9b45217287dc8..b3ee0a8fa7b04 100644
--- a/src/legacy/core_plugins/kibana/public/.eslintrc.js
+++ b/src/legacy/core_plugins/kibana/public/.eslintrc.js
@@ -17,8 +17,15 @@
  * under the License.
  */
 
+const topLevelConfig = require('../../../../../.eslintrc.js');
 const path = require('path');
 
+const topLevelRestricedZones = topLevelConfig.overrides.find(
+  override =>
+    override.files[0] === '**/*.{js,ts,tsx}' &&
+    Object.keys(override.rules)[0] === '@kbn/eslint/no-restricted-paths'
+).rules['@kbn/eslint/no-restricted-paths'][1].zones;
+
 /**
  * Builds custom restricted paths configuration for the shimmed plugins within the kibana plugin.
  * These custom rules extend the default checks in the top level `eslintrc.js` by also checking two other things:
@@ -28,34 +35,37 @@ const path = require('path');
  * @returns zones configuration for the no-restricted-paths linter
  */
 function buildRestrictedPaths(shimmedPlugins) {
-  return shimmedPlugins.map(shimmedPlugin => ([{
-    target: [
-      `src/legacy/core_plugins/kibana/public/${shimmedPlugin}/np_ready/**/*`,
-    ],
-    from: [
-      'ui/**/*',
-      'src/legacy/ui/**/*',
-      'src/legacy/core_plugins/kibana/public/**/*',
-      'src/legacy/core_plugins/data/public/**/*',
-      '!src/legacy/core_plugins/data/public/index.ts',
-      `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
-    ],
-    allowSameFolder: false,
-    errorMessage: `${shimmedPlugin} is a shimmed plugin that is not allowed to import modules from the legacy platform. If you need legacy modules for the transition period, import them either in the legacy_imports, kibana_services or index module.`,
-  }, {
-    target: [
-      'src/**/*',
-      `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
-      'x-pack/**/*',
-    ],
-    from: [
-      `src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
-      `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/index.ts`,
-      `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/legacy.ts`,
-    ],
-    allowSameFolder: false,
-    errorMessage: `kibana/public/${shimmedPlugin} is behaving like a NP plugin and does not allow deep imports. If you need something from within ${shimmedPlugin} in another plugin, consider re-exporting it from the top level index module`,
-  }])).reduce((acc, part) => [...acc, ...part], []);
+  return shimmedPlugins
+    .map(shimmedPlugin => [
+      {
+        target: [`src/legacy/core_plugins/kibana/public/${shimmedPlugin}/np_ready/**/*`],
+        from: [
+          'ui/**/*',
+          'src/legacy/ui/**/*',
+          'src/legacy/core_plugins/kibana/public/**/*',
+          'src/legacy/core_plugins/data/public/**/*',
+          '!src/legacy/core_plugins/data/public/index.ts',
+          `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
+        ],
+        allowSameFolder: false,
+        errorMessage: `${shimmedPlugin} is a shimmed plugin that is not allowed to import modules from the legacy platform. If you need legacy modules for the transition period, import them either in the legacy_imports, kibana_services or index module.`,
+      },
+      {
+        target: [
+          'src/**/*',
+          `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
+          'x-pack/**/*',
+        ],
+        from: [
+          `src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
+          `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/index.ts`,
+          `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/legacy.ts`,
+        ],
+        allowSameFolder: false,
+        errorMessage: `kibana/public/${shimmedPlugin} is behaving like a NP plugin and does not allow deep imports. If you need something from within ${shimmedPlugin} in another plugin, consider re-exporting it from the top level index module`,
+      },
+    ])
+    .reduce((acc, part) => [...acc, ...part], []);
 }
 
 module.exports = {
@@ -66,7 +76,9 @@ module.exports = {
       'error',
       {
         basePath: path.resolve(__dirname, '../../../../../'),
-        zones: buildRestrictedPaths(['visualize', 'discover', 'dashboard', 'devTools', 'home']),
+        zones: topLevelRestricedZones.concat(
+          buildRestrictedPaths(['visualize', 'discover', 'dashboard', 'devTools', 'home'])
+        ),
       },
     ],
   },
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts b/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts
index acbc4c4b6c47f..ca2dc9d5fb4f5 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/legacy.ts
@@ -41,6 +41,7 @@ async function getAngularDependencies(): Promise<LegacyAngularInjectedDependenci
   const instance = plugin({} as PluginInitializerContext);
   instance.setup(npSetup.core, {
     ...npSetup.plugins,
+    npData: npSetup.plugins.data,
     __LEGACY: {
       getAngularDependencies,
     },
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts b/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
index 14bdef99ca894..b729691831e9a 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
@@ -29,28 +29,26 @@ import chrome from 'ui/chrome';
 export const legacyChrome = chrome;
 export { SavedObjectSaveOpts } from 'ui/saved_objects/types';
 export { npSetup, npStart } from 'ui/new_platform';
-export { IPrivate } from 'ui/private';
-export { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
 export { subscribeWithScope } from 'ui/utils/subscribe_with_scope';
 // @ts-ignore
 export { ConfirmationButtonTypes } from 'ui/modals/confirm_modal';
-export { showSaveModal, SaveResult } from 'ui/saved_objects/show_saved_object_save_modal';
-export { migrateLegacyQuery } from 'ui/utils/migrate_legacy_query';
 export { KbnUrl } from 'ui/url/kbn_url';
 // @ts-ignore
-export { PrivateProvider } from 'ui/private/private';
-// @ts-ignore
 export { createTopNavDirective, createTopNavHelper } from 'ui/kbn_top_nav/kbn_top_nav';
 // @ts-ignore
-export { PromiseServiceCreator } from 'ui/promises/promises';
-// @ts-ignore
 export { KbnUrlProvider, RedirectWhenMissingProvider } from 'ui/url/index';
 // @ts-ignore
 export { confirmModalFactory } from 'ui/modals/confirm_modal';
-export { configureAppAngularModule } from 'ui/legacy_compat';
-export { ensureDefaultIndexPattern } from 'ui/legacy_compat';
 export { IInjector } from 'ui/chrome';
 export { SavedObjectLoader } from 'ui/saved_objects';
 export { VISUALIZE_EMBEDDABLE_TYPE } from '../../../visualizations/public/embeddable';
 export { registerTimefilterWithGlobalStateFactory } from 'ui/timefilter/setup_router';
 export { absoluteToParsedUrl } from 'ui/url/absolute_to_parsed_url';
+export {
+  configureAppAngularModule,
+  ensureDefaultIndexPattern,
+  IPrivate,
+  migrateLegacyQuery,
+  PrivateProvider,
+  PromiseServiceCreator,
+} from '../../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/migrations/migrations_730.test.ts b/src/legacy/core_plugins/kibana/public/dashboard/migrations/migrations_730.test.ts
index 6404b5bdbd63b..86d399d219a26 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/migrations/migrations_730.test.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/migrations/migrations_730.test.ts
@@ -28,6 +28,7 @@ import {
 
 const mockLogger = {
   warning: () => {},
+  warn: () => {},
   debug: () => {},
   info: () => {},
 };
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/application.ts b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/application.ts
index f1fd93fd09b3d..b0e4785edcb0b 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/application.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/application.ts
@@ -73,7 +73,6 @@ export const renderApp = (element: HTMLElement, appBasePath: string, deps: Rende
     angularModuleInstance = createLocalAngularModule(deps.core, deps.navigation);
     // global routing stuff
     configureAppAngularModule(angularModuleInstance, deps.core as LegacyCoreStart, true);
-    // custom routing stuff
     initDashboardApp(angularModuleInstance, deps);
   }
 
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
index 624be02ac3b9d..9f6b01d5beb49 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
@@ -31,8 +31,6 @@ import {
   ConfirmationButtonTypes,
   migrateLegacyQuery,
   SavedObjectSaveOpts,
-  SaveResult,
-  showSaveModal,
   subscribeWithScope,
 } from '../legacy_imports';
 import {
@@ -45,6 +43,11 @@ import {
   syncAppFilters,
   syncQuery,
 } from '../../../../../../plugins/data/public';
+import {
+  SaveResult,
+  showSaveModal,
+  getSavedObjectFinder,
+} from '../../../../../../plugins/saved_objects/public';
 
 import {
   DASHBOARD_CONTAINER_TYPE,
@@ -74,10 +77,6 @@ import { getDashboardTitle } from './dashboard_strings';
 import { DashboardAppScope } from './dashboard_app';
 import { convertSavedDashboardPanelToPanelState } from './lib/embeddable_saved_object_converters';
 import { RenderDeps } from './application';
-import {
-  SavedObjectFinderProps,
-  SavedObjectFinderUi,
-} from '../../../../../../plugins/kibana_react/public';
 import {
   IKbnUrlStateStorage,
   removeQueryParam,
@@ -114,7 +113,16 @@ export class DashboardAppController {
     share,
     dashboardCapabilities,
     npDataStart: { query: queryService },
-    core: { notifications, overlays, chrome, injectedMetadata, uiSettings, savedObjects, http },
+    core: {
+      notifications,
+      overlays,
+      chrome,
+      injectedMetadata,
+      uiSettings,
+      savedObjects,
+      http,
+      i18n: i18nStart,
+    },
     history,
     kbnUrlStateStorage,
   }: DashboardAppControllerDependencies) {
@@ -777,7 +785,7 @@ export class DashboardAppController {
           showCopyOnSave={dash.id ? true : false}
         />
       );
-      showSaveModal(dashboardSaveModal);
+      showSaveModal(dashboardSaveModal, i18nStart.Context);
     };
     navActions[TopNavIds.CLONE] = () => {
       const currentTitle = dashboardStateManager.getTitle();
@@ -806,17 +814,13 @@ export class DashboardAppController {
     };
     navActions[TopNavIds.ADD] = () => {
       if (dashboardContainer && !isErrorEmbeddable(dashboardContainer)) {
-        const SavedObjectFinder = (props: SavedObjectFinderProps) => (
-          <SavedObjectFinderUi {...props} savedObjects={savedObjects} uiSettings={uiSettings} />
-        );
-
         openAddPanelFlyout({
           embeddable: dashboardContainer,
           getAllFactories: embeddables.getEmbeddableFactories,
           getFactory: embeddables.getEmbeddableFactory,
           notifications,
           overlays,
-          SavedObjectFinder,
+          SavedObjectFinder: getSavedObjectFinder(savedObjects, uiSettings),
         });
       }
     };
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/test_utils/get_saved_dashboard_mock.ts b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/test_utils/get_saved_dashboard_mock.ts
index d5e61936f67cf..60b2a33f720ec 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/test_utils/get_saved_dashboard_mock.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/test_utils/get_saved_dashboard_mock.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { searchSourceMock } from '../../../../../../../plugins/data/public/search/search_source/mocks';
+import { searchSourceMock } from '../../../../../../../plugins/data/public/mocks';
 import { SavedObjectDashboard } from '../../saved_dashboard/saved_dashboard';
 
 export function getSavedDashboardMock(
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.test.js b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.test.js
index 5f708a22fd530..e3933ce9d0143 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.test.js
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.test.js
@@ -20,7 +20,7 @@
 import React from 'react';
 import { shallowWithI18nProvider } from 'test_utils/enzyme_helpers';
 
-jest.mock('../../legacy_imports', () => ({
+jest.mock('../../../../../../../plugins/saved_objects/public', () => ({
   SavedObjectSaveModal: () => null,
 }));
 
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.tsx b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.tsx
index bd53fd5a13083..026784fcae06f 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/save_modal.tsx
@@ -21,7 +21,7 @@ import React, { Fragment } from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiFormRow, EuiTextArea, EuiSwitch } from '@elastic/eui';
 
-import { SavedObjectSaveModal } from '../../legacy_imports';
+import { SavedObjectSaveModal } from '../../../../../../../plugins/saved_objects/public';
 
 interface SaveOptions {
   newTitle: string;
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/plugin.ts b/src/legacy/core_plugins/kibana/public/dashboard/plugin.ts
index 227bcb53ca0df..7ae1c723a3914 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/plugin.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/plugin.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { BehaviorSubject } from 'rxjs';
 import {
   App,
   CoreSetup,
@@ -28,7 +29,10 @@ import {
 import { i18n } from '@kbn/i18n';
 import { RenderDeps } from './np_ready/application';
 import { DataStart } from '../../../data/public';
-import { DataPublicPluginStart as NpDataStart } from '../../../../../plugins/data/public';
+import {
+  DataPublicPluginStart as NpDataStart,
+  DataPublicPluginSetup as NpDataSetup,
+} from '../../../../../plugins/data/public';
 import { IEmbeddableStart } from '../../../../../plugins/embeddable/public';
 import { Storage } from '../../../../../plugins/kibana_utils/public';
 import { NavigationPublicPluginStart as NavigationStart } from '../../../../../plugins/navigation/public';
@@ -38,8 +42,13 @@ import {
   HomePublicPluginSetup,
 } from '../../../../../plugins/home/public';
 import { SharePluginStart } from '../../../../../plugins/share/public';
-import { KibanaLegacySetup } from '../../../../../plugins/kibana_legacy/public';
+import {
+  AngularRenderedAppUpdater,
+  KibanaLegacySetup,
+} from '../../../../../plugins/kibana_legacy/public';
 import { createSavedDashboardLoader } from './saved_dashboard/saved_dashboards';
+import { createKbnUrlTracker } from '../../../../../plugins/kibana_utils/public';
+import { getQueryStateContainer } from '../../../../../plugins/data/public';
 
 export interface LegacyAngularInjectedDependencies {
   dashboardConfig: any;
@@ -58,7 +67,8 @@ export interface DashboardPluginSetupDependencies {
     getAngularDependencies: () => Promise<LegacyAngularInjectedDependencies>;
   };
   home: HomePublicPluginSetup;
-  kibana_legacy: KibanaLegacySetup;
+  kibanaLegacy: KibanaLegacySetup;
+  npData: NpDataSetup;
 }
 
 export class DashboardPlugin implements Plugin {
@@ -70,10 +80,38 @@ export class DashboardPlugin implements Plugin {
     share: SharePluginStart;
   } | null = null;
 
+  private appStateUpdater = new BehaviorSubject<AngularRenderedAppUpdater>(() => ({}));
+  private stopUrlTracking: (() => void) | undefined = undefined;
+
   public setup(
     core: CoreSetup,
-    { __LEGACY: { getAngularDependencies }, home, kibana_legacy }: DashboardPluginSetupDependencies
+    {
+      __LEGACY: { getAngularDependencies },
+      home,
+      kibanaLegacy,
+      npData,
+    }: DashboardPluginSetupDependencies
   ) {
+    const { querySyncStateContainer, stop: stopQuerySyncStateContainer } = getQueryStateContainer(
+      npData.query
+    );
+    const { appMounted, appUnMounted, stop: stopUrlTracker } = createKbnUrlTracker({
+      baseUrl: core.http.basePath.prepend('/app/kibana'),
+      defaultSubUrl: '#/dashboards',
+      storageKey: 'lastUrl:dashboard',
+      navLinkUpdater$: this.appStateUpdater,
+      toastNotifications: core.notifications.toasts,
+      stateParams: [
+        {
+          kbnUrlKey: '_g',
+          stateUpdate$: querySyncStateContainer.state$,
+        },
+      ],
+    });
+    this.stopUrlTracking = () => {
+      stopQuerySyncStateContainer();
+      stopUrlTracker();
+    };
     const app: App = {
       id: '',
       title: 'Dashboards',
@@ -81,6 +119,7 @@ export class DashboardPlugin implements Plugin {
         if (this.startDependencies === null) {
           throw new Error('not started yet');
         }
+        appMounted();
         const {
           savedObjectsClient,
           embeddables,
@@ -107,18 +146,28 @@ export class DashboardPlugin implements Plugin {
           chrome: contextCore.chrome,
           addBasePath: contextCore.http.basePath.prepend,
           uiSettings: contextCore.uiSettings,
-          config: kibana_legacy.config,
+          config: kibanaLegacy.config,
           savedQueryService: npDataStart.query.savedQueries,
           embeddables,
           dashboardCapabilities: contextCore.application.capabilities.dashboard,
           localStorage: new Storage(localStorage),
         };
         const { renderApp } = await import('./np_ready/application');
-        return renderApp(params.element, params.appBasePath, deps);
+        const unmount = renderApp(params.element, params.appBasePath, deps);
+        return () => {
+          unmount();
+          appUnMounted();
+        };
       },
     };
-    kibana_legacy.registerLegacyApp({ ...app, id: 'dashboard' });
-    kibana_legacy.registerLegacyApp({ ...app, id: 'dashboards' });
+    kibanaLegacy.registerLegacyApp({
+      ...app,
+      id: 'dashboard',
+      // only register the updater in once app, otherwise all updates would happen twice
+      updater$: this.appStateUpdater.asObservable(),
+      navLinkId: 'kibana:dashboard',
+    });
+    kibanaLegacy.registerLegacyApp({ ...app, id: 'dashboards' });
 
     home.featureCatalogue.register({
       id: 'dashboard',
@@ -147,4 +196,10 @@ export class DashboardPlugin implements Plugin {
       share,
     };
   }
+
+  stop() {
+    if (this.stopUrlTracking) {
+      this.stopUrlTracking();
+    }
+  }
 }
diff --git a/src/legacy/core_plugins/kibana/public/dev_tools/index.ts b/src/legacy/core_plugins/kibana/public/dev_tools/index.ts
index f2555259028cc..6515674c6b52a 100644
--- a/src/legacy/core_plugins/kibana/public/dev_tools/index.ts
+++ b/src/legacy/core_plugins/kibana/public/dev_tools/index.ts
@@ -22,7 +22,7 @@ import 'uiExports/devTools';
 
 import { npStart } from 'ui/new_platform';
 
-if (npStart.plugins.dev_tools.getSortedDevTools().length === 0) {
+if (npStart.plugins.devTools.getSortedDevTools().length === 0) {
   npStart.core.chrome.navLinks.update('kibana:dev_tools', {
     hidden: true,
   });
diff --git a/src/legacy/ui/public/directives/__tests__/css_truncate.js b/src/legacy/core_plugins/kibana/public/discover/__tests__/directives/css_truncate.js
similarity index 92%
rename from src/legacy/ui/public/directives/__tests__/css_truncate.js
rename to src/legacy/core_plugins/kibana/public/discover/__tests__/directives/css_truncate.js
index bf102f5a29fdb..8dea9c61475db 100644
--- a/src/legacy/ui/public/directives/__tests__/css_truncate.js
+++ b/src/legacy/core_plugins/kibana/public/discover/__tests__/directives/css_truncate.js
@@ -20,7 +20,7 @@
 import angular from 'angular';
 import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
-import 'plugins/kibana/discover/legacy';
+import { pluginInstance } from 'plugins/kibana/discover/legacy';
 
 let $parentScope;
 
@@ -30,7 +30,9 @@ let $elem;
 
 const init = function(expandable) {
   // Load the application
-  ngMock.module('kibana');
+  pluginInstance.initializeServices();
+  pluginInstance.initializeInnerAngular();
+  ngMock.module('app/discover');
 
   // Create the scope
   ngMock.inject(function($rootScope, $compile) {
diff --git a/src/legacy/ui/public/directives/__tests__/fixed_scroll.js b/src/legacy/core_plugins/kibana/public/discover/__tests__/directives/fixed_scroll.js
similarity index 96%
rename from src/legacy/ui/public/directives/__tests__/fixed_scroll.js
rename to src/legacy/core_plugins/kibana/public/discover/__tests__/directives/fixed_scroll.js
index b35836967c3f3..49a0df54079ea 100644
--- a/src/legacy/ui/public/directives/__tests__/fixed_scroll.js
+++ b/src/legacy/core_plugins/kibana/public/discover/__tests__/directives/fixed_scroll.js
@@ -18,8 +18,8 @@
  */
 
 import expect from '@kbn/expect';
+import { pluginInstance } from 'plugins/kibana/discover/legacy';
 import ngMock from 'ng_mock';
-import '../../fixed_scroll';
 import $ from 'jquery';
 import sinon from 'sinon';
 
@@ -29,8 +29,9 @@ describe('FixedScroll directive', function() {
   let compile;
   let flushPendingTasks;
   const trash = [];
-
-  beforeEach(ngMock.module('kibana'));
+  beforeEach(() => pluginInstance.initializeServices());
+  beforeEach(() => pluginInstance.initializeInnerAngular());
+  beforeEach(ngMock.module('app/discover'));
   beforeEach(
     ngMock.inject(function($compile, $rootScope, $timeout) {
       flushPendingTasks = function flushPendingTasks() {
diff --git a/src/legacy/core_plugins/kibana/public/discover/get_inner_angular.ts b/src/legacy/core_plugins/kibana/public/discover/get_inner_angular.ts
index fea834686eb4f..cc4dabd123ff4 100644
--- a/src/legacy/core_plugins/kibana/public/discover/get_inner_angular.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/get_inner_angular.ts
@@ -22,48 +22,24 @@
 // They can stay even after NP cutover
 import angular from 'angular';
 import 'ui/angular-bootstrap';
-import { IPrivate } from 'ui/private';
 import { EuiIcon } from '@elastic/eui';
 // @ts-ignore
 import { StateProvider } from 'ui/state_management/state';
 // @ts-ignore
 import { EventsProvider } from 'ui/events';
 import { PersistedState } from 'ui/persisted_state';
-// @ts-ignore
-import { PromiseServiceCreator } from 'ui/promises/promises';
 import { i18nDirective, i18nFilter, I18nProvider } from '@kbn/i18n/angular';
-// @ts-ignore
-import { PrivateProvider } from 'ui/private/private';
 import { CoreStart, LegacyCoreStart, IUiSettingsClient } from 'kibana/public';
 // @ts-ignore
-import { watchMultiDecorator } from 'ui/directives/watch_multi/watch_multi';
-// @ts-ignore
-import { registerListenEventListener } from 'ui/directives/listen/listen';
-// @ts-ignore
-import { KbnAccessibleClickProvider } from 'ui/accessibility/kbn_accessible_click';
-// @ts-ignore
-import { FieldNameDirectiveProvider } from 'ui/directives/field_name';
-// @ts-ignore
-import { CollapsibleSidebarProvider } from 'ui/collapsible_sidebar/collapsible_sidebar';
-// @ts-ignore
-import { CssTruncateProvide } from 'ui/directives/css_truncate';
-// @ts-ignore
-import { FixedScrollProvider } from 'ui/fixed_scroll';
-// @ts-ignore
-import { DebounceProviderTimeout } from 'ui/directives/debounce/debounce';
-// @ts-ignore
 import { AppStateProvider } from 'ui/state_management/app_state';
 // @ts-ignore
 import { GlobalStateProvider } from 'ui/state_management/global_state';
 // @ts-ignore
-import { createRenderCompleteDirective } from 'ui/render_complete/directive';
-// @ts-ignore
 import { StateManagementConfigProvider } from 'ui/state_management/config_provider';
 // @ts-ignore
 import { KbnUrlProvider, RedirectWhenMissingProvider } from 'ui/url';
 // @ts-ignore
 import { createTopNavDirective, createTopNavHelper } from 'ui/kbn_top_nav/kbn_top_nav';
-import { configureAppAngularModule } from 'ui/legacy_compat';
 import { IndexPatterns, DataPublicPluginStart } from '../../../../../plugins/data/public';
 import { Storage } from '../../../../../plugins/kibana_utils/public';
 import { NavigationPublicPluginStart as NavigationStart } from '../../../../../plugins/navigation/public';
@@ -81,11 +57,28 @@ import { createFieldSearchDirective } from './np_ready/components/field_chooser/
 import { createIndexPatternSelectDirective } from './np_ready/components/field_chooser/discover_index_pattern_directive';
 import { createStringFieldProgressBarDirective } from './np_ready/components/field_chooser/string_progress_bar';
 // @ts-ignore
+import { FieldNameDirectiveProvider } from './np_ready/angular/directives/field_name';
+// @ts-ignore
 import { createFieldChooserDirective } from './np_ready/components/field_chooser/field_chooser';
-
 // @ts-ignore
 import { createDiscoverFieldDirective } from './np_ready/components/field_chooser/discover_field';
+import { CollapsibleSidebarProvider } from './np_ready/angular/directives/collapsible_sidebar/collapsible_sidebar';
 import { DiscoverStartPlugins } from './plugin';
+import { createCssTruncateDirective } from './np_ready/angular/directives/css_truncate';
+// @ts-ignore
+import { FixedScrollProvider } from './np_ready/angular/directives/fixed_scroll';
+// @ts-ignore
+import { DebounceProviderTimeout } from './np_ready/angular/directives/debounce/debounce';
+import { createRenderCompleteDirective } from './np_ready/angular/directives/render_complete';
+import {
+  configureAppAngularModule,
+  IPrivate,
+  KbnAccessibleClickProvider,
+  PrivateProvider,
+  PromiseServiceCreator,
+  registerListenEventListener,
+  watchMultiDecorator,
+} from '../../../../../plugins/kibana_legacy/public';
 
 /**
  * returns the main inner angular module, it contains all the parts of Angular Discover
@@ -181,7 +174,7 @@ export function initializeInnerAngularModule(
     .directive('kbnAccessibleClick', KbnAccessibleClickProvider)
     .directive('fieldName', FieldNameDirectiveProvider)
     .directive('collapsibleSidebar', CollapsibleSidebarProvider)
-    .directive('cssTruncate', CssTruncateProvide)
+    .directive('cssTruncate', createCssTruncateDirective)
     .directive('fixedScroll', FixedScrollProvider)
     .directive('renderComplete', createRenderCompleteDirective)
     .directive('discoverFieldSearch', createFieldSearchDirective)
diff --git a/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts b/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
index 9a0b0731b6b11..b0bb17ce1ac7f 100644
--- a/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
@@ -47,33 +47,26 @@ export function setServices(newServices: any) {
   services = newServices;
 }
 
-// import directives that
-import 'ui/directives/css_truncate';
-import 'ui/directives/field_name';
-
 // EXPORT legacy static dependencies, should be migrated when available in a new version;
 export { angular };
 export { wrapInI18nContext } from 'ui/i18n';
 export { buildVislibDimensions } from '../../../visualizations/public';
-// @ts-ignore
-export { callAfterBindingsWorkaround } from 'ui/compat';
 export { getRequestInspectorStats, getResponseInspectorStats } from '../../../data/public';
 // @ts-ignore
-export { intervalOptions } from 'ui/agg_types/buckets/_interval_options';
-// @ts-ignore
-export { migrateLegacyQuery } from 'ui/utils/migrate_legacy_query';
-export { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
-export { showSaveModal } from 'ui/saved_objects/show_saved_object_save_modal';
+export { intervalOptions } from 'ui/agg_types';
 export { stateMonitorFactory } from 'ui/state_management/state_monitor_factory';
 export { subscribeWithScope } from 'ui/utils/subscribe_with_scope';
 // @ts-ignore
 export { timezoneProvider } from 'ui/vis/lib/timezone';
 // @ts-ignore
 export { tabifyAggResponse } from 'ui/agg_response/tabify';
-export { ensureDefaultIndexPattern } from 'ui/legacy_compat';
 export { unhashUrl } from '../../../../../plugins/kibana_utils/public';
-// @ts-ignore
-export { formatMsg, formatStack } from 'ui/notify/lib/index';
+export {
+  migrateLegacyQuery,
+  ensureDefaultIndexPattern,
+  formatMsg,
+  formatStack,
+} from '../../../../../plugins/kibana_legacy/public';
 
 // EXPORT types
 export {
@@ -90,7 +83,6 @@ export {
 } from '../../../../../plugins/data/public';
 export { ElasticSearchHit } from './np_ready/doc_views/doc_views_types';
 export { registerTimefilterWithGlobalStateFactory } from 'ui/timefilter/setup_router';
-export { FieldName } from 'ui/directives/field_name/field_name';
 export { getFormat } from 'ui/visualize/loader/pipeline_helpers/utilities';
 // @ts-ignore
 export { buildPointSeriesData } from 'ui/agg_response/point_series/point_series';
diff --git a/src/legacy/ui/public/compat/init_after_bindings_workaround.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context/helpers/call_after_bindings_workaround.js
similarity index 80%
rename from src/legacy/ui/public/compat/init_after_bindings_workaround.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context/helpers/call_after_bindings_workaround.js
index 7ba42d3b0476d..95a37f3d8e207 100644
--- a/src/legacy/ui/public/compat/init_after_bindings_workaround.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context/helpers/call_after_bindings_workaround.js
@@ -49,26 +49,6 @@
  *
  */
 
-export class InitAfterBindingsWorkaround {
-  static $inject = ['$injector', '$attrs', '$element', '$scope', '$transclude'];
-  constructor($injector, $attrs, $element, $scope, $transclude) {
-    if (!this.initAfterBindings) {
-      throw new Error(
-        'When using inheritance you must move the logic in the constructor to the `initAfterBindings` method'
-      );
-    }
-
-    this.$onInit = () => {
-      $injector.invoke(this.initAfterBindings, this, {
-        $attrs,
-        $element,
-        $scope,
-        $transclude,
-      });
-    };
-  }
-}
-
 export function callAfterBindingsWorkaround(constructor) {
   return function InitAfterBindingsWrapper($injector, $attrs, $element, $scope, $transclude) {
     this.$onInit = () => {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.html b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.html
index 3e0f8a8329154..8bbb746fa45f8 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.html
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.html
@@ -2,12 +2,11 @@
   app-name="'context'"
   show-search-bar="true"
   show-filter-bar="true"
+  show-query-bar="false"
   show-save-query="false"
   show-date-picker="false"
-
-  filters="contextApp.state.queryParameters.filters"
-  on-filters-updated="contextApp.actions.updateFilters"
   index-patterns="[contextApp.indexPattern]"
+  use-default-behaviors="true"
 >
 </kbn-top-nav>
 
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.js
index 5fa0958249d79..b5ba2844e8b06 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/context_app.js
@@ -18,7 +18,7 @@
  */
 
 import _ from 'lodash';
-import { getServices, callAfterBindingsWorkaround, getAngularModule } from '../../kibana_services';
+import { getAngularModule } from '../../kibana_services';
 import contextAppTemplate from './context_app.html';
 import './context/components/action_bar';
 import { getFirstSortableField } from './context/api/utils/sorting';
@@ -33,8 +33,7 @@ import {
   LOADING_STATUS,
   QueryActionsProvider,
 } from './context/query';
-
-const { timefilter } = getServices();
+import { callAfterBindingsWorkaround } from './context/helpers/call_after_bindings_workaround';
 
 const module = getAngularModule();
 
@@ -61,10 +60,6 @@ module.directive('contextApp', function ContextApp() {
 function ContextAppController($scope, config, Private) {
   const queryParameterActions = getQueryParameterActions();
   const queryActions = Private(QueryActionsProvider);
-
-  timefilter.disableAutoRefreshSelector();
-  timefilter.disableTimeRangeSelector();
-
   this.state = createInitialState(
     parseInt(config.get('context:step'), 10),
     getFirstSortableField(this.indexPattern, config.get('context:tieBreakerFields')),
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/_index.scss b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/_index.scss
index c65243d99c8f4..2bfc74ffa0279 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/_index.scss
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/_index.scss
@@ -1,2 +1,3 @@
 @import 'no_results';
-@import 'histogram';
\ No newline at end of file
+@import 'histogram';
+@import './collapsible_sidebar/index';
diff --git a/src/legacy/ui/public/collapsible_sidebar/_collapsible_sidebar.scss b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_collapsible_sidebar.scss
similarity index 100%
rename from src/legacy/ui/public/collapsible_sidebar/_collapsible_sidebar.scss
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_collapsible_sidebar.scss
diff --git a/src/legacy/ui/public/styles/_legacy/_depth.scss b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_depth.scss
similarity index 100%
rename from src/legacy/ui/public/styles/_legacy/_depth.scss
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_depth.scss
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_index.scss b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_index.scss
new file mode 100644
index 0000000000000..1409920d11aa7
--- /dev/null
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/_index.scss
@@ -0,0 +1,2 @@
+@import 'depth';
+@import 'collapsible_sidebar';
diff --git a/src/legacy/ui/public/collapsible_sidebar/collapsible_sidebar.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/collapsible_sidebar.ts
similarity index 91%
rename from src/legacy/ui/public/collapsible_sidebar/collapsible_sidebar.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/collapsible_sidebar.ts
index 98b8f310bb82f..5b6de7f16d444 100644
--- a/src/legacy/ui/public/collapsible_sidebar/collapsible_sidebar.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/collapsible_sidebar/collapsible_sidebar.ts
@@ -19,7 +19,11 @@
 
 import _ from 'lodash';
 import $ from 'jquery';
-import { uiModules } from '../modules';
+import { IScope } from 'angular';
+
+interface LazyScope extends IScope {
+  [key: string]: any;
+}
 
 export function CollapsibleSidebarProvider() {
   // simply a list of all of all of angulars .col-md-* classes except 12
@@ -29,7 +33,7 @@ export function CollapsibleSidebarProvider() {
 
   return {
     restrict: 'C',
-    link: function($scope, $elem) {
+    link: ($scope: LazyScope, $elem: any) => {
       let isCollapsed = false;
       const $collapser = $(
         `<button
@@ -48,10 +52,10 @@ export function CollapsibleSidebarProvider() {
       $collapser.append($icon);
       const $siblings = $elem.siblings();
 
-      const siblingsClass = listOfWidthClasses.reduce(function(prev, className) {
+      const siblingsClass = listOfWidthClasses.reduce((prev: string, className: string) => {
         if (prev) return prev;
         return $siblings.hasClass(className) && className;
-      }, false);
+      }, '');
 
       // If there is are only two elements we can assume the other one will take 100% of the width.
       const hasSingleSibling = $siblings.length === 1 && siblingsClass;
@@ -82,5 +86,3 @@ export function CollapsibleSidebarProvider() {
     },
   };
 }
-
-uiModules.get('kibana').directive('collapsibleSidebar', CollapsibleSidebarProvider);
diff --git a/src/legacy/ui/public/directives/css_truncate.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/css_truncate.ts
similarity index 89%
rename from src/legacy/ui/public/directives/css_truncate.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/css_truncate.ts
index 9b2c8a49f719f..6aa645ea9368e 100644
--- a/src/legacy/ui/public/directives/css_truncate.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/css_truncate.ts
@@ -16,15 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
-import { uiModules } from '../modules';
-const module = uiModules.get('kibana');
-
-export function CssTruncateProvide() {
+export function createCssTruncateDirective() {
   return {
     restrict: 'A',
     scope: {},
-    link: function($scope, $elem, attrs) {
+    link: ($scope: any, $elem: any, attrs: any) => {
       $elem.css({
         overflow: 'hidden',
         'white-space': 'nowrap',
@@ -63,5 +59,3 @@ export function CssTruncateProvide() {
     },
   };
 }
-
-module.directive('cssTruncate', CssTruncateProvide);
diff --git a/src/legacy/ui/public/directives/debounce/__tests__/debounce.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/__tests__/debounce.js
similarity index 95%
rename from src/legacy/ui/public/directives/debounce/__tests__/debounce.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/__tests__/debounce.js
index bfbe809139204..43fa5ffbf299a 100644
--- a/src/legacy/ui/public/directives/debounce/__tests__/debounce.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/__tests__/debounce.js
@@ -20,14 +20,17 @@
 import sinon from 'sinon';
 import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
-import { DebounceProvider } from '..';
+import { DebounceProvider } from '../index';
+import { pluginInstance } from 'plugins/kibana/discover/legacy';
 
 let debounce;
 let debounceFromProvider;
 let $timeout;
 
 function init() {
-  ngMock.module('kibana');
+  pluginInstance.initializeServices();
+  pluginInstance.initializeInnerAngular();
+  ngMock.module('app/discover');
 
   ngMock.inject(function($injector, _$timeout_, Private) {
     $timeout = _$timeout_;
diff --git a/src/legacy/ui/public/directives/debounce/debounce.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/debounce.js
similarity index 92%
rename from src/legacy/ui/public/directives/debounce/debounce.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/debounce.js
index 7515ff4c00785..54507f673c2d6 100644
--- a/src/legacy/ui/public/directives/debounce/debounce.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/debounce.js
@@ -18,12 +18,9 @@
  */
 
 import _ from 'lodash';
-import { uiModules } from '../../modules';
 // Debounce service, angularized version of lodash debounce
 // borrowed heavily from https://github.com/shahata/angular-debounce
 
-const module = uiModules.get('kibana');
-
 export function DebounceProviderTimeout($timeout) {
   return function(func, wait, options) {
     let timeout;
@@ -70,8 +67,6 @@ export function DebounceProviderTimeout($timeout) {
   };
 }
 
-module.service('debounce', ['$timeout', DebounceProviderTimeout]);
-
 export function DebounceProvider(debounce) {
   return debounce;
 }
diff --git a/src/legacy/ui/public/directives/debounce/index.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/index.js
similarity index 100%
rename from src/legacy/ui/public/directives/debounce/index.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/debounce/index.js
diff --git a/src/legacy/ui/public/directives/field_name.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
similarity index 86%
rename from src/legacy/ui/public/directives/field_name.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
index aff849fc5602f..4bc498928be52 100644
--- a/src/legacy/ui/public/directives/field_name.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
@@ -17,9 +17,7 @@
  * under the License.
  */
 import { FieldName } from './field_name/field_name';
-import { uiModules } from '../modules';
-import { wrapInI18nContext } from 'ui/i18n';
-const module = uiModules.get('kibana');
+import { wrapInI18nContext } from '../../../kibana_services';
 
 export function FieldNameDirectiveProvider(config, reactDirective) {
   return reactDirective(
@@ -35,5 +33,3 @@ export function FieldNameDirectiveProvider(config, reactDirective) {
     }
   );
 }
-
-module.directive('fieldName', FieldNameDirectiveProvider);
diff --git a/src/legacy/ui/public/directives/field_name/__snapshots__/field_name.test.tsx.snap b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/__snapshots__/field_name.test.tsx.snap
similarity index 100%
rename from src/legacy/ui/public/directives/field_name/__snapshots__/field_name.test.tsx.snap
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/__snapshots__/field_name.test.tsx.snap
diff --git a/src/legacy/ui/public/directives/field_name/field_name.test.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.test.tsx
similarity index 100%
rename from src/legacy/ui/public/directives/field_name/field_name.test.tsx
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.test.tsx
diff --git a/src/legacy/ui/public/directives/field_name/field_name.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx
similarity index 91%
rename from src/legacy/ui/public/directives/field_name/field_name.tsx
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx
index 0340ce9cb5d1b..95720bee38df8 100644
--- a/src/legacy/ui/public/directives/field_name/field_name.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx
@@ -18,9 +18,8 @@
  */
 import React from 'react';
 import classNames from 'classnames';
-// @ts-ignore
-import { shortenDottedString } from '../../../../core_plugins/kibana/common/utils/shorten_dotted_string';
-import { FieldIcon } from '../../../../../../src/plugins/kibana_react/public';
+import { FieldIcon } from '../../../../../../../../../plugins/kibana_react/public';
+import { shortenDottedString } from '../../../../../../../../../plugins/data/common/utils';
 import { getFieldTypeName } from './field_type_name';
 
 // property field is provided at discover's field chooser
diff --git a/src/legacy/ui/public/directives/field_name/field_type_name.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts
similarity index 62%
rename from src/legacy/ui/public/directives/field_name/field_type_name.ts
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts
index c8c886015cea3..0cf428ee48b9d 100644
--- a/src/legacy/ui/public/directives/field_name/field_type_name.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts
@@ -21,52 +21,52 @@ import { i18n } from '@kbn/i18n';
 export function getFieldTypeName(type: string) {
   switch (type) {
     case 'boolean':
-      return i18n.translate('common.ui.directives.fieldNameIcons.booleanAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.booleanAriaLabel', {
         defaultMessage: 'Boolean field',
       });
     case 'conflict':
-      return i18n.translate('common.ui.directives.fieldNameIcons.conflictFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.conflictFieldAriaLabel', {
         defaultMessage: 'Conflicting field',
       });
     case 'date':
-      return i18n.translate('common.ui.directives.fieldNameIcons.dateFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.dateFieldAriaLabel', {
         defaultMessage: 'Date field',
       });
     case 'geo_point':
-      return i18n.translate('common.ui.directives.fieldNameIcons.geoPointFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.geoPointFieldAriaLabel', {
         defaultMessage: 'Geo point field',
       });
     case 'geo_shape':
-      return i18n.translate('common.ui.directives.fieldNameIcons.geoShapeFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel', {
         defaultMessage: 'Geo shape field',
       });
     case 'ip':
-      return i18n.translate('common.ui.directives.fieldNameIcons.ipAddressFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel', {
         defaultMessage: 'IP address field',
       });
     case 'murmur3':
-      return i18n.translate('common.ui.directives.fieldNameIcons.murmur3FieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.murmur3FieldAriaLabel', {
         defaultMessage: 'Murmur3 field',
       });
     case 'number':
-      return i18n.translate('common.ui.directives.fieldNameIcons.numberFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.numberFieldAriaLabel', {
         defaultMessage: 'Number field',
       });
     case 'source':
       // Note that this type is currently not provided, type for _source is undefined
-      return i18n.translate('common.ui.directives.fieldNameIcons.sourceFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.sourceFieldAriaLabel', {
         defaultMessage: 'Source field',
       });
     case 'string':
-      return i18n.translate('common.ui.directives.fieldNameIcons.stringFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.stringFieldAriaLabel', {
         defaultMessage: 'String field',
       });
     case 'nested':
-      return i18n.translate('common.ui.directives.fieldNameIcons.nestedFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.nestedFieldAriaLabel', {
         defaultMessage: 'Nested field',
       });
     default:
-      return i18n.translate('common.ui.directives.fieldNameIcons.unknownFieldAriaLabel', {
+      return i18n.translate('kbn.discover.fieldNameIcons.unknownFieldAriaLabel', {
         defaultMessage: 'Unknown field',
       });
   }
diff --git a/src/legacy/ui/public/fixed_scroll.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/fixed_scroll.js
similarity index 96%
rename from src/legacy/ui/public/fixed_scroll.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/fixed_scroll.js
index 228ba3f8aaa99..bc159c14a16a7 100644
--- a/src/legacy/ui/public/fixed_scroll.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/fixed_scroll.js
@@ -19,11 +19,15 @@
 
 import $ from 'jquery';
 import _ from 'lodash';
-import { uiModules } from './modules';
-import { DebounceProvider } from 'ui/directives/debounce';
+import { DebounceProvider } from './debounce';
 
 const SCROLLER_HEIGHT = 20;
 
+/**
+ * This directive adds a fixed horizontal scrollbar to the bottom of the window that proxies its scroll events
+ * to the target element's real scrollbar. This is useful when the target element's horizontal scrollbar
+ * might be waaaay down the page, like the doc table on Discover.
+ */
 export function FixedScrollProvider(Private) {
   const debounce = Private(DebounceProvider);
 
@@ -145,10 +149,3 @@ export function FixedScrollProvider(Private) {
     },
   };
 }
-
-/**
- * This directive adds a fixed horizontal scrollbar to the bottom of the window that proxies its scroll events
- * to the target element's real scrollbar. This is useful when the target element's horizontal scrollbar
- * might be waaaay down the page, like the doc table on Discover.
- */
-uiModules.get('kibana').directive('fixedScroll', FixedScrollProvider);
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
index 4d387f44c3d57..77bbab97d95c7 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
@@ -30,7 +30,6 @@ import {
   Axis,
   Chart,
   HistogramBarSeries,
-  GeometryValue,
   LineAnnotation,
   Position,
   ScaleType,
@@ -38,6 +37,7 @@ import {
   RectAnnotation,
   TooltipValue,
   TooltipType,
+  ElementClickListener,
 } from '@elastic/charts';
 
 import { i18n } from '@kbn/i18n';
@@ -139,7 +139,7 @@ export class DiscoverHistogram extends Component<DiscoverHistogramProps, Discove
     this.props.timefilterUpdateHandler(range);
   };
 
-  public onElementClick = (xInterval: number) => (elementData: GeometryValue[]) => {
+  public onElementClick = (xInterval: number): ElementClickListener => ([elementData]) => {
     const startRange = elementData[0].x;
 
     const range = {
diff --git a/src/legacy/ui/public/render_complete/directive.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/render_complete.ts
similarity index 81%
rename from src/legacy/ui/public/render_complete/directive.js
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/render_complete.ts
index 961a07f58293a..7757deb806a18 100644
--- a/src/legacy/ui/public/render_complete/directive.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/render_complete.ts
@@ -16,18 +16,15 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
-import { uiModules } from '../modules';
-import { RenderCompleteHelper } from '../../../../plugins/kibana_utils/public';
+import { IScope } from 'angular';
+import { RenderCompleteHelper } from '../../../../../../../../plugins/kibana_utils/public';
 
 export function createRenderCompleteDirective() {
   return {
-    controller($scope, $element) {
+    controller($scope: IScope, $element: JQLite) {
       const el = $element[0];
       const renderCompleteHelper = new RenderCompleteHelper(el);
       $scope.$on('$destroy', renderCompleteHelper.destroy);
     },
   };
 }
-
-uiModules.get('kibana').directive('renderComplete', createRenderCompleteDirective);
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.html b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.html
index 45490ac7adc0f..efde83a0e35f0 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.html
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.html
@@ -5,24 +5,19 @@ <h1 class="euiScreenReaderOnly">{{screenTitle}}</h1>
   <kbn-top-nav
     app-name="'discover'"
     config="topNavMenu"
+    screen-title="screenTitle"
     show-search-bar="true"
     show-date-picker="enableTimeRangeSelector"
-    show-save-query="showSaveQuery"
-    query="state.query"
-    saved-query="savedQuery"
-    screen-title="screenTitle"
-    on-query-submit="updateQueryAndFetch"
     index-patterns="[indexPattern]"
-    filters="filters"
-    on-filters-updated="onFiltersUpdated"
-    date-range-from="time.from"
-    date-range-to="time.to"
-    is-refresh-paused="refreshInterval.pause"
-    refresh-interval="refreshInterval.value"
-    on-refresh-change="onRefreshChange"
-    on-saved="onQuerySaved"
-    on-saved-query-updated="onSavedQueryUpdated"
-    on-clear-saved-query="onClearSavedQuery"
+
+    query="state.query"
+    on-query-submit="updateQuery"
+	
+    show-save-query="showSaveQuery"
+    saved-query-id="state.savedQuery"
+    on-saved-query-id-change="updateSavedQueryId"
+
+    use-default-behaviors="true"
   >
   </kbn-top-nav>
 
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
index 2f73af2ab77e4..69f69d449354c 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
@@ -19,13 +19,18 @@
 
 import _ from 'lodash';
 import React from 'react';
-import { Subscription } from 'rxjs';
+import { Subscription, Subject, merge } from 'rxjs';
+import { debounceTime } from 'rxjs/operators';
 import moment from 'moment';
 import dateMath from '@elastic/datemath';
 import { i18n } from '@kbn/i18n';
 import '../components/field_chooser/field_chooser';
 
 import { RequestAdapter } from '../../../../../../../plugins/inspector/public';
+import {
+  SavedObjectSaveModal,
+  showSaveModal,
+} from '../../../../../../../plugins/saved_objects/public';
 // doc table
 import './doc_table';
 import { getSortArray } from './doc_table/lib/get_sort';
@@ -47,12 +52,10 @@ import {
   hasSearchStategyForIndexPattern,
   intervalOptions,
   migrateLegacyQuery,
-  showSaveModal,
   unhashUrl,
   stateMonitorFactory,
   subscribeWithScope,
   tabifyAggResponse,
-  SavedObjectSaveModal,
   getAngularModule,
   ensureDefaultIndexPattern,
   registerTimefilterWithGlobalStateFactory,
@@ -62,7 +65,6 @@ import { Vis } from '../../../../../visualizations/public';
 const {
   core,
   chrome,
-  data,
   docTitle,
   filterManager,
   share,
@@ -79,8 +81,6 @@ import {
 import { getIndexPatternId } from '../helpers/get_index_pattern_id';
 import { FilterStateManager } from '../../../../../data/public';
 
-const { getSavedQuery } = data.query.savedQueries;
-
 const fetchStatuses = {
   UNINITIALIZED: 'uninitialized',
   LOADING: 'loading',
@@ -205,8 +205,6 @@ function discoverController(
 
   const subscriptions = new Subscription();
 
-  timefilter.disableTimeRangeSelector();
-  timefilter.disableAutoRefreshSelector();
   $scope.timefilterUpdateHandler = ranges => {
     timefilter.setTime({
       from: moment(ranges.from).toISOString(),
@@ -218,7 +216,6 @@ function discoverController(
   $scope.showInterval = false;
   $scope.minimumVisibleRows = 50;
   $scope.fetchStatus = fetchStatuses.UNINITIALIZED;
-  $scope.refreshInterval = timefilter.getRefreshInterval();
   $scope.showSaveQuery = uiCapabilities.discover.saveQuery;
 
   $scope.$watch(
@@ -310,7 +307,7 @@ function discoverController(
             })}
           />
         );
-        showSaveModal(saveModal);
+        showSaveModal(saveModal, core.i18n.Context);
       },
     };
 
@@ -436,15 +433,10 @@ function discoverController(
   let stateMonitor;
 
   const $state = ($scope.state = new AppState(getStateDefaults()));
+  const $fetchObservable = new Subject();
 
-  $scope.filters = filterManager.getFilters();
   $scope.screenTitle = savedSearch.title;
 
-  $scope.onFiltersUpdated = filters => {
-    // The filters will automatically be set when the filterManager emits an update event (see below)
-    filterManager.setFilters(filters);
-  };
-
   const getFieldCounts = async () => {
     // the field counts aren't set until we have the data back,
     // so we wait for the fetch to be done before proceeding
@@ -571,17 +563,12 @@ function discoverController(
   };
 
   const shouldSearchOnPageLoad = () => {
-    // If a saved query is referenced in the app state, omit the initial load because the saved query will
-    // be fetched separately and trigger a reload
-    if ($scope.state.savedQuery) {
-      return false;
-    }
     // A saved search is created on every page load, so we check the ID to see if we're loading a
     // previously saved search or if it is just transient
     return (
       config.get('discover:searchOnPageLoad') ||
       savedSearch.id !== undefined ||
-      _.get($scope, 'refreshInterval.pause') === false
+      timefilter.getRefreshInterval().pause === false
     );
   };
 
@@ -593,25 +580,23 @@ function discoverController(
     $scope.$on('$destroy', () => stateMonitor.destroy());
 
     $scope.updateDataSource().then(function() {
-      subscriptions.add(
-        subscribeWithScope($scope, timefilter.getAutoRefreshFetch$(), {
-          next: $scope.fetch,
-        })
-      );
+      const searchBarChanges = merge(
+        timefilter.getAutoRefreshFetch$(),
+        timefilter.getFetch$(),
+        filterManager.getFetches$(),
+        $fetchObservable
+      ).pipe(debounceTime(100));
 
       subscriptions.add(
-        subscribeWithScope($scope, timefilter.getRefreshIntervalUpdate$(), {
-          next: $scope.updateRefreshInterval,
+        subscribeWithScope($scope, searchBarChanges, {
+          next: $scope.fetch,
         })
       );
       subscriptions.add(
         subscribeWithScope($scope, timefilter.getTimeUpdate$(), {
-          next: $scope.updateTime,
-        })
-      );
-      subscriptions.add(
-        subscribeWithScope($scope, timefilter.getFetch$(), {
-          next: $scope.fetch,
+          next: () => {
+            $scope.updateTime();
+          },
         })
       );
 
@@ -622,14 +607,14 @@ function discoverController(
         const currentSort = getSortArray($scope.searchSource.getField('sort'), $scope.indexPattern);
 
         // if the searchSource doesn't know, tell it so
-        if (!angular.equals(sort, currentSort)) $scope.fetch();
+        if (!angular.equals(sort, currentSort)) $fetchObservable.next();
       });
 
       // update data source when filters update
+
       subscriptions.add(
         subscribeWithScope($scope, filterManager.getUpdates$(), {
           next: () => {
-            $scope.filters = filterManager.getFilters();
             $scope.updateDataSource().then(function() {
               $state.save();
             });
@@ -637,16 +622,9 @@ function discoverController(
         })
       );
 
-      // fetch data when filters fire fetch event
-      subscriptions.add(
-        subscribeWithScope($scope, filterManager.getFetches$(), {
-          next: $scope.fetch,
-        })
-      );
-
       // update data source when hitting forward/back and the query changes
       $scope.$listen($state, 'fetch_with_changes', function(diff) {
-        if (diff.indexOf('query') >= 0) $scope.fetch();
+        if (diff.indexOf('query') >= 0) $fetchObservable.next();
       });
 
       $scope.$watch('opts.timefield', function(timefield) {
@@ -655,7 +633,7 @@ function discoverController(
 
       $scope.$watch('state.interval', function(newInterval, oldInterval) {
         if (newInterval !== oldInterval) {
-          $scope.fetch();
+          $fetchObservable.next();
         }
       });
 
@@ -674,7 +652,7 @@ function discoverController(
         if (!_.isEqual(newQuery, oldQuery)) {
           const query = migrateLegacyQuery(newQuery);
           if (!_.isEqual(query, newQuery)) {
-            $scope.updateQueryAndFetch({ query });
+            $scope.updateQuery({ query });
           }
         }
       });
@@ -734,7 +712,7 @@ function discoverController(
       $state.replace();
 
       if (shouldSearchOnPageLoad()) {
-        $scope.fetch();
+        $fetchObservable.next();
       }
     });
   });
@@ -827,15 +805,9 @@ function discoverController(
       });
   };
 
-  $scope.updateQueryAndFetch = function({ query, dateRange }) {
-    const oldDateRange = timefilter.getTime();
-    timefilter.setTime(dateRange);
+  $scope.updateQuery = function({ query }) {
     $state.query = query;
-    // storing the updated timerange in the state will trigger a fetch
-    // call automatically, so only trigger fetch in case this is a refresh call (no changes in parameters).
-    if (_.isEqual(oldDateRange, dateRange)) {
-      $scope.fetch();
-    }
+    $fetchObservable.next();
   };
 
   function onResults(resp) {
@@ -896,32 +868,12 @@ function discoverController(
       from: dateMath.parse(timefilter.getTime().from),
       to: dateMath.parse(timefilter.getTime().to, { roundUp: true }),
     };
-    $scope.time = timefilter.getTime();
   };
 
   $scope.toMoment = function(datetime) {
     return moment(datetime).format(config.get('dateFormat'));
   };
 
-  $scope.updateRefreshInterval = function() {
-    const newInterval = timefilter.getRefreshInterval();
-    const shouldFetch =
-      _.get($scope, 'refreshInterval.pause') === true && newInterval.pause === false;
-
-    $scope.refreshInterval = newInterval;
-
-    if (shouldFetch) {
-      $scope.fetch();
-    }
-  };
-
-  $scope.onRefreshChange = function({ isPaused, refreshInterval }) {
-    timefilter.setRefreshInterval({
-      pause: isPaused,
-      value: refreshInterval ? refreshInterval : $scope.refreshInterval.value,
-    });
-  };
-
   $scope.resetQuery = function() {
     kbnUrl.change('/discover/{{id}}', { id: $route.current.params.id });
   };
@@ -988,69 +940,14 @@ function discoverController(
     $scope.minimumVisibleRows = $scope.hits;
   };
 
-  $scope.onQuerySaved = savedQuery => {
-    $scope.savedQuery = savedQuery;
-  };
-
-  $scope.onSavedQueryUpdated = savedQuery => {
-    $scope.savedQuery = { ...savedQuery };
-  };
-
-  $scope.onClearSavedQuery = () => {
-    delete $scope.savedQuery;
-    delete $state.savedQuery;
-    $state.query = {
-      query: '',
-      language: localStorage.get('kibana.userQueryLanguage') || config.get('search:queryLanguage'),
-    };
-    filterManager.setFilters(filterManager.getGlobalFilters());
-    $state.save();
-    $scope.fetch();
-  };
-
-  const updateStateFromSavedQuery = savedQuery => {
-    $state.query = savedQuery.attributes.query;
-    $state.save();
-    const savedQueryFilters = savedQuery.attributes.filters || [];
-    const globalFilters = filterManager.getGlobalFilters();
-    filterManager.setFilters([...globalFilters, ...savedQueryFilters]);
-
-    if (savedQuery.attributes.timefilter) {
-      timefilter.setTime({
-        from: savedQuery.attributes.timefilter.from,
-        to: savedQuery.attributes.timefilter.to,
-      });
-      if (savedQuery.attributes.timefilter.refreshInterval) {
-        timefilter.setRefreshInterval(savedQuery.attributes.timefilter.refreshInterval);
-      }
+  $scope.updateSavedQueryId = newSavedQueryId => {
+    if (newSavedQueryId) {
+      $state.savedQuery = newSavedQueryId;
+    } else {
+      delete $state.savedQuery;
     }
-
-    $scope.fetch();
-  };
-
-  $scope.$watch('savedQuery', newSavedQuery => {
-    if (!newSavedQuery) return;
-
-    $state.savedQuery = newSavedQuery.id;
     $state.save();
-
-    updateStateFromSavedQuery(newSavedQuery);
-  });
-
-  $scope.$watch('state.savedQuery', newSavedQueryId => {
-    if (!newSavedQueryId) {
-      $scope.savedQuery = undefined;
-      return;
-    }
-    if (!$scope.savedQuery || newSavedQueryId !== $scope.savedQuery.id) {
-      getSavedQuery(newSavedQueryId).then(savedQuery => {
-        $scope.$evalAsync(() => {
-          $scope.savedQuery = savedQuery;
-          updateStateFromSavedQuery(savedQuery);
-        });
-      });
-    }
-  });
+  };
 
   async function setupVisualization() {
     // If no timefield has been specified we don't create a histogram of messages
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_table/components/table_header/helpers.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_table/components/table_header/helpers.tsx
index 990ace32e6449..68ba508ffebdd 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_table/components/table_header/helpers.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_table/components/table_header/helpers.tsx
@@ -17,8 +17,7 @@
  * under the License.
  */
 import { IndexPattern } from '../../../../../kibana_services';
-// @ts-ignore
-import { shortenDottedString } from '../../../../../../../common/utils/shorten_dotted_string';
+import { shortenDottedString } from '../../../../../../../../../../plugins/data/common/utils';
 
 export type SortOrder = [string, string];
 export interface ColumnProps {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
index d3bf3696c08a5..6cffc2cc533b0 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
@@ -62,36 +62,34 @@ export function useEsDocSearch({
   const [status, setStatus] = useState(ElasticRequestState.Loading);
   const [hit, setHit] = useState<ElasticSearchHit | null>(null);
 
-  async function requestData() {
-    try {
-      const indexPatternEntity = await indexPatternService.get(indexPatternId);
-      setIndexPattern(indexPatternEntity);
+  useEffect(() => {
+    async function requestData() {
+      try {
+        const indexPatternEntity = await indexPatternService.get(indexPatternId);
+        setIndexPattern(indexPatternEntity);
 
-      const { hits } = await esClient.search({
-        index,
-        body: buildSearchBody(id, indexPatternEntity),
-      });
+        const { hits } = await esClient.search({
+          index,
+          body: buildSearchBody(id, indexPatternEntity),
+        });
 
-      if (hits && hits.hits && hits.hits[0]) {
-        setStatus(ElasticRequestState.Found);
-        setHit(hits.hits[0]);
-      } else {
-        setStatus(ElasticRequestState.NotFound);
-      }
-    } catch (err) {
-      if (err.savedObjectId) {
-        setStatus(ElasticRequestState.NotFoundIndexPattern);
-      } else if (err.status === 404) {
-        setStatus(ElasticRequestState.NotFound);
-      } else {
-        setStatus(ElasticRequestState.Error);
+        if (hits && hits.hits && hits.hits[0]) {
+          setStatus(ElasticRequestState.Found);
+          setHit(hits.hits[0]);
+        } else {
+          setStatus(ElasticRequestState.NotFound);
+        }
+      } catch (err) {
+        if (err.savedObjectId) {
+          setStatus(ElasticRequestState.NotFoundIndexPattern);
+        } else if (err.status === 404) {
+          setStatus(ElasticRequestState.NotFound);
+        } else {
+          setStatus(ElasticRequestState.Error);
+        }
       }
     }
-  }
-
-  useEffect(() => {
     requestData();
-  });
-
+  }, [esClient, id, index, indexPatternId, indexPatternService]);
   return [status, hit, indexPattern];
 }
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx
index 201ed562cfd6f..075217add7b52 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx
@@ -21,12 +21,12 @@ import { EuiCallOut, EuiCodeBlock } from '@elastic/eui';
 import { formatMsg, formatStack } from '../../../kibana_services';
 
 interface Props {
-  error: Error | string | null;
+  error: Error | string;
 }
 
 export function DocViewerError({ error }: Props) {
   const errMsg = formatMsg(error);
-  const errStack = error ? formatStack(error) : '';
+  const errStack = typeof error === 'object' ? formatStack(error) : '';
 
   return (
     <EuiCallOut title={errMsg} color="danger" iconType="cross" data-test-subj="docViewerError">
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx
index 0c21fafc91d69..2dfee3487af8c 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx
@@ -31,7 +31,7 @@ interface Props {
 }
 
 interface State {
-  error: null | Error | string;
+  error: Error | string;
   hasError: boolean;
 }
 /**
@@ -42,7 +42,7 @@ interface State {
 export class DocViewerTab extends React.Component<Props, State> {
   state = {
     hasError: false,
-    error: null,
+    error: '',
   };
 
   static getDerivedStateFromError(error: unknown) {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx
index d1b05f20a6cb0..7a78e89416361 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx
@@ -18,7 +18,6 @@
  */
 import classNames from 'classnames';
 import React, { ReactNode } from 'react';
-import { FieldName } from '../../../kibana_services';
 import { FieldMapping, DocViewFilterFn } from '../../doc_views/doc_views_types';
 import { DocViewTableRowBtnFilterAdd } from './table_row_btn_filter_add';
 import { DocViewTableRowBtnFilterRemove } from './table_row_btn_filter_remove';
@@ -27,6 +26,7 @@ import { DocViewTableRowBtnCollapse } from './table_row_btn_collapse';
 import { DocViewTableRowBtnFilterExists } from './table_row_btn_filter_exists';
 import { DocViewTableRowIconNoMapping } from './table_row_icon_no_mapping';
 import { DocViewTableRowIconUnderscore } from './table_row_icon_underscore';
+import { FieldName } from '../../angular/directives/field_name/field_name';
 
 export interface Props {
   field: string;
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/top_nav/open_search_panel.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/top_nav/open_search_panel.js
index ebe4cbb1ddb69..747dd9abe2f2a 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/top_nav/open_search_panel.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/top_nav/open_search_panel.js
@@ -32,7 +32,7 @@ import {
   EuiFlyoutBody,
   EuiTitle,
 } from '@elastic/eui';
-import { SavedObjectFinderUi } from '../../../../../../../../plugins/kibana_react/public';
+import { SavedObjectFinderUi } from '../../../../../../../../plugins/saved_objects/public';
 import { getServices } from '../../../kibana_services';
 
 const SEARCH_OBJECT_TYPE = 'search';
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable.ts
index f47cf52c756ac..3f877520b5bf9 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable.ts
@@ -20,7 +20,7 @@ import _ from 'lodash';
 import * as Rx from 'rxjs';
 import { Subscription } from 'rxjs';
 import { i18n } from '@kbn/i18n';
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 import { RequestAdapter, Adapters } from '../../../../../../../plugins/inspector/public';
 import {
   esFilters,
@@ -111,7 +111,7 @@ export class SearchEmbeddable extends Embeddable<SearchInput, SearchOutput>
       filterManager,
     }: SearchEmbeddableConfig,
     initialInput: SearchInput,
-    private readonly executeTriggerActions: TExecuteTriggerActions,
+    private readonly executeTriggerActions: ExecuteTriggerActions,
     parent?: Container
   ) {
     super(
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable_factory.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable_factory.ts
index 842ef2bf9c825..15b3f2d4517ac 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable_factory.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/embeddable/search_embeddable_factory.ts
@@ -19,7 +19,7 @@
 
 import { auto } from 'angular';
 import { i18n } from '@kbn/i18n';
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 import { getServices } from '../../kibana_services';
 import {
   EmbeddableFactory,
@@ -43,7 +43,7 @@ export class SearchEmbeddableFactory extends EmbeddableFactory<
   public isEditable: () => boolean;
 
   constructor(
-    private readonly executeTriggerActions: TExecuteTriggerActions,
+    private readonly executeTriggerActions: ExecuteTriggerActions,
     getInjector: () => Promise<auto.IInjectorService>,
     isEditable: () => boolean
   ) {
diff --git a/src/legacy/core_plugins/kibana/public/discover/plugin.ts b/src/legacy/core_plugins/kibana/public/discover/plugin.ts
index 77135f6a98173..a495b56d5e9ea 100644
--- a/src/legacy/core_plugins/kibana/public/discover/plugin.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/plugin.ts
@@ -19,7 +19,7 @@
 import { i18n } from '@kbn/i18n';
 import { AppMountParameters, CoreSetup, CoreStart, Plugin } from 'kibana/public';
 import angular, { auto } from 'angular';
-import { IUiActionsSetup, IUiActionsStart } from 'src/plugins/ui_actions/public';
+import { UiActionsSetup, UiActionsStart } from 'src/plugins/ui_actions/public';
 import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { registerFeature } from './np_ready/register_feature';
 import './kibana_services';
@@ -47,13 +47,13 @@ export interface DiscoverSetup {
 }
 export type DiscoverStart = void;
 export interface DiscoverSetupPlugins {
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
   embeddable: IEmbeddableSetup;
-  kibana_legacy: KibanaLegacySetup;
+  kibanaLegacy: KibanaLegacySetup;
   home: HomePublicPluginSetup;
 }
 export interface DiscoverStartPlugins {
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
   embeddable: IEmbeddableStart;
   navigation: NavigationStart;
   charts: ChartsPluginStart;
@@ -99,7 +99,7 @@ export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
       order: 20,
       component: JsonCodeBlock,
     });
-    plugins.kibana_legacy.registerLegacyApp({
+    plugins.kibanaLegacy.registerLegacyApp({
       id: 'discover',
       title: 'Discover',
       order: -1004,
diff --git a/src/legacy/core_plugins/kibana/public/home/index.ts b/src/legacy/core_plugins/kibana/public/home/index.ts
index 27d09a53ba20d..f02ec234e0a83 100644
--- a/src/legacy/core_plugins/kibana/public/home/index.ts
+++ b/src/legacy/core_plugins/kibana/public/home/index.ts
@@ -20,9 +20,9 @@
 import { FeatureCatalogueRegistryProvider } from 'ui/registry/feature_catalogue';
 import { npSetup, npStart } from 'ui/new_platform';
 import chrome from 'ui/chrome';
-import { IPrivate } from 'ui/private';
 import { HomePlugin, LegacyAngularInjectedDependencies } from './plugin';
 import { TelemetryOptInProvider } from '../../../telemetry/public/services';
+import { IPrivate } from '../../../../../plugins/kibana_legacy/public';
 
 /**
  * Get dependencies relying on the global angular context.
diff --git a/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/instruction_set.js b/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/instruction_set.js
index 15bda33534185..631ef1d6e0e42 100644
--- a/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/instruction_set.js
+++ b/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/instruction_set.js
@@ -22,7 +22,7 @@ import PropTypes from 'prop-types';
 import { Instruction } from './instruction';
 import { ParameterForm } from './parameter_form';
 import { Content } from './content';
-import { getDisplayText } from '../../../../../../../../plugins/home/server/tutorials/instructions/instruction_variant';
+import { getDisplayText } from '../../../../../../../../plugins/home/public';
 import {
   EuiTabs,
   EuiTab,
diff --git a/src/legacy/core_plugins/kibana/public/home/plugin.ts b/src/legacy/core_plugins/kibana/public/home/plugin.ts
index aec3835dc075d..5802f33627fb3 100644
--- a/src/legacy/core_plugins/kibana/public/home/plugin.ts
+++ b/src/legacy/core_plugins/kibana/public/home/plugin.ts
@@ -59,7 +59,7 @@ export interface HomePluginSetupDependencies {
     getAngularDependencies: () => Promise<LegacyAngularInjectedDependencies>;
   };
   usageCollection: UsageCollectionSetup;
-  kibana_legacy: KibanaLegacySetup;
+  kibanaLegacy: KibanaLegacySetup;
   home: HomePublicPluginSetup;
 }
 
@@ -72,12 +72,12 @@ export class HomePlugin implements Plugin {
     core: CoreSetup,
     {
       home,
-      kibana_legacy,
+      kibanaLegacy,
       usageCollection,
       __LEGACY: { getAngularDependencies, ...legacyServices },
     }: HomePluginSetupDependencies
   ) {
-    kibana_legacy.registerLegacyApp({
+    kibanaLegacy.registerLegacyApp({
       id: 'home',
       title: 'Home',
       mount: async ({ core: contextCore }, params) => {
@@ -98,7 +98,7 @@ export class HomePlugin implements Plugin {
           getBasePath: core.http.basePath.get,
           indexPatternService: this.dataStart!.indexPatterns,
           environment: this.environment!,
-          config: kibana_legacy.config,
+          config: kibanaLegacy.config,
           homeConfig: home.config,
           ...angularDependencies,
         });
diff --git a/src/legacy/core_plugins/kibana/public/kibana.js b/src/legacy/core_plugins/kibana/public/kibana.js
index f2868da947a75..d77fc780f4cc2 100644
--- a/src/legacy/core_plugins/kibana/public/kibana.js
+++ b/src/legacy/core_plugins/kibana/public/kibana.js
@@ -57,13 +57,13 @@ import { showAppRedirectNotification } from 'ui/notify';
 import 'leaflet';
 import { localApplicationService } from './local_application_service';
 
-npSetup.plugins.kibana_legacy.forwardApp('doc', 'discover', { keepPrefix: true });
-npSetup.plugins.kibana_legacy.forwardApp('context', 'discover', { keepPrefix: true });
+npSetup.plugins.kibanaLegacy.forwardApp('doc', 'discover', { keepPrefix: true });
+npSetup.plugins.kibanaLegacy.forwardApp('context', 'discover', { keepPrefix: true });
 localApplicationService.attachToAngular(routes);
 
 routes.enable();
 
-const { config } = npSetup.plugins.kibana_legacy;
+const { config } = npSetup.plugins.kibanaLegacy;
 routes.otherwise({
   redirectTo: `/${config.defaultAppId || 'discover'}`,
 });
diff --git a/src/legacy/core_plugins/kibana/public/local_application_service/local_application_service.ts b/src/legacy/core_plugins/kibana/public/local_application_service/local_application_service.ts
index d52bec8304ff9..90328003c8292 100644
--- a/src/legacy/core_plugins/kibana/public/local_application_service/local_application_service.ts
+++ b/src/legacy/core_plugins/kibana/public/local_application_service/local_application_service.ts
@@ -50,7 +50,7 @@ export class LocalApplicationService {
    * @param angularRouteManager The current `ui/routes` instance
    */
   attachToAngular(angularRouteManager: UIRoutes) {
-    npStart.plugins.kibana_legacy.getApps().forEach(app => {
+    npStart.plugins.kibanaLegacy.getApps().forEach(app => {
       const wrapperElementId = this.idGenerator();
       angularRouteManager.when(matchAllWithPrefix(app), {
         outerAngularWrapperRoute: true,
@@ -79,9 +79,20 @@ export class LocalApplicationService {
           })();
         },
       });
+
+      if (app.updater$) {
+        app.updater$.subscribe(updater => {
+          const updatedFields = updater(app);
+          if (updatedFields && updatedFields.activeUrl) {
+            npStart.core.chrome.navLinks.update(app.navLinkId || app.id, {
+              url: updatedFields.activeUrl,
+            });
+          }
+        });
+      }
     });
 
-    npStart.plugins.kibana_legacy.getForwards().forEach(({ legacyAppId, newAppId, keepPrefix }) => {
+    npStart.plugins.kibanaLegacy.getForwards().forEach(({ legacyAppId, newAppId, keepPrefix }) => {
       angularRouteManager.when(matchAllWithPrefix(legacyAppId), {
         resolveRedirectTo: ($location: ILocationService) => {
           const url = $location.url();
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.js
index c990efaf43547..e10f033ed8165 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/components/step_index_pattern/step_index_pattern.js
@@ -279,13 +279,12 @@ export class StepIndexPattern extends Component {
 
   render() {
     const { isIncludingSystemIndices, allIndices } = this.props;
-    const { query, partialMatchedIndices, exactMatchedIndices } = this.state;
+    const { partialMatchedIndices, exactMatchedIndices } = this.state;
 
     const matchedIndices = getMatchedIndices(
       allIndices,
       partialMatchedIndices,
       exactMatchedIndices,
-      query,
       isIncludingSystemIndices
     );
 
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/constants/index.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/constants/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/constants/index.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/constants/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.error.json b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.error.json
deleted file mode 100644
index acb9a9ecd0206..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.error.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "statusCode": 400,
-  "error": "Bad Request"
-}
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.exception.json b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.exception.json
deleted file mode 100644
index 1406b06813637..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.exception.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "body": {
-    "error": {
-      "root_cause": [
-        {
-          "type": "index_not_found_exception",
-          "reason": "no such index",
-          "index_uuid": "_na_",
-          "resource.type": "index_or_alias",
-          "resource.id": "t",
-          "index": "t"
-        }
-      ],
-      "type": "transport_exception",
-      "reason": "unable to communicate with remote cluster [cluster_one]",
-      "caused_by": {
-        "type": "index_not_found_exception",
-        "reason": "no such index",
-        "index_uuid": "_na_",
-        "resource.type": "index_or_alias",
-        "resource.id": "t",
-        "index": "t"
-      }
-    }
-  },
-  "status": 500
-}
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.success.json b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.success.json
deleted file mode 100644
index 1b261243ca728..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/api/get_indices.success.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-  "hits": {
-    "total": 1,
-    "max_score": 0.0,
-    "hits": []
-  },
-  "aggregations": {
-    "indices": {
-      "doc_count_error_upper_bound": 0,
-      "sum_other_doc_count": 0,
-      "buckets": [{
-        "key": "1",
-        "doc_count": 1
-      },{
-        "key": "2",
-        "doc_count": 1
-      }]
-    }
-  }
-}
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_indices.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_indices.test.js
deleted file mode 100644
index 924b0dc46d74d..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_indices.test.js
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { getIndices } from '../get_indices';
-import successfulResponse from './api/get_indices.success.json';
-import errorResponse from './api/get_indices.error.json';
-import exceptionResponse from './api/get_indices.exception.json';
-const mockIndexPatternCreationType = {
-  getIndexPatternType: () => 'default',
-  getIndexPatternName: () => 'name',
-  checkIndicesForErrors: () => false,
-  getShowSystemIndices: () => false,
-  renderPrompt: () => {},
-  getIndexPatternMappings: () => {
-    return {};
-  },
-  getIndexTags: () => {
-    return [];
-  },
-};
-
-describe('getIndices', () => {
-  it('should work in a basic case', async () => {
-    const es = {
-      search: () => new Promise(resolve => resolve(successfulResponse)),
-    };
-
-    const result = await getIndices(es, mockIndexPatternCreationType, 'kibana', 1);
-    expect(result.length).toBe(2);
-    expect(result[0].name).toBe('1');
-    expect(result[1].name).toBe('2');
-  });
-
-  it('should ignore ccs query-all', async () => {
-    expect((await getIndices(null, mockIndexPatternCreationType, '*:')).length).toBe(0);
-  });
-
-  it('should ignore a single comma', async () => {
-    expect((await getIndices(null, mockIndexPatternCreationType, ',')).length).toBe(0);
-    expect((await getIndices(null, mockIndexPatternCreationType, ',*')).length).toBe(0);
-    expect((await getIndices(null, mockIndexPatternCreationType, ',foobar')).length).toBe(0);
-  });
-
-  it('should trim the input', async () => {
-    let index;
-    const es = {
-      search: jest.fn().mockImplementation(params => {
-        index = params.index;
-      }),
-    };
-
-    await getIndices(es, mockIndexPatternCreationType, 'kibana          ', 1);
-    expect(index).toBe('kibana');
-  });
-
-  it('should use the limit', async () => {
-    let limit;
-    const es = {
-      search: jest.fn().mockImplementation(params => {
-        limit = params.body.aggs.indices.terms.size;
-      }),
-    };
-
-    await getIndices(es, mockIndexPatternCreationType, 'kibana', 10);
-    expect(limit).toBe(10);
-  });
-
-  describe('errors', () => {
-    it('should handle errors gracefully', async () => {
-      const es = {
-        search: () => new Promise(resolve => resolve(errorResponse)),
-      };
-
-      const result = await getIndices(es, mockIndexPatternCreationType, 'kibana', 1);
-      expect(result.length).toBe(0);
-    });
-
-    it('should throw exceptions', async () => {
-      const es = {
-        search: () => {
-          throw new Error('Fail');
-        },
-      };
-
-      await expect(getIndices(es, mockIndexPatternCreationType, 'kibana', 1)).rejects.toThrow();
-    });
-
-    it('should handle index_not_found_exception errors gracefully', async () => {
-      const es = {
-        search: () => new Promise((resolve, reject) => reject(exceptionResponse)),
-      };
-
-      const result = await getIndices(es, mockIndexPatternCreationType, 'kibana', 1);
-      expect(result.length).toBe(0);
-    });
-
-    it('should throw an exception if no limit is provided', async () => {
-      await expect(getIndices({}, mockIndexPatternCreationType, 'kibana')).rejects.toThrow();
-    });
-  });
-});
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/can_append_wildcard.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.test.ts
similarity index 89%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/can_append_wildcard.test.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.test.ts
index 055632bdd19e0..14139c2e08dc0 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/can_append_wildcard.test.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.test.ts
@@ -17,13 +17,9 @@
  * under the License.
  */
 
-import { canAppendWildcard } from '../can_append_wildcard';
+import { canAppendWildcard } from './can_append_wildcard';
 
 describe('canAppendWildcard', () => {
-  test('ignores no data', () => {
-    expect(canAppendWildcard({})).toBeFalsy();
-  });
-
   test('ignores symbols', () => {
     expect(canAppendWildcard('%')).toBeFalsy();
   });
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.ts
similarity index 94%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.ts
index b47e645730aef..e9c4f75e4313b 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/can_append_wildcard.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-export const canAppendWildcard = keyPressed => {
+export const canAppendWildcard = (keyPressed: string) => {
   // If it's not a letter, number or is something longer, reject it
   if (!keyPressed || !/[a-z0-9]/i.test(keyPressed) || keyPressed.length !== 1) {
     return false;
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.ts
similarity index 90%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.ts
index 31485bb3daaa2..ca4fc8122903c 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_illegal_characters.ts
@@ -17,6 +17,6 @@
  * under the License.
  */
 
-export function containsIllegalCharacters(pattern, illegalCharacters) {
+export function containsIllegalCharacters(pattern: string, illegalCharacters: string[]) {
   return illegalCharacters.some(char => pattern.includes(char));
 }
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/contains_invalid_characters.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_invalid_characters.test.ts
similarity index 93%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/contains_invalid_characters.test.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_invalid_characters.test.ts
index 05c4aba2571bd..640908d3db6d1 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/contains_invalid_characters.test.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/contains_invalid_characters.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { containsIllegalCharacters } from '../contains_illegal_characters';
+import { containsIllegalCharacters } from './contains_illegal_characters';
 
 describe('containsIllegalCharacters', () => {
   it('returns true with illegal characters', () => {
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/ensure_minimum_time.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts
similarity index 96%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/ensure_minimum_time.test.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts
index 99724cbf3a2a7..e5fcfe056923a 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/ensure_minimum_time.test.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { ensureMinimumTime } from '../ensure_minimum_time';
+import { ensureMinimumTime } from './ensure_minimum_time';
 
 describe('ensureMinimumTime', () => {
   it('resolves single promise', async done => {
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.ts
similarity index 97%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.ts
index 0a6d3fcfbbdf0..84852ece485eb 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/ensure_minimum_time.ts
@@ -27,7 +27,7 @@
 export const DEFAULT_MINIMUM_TIME_MS = 300;
 
 export async function ensureMinimumTime(
-  promiseOrPromises,
+  promiseOrPromises: Promise<any> | Array<Promise<any>>,
   minimumTimeMs = DEFAULT_MINIMUM_TIME_MS
 ) {
   let returnValue;
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/extract_time_fields.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.test.ts
similarity index 89%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/extract_time_fields.test.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.test.ts
index ec420e19817c7..4cd28090420a7 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/extract_time_fields.test.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.test.ts
@@ -17,11 +17,14 @@
  * under the License.
  */
 
-import { extractTimeFields } from '../extract_time_fields';
+import { extractTimeFields } from './extract_time_fields';
 
 describe('extractTimeFields', () => {
   it('should handle no date fields', () => {
-    const fields = [{ type: 'text' }, { type: 'text' }];
+    const fields = [
+      { type: 'text', name: 'name' },
+      { type: 'text', name: 'name' },
+    ];
 
     expect(extractTimeFields(fields)).toEqual([
       { display: `The indices which match this index pattern don't contain any time fields.` },
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.ts
similarity index 92%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.ts
index 1a9deefb217f2..0b95ec0a120da 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/extract_time_fields.ts
@@ -18,8 +18,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { IFieldType } from '../../../../../../../../../plugins/data/public';
 
-export function extractTimeFields(fields) {
+export function extractTimeFields(fields: IFieldType[]) {
   const dateFields = fields.filter(field => field.type === 'date');
   const label = i18n.translate('kbn.management.createIndexPattern.stepTime.noTimeFieldsLabel', {
     defaultMessage: "The indices which match this index pattern don't contain any time fields.",
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.test.ts b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.test.ts
new file mode 100644
index 0000000000000..cd7c8278adcc7
--- /dev/null
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.test.ts
@@ -0,0 +1,167 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { getIndices } from './get_indices';
+import { IndexPatternCreationConfig } from './../../../../../../../management/public';
+import { LegacyApiCaller } from '../../../../../../../../../plugins/data/public';
+
+export const successfulResponse = {
+  hits: {
+    total: 1,
+    max_score: 0.0,
+    hits: [],
+  },
+  aggregations: {
+    indices: {
+      doc_count_error_upper_bound: 0,
+      sum_other_doc_count: 0,
+      buckets: [
+        {
+          key: '1',
+          doc_count: 1,
+        },
+        {
+          key: '2',
+          doc_count: 1,
+        },
+      ],
+    },
+  },
+};
+
+export const exceptionResponse = {
+  body: {
+    error: {
+      root_cause: [
+        {
+          type: 'index_not_found_exception',
+          reason: 'no such index',
+          index_uuid: '_na_',
+          'resource.type': 'index_or_alias',
+          'resource.id': 't',
+          index: 't',
+        },
+      ],
+      type: 'transport_exception',
+      reason: 'unable to communicate with remote cluster [cluster_one]',
+      caused_by: {
+        type: 'index_not_found_exception',
+        reason: 'no such index',
+        index_uuid: '_na_',
+        'resource.type': 'index_or_alias',
+        'resource.id': 't',
+        index: 't',
+      },
+    },
+  },
+  status: 500,
+};
+
+export const errorResponse = {
+  statusCode: 400,
+  error: 'Bad Request',
+};
+
+const mockIndexPatternCreationType = new IndexPatternCreationConfig({
+  type: 'default',
+  name: 'name',
+  showSystemIndices: false,
+  httpClient: {},
+  isBeta: false,
+});
+
+function esClientFactory(search: (params: any) => any): LegacyApiCaller {
+  return {
+    search,
+    msearch: () => ({
+      abort: () => {},
+      ...new Promise(resolve => resolve({})),
+    }),
+  };
+}
+
+const es = esClientFactory(() => successfulResponse);
+
+describe('getIndices', () => {
+  it('should work in a basic case', async () => {
+    const result = await getIndices(es, mockIndexPatternCreationType, 'kibana', 1);
+    expect(result.length).toBe(2);
+    expect(result[0].name).toBe('1');
+    expect(result[1].name).toBe('2');
+  });
+
+  it('should ignore ccs query-all', async () => {
+    expect((await getIndices(es, mockIndexPatternCreationType, '*:', 10)).length).toBe(0);
+  });
+
+  it('should ignore a single comma', async () => {
+    expect((await getIndices(es, mockIndexPatternCreationType, ',', 10)).length).toBe(0);
+    expect((await getIndices(es, mockIndexPatternCreationType, ',*', 10)).length).toBe(0);
+    expect((await getIndices(es, mockIndexPatternCreationType, ',foobar', 10)).length).toBe(0);
+  });
+
+  it('should trim the input', async () => {
+    let index;
+    const esClient = esClientFactory(
+      jest.fn().mockImplementation(params => {
+        index = params.index;
+      })
+    );
+
+    await getIndices(esClient, mockIndexPatternCreationType, 'kibana          ', 1);
+    expect(index).toBe('kibana');
+  });
+
+  it('should use the limit', async () => {
+    let limit;
+    const esClient = esClientFactory(
+      jest.fn().mockImplementation(params => {
+        limit = params.body.aggs.indices.terms.size;
+      })
+    );
+    await getIndices(esClient, mockIndexPatternCreationType, 'kibana', 10);
+    expect(limit).toBe(10);
+  });
+
+  describe('errors', () => {
+    it('should handle errors gracefully', async () => {
+      const esClient = esClientFactory(() => errorResponse);
+      const result = await getIndices(esClient, mockIndexPatternCreationType, 'kibana', 1);
+      expect(result.length).toBe(0);
+    });
+
+    it('should throw exceptions', async () => {
+      const esClient = esClientFactory(() => {
+        throw new Error('Fail');
+      });
+
+      await expect(
+        getIndices(esClient, mockIndexPatternCreationType, 'kibana', 1)
+      ).rejects.toThrow();
+    });
+
+    it('should handle index_not_found_exception errors gracefully', async () => {
+      const esClient = esClientFactory(
+        () => new Promise((resolve, reject) => reject(exceptionResponse))
+      );
+      const result = await getIndices(esClient, mockIndexPatternCreationType, 'kibana', 1);
+      expect(result.length).toBe(0);
+    });
+  });
+});
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.ts
similarity index 83%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.ts
index 8159fff8220bd..3848c425e2d49 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_indices.ts
@@ -18,8 +18,16 @@
  */
 
 import { get, sortBy } from 'lodash';
+import { IndexPatternCreationConfig } from '../../../../../../../management/public';
+import { DataPublicPluginStart } from '../../../../../../../../../plugins/data/public';
+import { MatchedIndex } from '../types';
 
-export async function getIndices(es, indexPatternCreationType, rawPattern, limit) {
+export async function getIndices(
+  es: DataPublicPluginStart['search']['__LEGACY']['esClient'],
+  indexPatternCreationType: IndexPatternCreationConfig,
+  rawPattern: string,
+  limit: number
+): Promise<MatchedIndex[]> {
   const pattern = rawPattern.trim();
 
   // Searching for `*:` fails for CCS environments. The search request
@@ -70,10 +78,10 @@ export async function getIndices(es, indexPatternCreationType, rawPattern, limit
 
     return sortBy(
       response.aggregations.indices.buckets
-        .map(bucket => {
+        .map((bucket: { key: string; doc_count: number }) => {
           return bucket.key;
         })
-        .map(indexName => {
+        .map((indexName: string) => {
           return {
             name: indexName,
             tags: indexPatternCreationType.getIndexTags(indexName),
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_matched_indices.test.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.test.ts
similarity index 53%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_matched_indices.test.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.test.ts
index 625c128181ffe..7aba50a7ca12b 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/__jest__/get_matched_indices.test.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.test.ts
@@ -17,24 +17,32 @@
  * under the License.
  */
 
-import { getMatchedIndices } from '../get_matched_indices';
+import { getMatchedIndices } from './get_matched_indices';
 
-jest.mock('../../constants', () => ({
+jest.mock('./../constants', () => ({
   MAX_NUMBER_OF_MATCHING_INDICES: 6,
 }));
 
+const tags: string[] = [];
 const indices = [
-  { name: 'kibana' },
-  { name: 'es' },
-  { name: 'logstash' },
-  { name: 'packetbeat' },
-  { name: 'metricbeat' },
-  { name: '.kibana' },
+  { name: 'kibana', tags },
+  { name: 'es', tags },
+  { name: 'logstash', tags },
+  { name: 'packetbeat', tags },
+  { name: 'metricbeat', tags },
+  { name: '.kibana', tags },
 ];
 
-const partialIndices = [{ name: 'kibana' }, { name: 'es' }, { name: '.kibana' }];
+const partialIndices = [
+  { name: 'kibana', tags },
+  { name: 'es', tags },
+  { name: '.kibana', tags },
+];
 
-const exactIndices = [{ name: 'kibana' }, { name: '.kibana' }];
+const exactIndices = [
+  { name: 'kibana', tags },
+  { name: '.kibana', tags },
+];
 
 describe('getMatchedIndices', () => {
   it('should return all indices', () => {
@@ -43,26 +51,32 @@ describe('getMatchedIndices', () => {
       exactMatchedIndices,
       partialMatchedIndices,
       visibleIndices,
-    } = getMatchedIndices(indices, partialIndices, exactIndices, '*', true);
+    } = getMatchedIndices(indices, partialIndices, exactIndices, true);
 
     expect(allIndices).toEqual([
-      { name: 'kibana' },
-      { name: 'es' },
-      { name: 'logstash' },
-      { name: 'packetbeat' },
-      { name: 'metricbeat' },
-      { name: '.kibana' },
+      { name: 'kibana', tags },
+      { name: 'es', tags },
+      { name: 'logstash', tags },
+      { name: 'packetbeat', tags },
+      { name: 'metricbeat', tags },
+      { name: '.kibana', tags },
     ]);
 
-    expect(exactMatchedIndices).toEqual([{ name: 'kibana' }, { name: '.kibana' }]);
+    expect(exactMatchedIndices).toEqual([
+      { name: 'kibana', tags },
+      { name: '.kibana', tags },
+    ]);
 
     expect(partialMatchedIndices).toEqual([
-      { name: 'kibana' },
-      { name: 'es' },
-      { name: '.kibana' },
+      { name: 'kibana', tags },
+      { name: 'es', tags },
+      { name: '.kibana', tags },
     ]);
 
-    expect(visibleIndices).toEqual([{ name: 'kibana' }, { name: '.kibana' }]);
+    expect(visibleIndices).toEqual([
+      { name: 'kibana', tags },
+      { name: '.kibana', tags },
+    ]);
   });
 
   it('should return all indices except for system indices', () => {
@@ -71,31 +85,38 @@ describe('getMatchedIndices', () => {
       exactMatchedIndices,
       partialMatchedIndices,
       visibleIndices,
-    } = getMatchedIndices(indices, partialIndices, exactIndices, '*', false);
+    } = getMatchedIndices(indices, partialIndices, exactIndices, false);
 
     expect(allIndices).toEqual([
-      { name: 'kibana' },
-      { name: 'es' },
-      { name: 'logstash' },
-      { name: 'packetbeat' },
-      { name: 'metricbeat' },
+      { name: 'kibana', tags },
+      { name: 'es', tags },
+      { name: 'logstash', tags },
+      { name: 'packetbeat', tags },
+      { name: 'metricbeat', tags },
     ]);
 
-    expect(exactMatchedIndices).toEqual([{ name: 'kibana' }]);
+    expect(exactMatchedIndices).toEqual([{ name: 'kibana', tags }]);
 
-    expect(partialMatchedIndices).toEqual([{ name: 'kibana' }, { name: 'es' }]);
+    expect(partialMatchedIndices).toEqual([
+      { name: 'kibana', tags },
+      { name: 'es', tags },
+    ]);
 
-    expect(visibleIndices).toEqual([{ name: 'kibana' }]);
+    expect(visibleIndices).toEqual([{ name: 'kibana', tags }]);
   });
 
   it('should return partial matches as visible if there are no exact', () => {
-    const { visibleIndices } = getMatchedIndices(indices, partialIndices, [], '*', true);
+    const { visibleIndices } = getMatchedIndices(indices, partialIndices, [], true);
 
-    expect(visibleIndices).toEqual([{ name: 'kibana' }, { name: 'es' }, { name: '.kibana' }]);
+    expect(visibleIndices).toEqual([
+      { name: 'kibana', tags },
+      { name: 'es', tags },
+      { name: '.kibana', tags },
+    ]);
   });
 
   it('should return all indices as visible if there are no exact or partial', () => {
-    const { visibleIndices } = getMatchedIndices(indices, [], [], '*', true);
+    const { visibleIndices } = getMatchedIndices(indices, [], [], true);
 
     expect(visibleIndices).toEqual(indices);
   });
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.ts
similarity index 86%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.ts
index 19a829a83a2b2..cc3fd4075aa0e 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/get_matched_indices.ts
@@ -19,19 +19,21 @@
 
 import { MAX_NUMBER_OF_MATCHING_INDICES } from '../constants';
 
-function isSystemIndex(index) {
+function isSystemIndex(index: string): boolean {
   if (index.startsWith('.')) {
     return true;
   }
 
   if (index.includes(':')) {
-    return index.split(':').reduce((isSystem, index) => isSystem || isSystemIndex(index), false);
+    return index
+      .split(':')
+      .reduce((isSystem: boolean, idx) => isSystem || isSystemIndex(idx), false);
   }
 
   return false;
 }
 
-function filterSystemIndices(indices, isIncludingSystemIndices) {
+function filterSystemIndices(indices: MatchedIndex[], isIncludingSystemIndices: boolean) {
   if (!indices) {
     return indices;
   }
@@ -62,12 +64,14 @@ function filterSystemIndices(indices, isIncludingSystemIndices) {
     This is the result of searching against a query that already ends in `*`.
     We call this `exact` matches because ES is telling us exactly what it matches
  */
+
+import { MatchedIndex } from '../types';
+
 export function getMatchedIndices(
-  unfilteredAllIndices,
-  unfilteredPartialMatchedIndices,
-  unfilteredExactMatchedIndices,
-  query,
-  isIncludingSystemIndices
+  unfilteredAllIndices: MatchedIndex[],
+  unfilteredPartialMatchedIndices: MatchedIndex[],
+  unfilteredExactMatchedIndices: MatchedIndex[],
+  isIncludingSystemIndices: boolean = false
 ) {
   const allIndices = filterSystemIndices(unfilteredAllIndices, isIncludingSystemIndices);
   const partialMatchedIndices = filterSystemIndices(
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/index.js b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/index.js
rename to src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/lib/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/types.ts b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/types.ts
new file mode 100644
index 0000000000000..93bb6920c6981
--- /dev/null
+++ b/src/legacy/core_plugins/kibana/public/management/sections/index_patterns/create_index_pattern_wizard/types.ts
@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export interface MatchedIndex {
+  name: string;
+  tags: string[];
+}
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/__snapshots__/advanced_settings.test.tsx.snap b/src/legacy/core_plugins/kibana/public/management/sections/settings/__snapshots__/advanced_settings.test.tsx.snap
index 4814432c832e2..e76435fdb73b2 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/__snapshots__/advanced_settings.test.tsx.snap
+++ b/src/legacy/core_plugins/kibana/public/management/sections/settings/__snapshots__/advanced_settings.test.tsx.snap
@@ -6,7 +6,7 @@ exports[`AdvancedSettings should render read-only when saving is disabled 1`] =
     gutterSize="none"
   >
     <EuiFlexItem>
-      <advanced_settings_page_title />
+      <foo_component />
     </EuiFlexItem>
     <EuiFlexItem>
       <Search
@@ -57,7 +57,7 @@ exports[`AdvancedSettings should render read-only when saving is disabled 1`] =
       />
     </EuiFlexItem>
   </EuiFlexGroup>
-  <advanced_settings_page_subtitle />
+  <foo_component />
   <EuiSpacer
     size="m"
   />
@@ -139,7 +139,7 @@ exports[`AdvancedSettings should render read-only when saving is disabled 1`] =
     }
     showNoResultsMessage={true}
   />
-  <advanced_settings_page_footer
+  <foo_component
     enableSaving={false}
     onQueryMatchChange={[Function]}
     query={
@@ -189,7 +189,7 @@ exports[`AdvancedSettings should render specific setting if given setting key 1`
     gutterSize="none"
   >
     <EuiFlexItem>
-      <advanced_settings_page_title />
+      <foo_component />
     </EuiFlexItem>
     <EuiFlexItem>
       <Search
@@ -240,7 +240,7 @@ exports[`AdvancedSettings should render specific setting if given setting key 1`
       />
     </EuiFlexItem>
   </EuiFlexGroup>
-  <advanced_settings_page_subtitle />
+  <foo_component />
   <EuiSpacer
     size="m"
   />
@@ -322,7 +322,7 @@ exports[`AdvancedSettings should render specific setting if given setting key 1`
     }
     showNoResultsMessage={true}
   />
-  <advanced_settings_page_footer
+  <foo_component
     enableSaving={true}
     onQueryMatchChange={[Function]}
     query={
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.test.tsx b/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.test.tsx
index 2a75c98b721bc..00b587c2e0fb5 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.test.tsx
+++ b/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.test.tsx
@@ -27,7 +27,9 @@ import {
   UiSettingsType,
 } from '../../../../../../../core/public';
 import { FieldSetting } from './types';
+
 import { AdvancedSettings } from './advanced_settings';
+jest.mock('ui/new_platform');
 
 jest.mock('ui/new_platform', () => ({
   npStart: mockConfig(),
@@ -215,6 +217,22 @@ function mockConfig() {
     core: {
       uiSettings: config,
     },
+    plugins: {
+      advancedSettings: {
+        component: {
+          register: jest.fn(),
+          get: () => {
+            const foo: React.ComponentType = () => <div>Hello</div>;
+            foo.displayName = 'foo_component';
+            return foo;
+          },
+          componentType: {
+            PAGE_TITLE_COMPONENT: 'page_title_component',
+            PAGE_SUBTITLE_COMPONENT: 'page_subtitle_component',
+          },
+        },
+      },
+    },
   };
 }
 
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.tsx b/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.tsx
index 569ef73f2b453..c995b391d3d2d 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.tsx
+++ b/src/legacy/core_plugins/kibana/public/management/sections/settings/advanced_settings.tsx
@@ -31,14 +31,6 @@ import { getAriaName, toEditableConfig, DEFAULT_CATEGORY } from './lib';
 
 import { FieldSetting, IQuery } from './types';
 
-import {
-  registerDefaultComponents,
-  PAGE_TITLE_COMPONENT,
-  PAGE_SUBTITLE_COMPONENT,
-  PAGE_FOOTER_COMPONENT,
-} from './components/default_component_registry';
-import { getSettingsComponent } from './components/component_registry';
-
 interface AdvancedSettingsProps {
   queryText: string;
   enableSaving: boolean;
@@ -75,8 +67,6 @@ export class AdvancedSettings extends Component<AdvancedSettingsProps, AdvancedS
       footerQueryMatched: false,
       filteredSettings: this.mapSettings(Query.execute(parsedQuery, this.settings)),
     };
-
-    registerDefaultComponents();
   }
 
   init(config: IUiSettingsClient) {
@@ -166,10 +156,13 @@ export class AdvancedSettings extends Component<AdvancedSettingsProps, AdvancedS
 
   render() {
     const { filteredSettings, query, footerQueryMatched } = this.state;
+    const componentRegistry = npStart.plugins.advancedSettings.component;
 
-    const PageTitle = getSettingsComponent(PAGE_TITLE_COMPONENT);
-    const PageSubtitle = getSettingsComponent(PAGE_SUBTITLE_COMPONENT);
-    const PageFooter = getSettingsComponent(PAGE_FOOTER_COMPONENT);
+    const PageTitle = componentRegistry.get(componentRegistry.componentType.PAGE_TITLE_COMPONENT);
+    const PageSubtitle = componentRegistry.get(
+      componentRegistry.componentType.PAGE_SUBTITLE_COMPONENT
+    );
+    const PageFooter = componentRegistry.get(componentRegistry.componentType.PAGE_FOOTER_COMPONENT);
 
     return (
       <div>
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/__snapshots__/component_registry.test.tsx.snap b/src/legacy/core_plugins/kibana/public/management/sections/settings/components/__snapshots__/component_registry.test.tsx.snap
deleted file mode 100644
index 070b387057061..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/__snapshots__/component_registry.test.tsx.snap
+++ /dev/null
@@ -1,5 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`getSettingsComponent should throw an error when requesting a component that does not exist 1`] = `"Component not found with id does not exist"`;
-
-exports[`registerSettingsComponent should disallow registering a component with a duplicate id 1`] = `"Component with id test2 is already registered."`;
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.test.tsx b/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.test.tsx
deleted file mode 100644
index 24e9e5dd3809c..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.test.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React, { FunctionComponent } from 'react';
-import {
-  tryRegisterSettingsComponent,
-  registerSettingsComponent,
-  getSettingsComponent,
-} from './component_registry';
-
-describe('tryRegisterSettingsComponent', () => {
-  it('should allow a component to be registered', () => {
-    const component = () => <div />;
-    expect(tryRegisterSettingsComponent('tryTest1', component)).toEqual(true);
-  });
-
-  it('should return false if the component is already registered, and not allow an override', () => {
-    const component = () => <div />;
-    expect(tryRegisterSettingsComponent('tryTest2', component)).toEqual(true);
-
-    const updatedComponent = () => <div />;
-    expect(tryRegisterSettingsComponent('tryTest2', updatedComponent)).toEqual(false);
-    expect(getSettingsComponent('tryTest2')).toBe(component);
-  });
-});
-
-describe('registerSettingsComponent', () => {
-  it('should allow a component to be registered', () => {
-    const component = () => <div />;
-    registerSettingsComponent('test', component);
-  });
-
-  it('should disallow registering a component with a duplicate id', () => {
-    const component = () => <div />;
-    registerSettingsComponent('test2', component);
-    expect(() => registerSettingsComponent('test2', () => <span />)).toThrowErrorMatchingSnapshot();
-  });
-
-  it('should allow a component to be overriden', () => {
-    const component = () => <div />;
-    registerSettingsComponent('test3', component);
-
-    const anotherComponent = () => <span />;
-    registerSettingsComponent('test3', anotherComponent, true);
-
-    expect(getSettingsComponent('test3')).toBe(anotherComponent);
-  });
-
-  it('should set a displayName for the component', () => {
-    const component = () => <div />;
-    registerSettingsComponent('display_name_component', component);
-    expect((component as FunctionComponent).displayName).toEqual('display_name_component');
-  });
-});
-
-describe('getSettingsComponent', () => {
-  it('should allow a component to be retrieved', () => {
-    const component = () => <div />;
-    registerSettingsComponent('test4', component);
-    expect(getSettingsComponent('test4')).toBe(component);
-  });
-
-  it('should throw an error when requesting a component that does not exist', () => {
-    expect(() => getSettingsComponent('does not exist')).toThrowErrorMatchingSnapshot();
-  });
-});
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.ts b/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.ts
deleted file mode 100644
index b58180c498edf..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/component_registry.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { ComponentType } from 'react';
-
-type Id = string;
-const registry: Record<Id, ComponentType<Record<string, any> | undefined>> = {};
-
-/**
- * Attempts to register the provided component.
- * If a component with that ID is already registered, then the registration fails.
- *
- * @param {*} id the id of the component to register
- * @param {*} component the component
- */
-export function tryRegisterSettingsComponent(
-  id: Id,
-  component: ComponentType<Record<string, any> | undefined>
-) {
-  if (id in registry) {
-    return false;
-  }
-
-  registerSettingsComponent(id, component);
-  return true;
-}
-
-/**
- * Attempts to register the provided component, with the ability to optionally allow
- * the component to override an existing one.
- *
- * If the intent is to override, then `allowOverride` must be set to true, otherwise an exception is thrown.
- *
- * @param {*} id the id of the component to register
- * @param {*} component the component
- * @param {*} allowOverride (default: false) - optional flag to allow this component to override a previously registered component
- */
-export function registerSettingsComponent(
-  id: Id,
-  component: ComponentType<Record<string, any> | undefined>,
-  allowOverride = false
-) {
-  if (!allowOverride && id in registry) {
-    throw new Error(`Component with id ${id} is already registered.`);
-  }
-
-  // Setting a display name if one does not already exist.
-  // This enhances the snapshots, as well as the debugging experience.
-  if (!component.displayName) {
-    component.displayName = id;
-  }
-
-  registry[id] = component;
-}
-
-/**
- * Retrieve a registered component by its ID.
- * If the component does not exist, then an exception is thrown.
- *
- * @param {*} id the ID of the component to retrieve
- */
-export function getSettingsComponent(id: Id): ComponentType<Record<string, any> | undefined> {
-  if (!(id in registry)) {
-    throw new Error(`Component not found with id ${id}`);
-  }
-  return registry[id];
-}
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.test.tsx b/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.test.tsx
deleted file mode 100644
index ff3f75b79baef..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.test.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { registerDefaultComponents, PAGE_TITLE_COMPONENT } from './default_component_registry';
-import { getSettingsComponent, registerSettingsComponent } from './component_registry';
-import { PageTitle } from './page_title';
-
-describe('default_component_registry', () => {
-  it('should register default components with the registry', () => {
-    registerDefaultComponents();
-    expect(getSettingsComponent(PAGE_TITLE_COMPONENT)).toEqual(PageTitle);
-  });
-
-  it('should be able to call "registerDefaultComponents" several times without throwing', () => {
-    registerDefaultComponents();
-    registerDefaultComponents();
-    registerDefaultComponents();
-  });
-
-  it('should not override components if they are already registered', () => {
-    const newComponent = () => <div />;
-    registerSettingsComponent(PAGE_TITLE_COMPONENT, newComponent, true);
-    registerDefaultComponents();
-
-    expect(getSettingsComponent(PAGE_TITLE_COMPONENT)).toEqual(newComponent);
-  });
-});
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.ts b/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.ts
deleted file mode 100644
index 80b2f2e79b9c7..0000000000000
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/default_component_registry.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { tryRegisterSettingsComponent } from './component_registry';
-import { PageTitle } from './page_title';
-import { PageSubtitle } from './page_subtitle';
-import { PageFooter } from './page_footer';
-
-export const PAGE_TITLE_COMPONENT = 'advanced_settings_page_title';
-export const PAGE_SUBTITLE_COMPONENT = 'advanced_settings_page_subtitle';
-export const PAGE_FOOTER_COMPONENT = 'advanced_settings_page_footer';
-
-export function registerDefaultComponents() {
-  tryRegisterSettingsComponent(PAGE_TITLE_COMPONENT, PageTitle);
-  tryRegisterSettingsComponent(PAGE_SUBTITLE_COMPONENT, PageSubtitle);
-  tryRegisterSettingsComponent(PAGE_FOOTER_COMPONENT, PageFooter);
-}
diff --git a/src/legacy/core_plugins/kibana/public/visualize/index.ts b/src/legacy/core_plugins/kibana/public/visualize/index.ts
index e7170836cf749..83b820a8e3134 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/index.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/index.ts
@@ -21,7 +21,6 @@ import { PluginInitializerContext } from 'kibana/public';
 import { VisualizePlugin } from './plugin';
 
 export * from './np_ready/visualize_constants';
-export { showNewVisModal } from './np_ready/wizard';
 export { VisualizeConstants, createVisualizeEditUrl } from './np_ready/visualize_constants';
 
 // Core will be looking for this when loading our plugin in the new platform
diff --git a/src/legacy/core_plugins/kibana/public/visualize/kibana_services.ts b/src/legacy/core_plugins/kibana/public/visualize/kibana_services.ts
index 15e9c73a39eff..428e6cb225710 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/kibana_services.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/kibana_services.ts
@@ -23,6 +23,7 @@ import {
   SavedObjectsClientContract,
   ToastsStart,
   IUiSettingsClient,
+  I18nStart,
 } from 'kibana/public';
 
 import { NavigationPublicPluginStart as NavigationStart } from '../../../../../plugins/navigation/public';
@@ -57,6 +58,7 @@ export interface VisualizeKibanaServices {
   visualizeCapabilities: any;
   visualizations: VisualizationsStart;
   usageCollection?: UsageCollectionSetup;
+  I18nContext: I18nStart['Context'];
 }
 
 let services: VisualizeKibanaServices | null = null;
diff --git a/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts b/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
index b185dc577a3aa..d3a7f6ac1ff7d 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
@@ -40,34 +40,29 @@ export { stateMonitorFactory } from 'ui/state_management/state_monitor_factory';
 export { PersistedState } from 'ui/persisted_state';
 
 export { npSetup, npStart } from 'ui/new_platform';
-export { IPrivate } from 'ui/private';
-// @ts-ignore
-export { PrivateProvider } from 'ui/private/private';
-
-export { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
-export { showSaveModal } from 'ui/saved_objects/show_saved_object_save_modal';
 
 export { subscribeWithScope } from 'ui/utils/subscribe_with_scope';
-export { migrateLegacyQuery } from 'ui/utils/migrate_legacy_query';
 // @ts-ignore
 export { EventsProvider } from 'ui/events';
 // @ts-ignore
 export { createTopNavDirective, createTopNavHelper } from 'ui/kbn_top_nav/kbn_top_nav';
 // @ts-ignore
-export { PromiseServiceCreator } from 'ui/promises/promises';
-// @ts-ignore
 export { confirmModalFactory } from 'ui/modals/confirm_modal';
-export { configureAppAngularModule, ensureDefaultIndexPattern } from 'ui/legacy_compat';
 export { registerTimefilterWithGlobalStateFactory } from 'ui/timefilter/setup_router';
-
 // @ts-ignore
 export { KbnUrlProvider, RedirectWhenMissingProvider } from 'ui/url';
 export { absoluteToParsedUrl } from 'ui/url/absolute_to_parsed_url';
 export { KibanaParsedUrl } from 'ui/url/kibana_parsed_url';
-
 export { wrapInI18nContext } from 'ui/i18n';
-
 export { DashboardConstants } from '../dashboard/np_ready/dashboard_constants';
 export { VisSavedObject } from '../../../visualizations/public/embeddable/visualize_embeddable';
 export { VISUALIZE_EMBEDDABLE_TYPE } from '../../../visualizations/public/embeddable';
 export { VisType } from '../../../visualizations/public';
+export {
+  configureAppAngularModule,
+  ensureDefaultIndexPattern,
+  IPrivate,
+  migrateLegacyQuery,
+  PrivateProvider,
+  PromiseServiceCreator,
+} from '../../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/_index.scss b/src/legacy/core_plugins/kibana/public/visualize/np_ready/_index.scss
index f97ae012055b0..847e72bf29fbc 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/_index.scss
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/_index.scss
@@ -7,4 +7,3 @@
 
 @import 'editor/index';
 @import 'listing/index';
-@import 'wizard/index';
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
index 96a583bec7dc9..46ae45c3a5fa2 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
@@ -31,6 +31,10 @@ import { getEditBreadcrumbs } from '../breadcrumbs';
 import { addHelpMenuToAppChrome } from '../help_menu/help_menu_util';
 import { FilterStateManager } from '../../../../../data/public';
 import { unhashUrl } from '../../../../../../../plugins/kibana_utils/public';
+import {
+  SavedObjectSaveModal,
+  showSaveModal,
+} from '../../../../../../../plugins/saved_objects/public';
 
 import { initVisEditorDirective } from './visualization_editor';
 import { initVisualizationDirective } from './visualization';
@@ -40,8 +44,6 @@ import {
   absoluteToParsedUrl,
   KibanaParsedUrl,
   migrateLegacyQuery,
-  SavedObjectSaveModal,
-  showSaveModal,
   stateMonitorFactory,
   DashboardConstants,
 } from '../../legacy_imports';
@@ -94,10 +96,10 @@ function VisualizeAppController(
     core: { docLinks },
     savedQueryService,
     uiSettings,
+    I18nContext,
   } = getServices();
 
   const filterStateManager = new FilterStateManager(globalState, getAppState, filterManager);
-  const queryFilter = filterManager;
   // Retrieve the resolved SavedVis instance.
   const savedVis = $route.current.locals.savedVis;
   const _applyVis = () => {
@@ -192,7 +194,7 @@ function VisualizeAppController(
                   description={savedVis.description}
                 />
               );
-              showSaveModal(saveModal);
+              showSaveModal(saveModal, I18nContext);
             },
           },
         ]
@@ -311,11 +313,11 @@ function VisualizeAppController(
     return appState;
   })();
 
-  $scope.filters = queryFilter.getFilters();
+  $scope.filters = filterManager.getFilters();
 
   $scope.onFiltersUpdated = filters => {
-    // The filters will automatically be set when the queryFilter emits an update event (see below)
-    queryFilter.setFilters(filters);
+    // The filters will automatically be set when the filterManager emits an update event (see below)
+    filterManager.setFilters(filters);
   };
 
   $scope.showSaveQuery = visualizeCapabilities.saveQuery;
@@ -426,15 +428,15 @@ function VisualizeAppController(
 
     // update the searchSource when filters update
     subscriptions.add(
-      subscribeWithScope($scope, queryFilter.getUpdates$(), {
+      subscribeWithScope($scope, filterManager.getUpdates$(), {
         next: () => {
-          $scope.filters = queryFilter.getFilters();
-          $scope.globalFilters = queryFilter.getGlobalFilters();
+          $scope.filters = filterManager.getFilters();
+          $scope.globalFilters = filterManager.getGlobalFilters();
         },
       })
     );
     subscriptions.add(
-      subscribeWithScope($scope, queryFilter.getFetches$(), {
+      subscribeWithScope($scope, filterManager.getFetches$(), {
         next: $scope.fetch,
       })
     );
@@ -500,7 +502,7 @@ function VisualizeAppController(
       language:
         localStorage.get('kibana.userQueryLanguage') || uiSettings.get('search:queryLanguage'),
     };
-    queryFilter.setFilters(queryFilter.getGlobalFilters());
+    filterManager.setFilters(filterManager.getGlobalFilters());
     $state.save();
     $scope.fetch();
   };
@@ -510,8 +512,8 @@ function VisualizeAppController(
     $state.save();
 
     const savedQueryFilters = savedQuery.attributes.filters || [];
-    const globalFilters = queryFilter.getGlobalFilters();
-    queryFilter.setFilters([...globalFilters, ...savedQueryFilters]);
+    const globalFilters = filterManager.getGlobalFilters();
+    filterManager.setFilters([...globalFilters, ...savedQueryFilters]);
 
     if (savedQuery.attributes.timefilter) {
       timefilter.setTime({
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.html b/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.html
index 522d20fffafd3..17caaba144a44 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.html
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.html
@@ -9,15 +9,4 @@
     edit-item="listingController.editItem"
     listing-limit="listingController.listingLimit"
   ></visualize-listing-table>
-
-  <new-vis-modal
-    is-open="listingController.showNewVisModal"
-    on-close="listingController.closeNewVisModal"
-    vis-types-registry="listingController.visTypeRegistry"
-    add-base-path="listingController.addBasePath"
-    ui-settings="listingController.uiSettings"
-    saved-objects="listingController.savedObjects"
-    usage-collection="listingController.usageCollection"
-  ></new-vis-modal>
-
 </div>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.js
index ac8308e1cd1c5..cae1e40cd445a 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/listing/visualize_listing.js
@@ -19,7 +19,7 @@
 
 import { addHelpMenuToAppChrome } from '../help_menu/help_menu_util';
 import { VisualizeListingTable } from './visualize_listing_table';
-import { NewVisModal } from '../wizard/new_vis_modal';
+
 import { VisualizeConstants } from '../visualize_constants';
 import { i18n } from '@kbn/i18n';
 
@@ -30,20 +30,9 @@ export function initListingDirective(app) {
   app.directive('visualizeListingTable', reactDirective =>
     reactDirective(wrapInI18nContext(VisualizeListingTable))
   );
-  app.directive('newVisModal', reactDirective =>
-    reactDirective(wrapInI18nContext(NewVisModal), [
-      ['visTypesRegistry', { watchDepth: 'collection' }],
-      ['onClose', { watchDepth: 'reference' }],
-      ['addBasePath', { watchDepth: 'reference' }],
-      ['uiSettings', { watchDepth: 'reference' }],
-      ['savedObjects', { watchDepth: 'reference' }],
-      ['usageCollection', { watchDepth: 'reference' }],
-      'isOpen',
-    ])
-  );
 }
 
-export function VisualizeListingController($injector, createNewVis) {
+export function VisualizeListingController($injector, $scope, createNewVis) {
   const {
     addBasePath,
     chrome,
@@ -59,21 +48,18 @@ export function VisualizeListingController($injector, createNewVis) {
     uiSettings,
     visualizations,
     core: { docLinks, savedObjects },
-    usageCollection,
   } = getServices();
   const kbnUrl = $injector.get('kbnUrl');
 
   timefilter.disableAutoRefreshSelector();
   timefilter.disableTimeRangeSelector();
 
-  this.showNewVisModal = false;
   this.addBasePath = addBasePath;
   this.uiSettings = uiSettings;
   this.savedObjects = savedObjects;
-  this.usageCollection = usageCollection;
 
   this.createNewVis = () => {
-    this.showNewVisModal = true;
+    this.closeNewVisModal = visualizations.showNewVisModal();
   };
 
   this.editItem = ({ editUrl }) => {
@@ -85,19 +71,15 @@ export function VisualizeListingController($injector, createNewVis) {
     return addBasePath(editUrl);
   };
 
-  this.closeNewVisModal = () => {
-    this.showNewVisModal = false;
-    // In case the user came via a URL to this page, change the URL to the regular landing page URL after closing the modal
-    if (createNewVis) {
-      kbnUrl.changePath(VisualizeConstants.LANDING_PAGE_PATH);
-    }
-  };
-
   if (createNewVis) {
     // In case the user navigated to the page via the /visualize/new URL we start the dialog immediately
-    this.createNewVis();
+    this.closeNewVisModal = visualizations.showNewVisModal({
+      onClose: () => {
+        // In case the user came via a URL to this page, change the URL to the regular landing page URL after closing the modal
+        kbnUrl.changePath(VisualizeConstants.LANDING_PAGE_PATH);
+      },
+    });
   }
-  this.visTypeRegistry = visualizations.types;
 
   this.fetchItems = filter => {
     const isLabsEnabled = uiSettings.get('visualize:enableLabs');
@@ -142,4 +124,10 @@ export function VisualizeListingController($injector, createNewVis) {
   this.listingLimit = uiSettings.get('savedObjects:listingLimit');
 
   addHelpMenuToAppChrome(chrome, docLinks);
+
+  $scope.$on('$destroy', () => {
+    if (this.closeNewVisModal) {
+      this.closeNewVisModal();
+    }
+  });
 }
diff --git a/src/legacy/core_plugins/kibana/public/visualize/plugin.ts b/src/legacy/core_plugins/kibana/public/visualize/plugin.ts
index 8e7487fee55f6..ce93fe7c2d578 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/plugin.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/plugin.ts
@@ -56,7 +56,7 @@ export interface VisualizePluginSetupDependencies {
     legacyChrome: Chrome;
   };
   home: HomePublicPluginSetup;
-  kibana_legacy: KibanaLegacySetup;
+  kibanaLegacy: KibanaLegacySetup;
   usageCollection?: UsageCollectionSetup;
 }
 
@@ -72,9 +72,9 @@ export class VisualizePlugin implements Plugin {
 
   public async setup(
     core: CoreSetup,
-    { home, kibana_legacy, __LEGACY, usageCollection }: VisualizePluginSetupDependencies
+    { home, kibanaLegacy, __LEGACY, usageCollection }: VisualizePluginSetupDependencies
   ) {
-    kibana_legacy.registerLegacyApp({
+    kibanaLegacy.registerLegacyApp({
       id: 'visualize',
       title: 'Visualize',
       mount: async ({ core: contextCore }, params) => {
@@ -108,10 +108,11 @@ export class VisualizePlugin implements Plugin {
           share,
           toastNotifications: contextCore.notifications.toasts,
           uiSettings: contextCore.uiSettings,
-          config: kibana_legacy.config,
+          config: kibanaLegacy.config,
           visualizeCapabilities: contextCore.application.capabilities.visualize,
           visualizations,
           usageCollection,
+          I18nContext: contextCore.i18n.Context,
         };
         setServices(deps);
 
diff --git a/src/legacy/core_plugins/kibana/ui_setting_defaults.js b/src/legacy/core_plugins/kibana/ui_setting_defaults.js
index 02a4f10a543c4..744ede891b84a 100644
--- a/src/legacy/core_plugins/kibana/ui_setting_defaults.js
+++ b/src/legacy/core_plugins/kibana/ui_setting_defaults.js
@@ -815,6 +815,9 @@ export function getUiSettingDefaults() {
       value: 'en',
       type: 'select',
       options: numeralLanguageIds,
+      optionLabels: Object.fromEntries(
+        numeralLanguages.map(language => [language.id, language.name])
+      ),
       description: i18n.translate('kbn.advancedSettings.format.formattingLocaleText', {
         defaultMessage: `{numeralLanguageLink} locale`,
         description:
diff --git a/src/legacy/core_plugins/management/public/np_ready/services/index_pattern_management/creation/config.ts b/src/legacy/core_plugins/management/public/np_ready/services/index_pattern_management/creation/config.ts
index 0598c88c80ba7..b68b2e40aad9e 100644
--- a/src/legacy/core_plugins/management/public/np_ready/services/index_pattern_management/creation/config.ts
+++ b/src/legacy/core_plugins/management/public/np_ready/services/index_pattern_management/creation/config.ts
@@ -102,7 +102,7 @@ export class IndexPatternCreationConfig {
     return this.showSystemIndices;
   }
 
-  public getIndexTags() {
+  public getIndexTags(indexName: string) {
     return [];
   }
 
diff --git a/src/legacy/core_plugins/telemetry/public/views/management/management.js b/src/legacy/core_plugins/telemetry/public/views/management/management.js
index 796caf1c8cfe6..7032775e391bb 100644
--- a/src/legacy/core_plugins/telemetry/public/views/management/management.js
+++ b/src/legacy/core_plugins/telemetry/public/views/management/management.js
@@ -19,7 +19,7 @@
 import React from 'react';
 import routes from 'ui/routes';
 
-import { registerSettingsComponent, PAGE_FOOTER_COMPONENT } from 'ui/management';
+import { npSetup } from 'ui/new_platform';
 import { TelemetryOptInProvider } from '../../services';
 import { TelemetryForm } from '../../components';
 
@@ -27,6 +27,7 @@ routes.defaults(/\/management/, {
   resolve: {
     telemetryManagementSection: function(Private) {
       const telemetryOptInProvider = Private(TelemetryOptInProvider);
+      const componentRegistry = npSetup.plugins.advancedSettings.component;
 
       const Component = props => (
         <TelemetryForm
@@ -36,7 +37,11 @@ routes.defaults(/\/management/, {
         />
       );
 
-      registerSettingsComponent(PAGE_FOOTER_COMPONENT, Component, true);
+      componentRegistry.register(
+        componentRegistry.componentType.PAGE_FOOTER_COMPONENT,
+        Component,
+        true
+      );
     },
   },
 });
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts b/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
index cf6059faf0c05..78685cd6becc8 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
+++ b/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
@@ -136,7 +136,7 @@ describe('telemetry_usage_collector', () => {
       const collectorOptions = createTelemetryUsageCollector(usageCollector, server);
 
       expect(collectorOptions.type).toBe('static_telemetry');
-      expect(await collectorOptions.fetch()).toEqual(expectedObject);
+      expect(await collectorOptions.fetch({} as any)).toEqual(expectedObject); // Sending any as the callCluster client because it's not needed in this collector but TS requires it when calling it.
     });
   });
 });
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.js b/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts
similarity index 62%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.js
rename to src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts
index e65606a83afc8..537d5a85911cd 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.js
+++ b/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts
@@ -17,9 +17,27 @@
  * under the License.
  */
 
-import { get, omit } from 'lodash';
+import { omit } from 'lodash';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 
-export function handleKibanaStats(server, response) {
+export interface KibanaUsageStats {
+  kibana: {
+    index: string;
+  };
+  kibana_stats: {
+    os: {
+      platform: string;
+      platformRelease: string;
+      distro?: string;
+      distroRelease?: string;
+    };
+  };
+
+  [plugin: string]: any;
+}
+
+export function handleKibanaStats(server: any, response?: KibanaUsageStats) {
   if (!response) {
     server.log(
       ['warning', 'telemetry', 'local-stats'],
@@ -30,8 +48,17 @@ export function handleKibanaStats(server, response) {
 
   const { kibana, kibana_stats: kibanaStats, ...plugins } = response;
 
-  const platform = get(kibanaStats, 'os.platform', 'unknown');
-  const platformRelease = get(kibanaStats, 'os.platformRelease', 'unknown');
+  const os = {
+    platform: 'unknown',
+    platformRelease: 'unknown',
+    ...kibanaStats.os,
+  };
+  const formattedOsStats = Object.entries(os).reduce((acc, [key, value]) => {
+    return {
+      ...acc,
+      [`${key}s`]: [{ [key]: value, count: 1 }],
+    };
+  }, {});
 
   const version = server
     .config()
@@ -44,16 +71,16 @@ export function handleKibanaStats(server, response) {
     ...omit(kibana, 'index'), // discard index
     count: 1,
     indices: 1,
-    os: {
-      platforms: [{ platform, count: 1 }],
-      platformReleases: [{ platformRelease, count: 1 }],
-    },
+    os: formattedOsStats,
     versions: [{ version, count: 1 }],
     plugins,
   };
 }
 
-export async function getKibana(usageCollection, callWithInternalUser) {
+export async function getKibana(
+  usageCollection: UsageCollectionSetup,
+  callWithInternalUser: CallCluster
+): Promise<KibanaUsageStats> {
   const usage = await usageCollection.bulkFetch(callWithInternalUser);
   return usageCollection.toObject(usage);
 }
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts b/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts
index a4ea2eb534226..8adb6d237bee8 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts
+++ b/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts
@@ -22,18 +22,25 @@ import { get, omit } from 'lodash';
 import { getClusterInfo } from './get_cluster_info';
 import { getClusterStats } from './get_cluster_stats';
 // @ts-ignore
-import { getKibana, handleKibanaStats } from './get_kibana';
+import { getKibana, handleKibanaStats, KibanaUsageStats } from './get_kibana';
 import { StatsGetter } from '../collection_manager';
 
 /**
  * Handle the separate local calls by combining them into a single object response that looks like the
  * "cluster_stats" document from X-Pack monitoring.
  *
+ * @param {Object} server ??
  * @param {Object} clusterInfo Cluster info (GET /)
  * @param {Object} clusterStats Cluster stats (GET /_cluster/stats)
+ * @param {Object} kibana The Kibana Usage stats
  * @return {Object} A combined object containing the different responses.
  */
-export function handleLocalStats(server: any, clusterInfo: any, clusterStats: any, kibana: any) {
+export function handleLocalStats(
+  server: any,
+  clusterInfo: any,
+  clusterStats: any,
+  kibana: KibanaUsageStats
+) {
   return {
     timestamp: new Date().toISOString(),
     cluster_uuid: get(clusterInfo, 'cluster_uuid'),
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
index 81c866923232e..f5ce55e82967d 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
@@ -24,7 +24,7 @@ import { act } from 'react-dom/test-utils';
 import { IndexPattern } from 'src/plugins/data/public';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 
-import { AggType, AggGroupNames } from '../legacy_imports';
+import { IAggType, AggGroupNames } from '../legacy_imports';
 import { DefaultEditorAgg, DefaultEditorAggProps } from './agg';
 import { DefaultEditorAggParams } from './agg_params';
 import { AGGS_ACTION_KEYS } from './agg_group_state';
@@ -117,7 +117,7 @@ describe('DefaultEditorAgg component', () => {
     (defaultProps.agg as any).brandNew = false;
     defaultProps.agg.type = {
       makeLabel: () => 'Agg description',
-    } as AggType;
+    } as IAggType;
     const comp = mount(<DefaultEditorAgg {...defaultProps} />);
 
     act(() => {
@@ -258,11 +258,11 @@ describe('DefaultEditorAgg component', () => {
     it('should disable min_doc_count when agg is histogram or date_histogram', () => {
       defaultProps.agg.type = {
         name: 'histogram',
-      } as AggType;
+      } as IAggType;
       const compHistogram = shallow(<DefaultEditorAgg {...defaultProps} />);
       defaultProps.agg.type = {
         name: 'date_histogram',
-      } as AggType;
+      } as IAggType;
       const compDateHistogram = shallow(<DefaultEditorAgg {...defaultProps} />);
 
       expect(compHistogram.find(DefaultEditorAggParams).props()).toHaveProperty('disabledParams', [
@@ -276,7 +276,7 @@ describe('DefaultEditorAgg component', () => {
     it('should set error when agg is not histogram or date_histogram', () => {
       defaultProps.agg.type = {
         name: 'aggType',
-      } as AggType;
+      } as IAggType;
       const comp = shallow(<DefaultEditorAgg {...defaultProps} />);
 
       expect(comp.find(DefaultEditorAggParams).prop('aggError')).toBeDefined();
@@ -285,7 +285,7 @@ describe('DefaultEditorAgg component', () => {
     it('should set min_doc_count to true when agg type was changed to histogram', () => {
       defaultProps.agg.type = {
         name: 'aggType',
-      } as AggType;
+      } as IAggType;
       const comp = mount(<DefaultEditorAgg {...defaultProps} />);
       comp.setProps({ agg: { ...defaultProps.agg, type: { name: 'histogram' } } });
 
@@ -299,7 +299,7 @@ describe('DefaultEditorAgg component', () => {
     it('should set min_doc_count to 0 when agg type was changed to date_histogram', () => {
       defaultProps.agg.type = {
         name: 'aggType',
-      } as AggType;
+      } as IAggType;
       const comp = mount(<DefaultEditorAgg {...defaultProps} />);
       comp.setProps({ agg: { ...defaultProps.agg, type: { name: 'date_histogram' } } });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg.tsx
index 871bd0cdf6811..5450c29450bac 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg.tsx
@@ -28,7 +28,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { AggConfig } from '../legacy_imports';
+import { IAggConfig } from '../legacy_imports';
 import { DefaultEditorAggParams } from './agg_params';
 import { DefaultEditorAggCommonProps } from './agg_common_props';
 import { AGGS_ACTION_KEYS, AggsAction } from './agg_group_state';
@@ -36,7 +36,7 @@ import { RowsOrColumnsControl } from './controls/rows_or_columns';
 import { RadiusRatioOptionControl } from './controls/radius_ratio_option';
 
 export interface DefaultEditorAggProps extends DefaultEditorAggCommonProps {
-  agg: AggConfig;
+  agg: IAggConfig;
   aggIndex: number;
   aggIsTooLow: boolean;
   dragHandleProps: {} | null;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_add.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_add.tsx
index f5175126c31c1..d8df5b315fca0 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_add.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_add.tsx
@@ -29,10 +29,10 @@ import {
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { AggConfig, AggGroupNames, Schema } from '../legacy_imports';
+import { IAggConfig, AggGroupNames, Schema } from '../legacy_imports';
 
 interface DefaultEditorAggAddProps {
-  group?: AggConfig[];
+  group?: IAggConfig[];
   groupName: string;
   schemas: Schema[];
   stats: {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
index 8d803810b647a..17d2c18d2532c 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
@@ -18,25 +18,25 @@
  */
 
 import { VisState, VisParams } from 'src/legacy/core_plugins/visualizations/public';
-import { AggType, AggConfig, AggGroupNames, Schema } from '../legacy_imports';
+import { IAggType, IAggConfig, AggGroupNames, Schema } from '../legacy_imports';
 
-type AggId = AggConfig['id'];
-type AggParams = AggConfig['params'];
+type AggId = IAggConfig['id'];
+type AggParams = IAggConfig['params'];
 
 export type AddSchema = (schemas: Schema) => void;
-export type ReorderAggs = (sourceAgg: AggConfig, destinationAgg: AggConfig) => void;
+export type ReorderAggs = (sourceAgg: IAggConfig, destinationAgg: IAggConfig) => void;
 
 export interface DefaultEditorCommonProps {
   formIsTouched: boolean;
   groupName: AggGroupNames;
-  metricAggs: AggConfig[];
+  metricAggs: IAggConfig[];
   state: VisState;
   setAggParamValue: <T extends keyof AggParams>(
     aggId: AggId,
     paramName: T,
     value: AggParams[T]
   ) => void;
-  onAggTypeChange: (aggId: AggId, aggType: AggType) => void;
+  onAggTypeChange: (aggId: AggId, aggType: IAggType) => void;
 }
 
 export interface DefaultEditorAggCommonProps extends DefaultEditorCommonProps {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
index 9cbcc31bdc60e..c36c0176439f9 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
@@ -21,7 +21,7 @@ import React from 'react';
 import { mount, shallow } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfigs, AggConfig, Schema } from '../legacy_imports';
+import { IAggConfigs, IAggConfig, Schema } from '../legacy_imports';
 import { DefaultEditorAggGroup, DefaultEditorAggGroupProps } from './agg_group';
 import { DefaultEditorAgg } from './agg';
 import { DefaultEditorAggAdd } from './agg_add';
@@ -56,7 +56,7 @@ jest.mock('./agg_add', () => ({
 
 describe('DefaultEditorAgg component', () => {
   let defaultProps: DefaultEditorAggGroupProps;
-  let aggs: AggConfigs;
+  let aggs: IAggConfigs;
   let setTouched: jest.Mock;
   let setValidity: jest.Mock;
   let reorderAggs: jest.Mock;
@@ -76,7 +76,7 @@ describe('DefaultEditorAgg component', () => {
             },
           },
           schema: { group: 'metrics' },
-        } as AggConfig,
+        } as IAggConfig,
         {
           id: '3',
           params: {
@@ -85,7 +85,7 @@ describe('DefaultEditorAgg component', () => {
             },
           },
           schema: { group: 'metrics' },
-        } as AggConfig,
+        } as IAggConfig,
         {
           id: '2',
           params: {
@@ -94,9 +94,9 @@ describe('DefaultEditorAgg component', () => {
             },
           },
           schema: { group: 'buckets' },
-        } as AggConfig,
+        } as IAggConfig,
       ],
-    } as AggConfigs;
+    } as IAggConfigs;
 
     defaultProps = {
       formIsTouched: false,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
index 3491414bec809..768a9669025e4 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
@@ -30,7 +30,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { AggConfig, aggGroupNamesMap, AggGroupNames, Schema } from '../legacy_imports';
+import { IAggConfig, aggGroupNamesMap, AggGroupNames, Schema } from '../legacy_imports';
 import { DefaultEditorAgg } from './agg';
 import { DefaultEditorAggAdd } from './agg_add';
 import { AddSchema, ReorderAggs, DefaultEditorAggCommonProps } from './agg_common_props';
@@ -69,8 +69,8 @@ function DefaultEditorAggGroup({
 }: DefaultEditorAggGroupProps) {
   const groupNameLabel = (aggGroupNamesMap() as any)[groupName];
   // e.g. buckets can have no aggs
-  const group: AggConfig[] = useMemo(
-    () => state.aggs.aggs.filter((agg: AggConfig) => agg.schema.group === groupName) || [],
+  const group: IAggConfig[] = useMemo(
+    () => state.aggs.aggs.filter((agg: IAggConfig) => agg.schema.group === groupName) || [],
     [groupName, state.aggs.aggs]
   );
 
@@ -151,7 +151,7 @@ function DefaultEditorAggGroup({
         )}
         <EuiDroppable droppableId={`agg_group_dnd_${groupName}`}>
           <>
-            {group.map((agg: AggConfig, index: number) => (
+            {group.map((agg: IAggConfig, index: number) => (
               <EuiDraggable
                 key={agg.id}
                 index={index}
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.test.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.test.ts
index dc007a294e0e1..b18e5af27f8b4 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.test.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { AggConfig } from '../legacy_imports';
+import { IAggConfig } from '../legacy_imports';
 import {
   isAggRemovable,
   calcAggIsTooLow,
@@ -27,7 +27,7 @@ import {
 import { AggsState } from './agg_group_state';
 
 describe('DefaultEditorGroup helpers', () => {
-  let group: AggConfig[];
+  let group: IAggConfig[];
 
   beforeEach(() => {
     group = [
@@ -39,7 +39,7 @@ describe('DefaultEditorGroup helpers', () => {
           },
         },
         schema: { name: 'metric', min: 1, mustBeFirst: true },
-      } as AggConfig,
+      } as IAggConfig,
       {
         id: '2',
         params: {
@@ -48,7 +48,7 @@ describe('DefaultEditorGroup helpers', () => {
           },
         },
         schema: { name: 'metric', min: 2 },
-      } as AggConfig,
+      } as IAggConfig,
     ];
   });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.tsx
index 87f0d00d50a1d..d2e8e5401c0f7 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_helper.tsx
@@ -18,12 +18,12 @@
  */
 
 import { findIndex, isEmpty } from 'lodash';
-import { AggConfig } from '../legacy_imports';
+import { IAggConfig } from '../legacy_imports';
 import { AggsState } from './agg_group_state';
 
-const isAggRemovable = (agg: AggConfig, group: AggConfig[]) => {
+const isAggRemovable = (agg: IAggConfig, group: IAggConfig[]) => {
   const metricCount = group.reduce(
-    (count, aggregation: AggConfig) =>
+    (count, aggregation: IAggConfig) =>
       aggregation.schema.name === agg.schema.name ? ++count : count,
     0
   );
@@ -31,20 +31,20 @@ const isAggRemovable = (agg: AggConfig, group: AggConfig[]) => {
   return metricCount > agg.schema.min;
 };
 
-const getEnabledMetricAggsCount = (group: AggConfig[]) => {
+const getEnabledMetricAggsCount = (group: IAggConfig[]) => {
   return group.reduce(
-    (count, aggregation: AggConfig) =>
+    (count, aggregation: IAggConfig) =>
       aggregation.schema.name === 'metric' && aggregation.enabled ? ++count : count,
     0
   );
 };
 
-const calcAggIsTooLow = (agg: AggConfig, aggIndex: number, group: AggConfig[]) => {
+const calcAggIsTooLow = (agg: IAggConfig, aggIndex: number, group: IAggConfig[]) => {
   if (!agg.schema.mustBeFirst) {
     return false;
   }
 
-  const firstDifferentSchema = findIndex(group, (aggr: AggConfig) => {
+  const firstDifferentSchema = findIndex(group, (aggr: IAggConfig) => {
     return aggr.schema !== agg.schema;
   });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_state.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_state.tsx
index b06ca1c2ce57a..d022297ae72b3 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_state.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group_state.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { AggConfig } from '../legacy_imports';
+import { IAggConfig } from '../legacy_imports';
 
 export enum AGGS_ACTION_KEYS {
   TOUCHED = 'aggsTouched',
@@ -52,7 +52,7 @@ function aggGroupReducer(state: AggsState, action: AggsAction): AggsState {
   }
 }
 
-function initAggsState(group: AggConfig[]): AggsState {
+function initAggsState(group: IAggConfig[]): AggsState {
   return group.reduce((state, agg) => {
     state[agg.id] = { touched: false, valid: true };
     return state;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
index 01a41d3c412c2..c858fb62045ca 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
@@ -19,15 +19,16 @@
 
 import { Field } from 'src/plugins/data/public';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfig, AggParam, EditorConfig } from '../legacy_imports';
+import { IAggConfig, AggParam } from '../legacy_imports';
 import { ComboBoxGroupedOptions } from '../utils';
+import { EditorConfig } from './utils';
 
 // NOTE: we cannot export the interface with export { InterfaceName }
 // as there is currently a bug on babel typescript transform plugin for it
 // https://github.com/babel/babel/issues/7641
 //
 export interface AggParamCommonProps<T, P = AggParam> {
-  agg: AggConfig;
+  agg: IAggConfig;
   aggParam: P;
   disabled?: boolean;
   editorConfig: EditorConfig;
@@ -36,7 +37,7 @@ export interface AggParamCommonProps<T, P = AggParam> {
   showValidation: boolean;
   state: VisState;
   value?: T;
-  metricAggs: AggConfig[];
+  metricAggs: IAggConfig[];
 }
 
 export interface AggParamEditorProps<T, P = AggParam> extends AggParamCommonProps<T, P> {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
index d782c819c7c41..af851aa9b4418 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
@@ -23,7 +23,7 @@ import { mount, shallow } from 'enzyme';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { IndexPattern } from 'src/plugins/data/public';
 import { DefaultEditorAggParams, DefaultEditorAggParamsProps } from './agg_params';
-import { AggConfig, AggGroupNames } from '../legacy_imports';
+import { IAggConfig, AggGroupNames } from '../legacy_imports';
 
 const mockEditorConfig = {
   useNormalizedEsInterval: { hidden: false, fixedValue: false },
@@ -36,10 +36,8 @@ const mockEditorConfig = {
 };
 
 jest.mock('ui/new_platform');
-jest.mock('ui/vis/config', () => ({
-  editorConfigProviders: {
-    getConfigForAgg: jest.fn(() => mockEditorConfig),
-  },
+jest.mock('./utils', () => ({
+  getEditorConfig: jest.fn(() => mockEditorConfig),
 }));
 jest.mock('./agg_params_helper', () => ({
   getAggParamsToRender: jest.fn(() => ({
@@ -97,7 +95,7 @@ describe('DefaultEditorAggParams component', () => {
         schema: {
           title: '',
         },
-      } as any) as AggConfig,
+      } as any) as IAggConfig,
       groupName: AggGroupNames.Metrics,
       formIsTouched: false,
       indexPattern: {} as IndexPattern,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.tsx
index 47e98f175ab73..e9583ab4cec79 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.tsx
@@ -23,14 +23,7 @@ import { i18n } from '@kbn/i18n';
 import useUnmount from 'react-use/lib/useUnmount';
 
 import { IndexPattern } from 'src/plugins/data/public';
-import {
-  AggConfig,
-  AggGroupNames,
-  editorConfigProviders,
-  FixedParam,
-  TimeIntervalParam,
-  EditorParamConfig,
-} from '../legacy_imports';
+import { IAggConfig, AggGroupNames } from '../legacy_imports';
 
 import { DefaultEditorAggSelect } from './agg_select';
 import { DefaultEditorAggParam } from './agg_param';
@@ -46,6 +39,7 @@ import {
   initAggParamsState,
 } from './agg_params_state';
 import { DefaultEditorCommonProps } from './agg_common_props';
+import { EditorParamConfig, TimeIntervalParam, FixedParam, getEditorConfig } from './utils';
 
 const FIXED_VALUE_PROP = 'fixedValue';
 const DEFAULT_PROP = 'default';
@@ -54,7 +48,7 @@ type EditorParamConfigType = EditorParamConfig & {
 };
 
 export interface DefaultEditorAggParamsProps extends DefaultEditorCommonProps {
-  agg: AggConfig;
+  agg: IAggConfig;
   aggError?: string;
   aggIndex?: number;
   aggIsTooLow?: boolean;
@@ -93,10 +87,12 @@ function DefaultEditorAggParams({
         values: { schema: agg.schema.title },
       })
     : '';
-
-  const editorConfig = useMemo(() => editorConfigProviders.getConfigForAgg(indexPattern, agg), [
+  const aggTypeName = agg.type?.name;
+  const fieldName = agg.params?.field?.name;
+  const editorConfig = useMemo(() => getEditorConfig(indexPattern, aggTypeName, fieldName), [
     indexPattern,
-    agg,
+    aggTypeName,
+    fieldName,
   ]);
   const params = useMemo(() => getAggParamsToRender({ agg, editorConfig, metricAggs, state }), [
     agg,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
index 6f584b4329500..f3bee80baa1ba 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
@@ -17,22 +17,16 @@
  * under the License.
  */
 
-import { IndexPattern, Field } from 'src/plugins/data/public';
+import { IndexPattern } from 'src/plugins/data/public';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
-import {
-  AggConfig,
-  AggType,
-  AggGroupNames,
-  BUCKET_TYPES,
-  IndexedArray,
-  EditorConfig,
-} from '../legacy_imports';
+import { IAggConfig, IAggType, AggGroupNames, BUCKET_TYPES } from '../legacy_imports';
 import {
   getAggParamsToRender,
   getAggTypeOptions,
   isInvalidParamsTouched,
 } from './agg_params_helper';
 import { FieldParamEditor, OrderByParamEditor } from './controls';
+import { EditorConfig } from './utils';
 
 jest.mock('../utils', () => ({
   groupAndSortBy: jest.fn(() => ['indexedFields']),
@@ -42,10 +36,10 @@ jest.mock('ui/new_platform');
 
 describe('DefaultEditorAggParams helpers', () => {
   describe('getAggParamsToRender', () => {
-    let agg: AggConfig;
+    let agg: IAggConfig;
     let editorConfig: EditorConfig;
     const state = {} as VisState;
-    const metricAggs: AggConfig[] = [];
+    const metricAggs: IAggConfig[] = [];
     const emptyParams = {
       basic: [],
       advanced: [],
@@ -57,14 +51,14 @@ describe('DefaultEditorAggParams helpers', () => {
           params: [{ name: 'interval' }],
         },
         schema: {},
-      } as AggConfig;
+      } as IAggConfig;
       const params = getAggParamsToRender({ agg, editorConfig, metricAggs, state });
 
       expect(params).toEqual(emptyParams);
     });
 
     it('should not create any param if there is no agg type', () => {
-      agg = {} as AggConfig;
+      agg = {} as IAggConfig;
       const params = getAggParamsToRender({ agg, editorConfig, metricAggs, state });
 
       expect(params).toEqual(emptyParams);
@@ -75,7 +69,7 @@ describe('DefaultEditorAggParams helpers', () => {
         type: {
           params: [{ name: 'interval' }],
         },
-      } as AggConfig;
+      } as IAggConfig;
       editorConfig = {
         interval: {
           hidden: true,
@@ -94,7 +88,7 @@ describe('DefaultEditorAggParams helpers', () => {
         schema: {
           hideCustomLabel: true,
         },
-      } as AggConfig;
+      } as IAggConfig;
       const params = getAggParamsToRender({ agg, editorConfig, metricAggs, state });
 
       expect(params).toEqual(emptyParams);
@@ -111,8 +105,10 @@ describe('DefaultEditorAggParams helpers', () => {
               name: 'field',
               type: 'field',
               filterFieldTypes,
-              getAvailableFields: jest.fn((fields: IndexedArray<Field>) =>
-                fields.filter(({ type }) => filterFieldTypes.includes(type))
+              getAvailableFields: jest.fn((aggConfig: IAggConfig) =>
+                aggConfig
+                  .getIndexPattern()
+                  .fields.filter(({ type }) => filterFieldTypes.includes(type))
               ),
             },
             {
@@ -131,7 +127,7 @@ describe('DefaultEditorAggParams helpers', () => {
           orderBy: 'orderBy',
           field: 'field',
         },
-      } as any) as AggConfig;
+      } as any) as IAggConfig;
       const params = getAggParamsToRender({ agg, editorConfig, metricAggs, state });
 
       expect(params).toEqual({
@@ -166,14 +162,14 @@ describe('DefaultEditorAggParams helpers', () => {
   describe('getAggTypeOptions', () => {
     it('should return agg type options grouped by subtype', () => {
       const indexPattern = {} as IndexPattern;
-      const aggs = getAggTypeOptions({} as AggConfig, indexPattern, 'metrics');
+      const aggs = getAggTypeOptions({} as IAggConfig, indexPattern, 'metrics');
 
       expect(aggs).toEqual(['indexedFields']);
     });
   });
 
   describe('isInvalidParamsTouched', () => {
-    let aggType: AggType;
+    let aggType: IAggType;
     const aggTypeState = {
       touched: false,
       valid: true,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
index 21154bd7ad603..124c41a50c0df 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
@@ -29,17 +29,17 @@ import {
   aggTypeFilters,
   aggTypeFieldFilters,
   aggTypes,
-  AggConfig,
+  IAggConfig,
   AggParam,
-  FieldParamType,
-  AggType,
-  EditorConfig,
+  IFieldParamType,
+  IAggType,
 } from '../legacy_imports';
+import { EditorConfig } from './utils';
 
 interface ParamInstanceBase {
-  agg: AggConfig;
+  agg: IAggConfig;
   editorConfig: EditorConfig;
-  metricAggs: AggConfig[];
+  metricAggs: IAggConfig[];
   state: VisState;
 }
 
@@ -73,9 +73,7 @@ function getAggParamsToRender({ agg, editorConfig, metricAggs, state }: ParamIns
     }
     // if field param exists, compute allowed fields
     if (param.type === 'field') {
-      const availableFields: Field[] = (param as FieldParamType).getAvailableFields(
-        agg.getIndexPattern().fields
-      );
+      const availableFields: Field[] = (param as IFieldParamType).getAvailableFields(agg);
       fields = aggTypeFieldFilters.filter(availableFields, agg);
       indexedFields = groupAndSortBy(fields, 'type', 'name');
 
@@ -117,10 +115,10 @@ function getAggParamsToRender({ agg, editorConfig, metricAggs, state }: ParamIns
 }
 
 function getAggTypeOptions(
-  agg: AggConfig,
+  agg: IAggConfig,
   indexPattern: IndexPattern,
   groupName: string
-): ComboBoxGroupedOptions<AggType> {
+): ComboBoxGroupedOptions<IAggType> {
   const aggTypeOptions = aggTypeFilters.filter((aggTypes as any)[groupName], indexPattern, agg);
   return groupAndSortBy(aggTypeOptions as any[], 'subtype', 'title');
 }
@@ -135,7 +133,7 @@ function getAggTypeOptions(
  * @param aggParams State of aggregation parameters.
  */
 function isInvalidParamsTouched(
-  aggType: AggType,
+  aggType: IAggType,
   aggTypeState: AggTypeState,
   aggParams: AggParamsState
 ) {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_select.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_select.tsx
index 2a9c74521e525..0ec19bfa1b843 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_select.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_select.tsx
@@ -24,20 +24,20 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { IndexPattern } from 'src/plugins/data/public';
-import { AggType, documentationLinks } from '../legacy_imports';
+import { IAggType, documentationLinks } from '../legacy_imports';
 import { ComboBoxGroupedOptions } from '../utils';
 import { AGG_TYPE_ACTION_KEYS, AggTypeAction } from './agg_params_state';
 
 interface DefaultEditorAggSelectProps {
   aggError?: string;
-  aggTypeOptions: ComboBoxGroupedOptions<AggType>;
+  aggTypeOptions: ComboBoxGroupedOptions<IAggType>;
   id: string;
   indexPattern: IndexPattern;
   showValidation: boolean;
   isSubAggregation: boolean;
-  value: AggType;
+  value: IAggType;
   onChangeAggType: React.Dispatch<AggTypeAction>;
-  setValue: (aggType: AggType) => void;
+  setValue: (aggType: IAggType) => void;
 }
 
 function DefaultEditorAggSelect({
@@ -51,7 +51,7 @@ function DefaultEditorAggSelect({
   isSubAggregation,
   onChangeAggType,
 }: DefaultEditorAggSelectProps) {
-  const selectedOptions: ComboBoxGroupedOptions<AggType> = value
+  const selectedOptions: ComboBoxGroupedOptions<IAggType> = value
     ? [{ label: value.title, target: value }]
     : [];
 
@@ -104,7 +104,7 @@ function DefaultEditorAggSelect({
     (options: EuiComboBoxOptionProps[]) => {
       const selectedOption = get(options, '0.target');
       if (selectedOption) {
-        setValue(selectedOption as AggType);
+        setValue(selectedOption as IAggType);
       }
     },
     [setValue]
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_control_props.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_control_props.tsx
index c8b5196d3b299..7f04b851902de 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_control_props.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_control_props.tsx
@@ -18,11 +18,11 @@
  */
 
 import { VisParams } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 import { DefaultEditorAggCommonProps } from '../agg_common_props';
 
 export interface AggControlProps {
-  agg: AggConfig;
+  agg: IAggConfig;
   editorStateParams: VisParams;
   setAggParamValue: DefaultEditorAggCommonProps['setAggParamValue'];
   setStateParamValue: DefaultEditorAggCommonProps['setStateParamValue'];
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_utils.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_utils.test.tsx
index 5c69fd0f1c091..0b847e3747b30 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_utils.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/agg_utils.test.tsx
@@ -20,7 +20,7 @@
 import React, { FunctionComponent } from 'react';
 import { mount, ReactWrapper } from 'enzyme';
 
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 import {
   safeMakeLabel,
   useAvailableOptions,
@@ -57,7 +57,7 @@ const metricAggs = [
       return 'avg';
     },
   },
-] as AggConfig[];
+] as IAggConfig[];
 
 const incompatibleAggs = [
   {
@@ -74,7 +74,7 @@ const incompatibleAggs = [
       return 'percentiles';
     },
   },
-] as AggConfig[];
+] as IAggConfig[];
 const aggFilter = ['!top_hits', '!percentiles'];
 
 describe('Aggregations utils', () => {
@@ -222,7 +222,7 @@ describe('Aggregations utils', () => {
     });
 
     test('should not fail and return a safety string if makeLabel func is not exist', () => {
-      const label = safeMakeLabel({} as AggConfig);
+      const label = safeMakeLabel({} as IAggConfig);
 
       expect(label).toEqual(expect.any(String));
     });
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
index e43304fe07347..636ef8f872d0e 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
@@ -26,7 +26,7 @@ import { Field } from 'src/plugins/data/public';
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { ComboBoxGroupedOptions } from '../../utils';
 import { FieldParamEditor, FieldParamEditorProps } from './field';
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 
 function callComboBoxOnChange(comp: ReactWrapper, value: any = []) {
   const comboBoxProps: EuiComboBoxProps<string> = comp.find(EuiComboBox).props();
@@ -64,7 +64,7 @@ describe('FieldParamEditor component', () => {
     ];
 
     defaultProps = {
-      agg: {} as AggConfig,
+      agg: {} as IAggConfig,
       aggParam: {
         name: 'field',
         type: 'field',
@@ -80,7 +80,7 @@ describe('FieldParamEditor component', () => {
       setValidity,
       setTouched,
       state: {} as VisState,
-      metricAggs: [] as AggConfig[],
+      metricAggs: [] as IAggConfig[],
     };
   });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.tsx
index 38c55e8fe3f24..f374353afabec 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.tsx
@@ -24,7 +24,7 @@ import { EuiComboBox, EuiComboBoxOptionProps, EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { Field } from 'src/plugins/data/public';
-import { AggConfig, AggParam, FieldParamType } from '../../legacy_imports';
+import { AggParam, IAggConfig, IFieldParamType } from '../../legacy_imports';
 import { formatListAsProse, parseCommaSeparatedList, useValidation } from './utils';
 import { AggParamEditorProps } from '../agg_param_props';
 import { ComboBoxGroupedOptions } from '../../utils';
@@ -126,9 +126,10 @@ function FieldParamEditor({
   );
 }
 
-function getFieldTypesString(agg: AggConfig) {
+function getFieldTypesString(agg: IAggConfig) {
   const param =
-    get(agg, 'type.params', []).find((p: AggParam) => p.name === 'field') || ({} as FieldParamType);
+    get(agg, 'type.params', []).find((p: AggParam) => p.name === 'field') ||
+    ({} as IFieldParamType);
   return formatListAsProse(parseCommaSeparatedList(param.filterFieldTypes), { inclusive: false });
 }
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/filter.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/filter.tsx
index 38c5b552553ae..3622b27bad403 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/filter.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/filter.tsx
@@ -22,7 +22,7 @@ import { EuiForm, EuiButtonIcon, EuiFieldText, EuiFormRow, EuiSpacer } from '@el
 import { i18n } from '@kbn/i18n';
 
 import { Query, QueryStringInput } from '../../../../../../plugins/data/public';
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 
 interface FilterRowProps {
   id: string;
@@ -34,7 +34,7 @@ interface FilterRowProps {
   dataTestSubj: string;
   onChangeValue(id: string, query: Query, label: string): void;
   onRemoveFilter(id: string): void;
-  agg: AggConfig;
+  agg: IAggConfig;
 }
 
 function FilterRow({
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/metric_agg.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/metric_agg.test.tsx
index 9b6fd204e7207..cf7af1aa5cb3a 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/metric_agg.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/metric_agg.test.tsx
@@ -20,7 +20,7 @@
 import React from 'react';
 import { mount, shallow } from 'enzyme';
 
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 import { DEFAULT_OPTIONS, aggFilter, MetricAggParamEditor } from './metric_agg';
 
 jest.mock('./utils', () => ({
@@ -44,7 +44,7 @@ const agg = {
   makeLabel() {
     return 'cumulative_sum';
   },
-} as AggConfig;
+} as IAggConfig;
 
 const metricAggs = [
   agg,
@@ -69,7 +69,7 @@ const metricAggs = [
       return 'max';
     },
   },
-] as AggConfig[];
+] as IAggConfig[];
 
 describe('MetricAggParamEditor', () => {
   let defaultProps: Partial<AggParamEditorProps<string>>;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/order_agg.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/order_agg.tsx
index 6bb9ad334d149..10679b578d54e 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/order_agg.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/order_agg.tsx
@@ -20,7 +20,7 @@
 import React, { useEffect } from 'react';
 import { EuiSpacer } from '@elastic/eui';
 
-import { AggParamType, AggConfig, AggGroupNames } from '../../legacy_imports';
+import { AggParamType, IAggConfig, AggGroupNames } from '../../legacy_imports';
 import { useSubAggParamsHandlers } from './utils';
 import { AggParamEditorProps } from '../agg_param_props';
 import { DefaultEditorAggParams } from '../agg_params';
@@ -35,7 +35,7 @@ function OrderAggParamEditor({
   setValue,
   setValidity,
   setTouched,
-}: AggParamEditorProps<AggConfig, AggParamType>) {
+}: AggParamEditorProps<IAggConfig, AggParamType>) {
   const orderBy = agg.params.orderBy;
 
   useEffect(() => {
@@ -51,7 +51,7 @@ function OrderAggParamEditor({
   const { onAggTypeChange, setAggParamValue } = useSubAggParamsHandlers(
     agg,
     aggParam,
-    value as AggConfig,
+    value as IAggConfig,
     setValue
   );
 
@@ -63,7 +63,7 @@ function OrderAggParamEditor({
     <>
       <EuiSpacer size="m" />
       <DefaultEditorAggParams
-        agg={value as AggConfig}
+        agg={value as IAggConfig}
         groupName={AggGroupNames.Metrics}
         className="visEditorAgg__subAgg"
         formIsTouched={formIsTouched}
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_agg.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_agg.tsx
index 71a8294541bbd..5dc28b59a52b3 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_agg.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_agg.tsx
@@ -20,7 +20,7 @@
 import React, { useEffect } from 'react';
 import { EuiSpacer } from '@elastic/eui';
 
-import { AggParamType, AggConfig, AggGroupNames } from '../../legacy_imports';
+import { AggParamType, IAggConfig, AggGroupNames } from '../../legacy_imports';
 import { useSubAggParamsHandlers } from './utils';
 import { AggParamEditorProps } from '../agg_param_props';
 import { DefaultEditorAggParams } from '../agg_params';
@@ -35,7 +35,7 @@ function SubAggParamEditor({
   setValue,
   setValidity,
   setTouched,
-}: AggParamEditorProps<AggConfig, AggParamType>) {
+}: AggParamEditorProps<IAggConfig, AggParamType>) {
   useEffect(() => {
     // we aren't creating a custom aggConfig
     if (agg.params.metricAgg !== 'custom') {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_metric.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_metric.tsx
index 9898d943870bc..45ff0610d88ed 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_metric.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/sub_metric.tsx
@@ -21,7 +21,7 @@ import React, { useEffect } from 'react';
 import { EuiFormLabel, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { AggParamType, AggConfig, AggGroupNames } from '../../legacy_imports';
+import { AggParamType, IAggConfig, AggGroupNames } from '../../legacy_imports';
 import { useSubAggParamsHandlers } from './utils';
 import { AggParamEditorProps } from '../agg_param_props';
 import { DefaultEditorAggParams } from '../agg_params';
@@ -35,7 +35,7 @@ function SubMetricParamEditor({
   setValue,
   setValidity,
   setTouched,
-}: AggParamEditorProps<AggConfig, AggParamType>) {
+}: AggParamEditorProps<IAggConfig, AggParamType>) {
   const metricTitle = i18n.translate('visDefaultEditor.controls.metrics.metricTitle', {
     defaultMessage: 'Metric',
   });
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts b/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
index 4e811f4543412..4280f85c901d7 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
@@ -18,14 +18,15 @@
  */
 
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfig, AggParam, EditorConfig } from '../../legacy_imports';
+import { IAggConfig, AggParam } from '../../legacy_imports';
+import { EditorConfig } from '../utils';
 
 export const aggParamCommonPropsMock = {
-  agg: {} as AggConfig,
+  agg: {} as IAggConfig,
   aggParam: {} as AggParam,
   editorConfig: {} as EditorConfig,
   formIsTouched: false,
-  metricAggs: [] as AggConfig[],
+  metricAggs: [] as IAggConfig[],
   state: {} as VisState,
   showValidation: false,
 };
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/time_interval.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/time_interval.tsx
index 6168890c2f2da..5da0d6462a8ba 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/time_interval.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/time_interval.tsx
@@ -107,7 +107,7 @@ function TimeIntervalParamEditor({
 
   const onChange = (opts: EuiComboBoxOptionProps[]) => {
     const selectedOpt: ComboBoxOption = get(opts, '0');
-    setValue(selectedOpt ? selectedOpt.key : selectedOpt);
+    setValue(selectedOpt ? selectedOpt.key : '');
 
     if (selectedOpt) {
       agg.write();
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.test.tsx
index b0c3fe00606aa..4ce0712040bd5 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.test.tsx
@@ -25,10 +25,10 @@ import {
   TopAggregateParamEditorProps,
 } from './top_aggregate';
 import { aggParamCommonPropsMock } from './test_utils';
-import { AggConfig } from '../../legacy_imports';
+import { IAggConfig } from '../../legacy_imports';
 
 describe('TopAggregateParamEditor', () => {
-  let agg: AggConfig;
+  let agg: IAggConfig;
   let aggParam: any;
   let defaultProps: TopAggregateParamEditorProps;
   let options: AggregateValueProp[];
@@ -37,17 +37,17 @@ describe('TopAggregateParamEditor', () => {
     options = [
       {
         text: 'Min',
-        isCompatible: jest.fn((aggr: AggConfig) => aggr.params.field.type === 'number'),
+        isCompatible: jest.fn((aggr: IAggConfig) => aggr.params.field.type === 'number'),
         value: 'min',
       },
       {
         text: 'Max',
-        isCompatible: jest.fn((aggr: AggConfig) => aggr.params.field.type === 'number'),
+        isCompatible: jest.fn((aggr: IAggConfig) => aggr.params.field.type === 'number'),
         value: 'max',
       },
       {
         text: 'Average',
-        isCompatible: jest.fn((aggr: AggConfig) => aggr.params.field.type === 'string'),
+        isCompatible: jest.fn((aggr: IAggConfig) => aggr.params.field.type === 'string'),
         value: 'average',
       },
     ];
@@ -69,7 +69,7 @@ describe('TopAggregateParamEditor', () => {
         },
       },
       getAggParams: jest.fn(() => [{ name: 'aggregate', options }]),
-    } as any) as AggConfig;
+    } as any) as IAggConfig;
     defaultProps = {
       ...aggParamCommonPropsMock,
       agg,
@@ -150,7 +150,7 @@ describe('TopAggregateParamEditor', () => {
           type: 'string',
         },
       },
-    } as AggConfig;
+    } as IAggConfig;
 
     comp.setProps({ agg });
 
@@ -165,7 +165,7 @@ describe('TopAggregateParamEditor', () => {
           type: 'date',
         },
       },
-    } as AggConfig;
+    } as IAggConfig;
 
     comp.setProps({ agg });
 
@@ -179,7 +179,7 @@ describe('TopAggregateParamEditor', () => {
           type: 'string',
         },
       },
-    } as AggConfig;
+    } as IAggConfig;
 
     comp.setProps({ agg, value: undefined });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.tsx
index 338e2fe463a80..346dfc0156f07 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/top_aggregate.tsx
@@ -23,7 +23,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import {
-  AggConfig,
+  IAggConfig,
   AggParam,
   OptionedValueProp,
   OptionedParamEditorProps,
@@ -32,13 +32,13 @@ import {
 import { AggParamEditorProps } from '../agg_param_props';
 
 export interface AggregateValueProp extends OptionedValueProp {
-  isCompatible(aggConfig: AggConfig): boolean;
+  isCompatible(aggConfig: IAggConfig): boolean;
 }
 
 export type TopAggregateParamEditorProps = AggParamEditorProps<AggregateValueProp> &
   OptionedParamEditorProps<AggregateValueProp>;
 
-export function getCompatibleAggs(agg: AggConfig): AggregateValueProp[] {
+export function getCompatibleAggs(agg: IAggConfig): AggregateValueProp[] {
   const { options = [] } = agg
     .getAggParams()
     .find(({ name }: AggParam) => name === 'aggregate') as OptionedParamType;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/agg_utils.ts b/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/agg_utils.ts
index 4c8ba23e63268..8aeae488942cd 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/agg_utils.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/agg_utils.ts
@@ -20,7 +20,7 @@
 import { useEffect, useCallback, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 
-import { AggConfig } from '../../../legacy_imports';
+import { IAggConfig } from '../../../legacy_imports';
 
 type AggFilter = string[];
 
@@ -43,7 +43,7 @@ function useCompatibleAggCallback(aggFilter: AggFilter) {
 function useFallbackMetric(
   setValue: (value?: string) => void,
   aggFilter: AggFilter,
-  metricAggs?: AggConfig[],
+  metricAggs?: IAggConfig[],
   value?: string,
   fallbackValue?: string
 ) {
@@ -69,7 +69,7 @@ function useFallbackMetric(
  */
 function useAvailableOptions(
   aggFilter: AggFilter,
-  metricAggs: AggConfig[] = [],
+  metricAggs: IAggConfig[] = [],
   defaultOptions: Array<{ text: string; value: string }> = []
 ) {
   const isCompatibleAgg = useCompatibleAggCallback(aggFilter);
@@ -107,7 +107,7 @@ function useValidation(setValidity: (isValid: boolean) => void, isValid: boolean
   }, [isValid, setValidity]);
 }
 
-function safeMakeLabel(agg: AggConfig): string {
+function safeMakeLabel(agg: IAggConfig): string {
   try {
     return agg.makeLabel();
   } catch (e) {
@@ -118,7 +118,7 @@ function safeMakeLabel(agg: AggConfig): string {
 }
 
 function isCompatibleAggregation(aggFilter: string[]) {
-  return (agg: AggConfig) => {
+  return (agg: IAggConfig) => {
     return !aggFilter.includes(`!${agg.type.name}`);
   };
 }
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/use_handlers.ts b/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/use_handlers.ts
index c2da648edcf81..c7816d5a9d305 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/use_handlers.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/utils/use_handlers.ts
@@ -19,14 +19,14 @@
 
 import { useCallback } from 'react';
 
-import { AggConfig, AggParamType } from '../../../legacy_imports';
+import { IAggConfig, AggParamType } from '../../../legacy_imports';
 
-type SetValue = (value?: AggConfig) => void;
+type SetValue = (value?: IAggConfig) => void;
 
 function useSubAggParamsHandlers(
-  agg: AggConfig,
+  agg: IAggConfig,
   aggParam: AggParamType,
-  subAgg: AggConfig,
+  subAgg: IAggConfig,
   setValue: SetValue
 ) {
   const setAggParamValue = useCallback(
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
index c7597ef43dfa6..efd17f02a0e09 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
@@ -23,11 +23,11 @@ import { EuiSpacer } from '@elastic/eui';
 
 import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import {
-  AggConfig,
+  IAggConfig,
   AggGroupNames,
   ISchemas,
   parentPipelineType,
-  MetricAggType,
+  IMetricAggType,
 } from '../../legacy_imports';
 import { DefaultEditorAggGroup } from '../agg_group';
 import {
@@ -45,7 +45,7 @@ export interface DefaultEditorDataTabProps {
   dispatch: React.Dispatch<EditorAction>;
   formIsTouched: boolean;
   isTabSelected: boolean;
-  metricAggs: AggConfig[];
+  metricAggs: IAggConfig[];
   schemas: ISchemas;
   state: VisState;
   setTouched(isTouched: boolean): void;
@@ -67,7 +67,7 @@ function DefaultEditorDataTab({
     () =>
       findLast(
         metricAggs,
-        ({ type }: { type: MetricAggType }) => type.subtype === parentPipelineType
+        ({ type }: { type: IMetricAggType }) => type.subtype === parentPipelineType
       ),
     [metricAggs]
   );
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/actions.ts b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/actions.ts
index 5738916d2ff80..93fa1083bebf9 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/actions.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/actions.ts
@@ -18,7 +18,7 @@
  */
 
 import { Vis, VisParams } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfig, Schema } from '../../../legacy_imports';
+import { IAggConfig, Schema } from '../../../legacy_imports';
 import { EditorStateActionTypes } from './constants';
 
 export interface ActionType<T, P> {
@@ -26,14 +26,14 @@ export interface ActionType<T, P> {
   payload: P;
 }
 
-type AggId = AggConfig['id'];
-type AggParams = AggConfig['params'];
+type AggId = IAggConfig['id'];
+type AggParams = IAggConfig['params'];
 
 type AddNewAgg = ActionType<EditorStateActionTypes.ADD_NEW_AGG, { schema: Schema }>;
 type DiscardChanges = ActionType<EditorStateActionTypes.DISCARD_CHANGES, Vis>;
 type ChangeAggType = ActionType<
   EditorStateActionTypes.CHANGE_AGG_TYPE,
-  { aggId: AggId; value: AggConfig['type'] }
+  { aggId: AggId; value: IAggConfig['type'] }
 >;
 type SetAggParamValue<T extends AggParams = AggParams> = ActionType<
   EditorStateActionTypes.SET_AGG_PARAM_VALUE,
@@ -50,11 +50,11 @@ type SetStateParamValue<T extends keyof AggParams = keyof AggParams> = ActionTyp
 type RemoveAgg = ActionType<EditorStateActionTypes.REMOVE_AGG, { aggId: AggId }>;
 type ReorderAggs = ActionType<
   EditorStateActionTypes.REORDER_AGGS,
-  { sourceAgg: AggConfig; destinationAgg: AggConfig }
+  { sourceAgg: IAggConfig; destinationAgg: IAggConfig }
 >;
 type ToggleEnabledAgg = ActionType<
   EditorStateActionTypes.TOGGLE_ENABLED_AGG,
-  { aggId: AggId; enabled: AggConfig['enabled'] }
+  { aggId: AggId; enabled: IAggConfig['enabled'] }
 >;
 type UpdateStateParams = ActionType<
   EditorStateActionTypes.UPDATE_STATE_PARAMS,
@@ -75,7 +75,7 @@ export type EditorAction =
 export interface EditorActions {
   addNewAgg(schema: Schema): AddNewAgg;
   discardChanges(vis: Vis): DiscardChanges;
-  changeAggType(aggId: AggId, value: AggConfig['type']): ChangeAggType;
+  changeAggType(aggId: AggId, value: IAggConfig['type']): ChangeAggType;
   setAggParamValue<T extends keyof AggParams>(
     aggId: AggId,
     paramName: T,
@@ -86,8 +86,8 @@ export interface EditorActions {
     value: AggParams[T]
   ): SetStateParamValue<T>;
   removeAgg(aggId: AggId): RemoveAgg;
-  reorderAggs(sourceAgg: AggConfig, destinationAgg: AggConfig): ReorderAggs;
-  toggleEnabledAgg(aggId: AggId, enabled: AggConfig['enabled']): ToggleEnabledAgg;
+  reorderAggs(sourceAgg: IAggConfig, destinationAgg: IAggConfig): ReorderAggs;
+  toggleEnabledAgg(aggId: AggId, enabled: IAggConfig['enabled']): ToggleEnabledAgg;
   updateStateParams(params: VisParams): UpdateStateParams;
 }
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
index 8e1cfd6bc9c13..851263f0ed702 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
@@ -20,7 +20,7 @@
 import { cloneDeep } from 'lodash';
 
 import { Vis, VisState } from 'src/legacy/core_plugins/visualizations/public';
-import { AggConfigs, AggConfig, AggGroupNames, move } from '../../../legacy_imports';
+import { AggConfigs, IAggConfig, AggGroupNames, move } from '../../../legacy_imports';
 import { EditorStateActionTypes } from './constants';
 import { getEnabledMetricAggsCount } from '../../agg_group_helper';
 import { EditorAction } from './actions';
@@ -32,7 +32,7 @@ function initEditorState(vis: Vis) {
 function editorStateReducer(state: VisState, action: EditorAction): VisState {
   switch (action.type) {
     case EditorStateActionTypes.ADD_NEW_AGG: {
-      const aggConfig = state.aggs.createAggConfig(action.payload as AggConfig, {
+      const aggConfig = state.aggs.createAggConfig(action.payload as IAggConfig, {
         addToAggConfigs: false,
       });
       aggConfig.brandNew = true;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/utils/editor_config.ts b/src/legacy/core_plugins/vis_default_editor/public/components/utils/editor_config.ts
new file mode 100644
index 0000000000000..80a64b7289f8c
--- /dev/null
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/utils/editor_config.ts
@@ -0,0 +1,135 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { IndexPattern } from 'src/plugins/data/public';
+
+/**
+ * A hidden parameter can be hidden from the UI completely.
+ */
+interface Param {
+  hidden?: boolean;
+  help?: string;
+}
+
+/**
+ * A fixed parameter has a fixed value for a specific field.
+ * It can optionally also be hidden.
+ */
+export type FixedParam = Partial<Param> & {
+  fixedValue: any;
+};
+
+/**
+ * Numeric interval parameters must always be set in the editor to a multiple of
+ * the specified base. It can optionally also be hidden.
+ */
+export type NumericIntervalParam = Partial<Param> & {
+  base: number;
+};
+
+/**
+ * Time interval parameters must always be set in the editor to a multiple of
+ * the specified base. It can optionally also be hidden.
+ */
+export type TimeIntervalParam = Partial<Param> & {
+  default: string;
+  timeBase: string;
+};
+
+export type EditorParamConfig = NumericIntervalParam | TimeIntervalParam | FixedParam | Param;
+
+export interface EditorConfig {
+  [paramName: string]: EditorParamConfig;
+}
+
+export function getEditorConfig(
+  indexPattern: IndexPattern,
+  aggTypeName: string,
+  fieldName: string
+): EditorConfig {
+  const aggRestrictions = indexPattern.getAggregationRestrictions();
+
+  if (!aggRestrictions || !aggTypeName || !fieldName) {
+    return {};
+  }
+
+  // Exclude certain param options for terms:
+  // otherBucket, missingBucket, orderBy, orderAgg
+  if (aggTypeName === 'terms') {
+    return {
+      otherBucket: {
+        hidden: true,
+      },
+      missingBucket: {
+        hidden: true,
+      },
+    };
+  }
+
+  const fieldAgg = aggRestrictions[aggTypeName] && aggRestrictions[aggTypeName][fieldName];
+
+  if (!fieldAgg) {
+    return {};
+  }
+
+  // Set interval and base interval for histograms based on agg restrictions
+  if (aggTypeName === 'histogram') {
+    const interval = fieldAgg.interval;
+    return interval
+      ? {
+          intervalBase: {
+            fixedValue: interval,
+          },
+          interval: {
+            base: interval,
+            help: i18n.translate('visDefaultEditor.editorConfig.histogram.interval.helpText', {
+              defaultMessage: 'Must be a multiple of configuration interval: {interval}',
+              values: { interval },
+            }),
+          },
+        }
+      : {};
+  }
+
+  // Set date histogram time zone based on agg restrictions
+  if (aggTypeName === 'date_histogram') {
+    // Interval is deprecated on date_histogram rollups, but may still be present
+    // See https://github.com/elastic/kibana/pull/36310
+    const interval = fieldAgg.calendar_interval || fieldAgg.fixed_interval;
+    return {
+      useNormalizedEsInterval: {
+        fixedValue: false,
+      },
+      interval: {
+        default: interval,
+        timeBase: interval,
+        help: i18n.translate(
+          'visDefaultEditor.editorConfig.dateHistogram.customInterval.helpText',
+          {
+            defaultMessage: 'Must be a multiple of configuration interval: {interval}',
+            values: { interval },
+          }
+        ),
+      },
+    };
+  }
+
+  return {};
+}
diff --git a/src/legacy/ui/public/promises/index.d.ts b/src/legacy/core_plugins/vis_default_editor/public/components/utils/index.ts
similarity index 94%
rename from src/legacy/ui/public/promises/index.d.ts
rename to src/legacy/core_plugins/vis_default_editor/public/components/utils/index.ts
index aa81770056cc1..14570356103b1 100644
--- a/src/legacy/ui/public/promises/index.d.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/utils/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { PromiseService } from './promises';
+export * from './editor_config';
diff --git a/src/legacy/core_plugins/vis_default_editor/public/legacy_imports.ts b/src/legacy/core_plugins/vis_default_editor/public/legacy_imports.ts
index 5c617f3dc8681..b7fd6b1e9ebb6 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/legacy_imports.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/legacy_imports.ts
@@ -20,39 +20,36 @@
 /* `ui/agg_types` dependencies */
 export {
   AggType,
-  AggConfig,
+  IAggType,
+  IAggConfig,
   AggConfigs,
+  IAggConfigs,
   AggParam,
   AggGroupNames,
   aggGroupNamesMap,
   aggTypes,
   FieldParamType,
+  IFieldParamType,
   BUCKET_TYPES,
   METRIC_TYPES,
   ISchemas,
   Schema,
   termsAggFilter,
 } from 'ui/agg_types';
-export { aggTypeFilters, propFilter } from 'ui/agg_types/filter';
-export { aggTypeFieldFilters } from 'ui/agg_types/param_types/filter';
-export { AggParamType } from 'ui/agg_types/param_types/agg';
-export { MetricAggType } from 'ui/agg_types/metrics/metric_agg_type';
-export { parentPipelineType } from 'ui/agg_types/metrics/lib/parent_pipeline_agg_helper';
-export { siblingPipelineType } from 'ui/agg_types/metrics/lib/sibling_pipeline_agg_helper';
-export { isType, isStringType } from 'ui/agg_types/buckets/migrate_include_exclude_format';
-export {
-  OptionedValueProp,
-  OptionedParamEditorProps,
-  OptionedParamType,
-} from 'ui/agg_types/param_types/optioned';
-export { isValidJson, isValidInterval } from 'ui/agg_types/utils';
-export { AggParamOption } from 'ui/agg_types/agg_params';
-export { CidrMask } from 'ui/agg_types/buckets/lib/cidr_mask';
+export { aggTypeFilters, propFilter } from 'ui/agg_types';
+export { aggTypeFieldFilters } from 'ui/agg_types';
+export { AggParamType } from 'ui/agg_types';
+export { MetricAggType, IMetricAggType } from 'ui/agg_types';
+export { parentPipelineType } from 'ui/agg_types';
+export { siblingPipelineType } from 'ui/agg_types';
+export { isType, isStringType } from 'ui/agg_types';
+export { OptionedValueProp, OptionedParamEditorProps, OptionedParamType } from 'ui/agg_types';
+export { isValidJson, isValidInterval } from 'ui/agg_types';
+export { AggParamOption } from 'ui/agg_types';
+export { CidrMask } from 'ui/agg_types';
 
 export { PersistedState } from 'ui/persisted_state';
-export { IndexedArray } from 'ui/indexed_array';
 export { getDocLink } from 'ui/documentation_links';
 export { documentationLinks } from 'ui/documentation_links/documentation_links';
 export { move } from 'ui/utils/collection';
 export * from 'ui/vis/lib';
-export * from 'ui/vis/config';
diff --git a/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx b/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
index f51e359d99573..babcb59c6582e 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
@@ -17,11 +17,11 @@
  * under the License.
  */
 
-import { AggConfigs, PersistedState } from './legacy_imports';
+import { IAggConfigs, PersistedState } from './legacy_imports';
 import { Vis } from '../../visualizations/public';
 
 export interface VisOptionsProps<VisParamType = unknown> {
-  aggs: AggConfigs;
+  aggs: IAggConfigs;
   hasHistogramAgg: boolean;
   isTabSelected: boolean;
   stateParams: VisParamType;
diff --git a/src/legacy/core_plugins/vis_default_editor/public/vis_type_agg_filter.ts b/src/legacy/core_plugins/vis_default_editor/public/vis_type_agg_filter.ts
index c1832d5512817..60b675f50a342 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/vis_type_agg_filter.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/vis_type_agg_filter.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 import { IndexPattern } from 'src/plugins/data/public';
-import { AggType, AggConfig, aggTypeFilters, propFilter } from './legacy_imports';
+import { IAggType, IAggConfig, aggTypeFilters, propFilter } from './legacy_imports';
 
 const filterByName = propFilter('name');
 
@@ -25,7 +25,9 @@ const filterByName = propFilter('name');
  * This filter checks the defined aggFilter in the schemas of that visualization
  * and limits available aggregations based on that.
  */
-aggTypeFilters.addFilter((aggType: AggType, indexPatterns: IndexPattern, aggConfig: AggConfig) => {
-  const doesSchemaAllowAggType = filterByName([aggType], aggConfig.schema.aggFilter).length !== 0;
-  return doesSchemaAllowAggType;
-});
+aggTypeFilters.addFilter(
+  (aggType: IAggType, indexPatterns: IndexPattern, aggConfig: IAggConfig) => {
+    const doesSchemaAllowAggType = filterByName([aggType], aggConfig.schema.aggFilter).length !== 0;
+    return doesSchemaAllowAggType;
+  }
+);
diff --git a/src/legacy/core_plugins/vis_type_table/public/legacy_imports.ts b/src/legacy/core_plugins/vis_type_table/public/legacy_imports.ts
index 8a454957b7ab9..ed0a09e139b09 100644
--- a/src/legacy/core_plugins/vis_type_table/public/legacy_imports.ts
+++ b/src/legacy/core_plugins/vis_type_table/public/legacy_imports.ts
@@ -19,23 +19,19 @@
 
 export { npSetup, npStart } from 'ui/new_platform';
 export { getFormat } from 'ui/visualize/loader/pipeline_helpers/utilities';
-export { AggConfig, AggGroupNames, Schemas } from 'ui/agg_types';
-
-// @ts-ignore
-export { PrivateProvider } from 'ui/private/private';
+export { IAggConfig, AggGroupNames, Schemas } from 'ui/agg_types';
 // @ts-ignore
 export { PaginateDirectiveProvider } from 'ui/directives/paginate';
 // @ts-ignore
 export { PaginateControlsDirectiveProvider } from 'ui/directives/paginate';
 // @ts-ignore
-export { watchMultiDecorator } from 'ui/directives/watch_multi/watch_multi';
-
-// @ts-ignore
-export { KbnAccessibleClickProvider } from 'ui/accessibility/kbn_accessible_click';
-// @ts-ignore
 export { StateManagementConfigProvider } from 'ui/state_management/config_provider';
-export { configureAppAngularModule } from 'ui/legacy_compat';
-
 export { tabifyGetColumns } from 'ui/agg_response/tabify/_get_columns';
 // @ts-ignore
 export { tabifyAggResponse } from 'ui/agg_response/tabify';
+export {
+  configureAppAngularModule,
+  KbnAccessibleClickProvider,
+  PrivateProvider,
+  watchMultiDecorator,
+} from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts b/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
index 16181a3f70ff1..d8912975227bf 100644
--- a/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
+++ b/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
@@ -27,7 +27,7 @@ import './table_vis.mock';
 import StubIndexPattern from 'test_utils/stub_index_pattern';
 import { getAngularModule } from './get_inner_angular';
 import { initTableVisLegacyModule } from './table_vis_legacy_module';
-import { npStart, AggConfig, tabifyAggResponse } from './legacy_imports';
+import { npStart, IAggConfig, tabifyAggResponse } from './legacy_imports';
 import { tableVisTypeDefinition } from './table_vis_type';
 import { Vis } from '../../visualizations/public';
 import { setup as visualizationsSetup } from '../../visualizations/public/np_ready/public/legacy';
@@ -148,7 +148,7 @@ describe('Table Vis - Controller', () => {
 
   // basically a parameterized beforeEach
   function initController(vis: Vis) {
-    vis.aggs.aggs.forEach((agg: AggConfig, i: number) => {
+    vis.aggs.aggs.forEach((agg: IAggConfig, i: number) => {
       agg.id = 'agg_' + (i + 1);
     });
 
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/index_pattern.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/index_pattern.js
index de8469adfb8a7..f6530eb22332a 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/index_pattern.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/index_pattern.js
@@ -206,6 +206,7 @@ export const IndexPattern = ({ fields, prefix, onChange, disabled, model: _model
             })}
           >
             <EuiFieldText
+              data-test-subj="metricsIndexPatternInterval"
               isInvalid={!intervalValidation.isValid}
               disabled={disabled || isEntireTimeRangeActive(model, isTimeSeries)}
               onChange={handleTextChange(intervalName, AUTO_INTERVAL)}
@@ -222,6 +223,7 @@ export const IndexPattern = ({ fields, prefix, onChange, disabled, model: _model
             })}
           >
             <YesNo
+              data-test-subj="metricsDropLastBucket"
               value={model[dropBucketName]}
               name={dropBucketName}
               onChange={onChange}
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/yes_no.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/yes_no.js
index fa9b2aa6e45c1..59c0366e3b980 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/yes_no.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/yes_no.js
@@ -24,7 +24,7 @@ import { EuiRadio, htmlIdGenerator } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 export function YesNo(props) {
-  const { name, value, disabled } = props;
+  const { name, value, disabled, 'data-test-subj': dataTestSubj } = props;
   const handleChange = value => {
     const { name } = props;
     return () => {
@@ -38,6 +38,7 @@ export function YesNo(props) {
     <div>
       <EuiRadio
         id={htmlId('yes')}
+        data-test-subj={`${dataTestSubj}-yes`}
         label={
           <FormattedMessage
             id="visTypeTimeseries.yesButtonLabel"
@@ -55,6 +56,7 @@ export function YesNo(props) {
       &emsp;
       <EuiRadio
         id={htmlId('no')}
+        data-test-subj={`${dataTestSubj}-no`}
         label={
           <FormattedMessage
             id="visTypeTimeseries.noButtonLabel"
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
index 514b957765a99..944ed7e20d1f7 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
@@ -27,7 +27,7 @@ import { Positions } from '../../../utils/collections';
 import { ValueAxesPanel } from './value_axes_panel';
 import { CategoryAxisPanel } from './category_axis_panel';
 import { ChartTypes } from '../../../utils/collections';
-import { AggConfig, AggType } from '../../../legacy_imports';
+import { IAggConfig, IAggType } from '../../../legacy_imports';
 import { defaultValueAxisId, valueAxis, seriesParam, categoryAxis } from './mocks';
 
 jest.mock('ui/new_platform');
@@ -44,17 +44,17 @@ jest.mock('./value_axes_panel', () => ({
 const SERIES_PARAMS = 'seriesParams';
 const VALUE_AXES = 'valueAxes';
 
-const aggCount: AggConfig = {
+const aggCount: IAggConfig = {
   id: '1',
   type: { name: 'count' },
   makeLabel: () => 'Count',
-} as AggConfig;
+} as IAggConfig;
 
-const aggAverage: AggConfig = {
+const aggAverage: IAggConfig = {
   id: '2',
-  type: { name: 'average' } as AggType,
+  type: { name: 'average' } as IAggType,
   makeLabel: () => 'Average',
-} as AggConfig;
+} as IAggConfig;
 
 const createAggs = (aggs: any[]) => ({
   aggs,
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
index c4dcbfaa47265..cdc8996f3fdeb 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
@@ -21,7 +21,7 @@ import React, { useState, useEffect, useCallback, useMemo } from 'react';
 import { cloneDeep, uniq, get } from 'lodash';
 import { EuiSpacer } from '@elastic/eui';
 
-import { AggConfig } from '../../../legacy_imports';
+import { IAggConfig } from '../../../legacy_imports';
 import { BasicVislibParams, ValueAxis, SeriesParam, Axis } from '../../../types';
 import { ValidationVisOptionsProps } from '../../common';
 import { SeriesPanel } from './series_panel';
@@ -99,7 +99,7 @@ function MetricsAxisOptions(props: ValidationVisOptionsProps<BasicVislibParams>)
 
     stateParams.valueAxes.forEach((axis, axisNumber) => {
       let newCustomLabel = '';
-      const matchingSeries: AggConfig[] = [];
+      const matchingSeries: IAggConfig[] = [];
 
       series.forEach((serie, seriesIndex) => {
         if ((axisNumber === 0 && !serie.valueAxis) || serie.valueAxis === axis.id) {
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/legacy_imports.ts b/src/legacy/core_plugins/vis_type_vislib/public/legacy_imports.ts
index df7278f2b761f..50a91df01de7c 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/legacy_imports.ts
+++ b/src/legacy/core_plugins/vis_type_vislib/public/legacy_imports.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-export { AggType, AggConfig, AggGroupNames, Schemas } from 'ui/agg_types';
+export { AggType, AggGroupNames, IAggConfig, IAggType, Schemas } from 'ui/agg_types';
 // @ts-ignore
 export { SimpleEmitter } from 'ui/utils/simple_emitter';
 // @ts-ignore
diff --git a/src/legacy/core_plugins/visualizations/public/embeddable/query_geohash_bounds.ts b/src/legacy/core_plugins/visualizations/public/embeddable/query_geohash_bounds.ts
index 46ade8ce465c0..719d69e21a826 100644
--- a/src/legacy/core_plugins/visualizations/public/embeddable/query_geohash_bounds.ts
+++ b/src/legacy/core_plugins/visualizations/public/embeddable/query_geohash_bounds.ts
@@ -21,7 +21,7 @@ import { i18n } from '@kbn/i18n';
 import { get } from 'lodash';
 import { toastNotifications } from 'ui/notify';
 
-import { AggConfig } from 'ui/agg_types';
+import { IAggConfig } from 'ui/agg_types';
 import { timefilter } from 'ui/timefilter';
 import { Vis } from '../np_ready/public';
 import { esFilters, Query, SearchSource, ISearchSource } from '../../../../../plugins/data/public';
@@ -42,7 +42,7 @@ interface QueryGeohashBoundsParams {
  * TODO: Remove this as a part of elastic/kibana#30593
  */
 export async function queryGeohashBounds(vis: Vis, params: QueryGeohashBoundsParams) {
-  const agg = vis.getAggConfig().aggs.find((a: AggConfig) => {
+  const agg = vis.getAggConfig().aggs.find((a: IAggConfig) => {
     return get(a, 'type.dslName') === 'geohash_grid';
   });
 
diff --git a/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx b/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
index e5836c1372068..03471174753fa 100644
--- a/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
+++ b/src/legacy/core_plugins/visualizations/public/embeddable/visualize_embeddable_factory.tsx
@@ -20,31 +20,24 @@
 import { i18n } from '@kbn/i18n';
 import { SavedObjectAttributes } from 'kibana/public';
 import {
-  EmbeddableFactory,
-  ErrorEmbeddable,
   Container,
+  EmbeddableFactory,
   EmbeddableOutput,
+  ErrorEmbeddable,
 } from '../../../../../plugins/embeddable/public';
-import { showNewVisModal } from '../../../kibana/public/visualize';
 import { SavedVisualizations } from '../../../kibana/public/visualize/np_ready/types';
 import { DisabledLabEmbeddable } from './disabled_lab_embeddable';
 import { getIndexPattern } from './get_index_pattern';
 import {
+  VisSavedObject,
   VisualizeEmbeddable,
   VisualizeInput,
   VisualizeOutput,
-  VisSavedObject,
 } from './visualize_embeddable';
 import { VISUALIZE_EMBEDDABLE_TYPE } from './constants';
 
-import {
-  getUISettings,
-  getCapabilities,
-  getHttp,
-  getTypes,
-  getSavedObjects,
-  getUsageCollector,
-} from '../np_ready/public/services';
+import { getCapabilities, getHttp, getTypes, getUISettings } from '../np_ready/public/services';
+import { showNewVisModal } from '../np_ready/public/wizard';
 
 interface VisualizationAttributes extends SavedObjectAttributes {
   visState: string;
@@ -157,16 +150,9 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory<
   public async create() {
     // TODO: This is a bit of a hack to preserve the original functionality. Ideally we will clean this up
     // to allow for in place creation of visualizations without having to navigate away to a new URL.
-    showNewVisModal(
-      getTypes(),
-      {
-        editorParams: ['addToDashboard'],
-      },
-      getHttp().basePath.prepend,
-      getUISettings(),
-      getSavedObjects(),
-      getUsageCollector()
-    );
+    showNewVisModal({
+      editorParams: ['addToDashboard'],
+    });
     return undefined;
   }
 }
diff --git a/src/legacy/core_plugins/visualizations/public/index.scss b/src/legacy/core_plugins/visualizations/public/index.scss
index 957d06be4daf0..748945eabd331 100644
--- a/src/legacy/core_plugins/visualizations/public/index.scss
+++ b/src/legacy/core_plugins/visualizations/public/index.scss
@@ -1,3 +1,4 @@
 @import 'src/legacy/ui/public/styles/styling_constants';
 
-@import './embeddable/_index';
+@import './embeddable/index';
+@import './np_ready/public/index';
diff --git a/src/legacy/core_plugins/visualizations/public/legacy_imports.ts b/src/legacy/core_plugins/visualizations/public/legacy_imports.ts
index 3088c4e67a3b7..5cff588d951b0 100644
--- a/src/legacy/core_plugins/visualizations/public/legacy_imports.ts
+++ b/src/legacy/core_plugins/visualizations/public/legacy_imports.ts
@@ -18,12 +18,13 @@
  */
 
 export { PersistedState } from '../../../ui/public/persisted_state';
-export { AggConfig } from '../../../ui/public/agg_types/agg_config';
-export { AggConfigs } from '../../../ui/public/agg_types/agg_configs';
 export {
+  AggConfigs,
+  IAggConfig,
+  IAggConfigs,
   isDateHistogramBucketAggConfig,
   setBounds,
-} from '../../../ui/public/agg_types/buckets/date_histogram';
+} from '../../../ui/public/agg_types';
 export { createFormat } from '../../../ui/public/visualize/loader/pipeline_helpers/utilities';
 export { I18nContext } from '../../../ui/public/i18n';
 import chrome from '../../../ui/public/chrome';
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/_index.scss b/src/legacy/core_plugins/visualizations/public/np_ready/public/_index.scss
new file mode 100644
index 0000000000000..d87b6b004a511
--- /dev/null
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/_index.scss
@@ -0,0 +1 @@
+@import 'wizard/index';
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
index e733bad2c0127..d1017de35474a 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
@@ -27,11 +27,11 @@ import {
   Schemas,
 } from './build_pipeline';
 import { Vis, VisState } from '..';
-import { AggConfig } from '../../../legacy_imports';
+import { IAggConfig } from '../../../legacy_imports';
 import { searchSourceMock } from '../../../legacy_mocks';
 
 jest.mock('ui/new_platform');
-jest.mock('ui/agg_types/buckets/date_histogram', () => ({
+jest.mock('ui/agg_types', () => ({
   setBounds: () => {},
   dateHistogramBucketAgg: () => {},
   isDateHistogramBucketAggConfig: () => true,
@@ -367,7 +367,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
   });
 
   describe('buildVislibDimensions', () => {
-    let aggs: AggConfig[];
+    let aggs: IAggConfig[];
     let visState: any;
     let vis: Vis;
     let params: any;
@@ -385,7 +385,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
             name: 'metric',
           },
           params: {},
-        } as AggConfig,
+        } as IAggConfig,
       ];
 
       params = {
@@ -453,7 +453,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
 
       it('with two numeric metrics, mixed normal and percent mode should have corresponding formatters', async () => {
         const aggConfig = aggs[0];
-        aggs = [{ ...aggConfig } as AggConfig, { ...aggConfig, id: '5' } as AggConfig];
+        aggs = [{ ...aggConfig } as IAggConfig, { ...aggConfig, id: '5' } as IAggConfig];
 
         visState = {
           params: {
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
index 6749a44b4d5b3..04a296a888e87 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
@@ -23,7 +23,7 @@ import moment from 'moment';
 import { SerializedFieldFormat } from 'src/plugins/expressions/public';
 import { ISearchSource } from 'src/plugins/data/public';
 import {
-  AggConfig,
+  IAggConfig,
   setBounds,
   isDateHistogramBucketAggConfig,
   createFormat,
@@ -85,7 +85,7 @@ const vislibCharts: string[] = [
 ];
 
 export const getSchemas = (vis: Vis, timeRange?: any): Schemas => {
-  const createSchemaConfig = (accessor: number, agg: AggConfig): SchemaConfig => {
+  const createSchemaConfig = (accessor: number, agg: IAggConfig): SchemaConfig => {
     if (isDateHistogramBucketAggConfig(agg)) {
       agg.params.timeRange = timeRange;
       setBounds(agg, true);
@@ -130,10 +130,10 @@ export const getSchemas = (vis: Vis, timeRange?: any): Schemas => {
   const schemas: Schemas = {
     metric: [],
   };
-  const responseAggs = vis.aggs.getResponseAggs().filter((agg: AggConfig) => agg.enabled);
+  const responseAggs = vis.aggs.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
   const isHierarchical = vis.isHierarchical();
-  const metrics = responseAggs.filter((agg: AggConfig) => agg.type.type === 'metrics');
-  responseAggs.forEach((agg: AggConfig) => {
+  const metrics = responseAggs.filter((agg: IAggConfig) => agg.type.type === 'metrics');
+  responseAggs.forEach((agg: IAggConfig) => {
     let skipMetrics = false;
     let schemaName = agg.schema ? agg.schema.name || agg.schema : null;
     if (typeof schemaName === 'object') {
@@ -224,7 +224,7 @@ export const prepareDimension = (variable: string, data: any) => {
 const adjustVislibDimensionFormmaters = (vis: Vis, dimensions: { y: any[] }): void => {
   const visState = vis.getCurrentState();
   const visConfig = visState.params;
-  const responseAggs = vis.aggs.getResponseAggs().filter((agg: AggConfig) => agg.enabled);
+  const responseAggs = vis.aggs.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
 
   (dimensions.y || []).forEach(yDimension => {
     const yAgg = responseAggs[yDimension.accessor];
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
index fc85970b906ae..1063b1718b851 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
@@ -48,6 +48,7 @@ const createStartContract = (): VisualizationsStart => ({
     getAliases: jest.fn(),
   },
   getSavedVisualizationsLoader: jest.fn(),
+  showNewVisModal: jest.fn(),
 });
 
 const createInstance = async () => {
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
index 01059044b98c2..cbbeb7ff980a6 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
@@ -43,6 +43,7 @@ import {
   SavedObjectKibanaServicesWithVisualizations,
 } from '../../saved_visualizations';
 import { SavedVisualizations } from '../../../../kibana/public/visualize/np_ready/types';
+import { showNewVisModal } from './wizard';
 /**
  * Interface for this plugin's returned setup/start contracts.
  *
@@ -55,6 +56,7 @@ export interface VisualizationsSetup {
 export interface VisualizationsStart {
   types: TypesStart;
   getSavedVisualizationsLoader: () => SavedVisualizations;
+  showNewVisModal: typeof showNewVisModal;
 }
 
 export interface VisualizationsSetupDeps {
@@ -92,7 +94,7 @@ export class VisualizationsPlugin
   public setup(
     core: CoreSetup,
     { expressions, embeddable, usageCollection }: VisualizationsSetupDeps
-  ) {
+  ): VisualizationsSetup {
     setUISettings(core.uiSettings);
     setUsageCollector(usageCollection);
 
@@ -107,7 +109,7 @@ export class VisualizationsPlugin
     };
   }
 
-  public start(core: CoreStart, { data }: VisualizationsStartDeps) {
+  public start(core: CoreStart, { data }: VisualizationsStartDeps): VisualizationsStart {
     const types = this.types.start();
     setI18n(core.i18n);
     setTypes(types);
@@ -128,6 +130,7 @@ export class VisualizationsPlugin
     return {
       types,
       getSavedVisualizationsLoader: () => this.getSavedVisualizationsLoader(),
+      showNewVisModal,
     };
   }
 
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.d.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.d.ts
index 6e6a2174d6ad1..71bf9bcf983ff 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.d.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.d.ts
@@ -18,7 +18,7 @@
  */
 
 import { VisType } from './types';
-import { AggConfigs } from '../../legacy_imports';
+import { IAggConfigs } from '../../legacy_imports';
 import { Status } from './legacy/update_status';
 
 export interface Vis {
@@ -39,7 +39,7 @@ export interface VisState {
   title: string;
   type: VisType;
   params: VisParams;
-  aggs: AggConfigs;
+  aggs: IAggConfigs;
 }
 
 export declare class VisualizationController {
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.js b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.js
index 4f1526c20cb6f..0c2e5012df439 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.js
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.js
@@ -21,7 +21,7 @@
  * @name Vis
  *
  * @description This class consists of aggs, params, listeners, title, and type.
- *  - Aggs: Instances of AggConfig.
+ *  - Aggs: Instances of IAggConfig.
  *  - Params: The settings in the Options tab.
  *
  * Not to be confused with vislib/vis.js.
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/__snapshots__/new_vis_modal.test.tsx.snap b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
similarity index 99%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/__snapshots__/new_vis_modal.test.tsx.snap
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
index 2dcf3ed0ea06f..b1c9e37218c58 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/__snapshots__/new_vis_modal.test.tsx.snap
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/__snapshots__/new_vis_modal.test.tsx.snap
@@ -1154,7 +1154,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                           >
                             <FormattedMessage
                               defaultMessage="New Visualization"
-                              id="kbn.visualize.newVisWizard.title"
+                              id="visualizations.newVisWizard.title"
                               values={Object {}}
                             >
                               New Visualization
@@ -1344,7 +1344,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                         >
                                           <FormattedMessage
                                             defaultMessage="{resultCount} {resultCount, plural, one {type} other {types} } found"
-                                            id="kbn.visualize.newVisWizard.resultsFound"
+                                            id="visualizations.newVisWizard.resultsFound"
                                             values={
                                               Object {
                                                 "resultCount": 2,
@@ -1693,7 +1693,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                 >
                                   <FormattedMessage
                                     defaultMessage="Select a visualization type"
-                                    id="kbn.visualize.newVisWizard.selectVisType"
+                                    id="visualizations.newVisWizard.selectVisType"
                                     values={Object {}}
                                   >
                                     Select a visualization type
@@ -1718,7 +1718,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
                                     <p>
                                       <FormattedMessage
                                         defaultMessage="Start creating your visualization by selecting a type for that visualization."
-                                        id="kbn.visualize.newVisWizard.helpText"
+                                        id="visualizations.newVisWizard.helpText"
                                         values={Object {}}
                                       >
                                         Start creating your visualization by selecting a type for that visualization.
@@ -2844,7 +2844,7 @@ exports[`NewVisModal should render as expected 1`] = `
                           >
                             <FormattedMessage
                               defaultMessage="New Visualization"
-                              id="kbn.visualize.newVisWizard.title"
+                              id="visualizations.newVisWizard.title"
                               values={Object {}}
                             >
                               New Visualization
@@ -3317,7 +3317,7 @@ exports[`NewVisModal should render as expected 1`] = `
                                 >
                                   <FormattedMessage
                                     defaultMessage="Select a visualization type"
-                                    id="kbn.visualize.newVisWizard.selectVisType"
+                                    id="visualizations.newVisWizard.selectVisType"
                                     values={Object {}}
                                   >
                                     Select a visualization type
@@ -3342,7 +3342,7 @@ exports[`NewVisModal should render as expected 1`] = `
                                     <p>
                                       <FormattedMessage
                                         defaultMessage="Start creating your visualization by selecting a type for that visualization."
-                                        id="kbn.visualize.newVisWizard.helpText"
+                                        id="visualizations.newVisWizard.helpText"
                                         values={Object {}}
                                       >
                                         Start creating your visualization by selecting a type for that visualization.
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/_dialog.scss b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/_dialog.scss
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/_dialog.scss
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/_dialog.scss
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/_index.scss b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/_index.scss
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/_index.scss
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/_index.scss
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/index.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/index.ts
similarity index 94%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/index.ts
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/index.ts
index 7a3fc63af5259..55ac9ddfb5ca8 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/index.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/index.ts
@@ -17,5 +17,4 @@
  * under the License.
  */
 
-export { NewVisModal } from './new_vis_modal';
 export { showNewVisModal } from './show_new_vis';
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.test.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.test.tsx
similarity index 89%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.test.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.test.tsx
index 0ef1b711eafc8..58f7bc49d1cdb 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.test.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.test.tsx
@@ -19,15 +19,7 @@
 
 import React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-
-import { VisType } from '../../legacy_imports';
-import { TypesStart } from '../../../../../visualizations/public/np_ready/public/types';
-
-jest.mock('../../legacy_imports', () => ({
-  State: () => null,
-  AppState: () => null,
-}));
-
+import { TypesStart, VisType } from '../types';
 import { NewVisModal } from './new_vis_modal';
 import { SavedObjectsStart } from 'kibana/public';
 
@@ -163,6 +155,26 @@ describe('NewVisModal', () => {
       expect(window.location.assign).toBeCalledWith('testbasepath/aliasUrl?addToDashboard');
       expect(onClose).toHaveBeenCalled();
     });
+
+    it('closes and redirects properly if visualization with aliasUrl and without addToDashboard in editorParams', () => {
+      const onClose = jest.fn();
+      window.location.assign = jest.fn();
+      const wrapper = mountWithIntl(
+        <NewVisModal
+          isOpen={true}
+          onClose={onClose}
+          visTypesRegistry={visTypes}
+          editorParams={['foo=true', 'bar=42']}
+          addBasePath={addBasePath}
+          uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
+        />
+      );
+      const visButton = wrapper.find('button[data-test-subj="visType-visWithAliasUrl"]');
+      visButton.simulate('click');
+      expect(window.location.assign).toBeCalledWith('testbasepath/aliasUrl');
+      expect(onClose).toHaveBeenCalled();
+    });
   });
 
   describe('filter for visualization types', () => {
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.tsx
similarity index 93%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.tsx
index 082fc3bc36b6b..b39e8e8926707 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/new_vis_modal.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/new_vis_modal.tsx
@@ -24,14 +24,9 @@ import { i18n } from '@kbn/i18n';
 
 import { METRIC_TYPE, UiStatsMetricType } from '@kbn/analytics';
 import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
-import { VisType } from '../../legacy_imports';
-import { VisualizeConstants } from '../visualize_constants';
 import { SearchSelection } from './search_selection';
 import { TypeSelection } from './type_selection';
-import {
-  TypesStart,
-  VisTypeAlias,
-} from '../../../../../visualizations/public/np_ready/public/types';
+import { TypesStart, VisType, VisTypeAlias } from '../types';
 import { UsageCollectionSetup } from '../../../../../../../plugins/usage_collection/public';
 
 interface TypeSelectionProps {
@@ -50,7 +45,9 @@ interface TypeSelectionState {
   visType?: VisType;
 }
 
-const baseUrl = `#${VisualizeConstants.CREATE_PATH}?`;
+// TODO: redirect logic is specific to visualise & dashboard
+// but it is likely should be decoupled. e.g. handled by the container instead
+const baseUrl = `#/visualize/create?`;
 
 class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState> {
   public static defaultProps = {
@@ -82,7 +79,7 @@ class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState
     }
 
     const visNewVisDialogAriaLabel = i18n.translate(
-      'kbn.visualize.newVisWizard.helpTextAriaLabel',
+      'visualizations.newVisWizard.helpTextAriaLabel',
       {
         defaultMessage:
           'Start creating your visualization by selecting a type for that visualization. Hit escape to close this modal. Hit Tab key to go further.',
@@ -148,8 +145,8 @@ class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState
       params = this.props.addBasePath(visType.aliasUrl);
       if (this.props.editorParams && this.props.editorParams.includes('addToDashboard')) {
         params = `${params}?addToDashboard`;
-        this.props.onClose();
       }
+      this.props.onClose();
       window.location.assign(params);
       return;
     }
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/search_selection/index.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/search_selection/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/search_selection/index.ts
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/search_selection/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/search_selection/search_selection.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/search_selection/search_selection.tsx
similarity index 86%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/search_selection/search_selection.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/search_selection/search_selection.tsx
index 5cab85c11c3c7..9b3b8a6425e52 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/search_selection/search_selection.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/search_selection/search_selection.tsx
@@ -23,8 +23,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
 import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
 
-import { SavedObjectFinderUi } from '../../../../../../../../plugins/kibana_react/public';
-import { VisType } from '../../../legacy_imports';
+import { SavedObjectFinderUi } from '../../../../../../../../plugins/saved_objects/public';
+import { VisType } from '../../types';
 
 interface SearchSelectionProps {
   onSearchSelected: (searchId: string, searchType: string) => void;
@@ -42,13 +42,13 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
         <EuiModalHeader>
           <EuiModalHeaderTitle>
             <FormattedMessage
-              id="kbn.visualize.newVisWizard.newVisTypeTitle"
+              id="visualizations.newVisWizard.newVisTypeTitle"
               defaultMessage="New {visTypeName}"
               values={{ visTypeName: this.props.visType.title }}
             />{' '}
             /{' '}
             <FormattedMessage
-              id="kbn.visualize.newVisWizard.chooseSourceTitle"
+              id="visualizations.newVisWizard.chooseSourceTitle"
               defaultMessage="Choose a source"
             />
           </EuiModalHeaderTitle>
@@ -59,7 +59,7 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
             onChoose={this.props.onSearchSelected}
             showFilter
             noItemsMessage={i18n.translate(
-              'kbn.visualize.newVisWizard.searchSelection.notFoundLabel',
+              'visualizations.newVisWizard.searchSelection.notFoundLabel',
               {
                 defaultMessage: 'No matching indices or saved searches found.',
               }
@@ -69,7 +69,7 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
                 type: 'search',
                 getIconForSavedObject: () => 'search',
                 name: i18n.translate(
-                  'kbn.visualize.newVisWizard.searchSelection.savedObjectType.search',
+                  'visualizations.newVisWizard.searchSelection.savedObjectType.search',
                   {
                     defaultMessage: 'Saved search',
                   }
@@ -79,7 +79,7 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
                 type: 'index-pattern',
                 getIconForSavedObject: () => 'indexPatternApp',
                 name: i18n.translate(
-                  'kbn.visualize.newVisWizard.searchSelection.savedObjectType.indexPattern',
+                  'visualizations.newVisWizard.searchSelection.savedObjectType.indexPattern',
                   {
                     defaultMessage: 'Index pattern',
                   }
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/show_new_vis.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/show_new_vis.tsx
similarity index 63%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/show_new_vis.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/show_new_vis.tsx
index 567b7e861ad8e..a79c6ad98edf6 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/show_new_vis.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/show_new_vis.tsx
@@ -21,27 +21,25 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 
 import { I18nProvider } from '@kbn/i18n/react';
-import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
 import { NewVisModal } from './new_vis_modal';
-import { TypesStart } from '../../../../../visualizations/public/np_ready/public/types';
-import { UsageCollectionSetup } from '../../../../../../../plugins/usage_collection/public';
+import { getHttp, getSavedObjects, getTypes, getUISettings, getUsageCollector } from '../services';
 
-interface ShowNewVisModalParams {
+export interface ShowNewVisModalParams {
   editorParams?: string[];
+  onClose?: () => void;
 }
 
-export function showNewVisModal(
-  visTypeRegistry: TypesStart,
-  { editorParams = [] }: ShowNewVisModalParams = {},
-  addBasePath: (path: string) => string,
-  uiSettings: IUiSettingsClient,
-  savedObjects: SavedObjectsStart,
-  usageCollection?: UsageCollectionSetup
-) {
+export function showNewVisModal({ editorParams = [], onClose }: ShowNewVisModalParams = {}) {
   const container = document.createElement('div');
-  const onClose = () => {
+  let isClosed = false;
+  const handleClose = () => {
+    if (isClosed) return;
     ReactDOM.unmountComponentAtNode(container);
     document.body.removeChild(container);
+    if (onClose) {
+      onClose();
+    }
+    isClosed = true;
   };
 
   document.body.appendChild(container);
@@ -49,15 +47,17 @@ export function showNewVisModal(
     <I18nProvider>
       <NewVisModal
         isOpen={true}
-        onClose={onClose}
-        visTypesRegistry={visTypeRegistry}
+        onClose={handleClose}
         editorParams={editorParams}
-        addBasePath={addBasePath}
-        uiSettings={uiSettings}
-        savedObjects={savedObjects}
-        usageCollection={usageCollection}
+        visTypesRegistry={getTypes()}
+        addBasePath={getHttp().basePath.prepend}
+        uiSettings={getUISettings()}
+        savedObjects={getSavedObjects()}
+        usageCollection={getUsageCollector()}
       />
     </I18nProvider>
   );
   ReactDOM.render(element, container);
+
+  return () => handleClose();
 }
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/index.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/index.ts
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.test.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.test.tsx
similarity index 97%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.test.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.test.tsx
index a33a82c252fb3..138251beb9593 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.test.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.test.tsx
@@ -49,7 +49,7 @@ describe('NewVisHelp', () => {
         <p>
           <FormattedMessage
             defaultMessage="Start creating your visualization by selecting a type for that visualization."
-            id="kbn.visualize.newVisWizard.helpText"
+            id="visualizations.newVisWizard.helpText"
             values={Object {}}
           />
         </p>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.tsx
similarity index 93%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.tsx
index 2f7effb7a33c8..5068f43952c4e 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/new_vis_help.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/new_vis_help.tsx
@@ -21,7 +21,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import React, { Fragment } from 'react';
 import { EuiText, EuiButton } from '@elastic/eui';
 import { VisTypeAliasListEntry } from './type_selection';
-import { VisTypeAlias } from '../../../../../../visualizations/public';
+import { VisTypeAlias } from '../../types';
 
 interface Props {
   promotedTypes: VisTypeAliasListEntry[];
@@ -33,7 +33,7 @@ export function NewVisHelp(props: Props) {
     <EuiText>
       <p>
         <FormattedMessage
-          id="kbn.visualize.newVisWizard.helpText"
+          id="visualizations.newVisWizard.helpText"
           defaultMessage="Start creating your visualization by selecting a type for that visualization."
         />
       </p>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/type_selection.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/type_selection.tsx
similarity index 90%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/type_selection.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/type_selection.tsx
index 44da7cc8f2c45..574f5b3cccc99 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/type_selection.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/type_selection.tsx
@@ -34,13 +34,13 @@ import {
   EuiSpacer,
   EuiTitle,
 } from '@elastic/eui';
-import { VisType } from '../../../legacy_imports';
+
 import { memoizeLast } from '../../../../../../visualizations/public/np_ready/public/legacy/memoize';
 import { VisTypeAlias } from '../../../../../../visualizations/public';
 import { NewVisHelp } from './new_vis_help';
 import { VisHelpText } from './vis_help_text';
 import { VisTypeIcon } from './vis_type_icon';
-import { TypesStart } from '../../../../../../visualizations/public/np_ready/public/types';
+import { VisType, TypesStart } from '../../types';
 
 export interface VisTypeListEntry extends VisType {
   highlighted: boolean;
@@ -85,7 +85,7 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
         <EuiModalHeader>
           <EuiModalHeaderTitle>
             <FormattedMessage
-              id="kbn.visualize.newVisWizard.title"
+              id="visualizations.newVisWizard.title"
               defaultMessage="New Visualization"
             />
           </EuiModalHeaderTitle>
@@ -107,7 +107,7 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
                     fullWidth
                     data-test-subj="filterVisType"
                     aria-label={i18n.translate(
-                      'kbn.visualize.newVisWizard.filterVisTypeAriaLabel',
+                      'visualizations.newVisWizard.filterVisTypeAriaLabel',
                       {
                         defaultMessage: 'Filter for a visualization type',
                       }
@@ -119,7 +119,7 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
                     <span aria-live="polite">
                       {query && (
                         <FormattedMessage
-                          id="kbn.visualize.newVisWizard.resultsFound"
+                          id="visualizations.newVisWizard.resultsFound"
                           defaultMessage="{resultCount} {resultCount, plural,
                             one {type}
                             other {types}
@@ -146,7 +146,7 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
                   <EuiTitle size="s">
                     <h2>
                       <FormattedMessage
-                        id="kbn.visualize.newVisWizard.selectVisType"
+                        id="visualizations.newVisWizard.selectVisType"
                         defaultMessage="Select a visualization type"
                       />
                     </h2>
@@ -207,26 +207,26 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
     let highlightMsg;
     if (!('aliasUrl' in visType) && visType.stage === 'experimental') {
       stage = {
-        betaBadgeLabel: i18n.translate('kbn.visualize.newVisWizard.experimentalTitle', {
+        betaBadgeLabel: i18n.translate('visualizations.newVisWizard.experimentalTitle', {
           defaultMessage: 'Experimental',
         }),
-        betaBadgeTooltipContent: i18n.translate('kbn.visualize.newVisWizard.experimentalTooltip', {
+        betaBadgeTooltipContent: i18n.translate('visualizations.newVisWizard.experimentalTooltip', {
           defaultMessage:
             'This visualization might be changed or removed in a future release and is not subject to the support SLA.',
         }),
       };
-      highlightMsg = i18n.translate('kbn.visualize.newVisWizard.experimentalDescription', {
+      highlightMsg = i18n.translate('visualizations.newVisWizard.experimentalDescription', {
         defaultMessage:
           'This visualization is experimental. The design and implementation are less mature than stable visualizations and might be subject to change.',
       });
     } else if ('aliasUrl' in visType) {
       if (visType.stage === 'beta') {
-        const aliasDescription = i18n.translate('kbn.visualize.newVisWizard.betaDescription', {
+        const aliasDescription = i18n.translate('visualizations.newVisWizard.betaDescription', {
           defaultMessage:
             'This visualization is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features',
         });
         stage = {
-          betaBadgeLabel: i18n.translate('kbn.visualize.newVisWizard.betaTitle', {
+          betaBadgeLabel: i18n.translate('visualizations.newVisWizard.betaTitle', {
             defaultMessage: 'Beta',
           }),
           betaBadgeTooltipContent: aliasDescription,
@@ -235,13 +235,13 @@ class TypeSelection extends React.Component<TypeSelectionProps, TypeSelectionSta
         highlightMsg = aliasDescription;
       } else {
         const aliasDescription = i18n.translate(
-          'kbn.visualize.newVisWizard.visTypeAliasDescription',
+          'visualizations.newVisWizard.visTypeAliasDescription',
           {
             defaultMessage: 'Opens a Kibana application that is outside of Visualize.',
           }
         );
         stage = {
-          betaBadgeLabel: i18n.translate('kbn.visualize.newVisWizard.visTypeAliasTitle', {
+          betaBadgeLabel: i18n.translate('visualizations.newVisWizard.visTypeAliasTitle', {
             defaultMessage: 'Kibana application',
           }),
           betaBadgeTooltipContent: aliasDescription,
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/vis_help_text.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/vis_help_text.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/vis_help_text.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/vis_help_text.tsx
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/vis_type_icon.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/vis_type_icon.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/visualize/np_ready/wizard/type_selection/vis_type_icon.tsx
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/wizard/type_selection/vis_type_icon.tsx
diff --git a/src/legacy/server/kbn_server.d.ts b/src/legacy/server/kbn_server.d.ts
index 8da1b3b05fa76..a21a05e1e012a 100644
--- a/src/legacy/server/kbn_server.d.ts
+++ b/src/legacy/server/kbn_server.d.ts
@@ -114,6 +114,7 @@ export interface KibanaCore {
     elasticsearch: LegacyServiceSetupDeps['core']['elasticsearch'];
     hapiServer: LegacyServiceSetupDeps['core']['http']['server'];
     kibanaMigrator: LegacyServiceStartDeps['core']['savedObjects']['migrator'];
+    typeRegistry: LegacyServiceStartDeps['core']['savedObjects']['typeRegistry'];
     legacy: ILegacyInternals;
     rendering: LegacyServiceSetupDeps['core']['rendering'];
     uiPlugins: LegacyServiceSetupDeps['core']['plugins']['uiPlugins'];
diff --git a/src/legacy/server/saved_objects/saved_objects_mixin.js b/src/legacy/server/saved_objects/saved_objects_mixin.js
index e0d8b895af838..1d2f2d0f23e17 100644
--- a/src/legacy/server/saved_objects/saved_objects_mixin.js
+++ b/src/legacy/server/saved_objects/saved_objects_mixin.js
@@ -20,7 +20,6 @@
 // Disable lint errors for imports from src/core/server/saved_objects until SavedObjects migration is complete
 /* eslint-disable @kbn/eslint/no-restricted-paths */
 import { SavedObjectsSchema } from '../../../core/server/saved_objects/schema';
-import { SavedObjectsSerializer } from '../../../core/server/saved_objects/serialization';
 import {
   SavedObjectsClient,
   SavedObjectsRepository,
@@ -29,6 +28,7 @@ import {
   resolveImportErrors,
 } from '../../../core/server/saved_objects';
 import { getRootPropertiesObjects } from '../../../core/server/saved_objects/mappings';
+import { convertTypesToLegacySchema } from '../../../core/server/saved_objects/utils';
 import { SavedObjectsManagement } from '../../../core/server/saved_objects/management';
 
 import {
@@ -57,9 +57,10 @@ function getImportableAndExportableTypes({ kbnServer, visibleTypes }) {
 
 export function savedObjectsMixin(kbnServer, server) {
   const migrator = kbnServer.newPlatform.__internals.kibanaMigrator;
+  const typeRegistry = kbnServer.newPlatform.__internals.typeRegistry;
   const mappings = migrator.getActiveMappings();
   const allTypes = Object.keys(getRootPropertiesObjects(mappings));
-  const schema = new SavedObjectsSchema(kbnServer.uiExports.savedObjectSchemas);
+  const schema = new SavedObjectsSchema(convertTypesToLegacySchema(typeRegistry.getAllTypes()));
   const visibleTypes = allTypes.filter(type => !schema.isHiddenType(type));
   const importableAndExportableTypes = getImportableAndExportableTypes({ kbnServer, visibleTypes });
 
@@ -99,7 +100,7 @@ export function savedObjectsMixin(kbnServer, server) {
   server.route(createResolveImportErrorsRoute(prereqs, server, importableAndExportableTypes));
   server.route(createLogLegacyImportRoute());
 
-  const serializer = new SavedObjectsSerializer(schema);
+  const serializer = kbnServer.newPlatform.start.core.savedObjects.createSerializer();
 
   const createRepository = (callCluster, extraTypes = []) => {
     if (typeof callCluster !== 'function') {
@@ -118,10 +119,9 @@ export function savedObjectsMixin(kbnServer, server) {
 
     return new SavedObjectsRepository({
       index: config.get('kibana.index'),
-      config,
       migrator,
       mappings,
-      schema,
+      typeRegistry,
       serializer,
       allowedTypes,
       callCluster,
diff --git a/src/legacy/server/saved_objects/saved_objects_mixin.test.js b/src/legacy/server/saved_objects/saved_objects_mixin.test.js
index 691878cf66d27..9ca0374b959f6 100644
--- a/src/legacy/server/saved_objects/saved_objects_mixin.test.js
+++ b/src/legacy/server/saved_objects/saved_objects_mixin.test.js
@@ -22,6 +22,14 @@ import { savedObjectsMixin } from './saved_objects_mixin';
 import { mockKibanaMigrator } from '../../../core/server/saved_objects/migrations/kibana/kibana_migrator.mock';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { savedObjectsClientProviderMock } from '../../../core/server/saved_objects/service/lib/scoped_client_provider.mock';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { convertLegacyTypes } from '../../../core/server/saved_objects/utils';
+import { SavedObjectTypeRegistry } from '../../../core/server';
+import { coreMock } from '../../../core/server/mocks';
+
+const mockConfig = {
+  get: jest.fn().mockReturnValue('anything'),
+};
 
 const savedObjectMappings = [
   {
@@ -61,7 +69,30 @@ const savedObjectMappings = [
   },
 ];
 
-const migrator = mockKibanaMigrator.create({ savedObjectMappings });
+const savedObjectSchemas = {
+  hiddentype: {
+    hidden: true,
+  },
+  doc1: {
+    indexPattern: 'other-index',
+  },
+};
+
+const savedObjectTypes = convertLegacyTypes(
+  {
+    savedObjectMappings,
+    savedObjectSchemas,
+    savedObjectMigrations: {},
+  },
+  mockConfig
+);
+
+const typeRegistry = new SavedObjectTypeRegistry();
+savedObjectTypes.forEach(type => typeRegistry.registerType(type));
+
+const migrator = mockKibanaMigrator.create({
+  types: savedObjectTypes,
+});
 
 describe('Saved Objects Mixin', () => {
   let mockKbnServer;
@@ -113,7 +144,17 @@ describe('Saved Objects Mixin', () => {
     };
     mockKbnServer = {
       newPlatform: {
-        __internals: { kibanaMigrator: migrator, savedObjectsClientProvider: clientProvider },
+        __internals: {
+          kibanaMigrator: migrator,
+          savedObjectsClientProvider: clientProvider,
+          typeRegistry,
+        },
+        setup: {
+          core: coreMock.createSetup(),
+        },
+        start: {
+          core: coreMock.createStart(),
+        },
       },
       server: mockServer,
       ready: () => {},
@@ -124,14 +165,7 @@ describe('Saved Objects Mixin', () => {
       },
       uiExports: {
         savedObjectMappings,
-        savedObjectSchemas: {
-          hiddentype: {
-            hidden: true,
-          },
-          doc1: {
-            indexPattern: 'other-index',
-          },
-        },
+        savedObjectSchemas,
       },
     };
   });
diff --git a/src/legacy/ui/public/UI_SYSTEMS.md b/src/legacy/ui/public/UI_SYSTEMS.md
index 37bfbcf92f640..8462b2c8f4144 100644
--- a/src/legacy/ui/public/UI_SYSTEMS.md
+++ b/src/legacy/ui/public/UI_SYSTEMS.md
@@ -5,4 +5,4 @@ In this directory you'll find various UI systems you can use to craft effective
 ## ui/notify
 
 * [banners](notify/banners/BANNERS.md)
-* [toastNotifications](notify/toasts/TOAST_NOTIFICATIONS.md)
+* [toastNotifications](../../../plugins/kibana_legacy/public/notify/toasts/TOAST_NOTIFICATIONS.md)
diff --git a/src/legacy/ui/public/_index.scss b/src/legacy/ui/public/_index.scss
index e4e58019dda69..e990ba2a46de5 100644
--- a/src/legacy/ui/public/_index.scss
+++ b/src/legacy/ui/public/_index.scss
@@ -10,7 +10,6 @@
 
 @import './accessibility/index';
 @import './chrome/index';
-@import './collapsible_sidebar/index';
 @import './directives/index';
 @import './error_auto_create_index/index';
 @import './error_url_overflow/index';
diff --git a/src/legacy/ui/public/accessibility/kbn_accessible_click.js b/src/legacy/ui/public/accessibility/kbn_accessible_click.js
index 35a2fa56af169..a57fbc6be82fd 100644
--- a/src/legacy/ui/public/accessibility/kbn_accessible_click.js
+++ b/src/legacy/ui/public/accessibility/kbn_accessible_click.js
@@ -37,58 +37,7 @@
  * Apply this directive to any of these elements to automatically do the above.
  */
 
-import { accessibleClickKeys, keyCodes } from '@elastic/eui';
 import { uiModules } from '../modules';
-
-export function KbnAccessibleClickProvider() {
-  return {
-    restrict: 'A',
-    controller: $element => {
-      $element.on('keydown', e => {
-        // Prevent a scroll from occurring if the user has hit space.
-        if (e.keyCode === keyCodes.SPACE) {
-          e.preventDefault();
-        }
-      });
-    },
-    link: (scope, element, attrs) => {
-      // The whole point of this directive is to hack in functionality that native buttons provide
-      // by default.
-      const elementType = element.prop('tagName');
-
-      if (elementType === 'BUTTON') {
-        throw new Error(`kbnAccessibleClick doesn't need to be used on a button.`);
-      }
-
-      if (elementType === 'A' && attrs.href !== undefined) {
-        throw new Error(
-          `kbnAccessibleClick doesn't need to be used on a link if it has a href attribute.`
-        );
-      }
-
-      // We're emulating a click action, so we should already have a regular click handler defined.
-      if (!attrs.ngClick) {
-        throw new Error('kbnAccessibleClick requires ng-click to be defined on its element.');
-      }
-
-      // If the developer hasn't already specified attributes required for accessibility, add them.
-      if (attrs.tabindex === undefined) {
-        element.attr('tabindex', '0');
-      }
-
-      if (attrs.role === undefined) {
-        element.attr('role', 'button');
-      }
-
-      element.on('keyup', e => {
-        // Support keyboard accessibility by emulating mouse click on ENTER or SPACE keypress.
-        if (accessibleClickKeys[e.keyCode]) {
-          // Delegate to the click handler on the element (assumed to be ng-click).
-          element.click();
-        }
-      });
-    },
-  };
-}
+import { KbnAccessibleClickProvider } from '../../../../plugins/kibana_legacy/public';
 
 uiModules.get('kibana').directive('kbnAccessibleClick', KbnAccessibleClickProvider);
diff --git a/src/legacy/ui/public/agg_response/tabify/_get_columns.ts b/src/legacy/ui/public/agg_response/tabify/_get_columns.ts
index a3127c039049b..4144d5be16012 100644
--- a/src/legacy/ui/public/agg_response/tabify/_get_columns.ts
+++ b/src/legacy/ui/public/agg_response/tabify/_get_columns.ts
@@ -18,15 +18,15 @@
  */
 
 import { groupBy } from 'lodash';
-import { AggConfig } from '../../agg_types';
+import { IAggConfig } from '../../agg_types';
 
 export interface AggColumn {
-  aggConfig: AggConfig;
+  aggConfig: IAggConfig;
   id: string;
   name: string;
 }
 
-const getColumn = (agg: AggConfig, i: number): AggColumn => {
+const getColumn = (agg: IAggConfig, i: number): AggColumn => {
   return {
     aggConfig: agg,
     id: `col-${i}-${agg.id}`,
@@ -40,7 +40,7 @@ const getColumn = (agg: AggConfig, i: number): AggColumn => {
  * @param {AggConfigs} aggs - the agg configs object to which the aggregation response correlates
  * @param {boolean} minimalColumns - setting to true will only return a column for the last bucket/metric instead of one for each level
  */
-export function tabifyGetColumns(aggs: AggConfig[], minimalColumns: boolean) {
+export function tabifyGetColumns(aggs: IAggConfig[], minimalColumns: boolean) {
   // pick the columns
   if (minimalColumns) {
     return aggs.map((agg, i) => getColumn(agg, i));
diff --git a/src/legacy/ui/public/agg_types/index.ts b/src/legacy/ui/public/agg_types/index.ts
index cf2733b9a9f36..ac5d0bed7ef15 100644
--- a/src/legacy/ui/public/agg_types/index.ts
+++ b/src/legacy/ui/public/agg_types/index.ts
@@ -17,15 +17,69 @@
  * under the License.
  */
 
-export { aggTypes } from './agg_types';
-export { AggParam } from './agg_params';
-export { AggConfig } from './agg_config';
-export { AggConfigs } from './agg_configs';
-export { AggGroupNames, aggGroupNamesMap } from './agg_groups';
-export { FieldParamType } from './param_types';
-export { BUCKET_TYPES } from './buckets/bucket_agg_types';
-export { METRIC_TYPES } from './metrics/metric_agg_types';
-export { ISchemas, Schema, Schemas } from './schemas';
-export { AggType } from './agg_type';
-export { setBounds } from './buckets/date_histogram';
-export { termsAggFilter } from './buckets/terms';
+/**
+ * Nothing to see here!
+ *
+ * Agg Types have moved to the data plugin, and are being
+ * re-exported from ui/agg_types for backwards compatibility.
+ */
+
+import { start as dataStart } from '../../../core_plugins/data/public/legacy';
+
+// runtime contracts
+export const {
+  types: aggTypes,
+  AggConfig,
+  AggConfigs,
+  AggType,
+  aggTypeFieldFilters,
+  FieldParamType,
+  MetricAggType,
+  parentPipelineAggHelper,
+  siblingPipelineAggHelper,
+  setBounds,
+} = dataStart.search.aggs;
+
+// types
+export {
+  IAggConfig,
+  IAggConfigs,
+  IAggType,
+  IFieldParamType,
+  IMetricAggType,
+  AggParam,
+  AggParamOption,
+  BUCKET_TYPES,
+  DateRangeKey,
+  IpRangeKey,
+  ISchemas,
+  METRIC_TYPES,
+  OptionedParamEditorProps,
+  OptionedValueProp,
+} from '../../../core_plugins/data/public';
+
+// static code
+export {
+  AggParamType,
+  AggTypeFilters,
+  aggTypeFilters,
+  AggTypeFieldFilters,
+  AggGroupNames,
+  aggGroupNamesMap,
+  CidrMask,
+  convertDateRangeToString,
+  convertIPRangeToString,
+  intervalOptions,
+  isDateHistogramBucketAggConfig,
+  isStringType,
+  isType,
+  isValidInterval,
+  isValidJson,
+  OptionedParamType,
+  parentPipelineType,
+  propFilter,
+  Schema,
+  Schemas,
+  siblingPipelineType,
+  termsAggFilter,
+} from '../../../core_plugins/data/public';
diff --git a/src/legacy/ui/public/chrome/api/nav.ts b/src/legacy/ui/public/chrome/api/nav.ts
index 771314d9e1481..ae32473e451b7 100644
--- a/src/legacy/ui/public/chrome/api/nav.ts
+++ b/src/legacy/ui/public/chrome/api/nav.ts
@@ -146,7 +146,7 @@ export function initChromeNavApi(chrome: any, internals: NavInternals) {
   // link.active and link.lastUrl properties
   coreNavLinks
     .getAll()
-    .filter(link => link.subUrlBase)
+    .filter(link => link.subUrlBase && !link.disableSubUrlTracking)
     .forEach(link => {
       coreNavLinks.update(link.id, {
         subUrlBase: relativeToAbsolute(chrome.addBasePath(link.subUrlBase)),
diff --git a/src/legacy/ui/public/collapsible_sidebar/_index.scss b/src/legacy/ui/public/collapsible_sidebar/_index.scss
deleted file mode 100644
index 84b759f66720e..0000000000000
--- a/src/legacy/ui/public/collapsible_sidebar/_index.scss
+++ /dev/null
@@ -1,3 +0,0 @@
-@import '../styles/_legacy/depth';
-
-@import './collapsible_sidebar';
diff --git a/src/legacy/ui/public/directives/listen/listen.js b/src/legacy/ui/public/directives/listen/listen.js
index 97185e4f602ff..db19471fdb640 100644
--- a/src/legacy/ui/public/directives/listen/listen.js
+++ b/src/legacy/ui/public/directives/listen/listen.js
@@ -18,23 +18,6 @@
  */
 
 import { uiModules } from '../../modules';
-
-export function registerListenEventListener($rootScope) {
-  /**
-   * Helper that registers an event listener, and removes that listener when
-   * the $scope is destroyed.
-   *
-   * @param  {SimpleEmitter} emitter - the event emitter to listen to
-   * @param  {string} eventName - the event name
-   * @param  {Function} handler - the event handler
-   * @return {undefined}
-   */
-  $rootScope.constructor.prototype.$listen = function(emitter, eventName, handler) {
-    emitter.on(eventName, handler);
-    this.$on('$destroy', function() {
-      emitter.off(eventName, handler);
-    });
-  };
-}
+import { registerListenEventListener } from '../../../../../plugins/kibana_legacy/public';
 
 uiModules.get('kibana').run(registerListenEventListener);
diff --git a/src/legacy/ui/public/directives/watch_multi/index.js b/src/legacy/ui/public/directives/watch_multi/index.js
index 3f0f43ce27ed2..800bb503088d4 100644
--- a/src/legacy/ui/public/directives/watch_multi/index.js
+++ b/src/legacy/ui/public/directives/watch_multi/index.js
@@ -17,4 +17,6 @@
  * under the License.
  */
 
-import './watch_multi';
+import { uiModules } from '../../modules';
+import { watchMultiDecorator } from '../../../../../plugins/kibana_legacy/public';
+uiModules.get('kibana').config(watchMultiDecorator);
diff --git a/src/legacy/ui/public/error_url_overflow/__tests__/ie_regex.js b/src/legacy/ui/public/error_url_overflow/__tests__/ie_regex.js
index 3f5a3442b47b3..3d770c13a81aa 100644
--- a/src/legacy/ui/public/error_url_overflow/__tests__/ie_regex.js
+++ b/src/legacy/ui/public/error_url_overflow/__tests__/ie_regex.js
@@ -18,7 +18,7 @@
  */
 
 import expect from '@kbn/expect';
-import { IE_REGEX } from '../url_overflow_service.js';
+import { IE_REGEX } from '../../../../../plugins/kibana_legacy/public';
 
 describe('IE_REGEX', () => {
   it('should detect IE 9', () => {
diff --git a/src/legacy/ui/public/error_url_overflow/error_url_overflow.js b/src/legacy/ui/public/error_url_overflow/error_url_overflow.js
index c9b20f41d2b99..223b81fa36fde 100644
--- a/src/legacy/ui/public/error_url_overflow/error_url_overflow.js
+++ b/src/legacy/ui/public/error_url_overflow/error_url_overflow.js
@@ -22,9 +22,9 @@ import uiRoutes from '../routes';
 import { KbnUrlProvider } from '../url';
 
 import template from './error_url_overflow.html';
-import { UrlOverflowService } from './url_overflow_service';
+import { UrlOverflowService } from '../../../../plugins/kibana_legacy/public';
 
-export * from './url_overflow_service';
+export { UrlOverflowService };
 
 uiRoutes.when('/error/url-overflow', {
   template,
diff --git a/src/legacy/ui/public/error_url_overflow/index.js b/src/legacy/ui/public/error_url_overflow/index.js
index c5b13182a8288..06a98789349f8 100644
--- a/src/legacy/ui/public/error_url_overflow/index.js
+++ b/src/legacy/ui/public/error_url_overflow/index.js
@@ -18,4 +18,4 @@
  */
 
 import './error_url_overflow';
-export { UrlOverflowService } from './url_overflow_service';
+export { UrlOverflowService } from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/__snapshots__/truncate.test.js.snap b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/__snapshots__/truncate.test.js.snap
index c0954491a2a47..729487dfae5d7 100644
--- a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/__snapshots__/truncate.test.js.snap
+++ b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/__snapshots__/truncate.test.js.snap
@@ -21,6 +21,7 @@ exports[`TruncateFormatEditor should render normally 1`] = `
   >
     <EuiFieldNumber
       isInvalid={false}
+      min={1}
       onChange={[Function]}
     />
   </EuiFormRow>
diff --git a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.js b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.js
index fdae8627ead69..9a9b6c954b78d 100644
--- a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.js
+++ b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.js
@@ -38,7 +38,7 @@ export class TruncateFormatEditor extends DefaultFormatEditor {
   }
 
   render() {
-    const { formatParams } = this.props;
+    const { formatParams, onError } = this.props;
     const { error, samples } = this.state;
 
     return (
@@ -55,8 +55,15 @@ export class TruncateFormatEditor extends DefaultFormatEditor {
         >
           <EuiFieldNumber
             defaultValue={formatParams.fieldLength}
+            min={1}
             onChange={e => {
-              this.onChange({ fieldLength: e.target.value ? Number(e.target.value) : null });
+              if (e.target.checkValidity()) {
+                this.onChange({
+                  fieldLength: e.target.value ? Number(e.target.value) : null,
+                });
+              } else {
+                onError(e.target.validationMessage);
+              }
             }}
             isInvalid={!!error}
           />
diff --git a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.test.js b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.test.js
index e98dd4edca386..7ab6f2a9cbeb0 100644
--- a/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.test.js
+++ b/src/legacy/ui/public/field_editor/components/field_format_editor/editors/truncate/truncate.test.js
@@ -19,6 +19,7 @@
 
 import React from 'react';
 import { shallow } from 'enzyme';
+import { EuiFieldNumber } from '@elastic/eui';
 
 import { TruncateFormatEditor } from './truncate';
 
@@ -34,6 +35,11 @@ const onChange = jest.fn();
 const onError = jest.fn();
 
 describe('TruncateFormatEditor', () => {
+  beforeEach(() => {
+    onChange.mockClear();
+    onError.mockClear();
+  });
+
   it('should have a formatId', () => {
     expect(TruncateFormatEditor.formatId).toEqual('truncate');
   });
@@ -50,4 +56,54 @@ describe('TruncateFormatEditor', () => {
     );
     expect(component).toMatchSnapshot();
   });
+
+  it('should fire error, when input is invalid', async () => {
+    const component = shallow(
+      <TruncateFormatEditor
+        fieldType={fieldType}
+        format={format}
+        formatParams={formatParams}
+        onChange={onChange}
+        onError={onError}
+      />
+    );
+    const input = component.find(EuiFieldNumber);
+
+    const changeEvent = {
+      target: {
+        value: '123.3',
+        checkValidity: () => false,
+        validationMessage: 'Error!',
+      },
+    };
+    await input.invoke('onChange')(changeEvent);
+
+    expect(onError).toBeCalledWith(changeEvent.target.validationMessage);
+    expect(onChange).not.toBeCalled();
+  });
+
+  it('should fire change, when input changed and is valid', async () => {
+    const component = shallow(
+      <TruncateFormatEditor
+        fieldType={fieldType}
+        format={format}
+        formatParams={formatParams}
+        onChange={onChange}
+        onError={onError}
+      />
+    );
+    const input = component.find(EuiFieldNumber);
+
+    const changeEvent = {
+      target: {
+        value: '123',
+        checkValidity: () => true,
+        validationMessage: null,
+      },
+    };
+    onError.mockClear();
+    await input.invoke('onChange')(changeEvent);
+    expect(onError).not.toBeCalled();
+    expect(onChange).toBeCalledWith({ fieldLength: 123 });
+  });
 });
diff --git a/src/legacy/ui/public/kbn_top_nav/kbn_top_nav.js b/src/legacy/ui/public/kbn_top_nav/kbn_top_nav.js
index 0788afd5f74eb..12c3ca2acc3cd 100644
--- a/src/legacy/ui/public/kbn_top_nav/kbn_top_nav.js
+++ b/src/legacy/ui/public/kbn_top_nav/kbn_top_nav.js
@@ -92,6 +92,7 @@ export const createTopNavHelper = ({ TopNavMenu }) => reactDirective => {
     ['onClearSavedQuery', { watchDepth: 'reference' }],
     ['onSaved', { watchDepth: 'reference' }],
     ['onSavedQueryUpdated', { watchDepth: 'reference' }],
+    ['onSavedQueryIdChange', { watchDepth: 'reference' }],
 
     ['indexPatterns', { watchDepth: 'collection' }],
     ['filters', { watchDepth: 'collection' }],
@@ -109,10 +110,14 @@ export const createTopNavHelper = ({ TopNavMenu }) => reactDirective => {
     'screenTitle',
     'dateRangeFrom',
     'dateRangeTo',
+    'savedQueryId',
     'isRefreshPaused',
     'refreshInterval',
     'disableAutoFocus',
     'showAutoRefreshOnly',
+
+    // temporary flag to use the stateful components
+    'useDefaultBehaviors',
   ]);
 };
 
diff --git a/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js b/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js
index 6d2fd2318686a..fc12a18d72823 100644
--- a/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js
+++ b/src/legacy/ui/public/legacy_compat/__tests__/xsrf.js
@@ -22,7 +22,7 @@ import expect from '@kbn/expect';
 import sinon from 'sinon';
 import ngMock from 'ng_mock';
 
-import { $setupXsrfRequestInterceptor } from '../angular_config';
+import { $setupXsrfRequestInterceptor } from '../../../../../plugins/kibana_legacy/public';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { version } from '../../../../../core/server/utils/package_json';
 
diff --git a/src/legacy/ui/public/legacy_compat/index.ts b/src/legacy/ui/public/legacy_compat/index.ts
index ea8932114118e..3b700c8d59399 100644
--- a/src/legacy/ui/public/legacy_compat/index.ts
+++ b/src/legacy/ui/public/legacy_compat/index.ts
@@ -17,5 +17,7 @@
  * under the License.
  */
 
-export { configureAppAngularModule } from './angular_config';
-export { ensureDefaultIndexPattern } from './ensure_default_index_pattern';
+export {
+  configureAppAngularModule,
+  ensureDefaultIndexPattern,
+} from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/management/index.d.ts b/src/legacy/ui/public/management/index.d.ts
index 7880e1d5d0295..529efd36623a3 100644
--- a/src/legacy/ui/public/management/index.d.ts
+++ b/src/legacy/ui/public/management/index.d.ts
@@ -18,15 +18,7 @@
  */
 
 declare module 'ui/management' {
-  export const PAGE_TITLE_COMPONENT: string;
-  export const PAGE_SUBTITLE_COMPONENT: string;
-  export const PAGE_FOOTER_COMPONENT: string;
   export const SidebarNav: React.FC<any>;
-  export function registerSettingsComponent(
-    id: string,
-    component: string | React.FC<any>,
-    allowOverride: boolean
-  ): void;
   export const management: any; // TODO - properly provide types
   export const MANAGEMENT_BREADCRUMB: {
     text: string;
diff --git a/src/legacy/ui/public/management/index.js b/src/legacy/ui/public/management/index.js
index b2f1946dbc59c..25d3678c5dbba 100644
--- a/src/legacy/ui/public/management/index.js
+++ b/src/legacy/ui/public/management/index.js
@@ -17,12 +17,6 @@
  * under the License.
  */
 
-export {
-  PAGE_TITLE_COMPONENT,
-  PAGE_SUBTITLE_COMPONENT,
-  PAGE_FOOTER_COMPONENT,
-} from '../../../core_plugins/kibana/public/management/sections/settings/components/default_component_registry';
-export { registerSettingsComponent } from '../../../core_plugins/kibana/public/management/sections/settings/components/component_registry';
 export { MANAGEMENT_BREADCRUMB } from './breadcrumbs';
 import { npStart } from 'ui/new_platform';
 export const management = npStart.plugins.management.legacy;
diff --git a/src/legacy/ui/public/new_platform/__mocks__/helpers.ts b/src/legacy/ui/public/new_platform/__mocks__/helpers.ts
index 439ac9b5713df..6f6b4be86f58d 100644
--- a/src/legacy/ui/public/new_platform/__mocks__/helpers.ts
+++ b/src/legacy/ui/public/new_platform/__mocks__/helpers.ts
@@ -29,6 +29,7 @@ import { managementPluginMock } from '../../../../../plugins/management/public/m
 import { usageCollectionPluginMock } from '../../../../../plugins/usage_collection/public/mocks';
 import { kibanaLegacyPluginMock } from '../../../../../plugins/kibana_legacy/public/mocks';
 import { chartPluginMock } from '../../../../../plugins/charts/public/mocks';
+import { advancedSettingsMock } from '../../../../../plugins/advanced_settings/public/mocks';
 /* eslint-enable @kbn/eslint/no-restricted-paths */
 
 export const pluginsMock = {
@@ -41,7 +42,8 @@ export const pluginsMock = {
     expressions: expressionsPluginMock.createSetupContract(),
     uiActions: uiActionsPluginMock.createSetupContract(),
     usageCollection: usageCollectionPluginMock.createSetupContract(),
-    kibana_legacy: kibanaLegacyPluginMock.createSetupContract(),
+    advancedSettings: advancedSettingsMock.createSetupContract(),
+    kibanaLegacy: kibanaLegacyPluginMock.createSetupContract(),
   }),
   createStart: () => ({
     data: dataPluginMock.createStartContract(),
@@ -52,7 +54,8 @@ export const pluginsMock = {
     expressions: expressionsPluginMock.createStartContract(),
     uiActions: uiActionsPluginMock.createStartContract(),
     management: managementPluginMock.createStartContract(),
-    kibana_legacy: kibanaLegacyPluginMock.createStartContract(),
+    advancedSettings: advancedSettingsMock.createStartContract(),
+    kibanaLegacy: kibanaLegacyPluginMock.createStartContract(),
   }),
 };
 
diff --git a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js b/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
index c2c8b5a0fae7a..3cc33504d3daa 100644
--- a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
+++ b/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
@@ -20,6 +20,7 @@
 import sinon from 'sinon';
 import { getFieldFormatsRegistry } from '../../../../test_utils/public/stub_field_formats';
 import { METRIC_TYPE } from '@kbn/analytics';
+import { ComponentRegistry } from '../../../../../src/plugins/advanced_settings/public/';
 
 const mockObservable = () => {
   return {
@@ -58,6 +59,12 @@ const mockCore = {
 export const npSetup = {
   core: mockCore,
   plugins: {
+    advancedSettings: {
+      component: {
+        register: sinon.fake(),
+        componentType: ComponentRegistry.componentType,
+      },
+    },
     usageCollection: {
       allowTrackUserAgent: sinon.fake(),
       reportUiStats: sinon.fake(),
@@ -113,10 +120,10 @@ export const npSetup = {
     share: {
       register: () => {},
     },
-    dev_tools: {
+    devTools: {
       register: () => {},
     },
-    kibana_legacy: {
+    kibanaLegacy: {
       registerLegacyApp: () => {},
       forwardApp: () => {},
       config: {
@@ -196,10 +203,10 @@ export const npStart = {
       registerRenderer: sinon.fake(),
       registerType: sinon.fake(),
     },
-    dev_tools: {
+    devTools: {
       getSortedDevTools: () => [],
     },
-    kibana_legacy: {
+    kibanaLegacy: {
       getApps: () => [],
       getForwards: () => [],
       config: {
diff --git a/src/legacy/ui/public/new_platform/new_platform.ts b/src/legacy/ui/public/new_platform/new_platform.ts
index 2ade98ec54efd..e300ce4a0caf8 100644
--- a/src/legacy/ui/public/new_platform/new_platform.ts
+++ b/src/legacy/ui/public/new_platform/new_platform.ts
@@ -18,7 +18,7 @@
  */
 import { IScope } from 'angular';
 
-import { IUiActionsStart, IUiActionsSetup } from 'src/plugins/ui_actions/public';
+import { UiActionsStart, UiActionsSetup } from 'src/plugins/ui_actions/public';
 import { IEmbeddableStart, IEmbeddableSetup } from 'src/plugins/embeddable/public';
 import { LegacyCoreSetup, LegacyCoreStart, App, AppMountDeprecated } from '../../../../core/public';
 import { Plugin as DataPlugin } from '../../../../plugins/data/public';
@@ -32,6 +32,10 @@ import { DevToolsSetup, DevToolsStart } from '../../../../plugins/dev_tools/publ
 import { KibanaLegacySetup, KibanaLegacyStart } from '../../../../plugins/kibana_legacy/public';
 import { HomePublicPluginSetup, HomePublicPluginStart } from '../../../../plugins/home/public';
 import { SharePluginSetup, SharePluginStart } from '../../../../plugins/share/public';
+import {
+  AdvancedSettingsSetup,
+  AdvancedSettingsStart,
+} from '../../../../plugins/advanced_settings/public';
 import { ManagementSetup, ManagementStart } from '../../../../plugins/management/public';
 import { BfetchPublicSetup, BfetchPublicStart } from '../../../../plugins/bfetch/public';
 import { UsageCollectionSetup } from '../../../../plugins/usage_collection/public';
@@ -48,12 +52,13 @@ export interface PluginsSetup {
   expressions: ReturnType<ExpressionsPlugin['setup']>;
   home: HomePublicPluginSetup;
   inspector: InspectorSetup;
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
   navigation: NavigationPublicPluginSetup;
-  dev_tools: DevToolsSetup;
-  kibana_legacy: KibanaLegacySetup;
+  devTools: DevToolsSetup;
+  kibanaLegacy: KibanaLegacySetup;
   share: SharePluginSetup;
   usageCollection: UsageCollectionSetup;
+  advancedSettings: AdvancedSettingsSetup;
   management: ManagementSetup;
 }
 
@@ -65,12 +70,13 @@ export interface PluginsStart {
   expressions: ReturnType<ExpressionsPlugin['start']>;
   home: HomePublicPluginStart;
   inspector: InspectorStart;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
   navigation: NavigationPublicPluginStart;
-  dev_tools: DevToolsStart;
-  kibana_legacy: KibanaLegacyStart;
+  devTools: DevToolsStart;
+  kibanaLegacy: KibanaLegacyStart;
   share: SharePluginStart;
   management: ManagementStart;
+  advancedSettings: AdvancedSettingsStart;
 }
 
 export const npSetup = {
diff --git a/src/legacy/ui/public/notify/banners/index.js b/src/legacy/ui/public/notify/banners/index.ts
similarity index 100%
rename from src/legacy/ui/public/notify/banners/index.js
rename to src/legacy/ui/public/notify/banners/index.ts
diff --git a/src/legacy/ui/public/notify/fatal_error.ts b/src/legacy/ui/public/notify/fatal_error.ts
index 4c02322bae492..7fa2ae7ac6fe6 100644
--- a/src/legacy/ui/public/notify/fatal_error.ts
+++ b/src/legacy/ui/public/notify/fatal_error.ts
@@ -22,7 +22,7 @@ import {
   AngularHttpError,
   formatAngularHttpError,
   isAngularHttpError,
-} from './lib/format_angular_http_error';
+} from '../../../../plugins/kibana_legacy/public';
 
 export function addFatalErrorCallback(callback: () => void) {
   npSetup.core.fatalErrors.get$().subscribe(() => {
diff --git a/src/legacy/ui/public/notify/index.d.ts b/src/legacy/ui/public/notify/index.d.ts
index c76924eb25819..3c1a7ba02db72 100644
--- a/src/legacy/ui/public/notify/index.d.ts
+++ b/src/legacy/ui/public/notify/index.d.ts
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { toastNotifications, Toast, ToastInput } from './toasts';
+export { toastNotifications } from './toasts';
 export { fatalError } from './fatal_error';
diff --git a/src/legacy/ui/public/notify/index.js b/src/legacy/ui/public/notify/index.js
index 70e6c635d43b9..f7526f3b8f8fd 100644
--- a/src/legacy/ui/public/notify/index.js
+++ b/src/legacy/ui/public/notify/index.js
@@ -19,5 +19,5 @@
 
 export { fatalError, addFatalErrorCallback } from './fatal_error';
 export { toastNotifications } from './toasts';
-export { banners } from './banners';
 export { addAppRedirectMessageToUrl, showAppRedirectNotification } from './app_redirect';
+export { banners } from './banners';
diff --git a/src/legacy/ui/public/notify/toasts/index.ts b/src/legacy/ui/public/notify/toasts/index.ts
index d305b176e1128..c5e8e3b7ca7a3 100644
--- a/src/legacy/ui/public/notify/toasts/index.ts
+++ b/src/legacy/ui/public/notify/toasts/index.ts
@@ -16,6 +16,5 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
+export { ToastNotifications } from './toast_notifications';
 export { toastNotifications } from './toasts';
-export { Toast, ToastInput } from './toast_notifications';
diff --git a/src/legacy/ui/public/notify/toasts/toast_notifications.ts b/src/legacy/ui/public/notify/toasts/toast_notifications.ts
index 987717ab17d39..d3ec8edb5d73a 100644
--- a/src/legacy/ui/public/notify/toasts/toast_notifications.ts
+++ b/src/legacy/ui/public/notify/toasts/toast_notifications.ts
@@ -16,40 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
-import {
-  ErrorToastOptions,
-  NotificationsSetup,
-  Toast,
-  ToastInput,
-} from '../../../../../core/public';
-
-export { Toast, ToastInput };
-
-export class ToastNotifications {
-  public list: Toast[] = [];
-
-  private onChangeCallback?: () => void;
-
-  constructor(private readonly toasts: NotificationsSetup['toasts']) {
-    toasts.get$().subscribe(list => {
-      this.list = list;
-
-      if (this.onChangeCallback) {
-        this.onChangeCallback();
-      }
-    });
-  }
-
-  public onChange = (callback: () => void) => {
-    this.onChangeCallback = callback;
-  };
-
-  public add = (toastOrTitle: ToastInput) => this.toasts.add(toastOrTitle);
-  public remove = (toast: Toast) => this.toasts.remove(toast);
-  public addSuccess = (toastOrTitle: ToastInput) => this.toasts.addSuccess(toastOrTitle);
-  public addWarning = (toastOrTitle: ToastInput) => this.toasts.addWarning(toastOrTitle);
-  public addDanger = (toastOrTitle: ToastInput) => this.toasts.addDanger(toastOrTitle);
-  public addError = (error: Error, options: ErrorToastOptions) =>
-    this.toasts.addError(error, options);
-}
+/**
+ * ToastNotifications is deprecated! Please use npSetup.core.notifications.toasts instead
+ */
+export { ToastNotifications } from '../../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/notify/toasts/toasts.ts b/src/legacy/ui/public/notify/toasts/toasts.ts
index 8889ee4a6d981..15be7a7891553 100644
--- a/src/legacy/ui/public/notify/toasts/toasts.ts
+++ b/src/legacy/ui/public/notify/toasts/toasts.ts
@@ -19,5 +19,4 @@
 
 import { npSetup } from 'ui/new_platform';
 import { ToastNotifications } from './toast_notifications';
-
 export const toastNotifications = new ToastNotifications(npSetup.core.notifications.toasts);
diff --git a/src/legacy/ui/public/private/index.d.ts b/src/legacy/ui/public/private/index.d.ts
index d814b31102d59..895dc63939311 100644
--- a/src/legacy/ui/public/private/index.d.ts
+++ b/src/legacy/ui/public/private/index.d.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { IPrivate } from './private';
+export { IPrivate } from '../../../../plugins/kibana_legacy/public/utils/private';
diff --git a/src/legacy/ui/public/private/private.js b/src/legacy/ui/public/private/private.js
index 05bd55f4e1bdf..7a0751959417e 100644
--- a/src/legacy/ui/public/private/private.js
+++ b/src/legacy/ui/public/private/private.js
@@ -17,196 +17,7 @@
  * under the License.
  */
 
-import _ from 'lodash';
 import { uiModules } from '../modules';
-/**
- * # `Private()`
- * Private module loader, used to merge angular and require js dependency styles
- * by allowing a require.js module to export a single provider function that will
- * create a value used within an angular application. This provider can declare
- * angular dependencies by listing them as arguments, and can be require additional
- * Private modules.
- *
- * ## Define a private module provider:
- * ```js
- * export default function PingProvider($http) {
- *   this.ping = function () {
- *     return $http.head('/health-check');
- *   };
- * };
- * ```
- *
- * ## Require a private module:
- * ```js
- * export default function ServerHealthProvider(Private, Promise) {
- *   let ping = Private(require('ui/ping'));
- *   return {
- *     check: Promise.method(function () {
- *       let attempts = 0;
- *       return (function attempt() {
- *         attempts += 1;
- *         return ping.ping()
- *         .catch(function (err) {
- *           if (attempts < 3) return attempt();
- *         })
- *       }())
- *       .then(function () {
- *         return true;
- *       })
- *       .catch(function () {
- *         return false;
- *       });
- *     })
- *   }
- * };
- * ```
- *
- * # `Private.stub(provider, newInstance)`
- * `Private.stub()` replaces the instance of a module with another value. This is all we have needed until now.
- *
- * ```js
- * beforeEach(inject(function ($injector, Private) {
- *   Private.stub(
- *     // since this module just exports a function, we need to change
- *     // what Private returns in order to modify it's behavior
- *     require('ui/agg_response/hierarchical/_build_split'),
- *     sinon.stub().returns(fakeSplit)
- *   );
- * }));
- * ```
- *
- * # `Private.swap(oldProvider, newProvider)`
- * This new method does an 1-for-1 swap of module providers, unlike `stub()` which replaces a modules instance.
- * Pass the module you want to swap out, and the one it should be replaced with, then profit.
- *
- * Note: even though this example shows `swap()` being called in a config
- * function, it can be called from anywhere. It is particularly useful
- * in this scenario though.
- *
- * ```js
- * beforeEach(module('kibana', function (PrivateProvider) {
- *   PrivateProvider.swap(
- *     function StubbedRedirectProvider($decorate) {
- *       // $decorate is a function that will instantiate the original module when called
- *       return sinon.spy($decorate());
- *     }
- *   );
- * }));
- * ```
- *
- * @param {[type]} prov [description]
- */
-
-const nextId = _.partial(_.uniqueId, 'privateProvider#');
-
-function name(fn) {
-  return (
-    fn.name ||
-    fn
-      .toString()
-      .split('\n')
-      .shift()
-  );
-}
-
-export function PrivateProvider() {
-  const provider = this;
-
-  // one cache/swaps per Provider
-  const cache = {};
-  const swaps = {};
-
-  // return the uniq id for this function
-  function identify(fn) {
-    if (typeof fn !== 'function') {
-      throw new TypeError('Expected private module "' + fn + '" to be a function');
-    }
-
-    if (fn.$$id) return fn.$$id;
-    else return (fn.$$id = nextId());
-  }
-
-  provider.stub = function(fn, instance) {
-    cache[identify(fn)] = instance;
-    return instance;
-  };
-
-  provider.swap = function(fn, prov) {
-    const id = identify(fn);
-    swaps[id] = prov;
-  };
-
-  provider.$get = [
-    '$injector',
-    function PrivateFactory($injector) {
-      // prevent circular deps by tracking where we came from
-      const privPath = [];
-      const pathToString = function() {
-        return privPath.map(name).join(' -> ');
-      };
-
-      // call a private provider and return the instance it creates
-      function instantiate(prov, locals) {
-        if (~privPath.indexOf(prov)) {
-          throw new Error(
-            'Circular reference to "' +
-              name(prov) +
-              '"' +
-              ' found while resolving private deps: ' +
-              pathToString()
-          );
-        }
-
-        privPath.push(prov);
-
-        const context = {};
-        let instance = $injector.invoke(prov, context, locals);
-        if (!_.isObject(instance)) instance = context;
-
-        privPath.pop();
-        return instance;
-      }
-
-      // retrieve an instance from cache or create and store on
-      function get(id, prov, $delegateId, $delegateProv) {
-        if (cache[id]) return cache[id];
-
-        let instance;
-
-        if ($delegateId != null && $delegateProv != null) {
-          instance = instantiate(prov, {
-            $decorate: _.partial(get, $delegateId, $delegateProv),
-          });
-        } else {
-          instance = instantiate(prov);
-        }
-
-        return (cache[id] = instance);
-      }
-
-      // main api, get the appropriate instance for a provider
-      function Private(prov) {
-        let id = identify(prov);
-        let $delegateId;
-        let $delegateProv;
-
-        if (swaps[id]) {
-          $delegateId = id;
-          $delegateProv = prov;
-
-          prov = swaps[$delegateId];
-          id = identify(prov);
-        }
-
-        return get(id, prov, $delegateId, $delegateProv);
-      }
-
-      Private.stub = provider.stub;
-      Private.swap = provider.swap;
-
-      return Private;
-    },
-  ];
-}
+import { PrivateProvider } from '../../../../plugins/kibana_legacy/public';
 
 uiModules.get('kibana/private').provider('Private', PrivateProvider);
diff --git a/src/legacy/ui/public/promises/index.ts b/src/legacy/ui/public/promises/index.ts
new file mode 100644
index 0000000000000..07bb2554c5eda
--- /dev/null
+++ b/src/legacy/ui/public/promises/index.ts
@@ -0,0 +1,28 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PromiseServiceCreator } from '../../../../plugins/kibana_legacy/public';
+export { createDefer } from './defer';
+// @ts-ignore
+import { uiModules } from '../modules';
+
+const module = uiModules.get('kibana');
+// Provides a tiny subset of the excellent API from
+// bluebird, reimplemented using the $q service
+module.service('Promise', PromiseServiceCreator);
diff --git a/src/legacy/ui/public/saved_objects/_index.scss b/src/legacy/ui/public/saved_objects/_index.scss
index 50a192b6a7b17..89cda29f67744 100644
--- a/src/legacy/ui/public/saved_objects/_index.scss
+++ b/src/legacy/ui/public/saved_objects/_index.scss
@@ -1 +1 @@
-@import '../../../../plugins/kibana_react/public/saved_objects/index';
+@import '../../../../plugins/saved_objects/public/index';
diff --git a/src/legacy/ui/public/saved_objects/components/saved_object_save_modal.tsx b/src/legacy/ui/public/saved_objects/components/saved_object_save_modal.tsx
deleted file mode 100644
index 131f28059cebd..0000000000000
--- a/src/legacy/ui/public/saved_objects/components/saved_object_save_modal.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @deprecated
- *
- * Do not import this component from here. Import from `src/plugins/kibana_react` instead.
- */
-export { SavedObjectSaveModal } from '../../../../../plugins/kibana_react/public';
diff --git a/src/legacy/ui/public/saved_objects/helpers/parse_search_source.ts b/src/legacy/ui/public/saved_objects/helpers/parse_search_source.ts
index 8c52b7cfa0dbf..b194420fc1cd0 100644
--- a/src/legacy/ui/public/saved_objects/helpers/parse_search_source.ts
+++ b/src/legacy/ui/public/saved_objects/helpers/parse_search_source.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 import _ from 'lodash';
-import { migrateLegacyQuery } from 'ui/utils/migrate_legacy_query';
+import { migrateLegacyQuery } from '../../../../../plugins/kibana_legacy/public';
 import { SavedObject } from '../types';
 import { InvalidJSONProperty } from '../../../../../plugins/kibana_utils/public';
 
diff --git a/src/legacy/ui/public/styles/_legacy/_index.scss b/src/legacy/ui/public/styles/_legacy/_index.scss
index 106730fecd2b8..a0b1a98b09b7d 100644
--- a/src/legacy/ui/public/styles/_legacy/_index.scss
+++ b/src/legacy/ui/public/styles/_legacy/_index.scss
@@ -1,6 +1,5 @@
 // //
 // // KIBANA THEME
-@import './depth';
 @import './base';
 @import './mixins';
 
diff --git a/src/legacy/ui/public/system_api/__tests__/system_api.js b/src/legacy/ui/public/system_api/__tests__/system_api.js
index 1bb8656502204..822edaa08fdd6 100644
--- a/src/legacy/ui/public/system_api/__tests__/system_api.js
+++ b/src/legacy/ui/public/system_api/__tests__/system_api.js
@@ -18,7 +18,10 @@
  */
 
 import expect from '@kbn/expect';
-import { addSystemApiHeader, isSystemApiRequest } from '../system_api';
+import {
+  addSystemApiHeader,
+  isSystemApiRequest,
+} from '../../../../../plugins/kibana_legacy/public';
 
 describe('system_api', () => {
   describe('#addSystemApiHeader', () => {
diff --git a/src/legacy/ui/public/system_api/index.js b/src/legacy/ui/public/system_api/index.js
index 61c5909395aef..6361c0ea6c69a 100644
--- a/src/legacy/ui/public/system_api/index.js
+++ b/src/legacy/ui/public/system_api/index.js
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-export { addSystemApiHeader, isSystemApiRequest } from './system_api';
+export { addSystemApiHeader, isSystemApiRequest } from '../../../../plugins/kibana_legacy/public';
diff --git a/src/legacy/ui/public/time_buckets/time_buckets.js b/src/legacy/ui/public/time_buckets/time_buckets.js
index 50a57d866099e..a611de45fa859 100644
--- a/src/legacy/ui/public/time_buckets/time_buckets.js
+++ b/src/legacy/ui/public/time_buckets/time_buckets.js
@@ -144,7 +144,7 @@ TimeBuckets.prototype.getDuration = function() {
  * generated.
  *
  * Input can be one of the following:
- *  - Any object from src/legacy/ui/agg_types/buckets/_interval_options.js
+ *  - Any object from src/legacy/ui/agg_types.js
  *  - "auto"
  *  - Pass a valid moment unit
  *  - a moment.duration object.
diff --git a/src/legacy/ui/public/vis/__tests__/_agg_config.js b/src/legacy/ui/public/vis/__tests__/_agg_config.js
index 2ccbaf6c1645e..7dccf3eec18aa 100644
--- a/src/legacy/ui/public/vis/__tests__/_agg_config.js
+++ b/src/legacy/ui/public/vis/__tests__/_agg_config.js
@@ -21,8 +21,8 @@ import sinon from 'sinon';
 import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
 import { Vis } from '../../../../core_plugins/visualizations/public';
-import { AggType } from '../../agg_types/agg_type';
-import { AggConfig } from '../../agg_types/agg_config';
+import { AggType, AggConfig } from '../../agg_types';
+
 import FixturesStubbedLogstashIndexPatternProvider from 'fixtures/stubbed_logstash_index_pattern';
 
 describe('AggConfig', function() {
diff --git a/src/legacy/ui/public/vis/config/editor_config_providers.test.ts b/src/legacy/ui/public/vis/config/editor_config_providers.test.ts
deleted file mode 100644
index 9d93930c09ebc..0000000000000
--- a/src/legacy/ui/public/vis/config/editor_config_providers.test.ts
+++ /dev/null
@@ -1,210 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { AggConfig } from 'ui/agg_types';
-import { EditorConfigProviderRegistry } from './editor_config_providers';
-import { EditorParamConfig, FixedParam, NumericIntervalParam, TimeIntervalParam } from './types';
-
-jest.mock('ui/new_platform');
-
-describe('EditorConfigProvider', () => {
-  let registry: EditorConfigProviderRegistry;
-  const indexPattern = {
-    id: '1234',
-    title: 'logstash-*',
-    fields: [
-      {
-        name: 'response',
-        type: 'number',
-        esTypes: ['integer'],
-        aggregatable: true,
-        filterable: true,
-        searchable: true,
-      },
-    ],
-  } as any;
-
-  beforeEach(() => {
-    registry = new EditorConfigProviderRegistry();
-  });
-
-  it('should call registered providers with given parameters', () => {
-    const provider = jest.fn<any, any>(() => ({}));
-    registry.register(provider);
-    expect(provider).not.toHaveBeenCalled();
-    const aggConfig = {} as AggConfig;
-    registry.getConfigForAgg(indexPattern, aggConfig);
-    expect(provider).toHaveBeenCalledWith(indexPattern, aggConfig);
-  });
-
-  it('should call all registered providers with given parameters', () => {
-    const provider = jest.fn<any, any>(() => ({}));
-    const provider2 = jest.fn<any, any>(() => ({}));
-    registry.register(provider);
-    registry.register(provider2);
-    expect(provider).not.toHaveBeenCalled();
-    expect(provider2).not.toHaveBeenCalled();
-    const aggConfig = {} as AggConfig;
-    registry.getConfigForAgg(indexPattern, aggConfig);
-    expect(provider).toHaveBeenCalledWith(indexPattern, aggConfig);
-    expect(provider2).toHaveBeenCalledWith(indexPattern, aggConfig);
-  });
-
-  describe('merging configs', () => {
-    function singleConfig(paramConfig: EditorParamConfig) {
-      return () => ({ singleParam: paramConfig });
-    }
-
-    function getOutputConfig(reg: EditorConfigProviderRegistry) {
-      return reg.getConfigForAgg(indexPattern, {} as AggConfig).singleParam;
-    }
-
-    it('should have hidden true if at least one config was hidden true', () => {
-      registry.register(singleConfig({ hidden: false }));
-      registry.register(singleConfig({ hidden: true }));
-      registry.register(singleConfig({ hidden: false }));
-      const config = getOutputConfig(registry);
-      expect(config.hidden).toBe(true);
-    });
-
-    it('should merge the same fixed values', () => {
-      registry.register(singleConfig({ fixedValue: 'foo' }));
-      registry.register(singleConfig({ fixedValue: 'foo' }));
-      const config = getOutputConfig(registry) as FixedParam;
-      expect(config).toHaveProperty('fixedValue');
-      expect(config.fixedValue).toBe('foo');
-    });
-
-    it('should throw having different fixed values', () => {
-      registry.register(singleConfig({ fixedValue: 'foo' }));
-      registry.register(singleConfig({ fixedValue: 'bar' }));
-      expect(() => {
-        getOutputConfig(registry);
-      }).toThrowError();
-    });
-
-    it('should allow same base values', () => {
-      registry.register(singleConfig({ base: 5 }));
-      registry.register(singleConfig({ base: 5 }));
-      const config = getOutputConfig(registry) as NumericIntervalParam;
-      expect(config).toHaveProperty('base');
-      expect(config.base).toBe(5);
-    });
-
-    it('should merge multiple base values, using least common multiple', () => {
-      registry.register(singleConfig({ base: 2 }));
-      registry.register(singleConfig({ base: 5 }));
-      registry.register(singleConfig({ base: 8 }));
-      const config = getOutputConfig(registry) as NumericIntervalParam;
-      expect(config).toHaveProperty('base');
-      expect(config.base).toBe(40);
-    });
-
-    it('should throw on combining fixedValue with base', () => {
-      registry.register(singleConfig({ fixedValue: 'foo' }));
-      registry.register(singleConfig({ base: 5 }));
-      expect(() => {
-        getOutputConfig(registry);
-      }).toThrowError();
-    });
-
-    it('should allow same timeBase values', () => {
-      registry.register(singleConfig({ timeBase: '2h', default: '2h' }));
-      registry.register(singleConfig({ timeBase: '2h', default: '2h' }));
-      const config = getOutputConfig(registry) as TimeIntervalParam;
-      expect(config).toHaveProperty('timeBase');
-      expect(config).toHaveProperty('default');
-      expect(config.timeBase).toBe('2h');
-      expect(config.default).toBe('2h');
-    });
-
-    it('should merge multiple compatible timeBase values, using least common interval', () => {
-      registry.register(singleConfig({ timeBase: '2h', default: '2h' }));
-      registry.register(singleConfig({ timeBase: '3h', default: '3h' }));
-      registry.register(singleConfig({ timeBase: '4h', default: '4h' }));
-      const config = getOutputConfig(registry) as TimeIntervalParam;
-      expect(config).toHaveProperty('timeBase');
-      expect(config).toHaveProperty('default');
-      expect(config.timeBase).toBe('12h');
-      expect(config.default).toBe('12h');
-    });
-
-    it('should throw on combining incompatible timeBase values', () => {
-      registry.register(singleConfig({ timeBase: '2h', default: '2h' }));
-      registry.register(singleConfig({ timeBase: '1d', default: '1d' }));
-      expect(() => {
-        getOutputConfig(registry);
-      }).toThrowError();
-    });
-
-    it('should throw on invalid timeBase values', () => {
-      registry.register(singleConfig({ timeBase: '2w', default: '2w' }));
-      expect(() => {
-        getOutputConfig(registry);
-      }).toThrowError();
-    });
-
-    it('should throw if timeBase and default are different', () => {
-      registry.register(singleConfig({ timeBase: '1h', default: '2h' }));
-      expect(() => {
-        getOutputConfig(registry);
-      }).toThrowError();
-    });
-
-    it('should merge hidden together with fixedValue', () => {
-      registry.register(singleConfig({ fixedValue: 'foo', hidden: true }));
-      registry.register(singleConfig({ fixedValue: 'foo', hidden: false }));
-      const config = getOutputConfig(registry) as FixedParam;
-      expect(config).toHaveProperty('fixedValue');
-      expect(config).toHaveProperty('hidden');
-      expect(config.fixedValue).toBe('foo');
-      expect(config.hidden).toBe(true);
-    });
-
-    it('should merge hidden together with base', () => {
-      registry.register(singleConfig({ base: 2, hidden: false }));
-      registry.register(singleConfig({ base: 13, hidden: false }));
-      const config = getOutputConfig(registry) as NumericIntervalParam;
-      expect(config).toHaveProperty('base');
-      expect(config).toHaveProperty('hidden');
-      expect(config.base).toBe(26);
-      expect(config.hidden).toBe(false);
-    });
-
-    it('should merge hidden together with timeBase', () => {
-      registry.register(singleConfig({ timeBase: '2h', default: '2h', hidden: false }));
-      registry.register(singleConfig({ timeBase: '4h', default: '4h', hidden: false }));
-      const config = getOutputConfig(registry) as TimeIntervalParam;
-      expect(config).toHaveProperty('timeBase');
-      expect(config).toHaveProperty('default');
-      expect(config).toHaveProperty('hidden');
-      expect(config.timeBase).toBe('4h');
-      expect(config.default).toBe('4h');
-      expect(config.hidden).toBe(false);
-    });
-
-    it('should merge helps together into one string', () => {
-      registry.register(singleConfig({ help: 'Warning' }));
-      registry.register(singleConfig({ help: 'Another help' }));
-      const config = getOutputConfig(registry);
-      expect(config).toHaveProperty('help');
-      expect(config.help).toBe('Warning\n\nAnother help');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/vis/config/editor_config_providers.ts b/src/legacy/ui/public/vis/config/editor_config_providers.ts
deleted file mode 100644
index 1e82a3ca2762e..0000000000000
--- a/src/legacy/ui/public/vis/config/editor_config_providers.ts
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { IndexPattern } from 'src/plugins/data/public';
-import { AggConfig } from 'ui/agg_types';
-import { parseEsInterval } from '../../../../core_plugins/data/public';
-import {
-  TimeIntervalParam,
-  EditorConfig,
-  EditorParamConfig,
-  FixedParam,
-  NumericIntervalParam,
-} from './types';
-import { leastCommonInterval, leastCommonMultiple } from '../lib';
-
-type EditorConfigProvider = (indexPattern: IndexPattern, aggConfig: AggConfig) => EditorConfig;
-
-class EditorConfigProviderRegistry {
-  private providers: Set<EditorConfigProvider> = new Set();
-
-  public register(configProvider: EditorConfigProvider): void {
-    this.providers.add(configProvider);
-  }
-
-  public getConfigForAgg(indexPattern: IndexPattern, aggConfig: AggConfig): EditorConfig {
-    const configs = Array.from(this.providers).map(provider => provider(indexPattern, aggConfig));
-    return this.mergeConfigs(configs);
-  }
-
-  private isTimeBaseParam(config: EditorParamConfig): config is TimeIntervalParam {
-    return config.hasOwnProperty('default') && config.hasOwnProperty('timeBase');
-  }
-
-  private isBaseParam(config: EditorParamConfig): config is NumericIntervalParam {
-    return config.hasOwnProperty('base');
-  }
-
-  private isFixedParam(config: EditorParamConfig): config is FixedParam {
-    return config.hasOwnProperty('fixedValue');
-  }
-
-  private mergeHidden(current: EditorParamConfig, merged: EditorParamConfig): boolean {
-    return Boolean(current.hidden || merged.hidden);
-  }
-
-  private mergeHelp(current: EditorParamConfig, merged: EditorParamConfig): string | undefined {
-    if (!current.help) {
-      return merged.help;
-    }
-
-    return merged.help ? `${merged.help}\n\n${current.help}` : current.help;
-  }
-
-  private mergeFixedAndBase(
-    current: EditorParamConfig,
-    merged: EditorParamConfig,
-    paramName: string
-  ): { fixedValue: unknown } | { base: number } | {} {
-    if (
-      this.isFixedParam(current) &&
-      this.isFixedParam(merged) &&
-      current.fixedValue !== merged.fixedValue
-    ) {
-      // In case multiple configurations provided a fixedValue, these must all be the same.
-      // If not we'll throw an error.
-      throw new Error(`Two EditorConfigProviders provided different fixed values for field ${paramName}:
-          ${merged.fixedValue} !== ${current.fixedValue}`);
-    }
-
-    if (
-      (this.isFixedParam(current) && this.isBaseParam(merged)) ||
-      (this.isBaseParam(current) && this.isFixedParam(merged))
-    ) {
-      // In case one config tries to set a fixed value and another setting a base value,
-      // we'll throw an error. This could be solved more elegantly, by allowing fixedValues
-      // that are the multiple of the specific base value, but since there is no use-case for that
-      // right now, this isn't implemented.
-      throw new Error(`Tried to provide a fixedValue and a base for param ${paramName}.`);
-    }
-
-    if (this.isBaseParam(current) && this.isBaseParam(merged)) {
-      // In case where both had interval values, just use the least common multiple between both interval
-      return {
-        base: leastCommonMultiple(current.base, merged.base),
-      };
-    }
-
-    // In this case we haven't had a fixed value of base for that param yet, we use the one specified
-    // in the current config
-    if (this.isFixedParam(current)) {
-      return {
-        fixedValue: current.fixedValue,
-      };
-    }
-    if (this.isBaseParam(current)) {
-      return {
-        base: current.base,
-      };
-    }
-
-    return {};
-  }
-
-  private mergeTimeBase(
-    current: TimeIntervalParam,
-    merged: EditorParamConfig,
-    paramName: string
-  ): { timeBase: string; default: string } {
-    if (current.default !== current.timeBase) {
-      throw new Error(`Tried to provide differing default and timeBase values for ${paramName}.`);
-    }
-
-    if (this.isTimeBaseParam(merged)) {
-      // In case both had where interval values, just use the least common multiple between both intervals
-      const timeBase = leastCommonInterval(current.timeBase, merged.timeBase);
-      return {
-        default: timeBase,
-        timeBase,
-      };
-    }
-
-    // This code is simply here to throw an error in case the `timeBase` is not a valid ES interval
-    parseEsInterval(current.timeBase);
-    return {
-      default: current.timeBase,
-      timeBase: current.timeBase,
-    };
-  }
-
-  private mergeConfigs(configs: EditorConfig[]): EditorConfig {
-    return configs.reduce((output, conf) => {
-      Object.entries(conf).forEach(([paramName, paramConfig]) => {
-        if (!output[paramName]) {
-          output[paramName] = {};
-        }
-
-        output[paramName] = {
-          hidden: this.mergeHidden(paramConfig, output[paramName]),
-          help: this.mergeHelp(paramConfig, output[paramName]),
-          ...(this.isTimeBaseParam(paramConfig)
-            ? this.mergeTimeBase(paramConfig, output[paramName], paramName)
-            : this.mergeFixedAndBase(paramConfig, output[paramName], paramName)),
-        };
-      });
-      return output;
-    }, {});
-  }
-}
-
-const editorConfigProviders = new EditorConfigProviderRegistry();
-
-export { editorConfigProviders, EditorConfigProviderRegistry };
diff --git a/src/legacy/ui/public/vis/config/types.ts b/src/legacy/ui/public/vis/config/types.ts
deleted file mode 100644
index 61c0ced3cd519..0000000000000
--- a/src/legacy/ui/public/vis/config/types.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * A hidden parameter can be hidden from the UI completely.
- */
-interface Param {
-  hidden?: boolean;
-  help?: string;
-}
-
-/**
- * A fixed parameter has a fixed value for a specific field.
- * It can optionally also be hidden.
- */
-export type FixedParam = Partial<Param> & {
-  fixedValue: any;
-};
-
-/**
- * Numeric interval parameters must always be set in the editor to a multiple of
- * the specified base. It can optionally also be hidden.
- */
-export type NumericIntervalParam = Partial<Param> & {
-  base: number;
-};
-
-/**
- * Time interval parameters must always be set in the editor to a multiple of
- * the specified base. It can optionally also be hidden.
- */
-export type TimeIntervalParam = Partial<Param> & {
-  default: string;
-  timeBase: string;
-};
-
-export type EditorParamConfig = NumericIntervalParam | TimeIntervalParam | FixedParam | Param;
-
-export interface EditorConfig {
-  [paramName: string]: EditorParamConfig;
-}
diff --git a/src/legacy/ui/public/visualize/loader/pipeline_helpers/utilities.ts b/src/legacy/ui/public/visualize/loader/pipeline_helpers/utilities.ts
index e763eb1b90791..d8227343159e6 100644
--- a/src/legacy/ui/public/visualize/loader/pipeline_helpers/utilities.ts
+++ b/src/legacy/ui/public/visualize/loader/pipeline_helpers/utilities.ts
@@ -19,15 +19,15 @@
 
 import { i18n } from '@kbn/i18n';
 import { identity } from 'lodash';
-import { AggConfig } from 'ui/agg_types';
+import { IAggConfig } from 'ui/agg_types';
 import { npStart } from 'ui/new_platform';
 import { SerializedFieldFormat } from 'src/plugins/expressions/public';
 import { fieldFormats } from '../../../../../../plugins/data/public';
 import { Vis } from '../../../../../core_plugins/visualizations/public';
 
 import { tabifyGetColumns } from '../../../agg_response/tabify/_get_columns';
-import { DateRangeKey, convertDateRangeToString } from '../../../agg_types/buckets/date_range';
-import { IpRangeKey, convertIPRangeToString } from '../../../agg_types/buckets/ip_range';
+import { DateRangeKey, convertDateRangeToString } from '../../../agg_types';
+import { IpRangeKey, convertIPRangeToString } from '../../../agg_types';
 
 interface TermsFieldFormatParams {
   otherBucketLabel: string;
@@ -62,7 +62,7 @@ const getFieldFormat = (
   return new DefaultFieldFormat();
 };
 
-export const createFormat = (agg: AggConfig): SerializedFieldFormat => {
+export const createFormat = (agg: IAggConfig): SerializedFieldFormat => {
   const format: SerializedFieldFormat = agg.params.field ? agg.params.field.format.toJSON() : {};
   const formats: Record<string, () => SerializedFieldFormat> = {
     date_range: () => ({ id: 'date_range', params: format }),
@@ -106,7 +106,7 @@ export const getFormat: FormatFactory = mapping => {
       const format = getFieldFormat(id, mapping.params);
       const gte = '\u2265';
       const lt = '\u003c';
-      return i18n.translate('common.ui.aggTypes.buckets.ranges.rangesFormatMessage', {
+      return i18n.translate('common.ui.aggTypes.rangesFormatMessage', {
         defaultMessage: '{gte} {from} and {lt} {to}',
         values: {
           gte,
@@ -155,7 +155,7 @@ export const getFormat: FormatFactory = mapping => {
   }
 };
 
-export const getTableAggs = (vis: Vis): AggConfig[] => {
+export const getTableAggs = (vis: Vis): IAggConfig[] => {
   if (!vis.aggs || !vis.aggs.getResponseAggs) {
     return [];
   }
diff --git a/src/optimize/base_optimizer.js b/src/optimize/base_optimizer.js
index efff7f0aa2b46..d9df2a1955df3 100644
--- a/src/optimize/base_optimizer.js
+++ b/src/optimize/base_optimizer.js
@@ -256,6 +256,7 @@ export default class BaseOptimizer {
       profile: this.profile || false,
 
       output: {
+        futureEmitAssets: true, // TODO: remove on webpack 5
         path: this.uiBundles.getWorkingDir(),
         filename: '[name].bundle.js',
         sourceMapFilename: '[file].map',
diff --git a/src/optimize/dynamic_dll_plugin/dll_config_model.js b/src/optimize/dynamic_dll_plugin/dll_config_model.js
index c7ab2fe30dd14..2e74cb6af86d4 100644
--- a/src/optimize/dynamic_dll_plugin/dll_config_model.js
+++ b/src/optimize/dynamic_dll_plugin/dll_config_model.js
@@ -48,6 +48,7 @@ function generateDLL(config) {
     entry: dllEntry,
     context: dllContext,
     output: {
+      futureEmitAssets: true, // TODO: remove on webpack 5
       filename: dllBundleFilename,
       path: dllOutputPath,
       publicPath: dllPublicPath,
@@ -227,36 +228,7 @@ function optimized(config) {
           cache: false,
           extractComments: false,
           terserOptions: {
-            compress: {
-              // The following is required for dead-code the removal
-              // check in React DevTools
-              //
-              // default
-              unused: true,
-              dead_code: true,
-              conditionals: true,
-              evaluate: true,
-
-              // changed
-              keep_fnames: true,
-              keep_infinity: true,
-              comparisons: false,
-              sequences: false,
-              properties: false,
-              drop_debugger: false,
-              booleans: false,
-              loops: false,
-              toplevel: false,
-              top_retain: false,
-              hoist_funs: false,
-              if_return: false,
-              join_vars: false,
-              collapse_vars: false,
-              reduce_vars: false,
-              warnings: false,
-              negate_iife: false,
-              side_effects: false,
-            },
+            compress: false,
             mangle: false,
           },
         }),
diff --git a/src/plugins/advanced_settings/kibana.json b/src/plugins/advanced_settings/kibana.json
new file mode 100644
index 0000000000000..5fc1e916ae45f
--- /dev/null
+++ b/src/plugins/advanced_settings/kibana.json
@@ -0,0 +1,7 @@
+{
+  "id": "advancedSettings",
+  "version": "kibana",
+  "server": false,
+  "ui": true,
+  "requiredPlugins": []
+}
diff --git a/src/plugins/advanced_settings/public/component_registry/__snapshots__/component_registry.test.tsx.snap b/src/plugins/advanced_settings/public/component_registry/__snapshots__/component_registry.test.tsx.snap
new file mode 100644
index 0000000000000..1d6cc882cb344
--- /dev/null
+++ b/src/plugins/advanced_settings/public/component_registry/__snapshots__/component_registry.test.tsx.snap
@@ -0,0 +1,3 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ComponentRegistry register should disallow registering a component with a duplicate id 1`] = `"Component with id advanced_settings_page_title is already registered."`;
diff --git a/src/plugins/advanced_settings/public/component_registry/component_registry.test.tsx b/src/plugins/advanced_settings/public/component_registry/component_registry.test.tsx
new file mode 100644
index 0000000000000..3b722e9517fdb
--- /dev/null
+++ b/src/plugins/advanced_settings/public/component_registry/component_registry.test.tsx
@@ -0,0 +1,90 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { ComponentRegistry } from './component_registry';
+
+describe('ComponentRegistry', () => {
+  describe('register', () => {
+    it('should allow a component to be registered', () => {
+      const component = () => <div />;
+      new ComponentRegistry().setup.register(
+        ComponentRegistry.componentType.PAGE_TITLE_COMPONENT,
+        component
+      );
+    });
+
+    it('should disallow registering a component with a duplicate id', () => {
+      const registry = new ComponentRegistry();
+      const component = () => <div />;
+      registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, component);
+      expect(() =>
+        registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, () => (
+          <span />
+        ))
+      ).toThrowErrorMatchingSnapshot();
+    });
+
+    it('should allow a component to be overriden', () => {
+      const registry = new ComponentRegistry();
+      const component = () => <div />;
+      registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, component);
+
+      const anotherComponent = () => <span />;
+      registry.setup.register(
+        ComponentRegistry.componentType.PAGE_TITLE_COMPONENT,
+        anotherComponent,
+        true
+      );
+
+      expect(registry.start.get(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT)).toBe(
+        anotherComponent
+      );
+    });
+  });
+
+  describe('get', () => {
+    it('should allow a component to be retrieved', () => {
+      const registry = new ComponentRegistry();
+      const component = () => <div />;
+      registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, component);
+      expect(registry.start.get(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT)).toBe(
+        component
+      );
+    });
+  });
+
+  it('should set a displayName for the component if one does not exist', () => {
+    const component: React.ComponentType = () => <div />;
+    const registry = new ComponentRegistry();
+    registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, component);
+
+    expect(component.displayName).toEqual(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT);
+  });
+
+  it('should not set a displayName for the component if one already exists', () => {
+    const component: React.ComponentType = () => <div />;
+    component.displayName = '<AwesomeComponent>';
+    const registry = new ComponentRegistry();
+
+    registry.setup.register(ComponentRegistry.componentType.PAGE_TITLE_COMPONENT, component);
+
+    expect(component.displayName).toEqual('<AwesomeComponent>');
+  });
+});
diff --git a/src/plugins/advanced_settings/public/component_registry/component_registry.ts b/src/plugins/advanced_settings/public/component_registry/component_registry.ts
new file mode 100644
index 0000000000000..cc61798e84cb7
--- /dev/null
+++ b/src/plugins/advanced_settings/public/component_registry/component_registry.ts
@@ -0,0 +1,91 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ComponentType } from 'react';
+import { PageTitle } from './page_title';
+import { PageSubtitle } from './page_subtitle';
+import { PageFooter } from './page_footer';
+
+type Id =
+  | 'advanced_settings_page_title'
+  | 'advanced_settings_page_subtitle'
+  | 'advanced_settings_page_footer';
+
+const componentType: { [key: string]: Id } = {
+  PAGE_TITLE_COMPONENT: 'advanced_settings_page_title' as Id,
+  PAGE_SUBTITLE_COMPONENT: 'advanced_settings_page_subtitle' as Id,
+  PAGE_FOOTER_COMPONENT: 'advanced_settings_page_footer' as Id,
+};
+
+type RegistryComponent = ComponentType<Record<string, any> | undefined>;
+
+export class ComponentRegistry {
+  static readonly componentType = componentType;
+  static readonly defaultRegistry: Record<Id, RegistryComponent> = {
+    advanced_settings_page_title: PageTitle,
+    advanced_settings_page_subtitle: PageSubtitle,
+    advanced_settings_page_footer: PageFooter,
+  };
+
+  registry: { [key in Id]?: RegistryComponent } = {};
+
+  /**
+   * Attempts to register the provided component, with the ability to optionally allow
+   * the component to override an existing one.
+   *
+   * If the intent is to override, then `allowOverride` must be set to true, otherwise an exception is thrown.
+   *
+   * @param {*} id the id of the component to register
+   * @param {*} component the component
+   * @param {*} allowOverride (default: false) - optional flag to allow this component to override a previously registered component
+   */
+  private register(id: Id, component: RegistryComponent, allowOverride = false) {
+    if (!allowOverride && id in this.registry) {
+      throw new Error(`Component with id ${id} is already registered.`);
+    }
+
+    // Setting a display name if one does not already exist.
+    // This enhances the snapshots, as well as the debugging experience.
+    if (!component.displayName) {
+      component.displayName = id;
+    }
+
+    this.registry[id] = component;
+  }
+
+  /**
+   * Retrieve a registered component by its ID.
+   * If the component does not exist, then an exception is thrown.
+   *
+   * @param {*} id the ID of the component to retrieve
+   */
+  private get(id: Id): RegistryComponent {
+    return this.registry[id] || ComponentRegistry.defaultRegistry[id];
+  }
+
+  setup = {
+    componentType: ComponentRegistry.componentType,
+    register: this.register.bind(this),
+  };
+
+  start = {
+    componentType: ComponentRegistry.componentType,
+    get: this.get.bind(this),
+  };
+}
diff --git a/src/legacy/ui/public/promises/index.js b/src/plugins/advanced_settings/public/component_registry/index.ts
similarity index 93%
rename from src/legacy/ui/public/promises/index.js
rename to src/plugins/advanced_settings/public/component_registry/index.ts
index 88fe7520d4967..79c9248e0c2a9 100644
--- a/src/legacy/ui/public/promises/index.js
+++ b/src/plugins/advanced_settings/public/component_registry/index.ts
@@ -17,5 +17,4 @@
  * under the License.
  */
 
-import './promises';
-export { createDefer } from './defer';
+export { ComponentRegistry } from './component_registry';
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/__snapshots__/page_footer.test.tsx.snap b/src/plugins/advanced_settings/public/component_registry/page_footer/__snapshots__/page_footer.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/__snapshots__/page_footer.test.tsx.snap
rename to src/plugins/advanced_settings/public/component_registry/page_footer/__snapshots__/page_footer.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/index.ts b/src/plugins/advanced_settings/public/component_registry/page_footer/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/index.ts
rename to src/plugins/advanced_settings/public/component_registry/page_footer/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/page_footer.test.tsx b/src/plugins/advanced_settings/public/component_registry/page_footer/page_footer.test.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/page_footer.test.tsx
rename to src/plugins/advanced_settings/public/component_registry/page_footer/page_footer.test.tsx
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/page_footer.ts b/src/plugins/advanced_settings/public/component_registry/page_footer/page_footer.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_footer/page_footer.ts
rename to src/plugins/advanced_settings/public/component_registry/page_footer/page_footer.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/__snapshots__/page_subtitle.test.tsx.snap b/src/plugins/advanced_settings/public/component_registry/page_subtitle/__snapshots__/page_subtitle.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/__snapshots__/page_subtitle.test.tsx.snap
rename to src/plugins/advanced_settings/public/component_registry/page_subtitle/__snapshots__/page_subtitle.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/index.ts b/src/plugins/advanced_settings/public/component_registry/page_subtitle/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/index.ts
rename to src/plugins/advanced_settings/public/component_registry/page_subtitle/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/page_subtitle.test.tsx b/src/plugins/advanced_settings/public/component_registry/page_subtitle/page_subtitle.test.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/page_subtitle.test.tsx
rename to src/plugins/advanced_settings/public/component_registry/page_subtitle/page_subtitle.test.tsx
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/page_subtitle.ts b/src/plugins/advanced_settings/public/component_registry/page_subtitle/page_subtitle.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_subtitle/page_subtitle.ts
rename to src/plugins/advanced_settings/public/component_registry/page_subtitle/page_subtitle.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/__snapshots__/page_title.test.tsx.snap b/src/plugins/advanced_settings/public/component_registry/page_title/__snapshots__/page_title.test.tsx.snap
similarity index 85%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/__snapshots__/page_title.test.tsx.snap
rename to src/plugins/advanced_settings/public/component_registry/page_title/__snapshots__/page_title.test.tsx.snap
index 8dd4e501067b5..10b799a986b84 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/__snapshots__/page_title.test.tsx.snap
+++ b/src/plugins/advanced_settings/public/component_registry/page_title/__snapshots__/page_title.test.tsx.snap
@@ -7,7 +7,7 @@ exports[`PageTitle should render normally 1`] = `
   >
     <FormattedMessage
       defaultMessage="Settings"
-      id="kbn.management.settings.pageTitle"
+      id="advancedSettings.pageTitle"
       values={Object {}}
     />
   </h1>
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/index.ts b/src/plugins/advanced_settings/public/component_registry/page_title/index.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/index.ts
rename to src/plugins/advanced_settings/public/component_registry/page_title/index.ts
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/page_title.test.tsx b/src/plugins/advanced_settings/public/component_registry/page_title/page_title.test.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/page_title.test.tsx
rename to src/plugins/advanced_settings/public/component_registry/page_title/page_title.test.tsx
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/page_title.tsx b/src/plugins/advanced_settings/public/component_registry/page_title/page_title.tsx
similarity index 91%
rename from src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/page_title.tsx
rename to src/plugins/advanced_settings/public/component_registry/page_title/page_title.tsx
index cb807302c2380..18d9c60d331bb 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/settings/components/page_title/page_title.tsx
+++ b/src/plugins/advanced_settings/public/component_registry/page_title/page_title.tsx
@@ -25,7 +25,7 @@ export const PageTitle = () => {
   return (
     <EuiText>
       <h1 data-test-subj="managementSettingsTitle">
-        <FormattedMessage id="kbn.management.settings.pageTitle" defaultMessage="Settings" />
+        <FormattedMessage id="advancedSettings.pageTitle" defaultMessage="Settings" />
       </h1>
     </EuiText>
   );
diff --git a/src/plugins/advanced_settings/public/index.ts b/src/plugins/advanced_settings/public/index.ts
new file mode 100644
index 0000000000000..13be36e671f75
--- /dev/null
+++ b/src/plugins/advanced_settings/public/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializerContext } from 'kibana/public';
+import { AdvancedSettingsPlugin } from './plugin';
+export { AdvancedSettingsSetup, AdvancedSettingsStart } from './types';
+export { ComponentRegistry } from './component_registry';
+
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new AdvancedSettingsPlugin();
+}
diff --git a/src/legacy/ui/public/notify/filters/markdown.js b/src/plugins/advanced_settings/public/mocks.ts
similarity index 70%
rename from src/legacy/ui/public/notify/filters/markdown.js
rename to src/plugins/advanced_settings/public/mocks.ts
index 9ab7470b4a1c9..e147f57101aae 100644
--- a/src/legacy/ui/public/notify/filters/markdown.js
+++ b/src/plugins/advanced_settings/public/mocks.ts
@@ -17,15 +17,17 @@
  * under the License.
  */
 
-import MarkdownIt from 'markdown-it';
-import { uiModules } from 'ui/modules';
-import 'angular-sanitize';
+import { ComponentRegistry } from './component_registry';
 
-const markdownIt = new MarkdownIt({
-  html: false,
-  linkify: true,
-});
+const register = jest.fn();
+const get = jest.fn();
+const componentType = ComponentRegistry.componentType;
 
-uiModules.get('kibana', ['ngSanitize']).filter('markdown', function($sanitize) {
-  return md => (md ? $sanitize(markdownIt.render(md)) : '');
-});
+export const advancedSettingsMock = {
+  createSetupContract() {
+    return { register, componentType };
+  },
+  createStartContract() {
+    return { get, componentType };
+  },
+};
diff --git a/src/plugins/advanced_settings/public/plugin.ts b/src/plugins/advanced_settings/public/plugin.ts
new file mode 100644
index 0000000000000..692e515ca4e5e
--- /dev/null
+++ b/src/plugins/advanced_settings/public/plugin.ts
@@ -0,0 +1,39 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { ComponentRegistry } from './component_registry';
+import { AdvancedSettingsSetup, AdvancedSettingsStart } from './types';
+
+const component = new ComponentRegistry();
+
+export class AdvancedSettingsPlugin
+  implements Plugin<AdvancedSettingsSetup, AdvancedSettingsStart> {
+  public setup(core: CoreSetup) {
+    return {
+      component: component.setup,
+    };
+  }
+
+  public start(core: CoreStart) {
+    return {
+      component: component.start,
+    };
+  }
+}
diff --git a/src/legacy/ui/public/promises/promises.d.ts b/src/plugins/advanced_settings/public/types.ts
similarity index 78%
rename from src/legacy/ui/public/promises/promises.d.ts
rename to src/plugins/advanced_settings/public/types.ts
index 84d81b39ec37d..a9b965c3c22de 100644
--- a/src/legacy/ui/public/promises/promises.d.ts
+++ b/src/plugins/advanced_settings/public/types.ts
@@ -17,9 +17,11 @@
  * under the License.
  */
 
-export interface PromiseService {
-  resolve: <T>(value: T | PromiseLike<T>) => ng.IPromise<T>;
+import { ComponentRegistry } from './component_registry';
 
-  // TODO: add additional typing
-  [key: string]: any;
+export interface AdvancedSettingsSetup {
+  component: ComponentRegistry['setup'];
+}
+export interface AdvancedSettingsStart {
+  component: ComponentRegistry['start'];
 }
diff --git a/src/plugins/console/kibana.json b/src/plugins/console/kibana.json
index 18f7eb06e98ed..57de385ba565c 100644
--- a/src/plugins/console/kibana.json
+++ b/src/plugins/console/kibana.json
@@ -3,6 +3,6 @@
   "version": "kibana",
   "server": true,
   "ui": true,
-  "requiredPlugins": ["dev_tools", "home"],
+  "requiredPlugins": ["devTools", "home"],
   "optionalPlugins": ["usageCollection"]
 }
diff --git a/src/plugins/console/public/application/components/index.ts b/src/plugins/console/public/application/components/index.ts
index eccde899a2640..d9a8aa9328b73 100644
--- a/src/plugins/console/public/application/components/index.ts
+++ b/src/plugins/console/public/application/components/index.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+export { NetworkRequestStatusBar } from './network_request_status_bar';
 export { SomethingWentWrongCallout } from './something_went_wrong_callout';
 export { TopNavMenuItem, TopNavMenu } from './top_nav_menu';
 export { ConsoleMenu } from './console_menu';
diff --git a/src/plugins/kibana_react/public/saved_objects/index.ts b/src/plugins/console/public/application/components/network_request_status_bar/index.ts
similarity index 90%
rename from src/plugins/kibana_react/public/saved_objects/index.ts
rename to src/plugins/console/public/application/components/network_request_status_bar/index.ts
index ade80d2cd2a92..ce214c1cdfffa 100644
--- a/src/plugins/kibana_react/public/saved_objects/index.ts
+++ b/src/plugins/console/public/application/components/network_request_status_bar/index.ts
@@ -17,5 +17,4 @@
  * under the License.
  */
 
-export * from './saved_object_finder';
-export * from './saved_object_save_modal';
+export { NetworkRequestStatusBar } from './network_request_status_bar';
diff --git a/src/plugins/console/public/application/components/network_request_status_bar/network_request_status_bar.tsx b/src/plugins/console/public/application/components/network_request_status_bar/network_request_status_bar.tsx
new file mode 100644
index 0000000000000..6915ff15f374d
--- /dev/null
+++ b/src/plugins/console/public/application/components/network_request_status_bar/network_request_status_bar.tsx
@@ -0,0 +1,133 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import React, { FunctionComponent } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiBadge, EuiText, EuiToolTip } from '@elastic/eui';
+
+export interface Props {
+  requestInProgress: boolean;
+  requestResult?: {
+    // Status code of the request, e.g., 200
+    statusCode: number;
+
+    // Status text of the request, e.g., OK
+    statusText: string;
+
+    // Method of the request, e.g., GET
+    method: string;
+
+    // The path of endpoint that was called, e.g., /_search
+    endpoint: string;
+
+    // The time, in milliseconds, that the last request took
+    timeElapsedMs: number;
+  };
+}
+
+const mapStatusCodeToBadgeColor = (statusCode: number) => {
+  if (statusCode <= 199) {
+    return 'default';
+  }
+
+  if (statusCode <= 299) {
+    return 'secondary';
+  }
+
+  if (statusCode <= 399) {
+    return 'primary';
+  }
+
+  if (statusCode <= 499) {
+    return 'warning';
+  }
+
+  return 'danger';
+};
+
+export const NetworkRequestStatusBar: FunctionComponent<Props> = ({
+  requestInProgress,
+  requestResult,
+}) => {
+  let content: React.ReactNode = null;
+
+  if (requestInProgress) {
+    content = (
+      <EuiFlexItem grow={false}>
+        <EuiBadge color="hollow">
+          {i18n.translate('console.requestInProgressBadgeText', {
+            defaultMessage: 'Request in progress',
+          })}
+        </EuiBadge>
+      </EuiFlexItem>
+    );
+  } else if (requestResult) {
+    const { endpoint, method, statusCode, statusText, timeElapsedMs } = requestResult;
+
+    content = (
+      <>
+        <EuiFlexItem grow={false}>
+          <EuiToolTip
+            position="top"
+            content={
+              <EuiText size="s">{`${method} ${
+                endpoint.startsWith('/') ? endpoint : '/' + endpoint
+              }`}</EuiText>
+            }
+          >
+            <EuiBadge color={mapStatusCodeToBadgeColor(statusCode)}>
+              {/*  Use &nbsp; to ensure that no matter the width we don't allow line breaks */}
+              {statusCode}&nbsp;-&nbsp;{statusText}
+            </EuiBadge>
+          </EuiToolTip>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiToolTip
+            position="top"
+            content={
+              <EuiText size="s">
+                {i18n.translate('console.requestTimeElapasedBadgeTooltipContent', {
+                  defaultMessage: 'Time Elapsed',
+                })}
+              </EuiText>
+            }
+          >
+            <EuiText size="s">
+              <EuiBadge color="default">
+                {timeElapsedMs}&nbsp;{'ms'}
+              </EuiBadge>
+            </EuiText>
+          </EuiToolTip>
+        </EuiFlexItem>
+      </>
+    );
+  }
+
+  return (
+    <EuiFlexGroup
+      justifyContent="flexEnd"
+      alignItems="center"
+      direction="row"
+      gutterSize="s"
+      responsive={false}
+    >
+      {content}
+    </EuiFlexGroup>
+  );
+};
diff --git a/src/plugins/console/public/application/containers/editor/editor.tsx b/src/plugins/console/public/application/containers/editor/editor.tsx
index 5c7fe293651fb..0bfe837f2cd90 100644
--- a/src/plugins/console/public/application/containers/editor/editor.tsx
+++ b/src/plugins/console/public/application/containers/editor/editor.tsx
@@ -17,14 +17,15 @@
  * under the License.
  */
 
-import React, { useCallback } from 'react';
+import React, { useCallback, memo } from 'react';
 import { debounce } from 'lodash';
+import { EuiProgress } from '@elastic/eui';
 
 import { EditorContentSpinner } from '../../components';
 import { Panel, PanelsContainer } from '../../../../../kibana_react/public';
 import { Editor as EditorUI, EditorOutput } from './legacy/console_editor';
 import { StorageKeys } from '../../../services';
-import { useEditorReadContext, useServicesContext } from '../../contexts';
+import { useEditorReadContext, useServicesContext, useRequestReadContext } from '../../contexts';
 
 const INITIAL_PANEL_WIDTH = 50;
 const PANEL_MIN_WIDTH = '100px';
@@ -33,12 +34,13 @@ interface Props {
   loading: boolean;
 }
 
-export const Editor = ({ loading }: Props) => {
+export const Editor = memo(({ loading }: Props) => {
   const {
     services: { storage },
   } = useServicesContext();
 
   const { currentTextObject } = useEditorReadContext();
+  const { requestInFlight } = useRequestReadContext();
 
   const [firstPanelWidth, secondPanelWidth] = storage.get(StorageKeys.WIDTH, [
     INITIAL_PANEL_WIDTH,
@@ -55,23 +57,30 @@ export const Editor = ({ loading }: Props) => {
   if (!currentTextObject) return null;
 
   return (
-    <PanelsContainer onPanelWidthChange={onPanelWidthChange} resizerClassName="conApp__resizer">
-      <Panel
-        style={{ height: '100%', position: 'relative', minWidth: PANEL_MIN_WIDTH }}
-        initialWidth={firstPanelWidth}
-      >
-        {loading ? (
-          <EditorContentSpinner />
-        ) : (
-          <EditorUI initialTextValue={currentTextObject.text} />
-        )}
-      </Panel>
-      <Panel
-        style={{ height: '100%', position: 'relative', minWidth: PANEL_MIN_WIDTH }}
-        initialWidth={secondPanelWidth}
-      >
-        {loading ? <EditorContentSpinner /> : <EditorOutput />}
-      </Panel>
-    </PanelsContainer>
+    <>
+      {requestInFlight ? (
+        <div className="conApp__requestProgressBarContainer">
+          <EuiProgress size="xs" color="accent" position="absolute" />
+        </div>
+      ) : null}
+      <PanelsContainer onPanelWidthChange={onPanelWidthChange} resizerClassName="conApp__resizer">
+        <Panel
+          style={{ height: '100%', position: 'relative', minWidth: PANEL_MIN_WIDTH }}
+          initialWidth={firstPanelWidth}
+        >
+          {loading ? (
+            <EditorContentSpinner />
+          ) : (
+            <EditorUI initialTextValue={currentTextObject.text} />
+          )}
+        </Panel>
+        <Panel
+          style={{ height: '100%', position: 'relative', minWidth: PANEL_MIN_WIDTH }}
+          initialWidth={secondPanelWidth}
+        >
+          {loading ? <EditorContentSpinner /> : <EditorOutput />}
+        </Panel>
+      </PanelsContainer>
+    </>
   );
-};
+});
diff --git a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
index 759e3dbafb39c..b3e966ddffa4c 100644
--- a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
+++ b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor.tsx
@@ -211,14 +211,14 @@ function EditorUI({ initialTextValue }: EditorProps) {
           <EuiFlexItem>
             <EuiToolTip
               content={i18n.translate('console.sendRequestButtonTooltip', {
-                defaultMessage: 'click to send request',
+                defaultMessage: 'Click to send request',
               })}
             >
               <button
                 onClick={sendCurrentRequestToES}
                 data-test-subj="sendRequestButton"
                 aria-label={i18n.translate('console.sendRequestButtonTooltip', {
-                  defaultMessage: 'click to send request',
+                  defaultMessage: 'Click to send request',
                 })}
                 className="conApp__editorActionButton conApp__editorActionButton--success"
               >
diff --git a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor_output.tsx b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor_output.tsx
index b1398d0a19a8f..e232e41902cbb 100644
--- a/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor_output.tsx
+++ b/src/plugins/console/public/application/containers/editor/legacy/console_editor/editor_output.tsx
@@ -18,6 +18,7 @@
  */
 
 import React, { useEffect, useRef } from 'react';
+
 import { createReadOnlyAceEditor, CustomAceEditor } from '../../../../models/legacy_core_editor';
 import {
   useServicesContext,
@@ -70,8 +71,8 @@ function EditorOutputUI() {
           .join('\n')
       );
     } else if (error) {
-      editor.session.setMode(modeForContentType(error.contentType));
-      editor.update(error.value);
+      editor.session.setMode(modeForContentType(error.response.contentType));
+      editor.update(error.response.value as string);
     } else {
       editor.update('');
     }
@@ -82,16 +83,18 @@ function EditorOutputUI() {
   }, [readOnlySettings]);
 
   return (
-    <div ref={editorRef} className="conApp__output" data-test-subj="response-editor">
-      {/* Axe complains about Ace's textarea element missing a label, which interferes with our
+    <>
+      <div ref={editorRef} className="conApp__output" data-test-subj="response-editor">
+        {/* Axe complains about Ace's textarea element missing a label, which interferes with our
       automated a11y tests per #52136. This wrapper does nothing to address a11y but it does
       satisfy Axe. */}
 
-      {/* eslint-disable-next-line jsx-a11y/label-has-associated-control */}
-      <label className="conApp__textAreaLabelHack">
-        <div className="conApp__outputContent" id="ConAppOutput" />
-      </label>
-    </div>
+        {/* eslint-disable-next-line jsx-a11y/label-has-associated-control */}
+        <label className="conApp__textAreaLabelHack">
+          <div className="conApp__outputContent" id="ConAppOutput" />
+        </label>
+      </div>
+    </>
   );
 }
 
diff --git a/src/plugins/console/public/application/containers/main/main.tsx b/src/plugins/console/public/application/containers/main/main.tsx
index 902d800b3e56b..656db68b992ce 100644
--- a/src/plugins/console/public/application/containers/main/main.tsx
+++ b/src/plugins/console/public/application/containers/main/main.tsx
@@ -24,9 +24,15 @@ import { ConsoleHistory } from '../console_history';
 import { Editor } from '../editor';
 import { Settings } from '../settings';
 
-import { TopNavMenu, WelcomePanel, HelpPanel, SomethingWentWrongCallout } from '../../components';
+import {
+  TopNavMenu,
+  WelcomePanel,
+  HelpPanel,
+  SomethingWentWrongCallout,
+  NetworkRequestStatusBar,
+} from '../../components';
 
-import { useServicesContext, useEditorReadContext } from '../../contexts';
+import { useServicesContext, useEditorReadContext, useRequestReadContext } from '../../contexts';
 import { useDataInit } from '../../hooks';
 
 import { getTopNavConfig } from './get_top_nav';
@@ -38,6 +44,11 @@ export function Main() {
 
   const { ready: editorsReady } = useEditorReadContext();
 
+  const {
+    requestInFlight: requestInProgress,
+    lastResult: { data: requestData, error: requestError },
+  } = useRequestReadContext();
+
   const [showWelcome, setShowWelcomePanel] = useState(
     () => storage.get('version_welcome_shown') !== '@@SENSE_REVISION'
   );
@@ -59,6 +70,8 @@ export function Main() {
     );
   }
 
+  const lastDatum = requestData?.[requestData.length - 1] ?? requestError;
+
   return (
     <div id="consoleRoot">
       <EuiFlexGroup
@@ -75,14 +88,34 @@ export function Main() {
               })}
             </h1>
           </EuiTitle>
-          <TopNavMenu
-            disabled={!done}
-            items={getTopNavConfig({
-              onClickHistory: () => setShowHistory(!showingHistory),
-              onClickSettings: () => setShowSettings(true),
-              onClickHelp: () => setShowHelp(!showHelp),
-            })}
-          />
+          <EuiFlexGroup gutterSize="none">
+            <EuiFlexItem>
+              <TopNavMenu
+                disabled={!done}
+                items={getTopNavConfig({
+                  onClickHistory: () => setShowHistory(!showingHistory),
+                  onClickSettings: () => setShowSettings(true),
+                  onClickHelp: () => setShowHelp(!showHelp),
+                })}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem grow={false} className="conApp__tabsExtension">
+              <NetworkRequestStatusBar
+                requestInProgress={requestInProgress}
+                requestResult={
+                  lastDatum
+                    ? {
+                        method: lastDatum.request.method.toUpperCase(),
+                        endpoint: lastDatum.request.path,
+                        statusCode: lastDatum.response.statusCode,
+                        statusText: lastDatum.response.statusText,
+                        timeElapsedMs: lastDatum.response.timeMs,
+                      }
+                    : undefined
+                }
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
         </EuiFlexItem>
         {showingHistory ? <EuiFlexItem grow={false}>{renderConsoleHistory()}</EuiFlexItem> : null}
         <EuiFlexItem>
diff --git a/src/plugins/console/public/application/hooks/use_send_current_request_to_es/send_request_to_es.ts b/src/plugins/console/public/application/hooks/use_send_current_request_to_es/send_request_to_es.ts
index 10dab65b61d44..35d9865ee4ccb 100644
--- a/src/plugins/console/public/application/hooks/use_send_current_request_to_es/send_request_to_es.ts
+++ b/src/plugins/console/public/application/hooks/use_send_current_request_to_es/send_request_to_es.ts
@@ -26,16 +26,23 @@ export interface EsRequestArgs {
   requests: any;
 }
 
-export interface ESRequestResult {
-  request: {
-    path: string;
-    data: any;
-    method: string;
-  };
-  response: {
-    contentType: BaseResponseType;
-    value: unknown;
-  };
+export interface ESRequestObject {
+  path: string;
+  data: any;
+  method: string;
+}
+
+export interface ESResponseObject<V = unknown> {
+  statusCode: number;
+  statusText: string;
+  timeMs: number;
+  contentType: BaseResponseType;
+  value: V;
+}
+
+export interface ESRequestResult<V = unknown> {
+  request: ESRequestObject;
+  response: ESResponseObject<V>;
 }
 
 let CURRENT_REQ_ID = 0;
@@ -71,6 +78,7 @@ export function sendRequestToES(args: EsRequestArgs): Promise<ESRequestResult[]>
         esData += '\n';
       } // append a new line for bulk requests.
 
+      const startTime = Date.now();
       es.send(esMethod, esPath, esData).always(
         (dataOrjqXHR: any, textStatus: string, jqXhrORerrorThrown: any) => {
           if (reqId !== CURRENT_REQ_ID) {
@@ -99,6 +107,9 @@ export function sendRequestToES(args: EsRequestArgs): Promise<ESRequestResult[]>
 
             results.push({
               response: {
+                timeMs: Date.now() - startTime,
+                statusCode: xhr.status,
+                statusText: xhr.statusText,
                 contentType: xhr.getResponseHeader('Content-Type'),
                 value,
               },
@@ -124,7 +135,20 @@ export function sendRequestToES(args: EsRequestArgs): Promise<ESRequestResult[]>
             if (isMultiRequest) {
               value = '# ' + req.method + ' ' + req.url + '\n' + value;
             }
-            reject({ value, contentType });
+            reject({
+              response: {
+                value,
+                contentType,
+                timeMs: Date.now() - startTime,
+                statusCode: xhr.status,
+                statusText: xhr.statusText,
+              },
+              request: {
+                data: esData,
+                method: esMethod,
+                path: esPath,
+              },
+            });
           }
         }
       );
diff --git a/src/plugins/console/public/application/hooks/use_send_current_request_to_es/use_send_current_request_to_es.ts b/src/plugins/console/public/application/hooks/use_send_current_request_to_es/use_send_current_request_to_es.ts
index 6bf0b5024376b..ef5f63b39c0a7 100644
--- a/src/plugins/console/public/application/hooks/use_send_current_request_to_es/use_send_current_request_to_es.ts
+++ b/src/plugins/console/public/application/hooks/use_send_current_request_to_es/use_send_current_request_to_es.ts
@@ -34,18 +34,21 @@ export const useSendCurrentRequestToES = () => {
   const dispatch = useRequestActionContext();
 
   return useCallback(async () => {
-    dispatch({ type: 'sendRequest', payload: undefined });
     try {
       const editor = registry.getInputEditor();
       const requests = await editor.getRequestsInRange();
       if (!requests.length) {
-        dispatch({
-          type: 'requestFail',
-          payload: { value: 'No requests in range', contentType: 'text/plain' },
-        });
+        notifications.toasts.add(
+          i18n.translate('console.notification.noReqeustSelectedTitle', {
+            defaultMessage:
+              'No request selected. Select a request by placing the cursor inside it.',
+          })
+        );
         return;
       }
 
+      dispatch({ type: 'sendRequest', payload: undefined });
+
       // Fire and forget
       setTimeout(() => track(requests, editor, trackUiMetric), 0);
 
@@ -71,14 +74,14 @@ export const useSendCurrentRequestToES = () => {
         },
       });
     } catch (e) {
-      if (e.contentType) {
+      if (e.response?.contentType) {
         dispatch({
           type: 'requestFail',
           payload: e,
         });
       } else {
         notifications.toasts.addError(e, {
-          title: i18n.translate('console.unknownRequestErrorTitle', {
+          title: i18n.translate('console.notification.unknownRequestErrorTitle', {
             defaultMessage: 'Unknown Request Error',
           }),
         });
diff --git a/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts b/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
index 8301daa675b5c..19a86648d6dd3 100644
--- a/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
+++ b/src/plugins/console/public/application/models/legacy_core_editor/legacy_core_editor.ts
@@ -252,14 +252,23 @@ export class LegacyCoreEditor implements CoreEditor {
     this._aceOnPaste.call(this.editor, text);
   }
 
-  private setActionsBar = (top?: any) => {
-    if (top === null) {
+  private setActionsBar = (value?: any, topOrBottom: 'top' | 'bottom' = 'top') => {
+    if (value === null) {
       this.$actions.css('visibility', 'hidden');
     } else {
-      this.$actions.css({
-        top,
-        visibility: 'visible',
-      });
+      if (topOrBottom === 'top') {
+        this.$actions.css({
+          bottom: 'auto',
+          top: value,
+          visibility: 'visible',
+        });
+      } else {
+        this.$actions.css({
+          top: 'auto',
+          bottom: value,
+          visibility: 'visible',
+        });
+      }
     }
   };
 
@@ -302,13 +311,17 @@ export class LegacyCoreEditor implements CoreEditor {
       const firstLine = this.getLineValue(startLine);
       const maxLineLength = this.getWrapLimit() - 5;
       const isWrapping = firstLine.length > maxLineLength;
+      const totalOffset = offsetFromPage - (window.pageYOffset || 0);
       const getScreenCoords = (line: number) =>
-        this.editor.renderer.textToScreenCoordinates(line - 1, startColumn).pageY -
-        offsetFromPage +
-        (window.pageYOffset || 0);
+        this.editor.renderer.textToScreenCoordinates(line - 1, startColumn).pageY - totalOffset;
       const topOfReq = getScreenCoords(startLine);
 
       if (topOfReq >= 0) {
+        const { bottom: maxBottom } = this.editor.container.getBoundingClientRect();
+        if (topOfReq > maxBottom - totalOffset) {
+          this.setActionsBar(0, 'bottom');
+          return;
+        }
         let offset = 0;
         if (isWrapping) {
           // Try get the line height of the text area in pixels.
diff --git a/src/plugins/console/public/application/stores/request.ts b/src/plugins/console/public/application/stores/request.ts
index fec7f4195eb74..fe43d9f0b74d4 100644
--- a/src/plugins/console/public/application/stores/request.ts
+++ b/src/plugins/console/public/application/stores/request.ts
@@ -26,13 +26,13 @@ import { ESRequestResult } from '../hooks/use_send_current_request_to_es/send_re
 export type Actions =
   | { type: 'sendRequest'; payload: undefined }
   | { type: 'requestSuccess'; payload: { data: ESRequestResult[] } }
-  | { type: 'requestFail'; payload: { contentType: BaseResponseType; value: string } };
+  | { type: 'requestFail'; payload: ESRequestResult<string> };
 
 export interface Store {
   requestInFlight: boolean;
   lastResult: {
     data: ESRequestResult[] | null;
-    error?: { contentType: BaseResponseType; value: string };
+    error?: ESRequestResult<string>;
   };
 }
 
diff --git a/src/plugins/console/public/lib/es/es.js b/src/plugins/console/public/lib/es/es.ts
similarity index 76%
rename from src/plugins/console/public/lib/es/es.js
rename to src/plugins/console/public/lib/es/es.ts
index e36976fb7acee..52aba98d9e662 100644
--- a/src/plugins/console/public/lib/es/es.js
+++ b/src/plugins/console/public/lib/es/es.ts
@@ -20,21 +20,21 @@
 import { stringify as formatQueryString } from 'querystring';
 import $ from 'jquery';
 
-const esVersion = [];
+const esVersion: string[] = [];
 
 export function getVersion() {
   return esVersion;
 }
 
-export function getContentType(body) {
+export function getContentType(body: any) {
   if (!body) return;
   return 'application/json';
 }
 
-export function send(method, path, data) {
+export function send(method: string, path: string, data: any) {
   const wrappedDfd = $.Deferred(); // eslint-disable-line new-cap
 
-  const options = {
+  const options: JQuery.AjaxSettings = {
     url: '../api/console/proxy?' + formatQueryString({ path, method }),
     data,
     contentType: getContentType(data),
@@ -45,21 +45,21 @@ export function send(method, path, data) {
   };
 
   $.ajax(options).then(
-    function(data, textStatus, jqXHR) {
-      wrappedDfd.resolveWith(this, [data, textStatus, jqXHR]);
+    (responseData: any, textStatus: string, jqXHR: any) => {
+      wrappedDfd.resolveWith({}, [responseData, textStatus, jqXHR]);
     },
-    function(jqXHR, textStatus, errorThrown) {
+    ((jqXHR: any, textStatus: string, errorThrown: Error) => {
       if (jqXHR.status === 0) {
         jqXHR.responseText =
           "\n\nFailed to connect to Console's backend.\nPlease check the Kibana server is up and running";
       }
-      wrappedDfd.rejectWith(this, [jqXHR, textStatus, errorThrown]);
-    }
+      wrappedDfd.rejectWith({}, [jqXHR, textStatus, errorThrown]);
+    }) as any
   );
   return wrappedDfd;
 }
 
-export function constructESUrl(baseUri, path) {
+export function constructESUrl(baseUri: string, path: string) {
   baseUri = baseUri.replace(/\/+$/, '');
   path = path.replace(/^\/+/, '');
   return baseUri + '/' + path;
diff --git a/src/plugins/console/public/lib/es/index.ts b/src/plugins/console/public/lib/es/index.ts
new file mode 100644
index 0000000000000..9053686a1cdb1
--- /dev/null
+++ b/src/plugins/console/public/lib/es/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { send, constructESUrl, getContentType, getVersion } from './es';
diff --git a/src/plugins/console/public/plugin.ts b/src/plugins/console/public/plugin.ts
index 1b177843f2074..f867f37b0ec01 100644
--- a/src/plugins/console/public/plugin.ts
+++ b/src/plugins/console/public/plugin.ts
@@ -34,7 +34,7 @@ export class ConsoleUIPlugin implements Plugin<ConsoleSetup, void, AppSetupUIPlu
 
   async setup(
     { notifications, getStartServices }: CoreSetup,
-    { dev_tools, home, usageCollection }: AppSetupUIPluginDependencies
+    { devTools, home, usageCollection }: AppSetupUIPluginDependencies
   ) {
     home.featureCatalogue.register({
       id: 'console',
@@ -50,7 +50,7 @@ export class ConsoleUIPlugin implements Plugin<ConsoleSetup, void, AppSetupUIPlu
       category: FeatureCatalogueCategory.ADMIN,
     });
 
-    dev_tools.register({
+    devTools.register({
       id: 'console',
       order: 1,
       title: i18n.translate('console.consoleDisplayName', {
diff --git a/src/plugins/console/public/types/plugin_dependencies.ts b/src/plugins/console/public/types/plugin_dependencies.ts
index 6bc4ff25ee442..62202d5e1e438 100644
--- a/src/plugins/console/public/types/plugin_dependencies.ts
+++ b/src/plugins/console/public/types/plugin_dependencies.ts
@@ -22,6 +22,6 @@ import { UsageCollectionSetup } from '../../../usage_collection/public';
 
 export interface AppSetupUIPluginDependencies {
   home: HomePublicPluginSetup;
-  dev_tools: DevToolsSetup;
+  devTools: DevToolsSetup;
   usageCollection?: UsageCollectionSetup;
 }
diff --git a/src/plugins/dashboard_embeddable_container/public/actions/expand_panel_action.tsx b/src/plugins/dashboard_embeddable_container/public/actions/expand_panel_action.tsx
index 68f68f8a53bcc..edfba153b2b0b 100644
--- a/src/plugins/dashboard_embeddable_container/public/actions/expand_panel_action.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/actions/expand_panel_action.tsx
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { IEmbeddable } from '../embeddable_plugin';
-import { IAction, IncompatibleActionError } from '../ui_actions_plugin';
+import { Action, IncompatibleActionError } from '../ui_actions_plugin';
 import { DASHBOARD_CONTAINER_TYPE, DashboardContainer } from '../embeddable';
 
 export const EXPAND_PANEL_ACTION = 'togglePanel';
@@ -40,7 +40,7 @@ interface ActionContext {
   embeddable: IEmbeddable;
 }
 
-export class ExpandPanelAction implements IAction<ActionContext> {
+export class ExpandPanelAction implements Action<ActionContext> {
   public readonly type = EXPAND_PANEL_ACTION;
   public readonly id = EXPAND_PANEL_ACTION;
   public order = 7;
diff --git a/src/plugins/dashboard_embeddable_container/public/actions/replace_panel_action.tsx b/src/plugins/dashboard_embeddable_container/public/actions/replace_panel_action.tsx
index 78ce6bdc4c58f..16f611a2f1ff2 100644
--- a/src/plugins/dashboard_embeddable_container/public/actions/replace_panel_action.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/actions/replace_panel_action.tsx
@@ -21,7 +21,7 @@ import { i18n } from '@kbn/i18n';
 import { CoreStart } from '../../../../core/public';
 import { IEmbeddable, ViewMode, IEmbeddableStart } from '../embeddable_plugin';
 import { DASHBOARD_CONTAINER_TYPE, DashboardContainer } from '../embeddable';
-import { IAction, IncompatibleActionError } from '../ui_actions_plugin';
+import { Action, IncompatibleActionError } from '../ui_actions_plugin';
 import { openReplacePanelFlyout } from './open_replace_panel_flyout';
 
 export const REPLACE_PANEL_ACTION = 'replacePanel';
@@ -34,7 +34,7 @@ interface ActionContext {
   embeddable: IEmbeddable;
 }
 
-export class ReplacePanelAction implements IAction<ActionContext> {
+export class ReplacePanelAction implements Action<ActionContext> {
   public readonly type = REPLACE_PANEL_ACTION;
   public readonly id = REPLACE_PANEL_ACTION;
   public order = 11;
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
index 021a1a9d1e64a..21bd1eeac6688 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
@@ -22,7 +22,7 @@ import ReactDOM from 'react-dom';
 import { I18nProvider } from '@kbn/i18n/react';
 import { RefreshInterval, TimeRange, Query, esFilters } from '../../../data/public';
 import { CoreStart } from '../../../../core/public';
-import { IUiActionsStart } from '../ui_actions_plugin';
+import { UiActionsStart } from '../ui_actions_plugin';
 import {
   Container,
   ContainerInput,
@@ -81,7 +81,7 @@ export interface DashboardContainerOptions {
   inspector: InspectorStartContract;
   SavedObjectFinder: React.ComponentType<any>;
   ExitFullScreenButton: React.ComponentType<any>;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
 }
 
 export type DashboardReactContextValue = KibanaReactContextValue<DashboardContainerOptions>;
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container_factory.tsx b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container_factory.tsx
index c8a2837fd77d0..d08fcfef3529e 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container_factory.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container_factory.tsx
@@ -18,8 +18,8 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { SavedObjectMetaData } from '../../../saved_objects/public';
 import { SavedObjectAttributes } from '../../../../core/public';
-import { SavedObjectMetaData } from '../types';
 import {
   ContainerOutput,
   EmbeddableFactory,
diff --git a/src/plugins/dashboard_embeddable_container/public/plugin.tsx b/src/plugins/dashboard_embeddable_container/public/plugin.tsx
index d18fbba239ec0..44c9dbf2dcc4b 100644
--- a/src/plugins/dashboard_embeddable_container/public/plugin.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/plugin.tsx
@@ -21,27 +21,26 @@
 
 import * as React from 'react';
 import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from 'src/core/public';
-import { IUiActionsSetup, IUiActionsStart } from '../../../plugins/ui_actions/public';
+import { UiActionsSetup, UiActionsStart } from '../../../plugins/ui_actions/public';
 import { CONTEXT_MENU_TRIGGER, IEmbeddableSetup, IEmbeddableStart } from './embeddable_plugin';
 import { ExpandPanelAction, ReplacePanelAction } from '.';
 import { DashboardContainerFactory } from './embeddable/dashboard_container_factory';
 import { Start as InspectorStartContract } from '../../../plugins/inspector/public';
+import { getSavedObjectFinder } from '../../../plugins/saved_objects/public';
 import {
-  SavedObjectFinderUi,
-  SavedObjectFinderProps,
   ExitFullScreenButton as ExitFullScreenButtonUi,
   ExitFullScreenButtonProps,
 } from '../../../plugins/kibana_react/public';
 
 interface SetupDependencies {
   embeddable: IEmbeddableSetup;
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
 }
 
 interface StartDependencies {
   embeddable: IEmbeddableStart;
   inspector: InspectorStartContract;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
 }
 
 export type Setup = void;
@@ -61,16 +60,7 @@ export class DashboardEmbeddableContainerPublicPlugin
     const { application, notifications, overlays } = core;
     const { embeddable, inspector, uiActions } = plugins;
 
-    const SavedObjectFinder: React.FC<Exclude<
-      SavedObjectFinderProps,
-      'savedObjects' | 'uiSettings'
-    >> = props => (
-      <SavedObjectFinderUi
-        {...props}
-        savedObjects={core.savedObjects}
-        uiSettings={core.uiSettings}
-      />
-    );
+    const SavedObjectFinder = getSavedObjectFinder(core.savedObjects, core.uiSettings);
 
     const useHideChrome = () => {
       React.useEffect(() => {
diff --git a/src/plugins/dashboard_embeddable_container/public/types.ts b/src/plugins/dashboard_embeddable_container/public/types.ts
index 9c2d6c0ab388d..f58be10e11ba6 100644
--- a/src/plugins/dashboard_embeddable_container/public/types.ts
+++ b/src/plugins/dashboard_embeddable_container/public/types.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import { IconType } from '@elastic/eui';
 import { SavedObject as SavedObjectType, SavedObjectAttributes } from '../../../core/public';
 
 export interface DashboardCapabilities {
@@ -50,14 +49,6 @@ export interface SimpleSavedObject<T extends SavedObjectAttributes> {
   delete(): void;
 }
 
-export interface SavedObjectMetaData<T extends SavedObjectAttributes> {
-  type: string;
-  name: string;
-  getIconForSavedObject(savedObject: SimpleSavedObject<T>): IconType;
-  getTooltipForSavedObject?(savedObject: SimpleSavedObject<T>): string;
-  showSavedObject?(savedObject: SimpleSavedObject<T>): boolean;
-}
-
 interface FieldSubType {
   multi?: { parent: string };
   nested?: { path: string };
diff --git a/src/plugins/data/common/es_query/kuery/node_types/function.js b/src/plugins/data/common/es_query/kuery/node_types/function.ts
similarity index 72%
rename from src/plugins/data/common/es_query/kuery/node_types/function.js
rename to src/plugins/data/common/es_query/kuery/node_types/function.ts
index c0e7dffde8f5e..5b09bc2a67349 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/function.js
+++ b/src/plugins/data/common/es_query/kuery/node_types/function.ts
@@ -18,9 +18,13 @@
  */
 
 import _ from 'lodash';
+// @ts-ignore
 import { functions } from '../functions';
+import { IIndexPattern } from '../../..';
+import { FunctionName, FunctionTypeBuildNode } from './types';
+import { JsonValue } from '..';
 
-export function buildNode(functionName, ...functionArgs) {
+export function buildNode(functionName: FunctionName, ...args: any[]) {
   const kueryFunction = functions[functionName];
   if (_.isUndefined(kueryFunction)) {
     throw new Error(`Unknown function "${functionName}"`);
@@ -29,12 +33,15 @@ export function buildNode(functionName, ...functionArgs) {
   return {
     type: 'function',
     function: functionName,
-    ...kueryFunction.buildNodeParams(...functionArgs),
+    ...kueryFunction.buildNodeParams(...args),
   };
 }
 
 // Mainly only useful in the grammar where we'll already have real argument nodes in hand
-export function buildNodeWithArgumentNodes(functionName, argumentNodes) {
+export function buildNodeWithArgumentNodes(
+  functionName: FunctionName,
+  args: any[]
+): FunctionTypeBuildNode {
   if (_.isUndefined(functions[functionName])) {
     throw new Error(`Unknown function "${functionName}"`);
   }
@@ -42,11 +49,16 @@ export function buildNodeWithArgumentNodes(functionName, argumentNodes) {
   return {
     type: 'function',
     function: functionName,
-    arguments: argumentNodes,
+    arguments: args,
   };
 }
 
-export function toElasticsearchQuery(node, indexPattern, config = {}, context = {}) {
+export function toElasticsearchQuery(
+  node: any,
+  indexPattern?: IIndexPattern,
+  config?: Record<string, any>,
+  context?: Record<string, any>
+): JsonValue {
   const kueryFunction = functions[node.function];
   return kueryFunction.toElasticsearchQuery(node, indexPattern, config, context);
 }
diff --git a/src/plugins/data/common/es_query/kuery/node_types/index.js b/src/plugins/data/common/es_query/kuery/node_types/index.ts
similarity index 91%
rename from src/plugins/data/common/es_query/kuery/node_types/index.js
rename to src/plugins/data/common/es_query/kuery/node_types/index.ts
index 4bca179e2a4d1..6023952b634f2 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/index.js
+++ b/src/plugins/data/common/es_query/kuery/node_types/index.ts
@@ -21,8 +21,11 @@ import * as functionType from './function';
 import * as literal from './literal';
 import * as namedArg from './named_arg';
 import * as wildcard from './wildcard';
+import { NodeTypes } from './types';
 
-export const nodeTypes = {
+export { NodeTypes };
+
+export const nodeTypes: NodeTypes = {
   function: functionType,
   literal,
   namedArg,
diff --git a/src/plugins/data/common/es_query/kuery/node_types/literal.js b/src/plugins/data/common/es_query/kuery/node_types/literal.ts
similarity index 78%
rename from src/plugins/data/common/es_query/kuery/node_types/literal.js
rename to src/plugins/data/common/es_query/kuery/node_types/literal.ts
index 9fc836660eba3..070ea09e0f647 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/literal.js
+++ b/src/plugins/data/common/es_query/kuery/node_types/literal.ts
@@ -17,13 +17,15 @@
  * under the License.
  */
 
-export function buildNode(value) {
+import { LiteralTypeBuildNode } from './types';
+
+export function buildNode(value: LiteralTypeBuildNode['value']): LiteralTypeBuildNode {
   return {
     type: 'literal',
     value,
   };
 }
 
-export function toElasticsearchQuery(node) {
+export function toElasticsearchQuery(node: LiteralTypeBuildNode): LiteralTypeBuildNode['value'] {
   return node.value;
 }
diff --git a/src/plugins/data/common/es_query/kuery/node_types/named_arg.js b/src/plugins/data/common/es_query/kuery/node_types/named_arg.ts
similarity index 83%
rename from src/plugins/data/common/es_query/kuery/node_types/named_arg.js
rename to src/plugins/data/common/es_query/kuery/node_types/named_arg.ts
index d99bc1fcce343..750801990f44e 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/named_arg.js
+++ b/src/plugins/data/common/es_query/kuery/node_types/named_arg.ts
@@ -20,8 +20,10 @@
 import _ from 'lodash';
 import * as ast from '../ast';
 import { nodeTypes } from '../node_types';
+import { NamedArgTypeBuildNode } from './types';
+import { JsonObject } from '../types';
 
-export function buildNode(name, value) {
+export function buildNode(name: string, value: any): NamedArgTypeBuildNode {
   const argumentNode =
     _.get(value, 'type') === 'literal' ? value : nodeTypes.literal.buildNode(value);
   return {
@@ -31,6 +33,6 @@ export function buildNode(name, value) {
   };
 }
 
-export function toElasticsearchQuery(node) {
+export function toElasticsearchQuery(node: any): JsonObject {
   return ast.toElasticsearchQuery(node.value);
 }
diff --git a/src/plugins/data/common/es_query/kuery/node_types/index.d.ts b/src/plugins/data/common/es_query/kuery/node_types/types.ts
similarity index 81%
rename from src/plugins/data/common/es_query/kuery/node_types/index.d.ts
rename to src/plugins/data/common/es_query/kuery/node_types/types.ts
index 720d64e11a0f8..1af4a20583d46 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/index.d.ts
+++ b/src/plugins/data/common/es_query/kuery/node_types/types.ts
@@ -22,9 +22,9 @@
  */
 
 import { IIndexPattern } from '../../../index_patterns';
-import { KueryNode, JsonValue } from '..';
+import { JsonValue, KueryNode } from '..';
 
-type FunctionName =
+export type FunctionName =
   | 'is'
   | 'and'
   | 'or'
@@ -37,7 +37,7 @@ type FunctionName =
 
 interface FunctionType {
   buildNode: (functionName: FunctionName, ...args: any[]) => FunctionTypeBuildNode;
-  buildNodeWithArgumentNodes: (functionName: FunctionName, ...args: any[]) => FunctionTypeBuildNode;
+  buildNodeWithArgumentNodes: (functionName: FunctionName, args: any[]) => FunctionTypeBuildNode;
   toElasticsearchQuery: (
     node: any,
     indexPattern?: IIndexPattern,
@@ -46,7 +46,7 @@ interface FunctionType {
   ) => JsonValue;
 }
 
-interface FunctionTypeBuildNode {
+export interface FunctionTypeBuildNode {
   type: 'function';
   function: FunctionName;
   // TODO -> Need to define a better type for DSL query
@@ -58,40 +58,38 @@ interface LiteralType {
   toElasticsearchQuery: (node: any) => null | boolean | number | string;
 }
 
-interface LiteralTypeBuildNode {
+export interface LiteralTypeBuildNode {
   type: 'literal';
   value: null | boolean | number | string;
 }
 
 interface NamedArgType {
   buildNode: (name: string, value: any) => NamedArgTypeBuildNode;
-  toElasticsearchQuery: (node: any) => string;
+  toElasticsearchQuery: (node: any) => JsonValue;
 }
 
-interface NamedArgTypeBuildNode {
+export interface NamedArgTypeBuildNode {
   type: 'namedArg';
   name: string;
   value: any;
 }
 
 interface WildcardType {
-  buildNode: (value: string) => WildcardTypeBuildNode;
+  buildNode: (value: string) => WildcardTypeBuildNode | KueryNode;
   test: (node: any, string: string) => boolean;
   toElasticsearchQuery: (node: any) => string;
   toQueryStringQuery: (node: any) => string;
   hasLeadingWildcard: (node: any) => boolean;
 }
 
-interface WildcardTypeBuildNode {
+export interface WildcardTypeBuildNode {
   type: 'wildcard';
   value: string;
 }
 
-interface NodeTypes {
+export interface NodeTypes {
   function: FunctionType;
   literal: LiteralType;
   namedArg: NamedArgType;
   wildcard: WildcardType;
 }
-
-export const nodeTypes: NodeTypes;
diff --git a/src/plugins/data/common/es_query/kuery/node_types/wildcard.js b/src/plugins/data/common/es_query/kuery/node_types/wildcard.ts
similarity index 73%
rename from src/plugins/data/common/es_query/kuery/node_types/wildcard.js
rename to src/plugins/data/common/es_query/kuery/node_types/wildcard.ts
index 8c6bf1009b3a1..87fcfa1ca2f64 100644
--- a/src/plugins/data/common/es_query/kuery/node_types/wildcard.js
+++ b/src/plugins/data/common/es_query/kuery/node_types/wildcard.ts
@@ -18,20 +18,22 @@
  */
 
 import { fromLiteralExpression } from '../ast/ast';
+import { WildcardTypeBuildNode } from './types';
+import { KueryNode } from '..';
 
 export const wildcardSymbol = '@kuery-wildcard@';
 
 // Copied from https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions
-function escapeRegExp(string) {
-  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+function escapeRegExp(str: string) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
 }
 
 // See https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_reserved_characters
-function escapeQueryString(string) {
-  return string.replace(/[+-=&|><!(){}[\]^"~*?:\\/]/g, '\\$&'); // $& means the whole matched string
+function escapeQueryString(str: string) {
+  return str.replace(/[+-=&|><!(){}[\]^"~*?:\\/]/g, '\\$&'); // $& means the whole matched string
 }
 
-export function buildNode(value) {
+export function buildNode(value: string): WildcardTypeBuildNode | KueryNode {
   if (!value.includes(wildcardSymbol)) {
     return fromLiteralExpression(value);
   }
@@ -42,22 +44,22 @@ export function buildNode(value) {
   };
 }
 
-export function test(node, string) {
+export function test(node: any, str: string): boolean {
   const { value } = node;
   const regex = value
     .split(wildcardSymbol)
     .map(escapeRegExp)
     .join('[\\s\\S]*');
   const regexp = new RegExp(`^${regex}$`);
-  return regexp.test(string);
+  return regexp.test(str);
 }
 
-export function toElasticsearchQuery(node) {
+export function toElasticsearchQuery(node: any): string {
   const { value } = node;
   return value.split(wildcardSymbol).join('*');
 }
 
-export function toQueryStringQuery(node) {
+export function toQueryStringQuery(node: any): string {
   const { value } = node;
   return value
     .split(wildcardSymbol)
@@ -65,7 +67,7 @@ export function toQueryStringQuery(node) {
     .join('*');
 }
 
-export function hasLeadingWildcard(node) {
+export function hasLeadingWildcard(node: any): boolean {
   const { value } = node;
   // A lone wildcard turns into an `exists` query, so we're only concerned with
   // leading wildcards followed by additional characters.
diff --git a/src/plugins/data/common/field_formats/converters/boolean.ts b/src/plugins/data/common/field_formats/converters/boolean.ts
index 6cc6c71465d50..a824f9e73fb1e 100644
--- a/src/plugins/data/common/field_formats/converters/boolean.ts
+++ b/src/plugins/data/common/field_formats/converters/boolean.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
@@ -24,7 +25,9 @@ import { asPrettyString } from '../utils';
 
 export class BoolFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.BOOLEAN;
-  static title = 'Boolean';
+  static title = i18n.translate('data.fieldFormats.boolean.title', {
+    defaultMessage: 'Boolean',
+  });
   static fieldType = [KBN_FIELD_TYPES.BOOLEAN, KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.STRING];
 
   textConvert: TextContextTypeConvert = value => {
diff --git a/src/plugins/data/common/field_formats/converters/bytes.ts b/src/plugins/data/common/field_formats/converters/bytes.ts
index f1110add3e7de..13770e087b2a7 100644
--- a/src/plugins/data/common/field_formats/converters/bytes.ts
+++ b/src/plugins/data/common/field_formats/converters/bytes.ts
@@ -17,12 +17,15 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { FIELD_FORMAT_IDS } from '../types';
 
 export class BytesFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.BYTES;
-  static title = 'Bytes';
+  static title = i18n.translate('data.fieldFormats.bytes.title', {
+    defaultMessage: 'Bytes',
+  });
 
   id = BytesFormat.id;
   title = BytesFormat.title;
diff --git a/src/plugins/data/common/field_formats/converters/color.ts b/src/plugins/data/common/field_formats/converters/color.ts
index 20d9d6aee6d26..babf3dbd8c451 100644
--- a/src/plugins/data/common/field_formats/converters/color.ts
+++ b/src/plugins/data/common/field_formats/converters/color.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { findLast, cloneDeep, template, escape } from 'lodash';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
@@ -28,7 +29,9 @@ const convertTemplate = template('<span style="<%- style %>"><%- val %></span>')
 
 export class ColorFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.COLOR;
-  static title = 'Color';
+  static title = i18n.translate('data.fieldFormats.color.title', {
+    defaultMessage: 'Color',
+  });
   static fieldType = [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.STRING];
 
   getParamDefaults() {
diff --git a/src/plugins/data/common/field_formats/converters/date.ts b/src/plugins/data/common/field_formats/converters/date.ts
index 06af64d9c17c2..3888df051b118 100644
--- a/src/plugins/data/common/field_formats/converters/date.ts
+++ b/src/plugins/data/common/field_formats/converters/date.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { memoize, noop } from 'lodash';
 import moment from 'moment';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
@@ -25,7 +26,9 @@ import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 export class DateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE;
-  static title = 'Date';
+  static title = i18n.translate('data.fieldFormats.date.title', {
+    defaultMessage: 'Date',
+  });
   static fieldType = KBN_FIELD_TYPES.DATE;
 
   private memoizedConverter: Function = noop;
diff --git a/src/plugins/data/common/field_formats/converters/date_nanos.ts b/src/plugins/data/common/field_formats/converters/date_nanos.ts
index 8b0f8b111694e..93f3a62842749 100644
--- a/src/plugins/data/common/field_formats/converters/date_nanos.ts
+++ b/src/plugins/data/common/field_formats/converters/date_nanos.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import moment, { Moment } from 'moment';
 import { memoize, noop } from 'lodash';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
@@ -70,7 +71,9 @@ export function formatWithNanos(
 
 export class DateNanosFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE_NANOS;
-  static title = 'Date Nanos';
+  static title = i18n.translate('data.fieldFormats.date_nanos.title', {
+    defaultMessage: 'Date nanos',
+  });
   static fieldType = KBN_FIELD_TYPES.DATE;
 
   private memoizedConverter: Function = noop;
diff --git a/src/plugins/data/common/field_formats/converters/date_server.ts b/src/plugins/data/common/field_formats/converters/date_server.ts
index cc7eba966cf0d..9be8f066539f1 100644
--- a/src/plugins/data/common/field_formats/converters/date_server.ts
+++ b/src/plugins/data/common/field_formats/converters/date_server.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { memoize, noop } from 'lodash';
 import moment from 'moment-timezone';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
@@ -30,14 +31,16 @@ import {
 
 export class DateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DATE;
-  static title = 'Date';
+  static title = i18n.translate('data.fieldFormats.date.title', {
+    defaultMessage: 'Date',
+  });
   static fieldType = KBN_FIELD_TYPES.DATE;
 
   private memoizedConverter: Function = noop;
   private memoizedPattern: string = '';
   private timeZone: string = '';
 
-  constructor(params: IFieldFormatMetaParams, getConfig: GetConfigFn) {
+  constructor(params: IFieldFormatMetaParams, getConfig?: GetConfigFn) {
     super(params, getConfig);
 
     this.memoizedConverter = memoize((val: any) => {
diff --git a/src/plugins/data/common/field_formats/converters/duration.ts b/src/plugins/data/common/field_formats/converters/duration.ts
index 8caa11be5ca79..3b3b6f87f36f9 100644
--- a/src/plugins/data/common/field_formats/converters/duration.ts
+++ b/src/plugins/data/common/field_formats/converters/duration.ts
@@ -31,76 +31,76 @@ const ratioToSeconds: Record<string, number> = {
 const HUMAN_FRIENDLY = 'humanize';
 const DEFAULT_OUTPUT_PRECISION = 2;
 const DEFAULT_INPUT_FORMAT = {
-  text: i18n.translate('data.common.fieldFormats.duration.inputFormats.seconds', {
+  text: i18n.translate('data.fieldFormats.duration.inputFormats.seconds', {
     defaultMessage: 'Seconds',
   }),
   kind: 'seconds',
 };
 const inputFormats = [
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.picoseconds', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.picoseconds', {
       defaultMessage: 'Picoseconds',
     }),
     kind: 'picoseconds',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.nanoseconds', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.nanoseconds', {
       defaultMessage: 'Nanoseconds',
     }),
     kind: 'nanoseconds',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.microseconds', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.microseconds', {
       defaultMessage: 'Microseconds',
     }),
     kind: 'microseconds',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.milliseconds', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.milliseconds', {
       defaultMessage: 'Milliseconds',
     }),
     kind: 'milliseconds',
   },
   { ...DEFAULT_INPUT_FORMAT },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.minutes', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.minutes', {
       defaultMessage: 'Minutes',
     }),
     kind: 'minutes',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.hours', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.hours', {
       defaultMessage: 'Hours',
     }),
     kind: 'hours',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.days', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.days', {
       defaultMessage: 'Days',
     }),
     kind: 'days',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.weeks', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.weeks', {
       defaultMessage: 'Weeks',
     }),
     kind: 'weeks',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.months', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.months', {
       defaultMessage: 'Months',
     }),
     kind: 'months',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.inputFormats.years', {
+    text: i18n.translate('data.fieldFormats.duration.inputFormats.years', {
       defaultMessage: 'Years',
     }),
     kind: 'years',
   },
 ];
 const DEFAULT_OUTPUT_FORMAT = {
-  text: i18n.translate('data.common.fieldFormats.duration.outputFormats.humanize', {
+  text: i18n.translate('data.fieldFormats.duration.outputFormats.humanize', {
     defaultMessage: 'Human Readable',
   }),
   method: 'humanize',
@@ -108,49 +108,49 @@ const DEFAULT_OUTPUT_FORMAT = {
 const outputFormats = [
   { ...DEFAULT_OUTPUT_FORMAT },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asMilliseconds', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMilliseconds', {
       defaultMessage: 'Milliseconds',
     }),
     method: 'asMilliseconds',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asSeconds', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asSeconds', {
       defaultMessage: 'Seconds',
     }),
     method: 'asSeconds',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asMinutes', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMinutes', {
       defaultMessage: 'Minutes',
     }),
     method: 'asMinutes',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asHours', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asHours', {
       defaultMessage: 'Hours',
     }),
     method: 'asHours',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asDays', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asDays', {
       defaultMessage: 'Days',
     }),
     method: 'asDays',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asWeeks', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asWeeks', {
       defaultMessage: 'Weeks',
     }),
     method: 'asWeeks',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asMonths', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asMonths', {
       defaultMessage: 'Months',
     }),
     method: 'asMonths',
   },
   {
-    text: i18n.translate('data.common.fieldFormats.duration.outputFormats.asYears', {
+    text: i18n.translate('data.fieldFormats.duration.outputFormats.asYears', {
       defaultMessage: 'Years',
     }),
     method: 'asYears',
@@ -167,7 +167,9 @@ function parseInputAsDuration(val: number, inputFormat: string) {
 
 export class DurationFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.DURATION;
-  static title = 'Duration';
+  static title = i18n.translate('data.fieldFormats.duration.title', {
+    defaultMessage: 'Duration',
+  });
   static fieldType = KBN_FIELD_TYPES.NUMBER;
   static inputFormats = inputFormats;
   static outputFormats = outputFormats;
@@ -189,7 +191,12 @@ export class DurationFormat extends FieldFormat {
     const outputFormat = this.param('outputFormat') as keyof Duration;
     const outputPrecision = this.param('outputPrecision');
     const human = this.isHuman();
-    const prefix = val < 0 && human ? 'minus ' : '';
+    const prefix =
+      val < 0 && human
+        ? i18n.translate('data.fieldFormats.duration.negativeLabel', {
+            defaultMessage: 'minus',
+          }) + ' '
+        : '';
     const duration = parseInputAsDuration(val, inputFormat) as Record<keyof Duration, Function>;
     const formatted = duration[outputFormat]();
     const precise = human ? formatted : formatted.toFixed(outputPrecision);
diff --git a/src/plugins/data/common/field_formats/converters/ip.ts b/src/plugins/data/common/field_formats/converters/ip.ts
index 3e011e8d7dde8..8e65d9c12d6c8 100644
--- a/src/plugins/data/common/field_formats/converters/ip.ts
+++ b/src/plugins/data/common/field_formats/converters/ip.ts
@@ -17,13 +17,16 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 export class IpFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.IP;
-  static title = 'IP Address';
+  static title = i18n.translate('data.fieldFormats.ip.title', {
+    defaultMessage: 'IP address',
+  });
   static fieldType = KBN_FIELD_TYPES.IP;
 
   textConvert: TextContextTypeConvert = val => {
diff --git a/src/plugins/data/common/field_formats/converters/number.ts b/src/plugins/data/common/field_formats/converters/number.ts
index 686329e887682..17c7006f622a3 100644
--- a/src/plugins/data/common/field_formats/converters/number.ts
+++ b/src/plugins/data/common/field_formats/converters/number.ts
@@ -17,12 +17,15 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { FIELD_FORMAT_IDS } from '../types';
 
 export class NumberFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.NUMBER;
-  static title = 'Number';
+  static title = i18n.translate('data.fieldFormats.number.title', {
+    defaultMessage: 'Number',
+  });
 
   id = NumberFormat.id;
   title = NumberFormat.title;
diff --git a/src/plugins/data/common/field_formats/converters/percent.ts b/src/plugins/data/common/field_formats/converters/percent.ts
index d839a54dd0c2c..8cbc2d36d0ef1 100644
--- a/src/plugins/data/common/field_formats/converters/percent.ts
+++ b/src/plugins/data/common/field_formats/converters/percent.ts
@@ -17,12 +17,15 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { NumeralFormat } from './numeral';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 export class PercentFormat extends NumeralFormat {
   static id = FIELD_FORMAT_IDS.PERCENT;
-  static title = 'Percentage';
+  static title = i18n.translate('data.fieldFormats.percent.title', {
+    defaultMessage: 'Percentage',
+  });
 
   id = PercentFormat.id;
   title = PercentFormat.title;
diff --git a/src/plugins/data/common/field_formats/converters/relative_date.ts b/src/plugins/data/common/field_formats/converters/relative_date.ts
index 273b2cef28a03..7c7f20ee9c411 100644
--- a/src/plugins/data/common/field_formats/converters/relative_date.ts
+++ b/src/plugins/data/common/field_formats/converters/relative_date.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import moment from 'moment';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
@@ -24,7 +25,9 @@ import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
 
 export class RelativeDateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.RELATIVE_DATE;
-  static title = 'Relative Date';
+  static title = i18n.translate('data.fieldFormats.relative_date.title', {
+    defaultMessage: 'Relative date',
+  });
   static fieldType = KBN_FIELD_TYPES.DATE;
 
   textConvert: TextContextTypeConvert = val => {
diff --git a/src/plugins/data/common/field_formats/converters/static_lookup.ts b/src/plugins/data/common/field_formats/converters/static_lookup.ts
index 419e7c786640b..c835afd3db5ec 100644
--- a/src/plugins/data/common/field_formats/converters/static_lookup.ts
+++ b/src/plugins/data/common/field_formats/converters/static_lookup.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
 import { TextContextTypeConvert, FIELD_FORMAT_IDS } from '../types';
@@ -33,7 +34,9 @@ function convertLookupEntriesToMap(lookupEntries: any[]) {
 
 export class StaticLookupFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.STATIC_LOOKUP;
-  static title = 'Static Lookup';
+  static title = i18n.translate('data.fieldFormats.static_lookup.title', {
+    defaultMessage: 'Static lookup',
+  });
   static fieldType = [
     KBN_FIELD_TYPES.STRING,
     KBN_FIELD_TYPES.NUMBER,
diff --git a/src/plugins/data/common/field_formats/converters/string.ts b/src/plugins/data/common/field_formats/converters/string.ts
index 1a095d4fd3cfd..22df9f1f88bfb 100644
--- a/src/plugins/data/common/field_formats/converters/string.ts
+++ b/src/plugins/data/common/field_formats/converters/string.ts
@@ -27,43 +27,43 @@ import { shortenDottedString } from '../../utils';
 const TRANSFORM_OPTIONS = [
   {
     kind: false,
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.none', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.none', {
       defaultMessage: '- None -',
     }),
   },
   {
     kind: 'lower',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.lower', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.lower', {
       defaultMessage: 'Lower Case',
     }),
   },
   {
     kind: 'upper',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.upper', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.upper', {
       defaultMessage: 'Upper Case',
     }),
   },
   {
     kind: 'title',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.title', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.title', {
       defaultMessage: 'Title Case',
     }),
   },
   {
     kind: 'short',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.short', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.short', {
       defaultMessage: 'Short Dots',
     }),
   },
   {
     kind: 'base64',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.base64', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.base64', {
       defaultMessage: 'Base64 Decode',
     }),
   },
   {
     kind: 'urlparam',
-    text: i18n.translate('data.common.fieldFormats.string.transformOptions.url', {
+    text: i18n.translate('data.fieldFormats.string.transformOptions.url', {
       defaultMessage: 'URL Param Decode',
     }),
   },
@@ -72,7 +72,9 @@ const DEFAULT_TRANSFORM_OPTION = false;
 
 export class StringFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.STRING;
-  static title = 'String';
+  static title = i18n.translate('data.fieldFormats.string.title', {
+    defaultMessage: 'String',
+  });
   static fieldType = [
     KBN_FIELD_TYPES.NUMBER,
     KBN_FIELD_TYPES.BOOLEAN,
diff --git a/src/plugins/data/common/field_formats/converters/truncate.test.ts b/src/plugins/data/common/field_formats/converters/truncate.test.ts
index 472d9673346d7..3a0abc918fa98 100644
--- a/src/plugins/data/common/field_formats/converters/truncate.test.ts
+++ b/src/plugins/data/common/field_formats/converters/truncate.test.ts
@@ -43,4 +43,11 @@ describe('String TruncateFormat', () => {
 
     expect(truncate.convert('This is some text')).toBe('This is some text');
   });
+
+  test('does not truncate whole text when non integer is passed in', () => {
+    // https://github.com/elastic/kibana/issues/29648
+    const truncate = new TruncateFormat({ fieldLength: 3.2 }, jest.fn());
+
+    expect(truncate.convert('This is some text')).toBe('Thi...');
+  });
 });
diff --git a/src/plugins/data/common/field_formats/converters/truncate.ts b/src/plugins/data/common/field_formats/converters/truncate.ts
index dc25d71ec95d7..70b2a3dff18f2 100644
--- a/src/plugins/data/common/field_formats/converters/truncate.ts
+++ b/src/plugins/data/common/field_formats/converters/truncate.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
 import { trunc } from 'lodash';
 import { KBN_FIELD_TYPES } from '../../kbn_field_types/types';
 import { FieldFormat } from '../field_format';
@@ -26,7 +27,9 @@ const omission = '...';
 
 export class TruncateFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.TRUNCATE;
-  static title = 'Truncated String';
+  static title = i18n.translate('data.fieldFormats.truncated_string.title', {
+    defaultMessage: 'Truncated string',
+  });
   static fieldType = KBN_FIELD_TYPES.STRING;
 
   textConvert: TextContextTypeConvert = val => {
diff --git a/src/plugins/data/common/field_formats/converters/url.ts b/src/plugins/data/common/field_formats/converters/url.ts
index 7c3e1e1d2cad1..60d7efdba34ff 100644
--- a/src/plugins/data/common/field_formats/converters/url.ts
+++ b/src/plugins/data/common/field_formats/converters/url.ts
@@ -35,19 +35,19 @@ const whitelistUrlSchemes = ['http://', 'https://'];
 const URL_TYPES = [
   {
     kind: 'a',
-    text: i18n.translate('data.common.fieldFormats.url.types.link', {
+    text: i18n.translate('data.fieldFormats.url.types.link', {
       defaultMessage: 'Link',
     }),
   },
   {
     kind: 'img',
-    text: i18n.translate('data.common.fieldFormats.url.types.img', {
+    text: i18n.translate('data.fieldFormats.url.types.img', {
       defaultMessage: 'Image',
     }),
   },
   {
     kind: 'audio',
-    text: i18n.translate('data.common.fieldFormats.url.types.audio', {
+    text: i18n.translate('data.fieldFormats.url.types.audio', {
       defaultMessage: 'Audio',
     }),
   },
@@ -56,7 +56,9 @@ const DEFAULT_URL_TYPE = 'a';
 
 export class UrlFormat extends FieldFormat {
   static id = FIELD_FORMAT_IDS.URL;
-  static title = 'Url';
+  static title = i18n.translate('data.fieldFormats.url.title', {
+    defaultMessage: 'Url',
+  });
   static fieldType = [
     KBN_FIELD_TYPES.NUMBER,
     KBN_FIELD_TYPES.BOOLEAN,
diff --git a/src/plugins/data/public/actions/apply_filter_action.ts b/src/plugins/data/public/actions/apply_filter_action.ts
index b006889637c50..cc8bcf7679cf1 100644
--- a/src/plugins/data/public/actions/apply_filter_action.ts
+++ b/src/plugins/data/public/actions/apply_filter_action.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { toMountPoint } from '../../../kibana_react/public';
-import { IAction, createAction, IncompatibleActionError } from '../../../ui_actions/public';
+import { Action, createAction, IncompatibleActionError } from '../../../ui_actions/public';
 import { getOverlays, getIndexPatterns } from '../services';
 import { applyFiltersPopover } from '../ui/apply_filters';
 import {
@@ -44,7 +44,7 @@ async function isCompatible(context: ActionContext) {
 export function createFilterAction(
   filterManager: FilterManager,
   timeFilter: TimefilterContract
-): IAction<ActionContext> {
+): Action<ActionContext> {
   return createAction<ActionContext>({
     type: GLOBAL_APPLY_FILTER_ACTION,
     id: GLOBAL_APPLY_FILTER_ACTION,
diff --git a/src/plugins/data/public/index_patterns/index.ts b/src/plugins/data/public/index_patterns/index.ts
index 7444126ee6cae..ecddd893d1a54 100644
--- a/src/plugins/data/public/index_patterns/index.ts
+++ b/src/plugins/data/public/index_patterns/index.ts
@@ -44,7 +44,13 @@ export const indexPatterns = {
   isDefault,
 };
 
-export { Field, FieldList, IFieldList } from './fields';
+export { Field, FieldList } from './fields';
 
 // TODO: figure out how to replace IndexPatterns in get_inner_angular.
-export { IndexPattern, IndexPatterns, IndexPatternsContract } from './index_patterns';
+export {
+  IndexPattern,
+  IndexPatterns,
+  IndexPatternsContract,
+  TypeMeta,
+  AggregationRestrictions,
+} from './index_patterns';
diff --git a/src/plugins/data/public/index_patterns/index_patterns/index.ts b/src/plugins/data/public/index_patterns/index_patterns/index.ts
index 4ca7e053a4492..fca82025cdc66 100644
--- a/src/plugins/data/public/index_patterns/index_patterns/index.ts
+++ b/src/plugins/data/public/index_patterns/index_patterns/index.ts
@@ -22,3 +22,4 @@ export * from './format_hit';
 export * from './index_pattern';
 export * from './index_patterns';
 export * from './index_patterns_api_client';
+export * from './types';
diff --git a/src/plugins/data/public/index_patterns/index_patterns/index_pattern.ts b/src/plugins/data/public/index_patterns/index_patterns/index_pattern.ts
index 5c09e22b6dbb4..c09c9f4828799 100644
--- a/src/plugins/data/public/index_patterns/index_patterns/index_pattern.ts
+++ b/src/plugins/data/public/index_patterns/index_patterns/index_pattern.ts
@@ -38,6 +38,7 @@ import { formatHitProvider } from './format_hit';
 import { flattenHitWrapper } from './flatten_hit';
 import { IIndexPatternsApiClient } from './index_patterns_api_client';
 import { getNotifications, getFieldFormats } from '../../services';
+import { TypeMeta } from './types';
 
 const MAX_ATTEMPTS_TO_RESOLVE_CONFLICTS = 3;
 const type = 'index-pattern';
@@ -49,7 +50,7 @@ export class IndexPattern implements IIndexPattern {
   public title: string = '';
   public type?: string;
   public fieldFormatMap: any;
-  public typeMeta: any;
+  public typeMeta?: TypeMeta;
   public fields: IFieldList;
   public timeFieldName: string | undefined;
   public formatHit: any;
@@ -336,6 +337,10 @@ export class IndexPattern implements IIndexPattern {
     return this.fields.getByName(name);
   }
 
+  getAggregationRestrictions() {
+    return this.typeMeta?.aggs;
+  }
+
   isWildcard() {
     return _.includes(this.title, '*');
   }
diff --git a/src/plugins/data/public/index_patterns/index_patterns/index_patterns.test.ts b/src/plugins/data/public/index_patterns/index_patterns/index_patterns.test.ts
index 919115d40b068..f21a1610f29e2 100644
--- a/src/plugins/data/public/index_patterns/index_patterns/index_patterns.test.ts
+++ b/src/plugins/data/public/index_patterns/index_patterns/index_patterns.test.ts
@@ -19,7 +19,12 @@
 
 // eslint-disable-next-line max-classes-per-file
 import { IndexPatterns } from './index_patterns';
-import { SavedObjectsClientContract, IUiSettingsClient, HttpSetup } from 'kibana/public';
+import {
+  SavedObjectsClientContract,
+  IUiSettingsClient,
+  HttpSetup,
+  SavedObjectsFindResponsePublic,
+} from 'kibana/public';
 
 jest.mock('./index_pattern', () => {
   class IndexPattern {
@@ -45,9 +50,17 @@ jest.mock('./index_patterns_api_client', () => {
 
 describe('IndexPatterns', () => {
   let indexPatterns: IndexPatterns;
+  let savedObjectsClient: SavedObjectsClientContract;
 
   beforeEach(() => {
-    const savedObjectsClient = {} as SavedObjectsClientContract;
+    savedObjectsClient = {} as SavedObjectsClientContract;
+    savedObjectsClient.find = jest.fn(
+      () =>
+        Promise.resolve({
+          savedObjects: [{ id: 'id', attributes: { title: 'title' } }],
+        }) as Promise<SavedObjectsFindResponsePublic<any>>
+    );
+
     const uiSettings = {} as IUiSettingsClient;
     const http = {} as HttpSetup;
 
@@ -61,4 +74,27 @@ describe('IndexPatterns', () => {
     expect(indexPattern).toBeDefined();
     expect(indexPattern).toBe(await indexPatterns.get(id));
   });
+
+  test('savedObjectCache pre-fetches only title', async () => {
+    expect(await indexPatterns.getIds()).toEqual(['id']);
+    expect(savedObjectsClient.find).toHaveBeenCalledWith({
+      type: 'index-pattern',
+      fields: ['title'],
+      perPage: 10000,
+    });
+  });
+
+  test('caches saved objects', async () => {
+    await indexPatterns.getIds();
+    await indexPatterns.getTitles();
+    await indexPatterns.getFields(['id', 'title']);
+    expect(savedObjectsClient.find).toHaveBeenCalledTimes(1);
+  });
+
+  test('can refresh the saved objects caches', async () => {
+    await indexPatterns.getIds();
+    await indexPatterns.getTitles(true);
+    await indexPatterns.getFields(['id', 'title'], true);
+    expect(savedObjectsClient.find).toHaveBeenCalledTimes(3);
+  });
 });
diff --git a/src/plugins/data/public/index_patterns/index_patterns/index_patterns.ts b/src/plugins/data/public/index_patterns/index_patterns/index_patterns.ts
index 8d7dd0f054366..2c93ed7fb79bf 100644
--- a/src/plugins/data/public/index_patterns/index_patterns/index_patterns.ts
+++ b/src/plugins/data/public/index_patterns/index_patterns/index_patterns.ts
@@ -30,6 +30,8 @@ import { IndexPatternsApiClient, GetFieldsOptions } from './index_patterns_api_c
 
 const indexPatternCache = createIndexPatternCache();
 
+type IndexPatternCachedFieldType = 'id' | 'title';
+
 export class IndexPatterns {
   private config: IUiSettingsClient;
   private savedObjectsClient: SavedObjectsClientContract;
@@ -50,7 +52,7 @@ export class IndexPatterns {
     this.savedObjectsCache = (
       await this.savedObjectsClient.find({
         type: 'index-pattern',
-        fields: [],
+        fields: ['title'],
         perPage: 10000,
       })
     ).savedObjects;
@@ -76,7 +78,7 @@ export class IndexPatterns {
     return this.savedObjectsCache.map(obj => obj?.attributes?.title);
   };
 
-  getFields = async (fields: string[], refresh: boolean = false) => {
+  getFields = async (fields: IndexPatternCachedFieldType[], refresh: boolean = false) => {
     if (!this.savedObjectsCache || refresh) {
       await this.refreshSavedObjectsCache();
     }
@@ -84,8 +86,10 @@ export class IndexPatterns {
       return [];
     }
     return this.savedObjectsCache.map((obj: Record<string, any>) => {
-      const result: Record<string, any> = {};
-      fields.forEach((f: string) => (result[f] = obj[f] || obj?.attributes?.[f]));
+      const result: Partial<Record<IndexPatternCachedFieldType, string>> = {};
+      fields.forEach(
+        (f: IndexPatternCachedFieldType) => (result[f] = obj[f] || obj?.attributes?.[f])
+      );
       return result;
     });
   };
diff --git a/src/plugins/data/public/index_patterns/index_patterns/types.ts b/src/plugins/data/public/index_patterns/index_patterns/types.ts
new file mode 100644
index 0000000000000..b2060dd1d48ba
--- /dev/null
+++ b/src/plugins/data/public/index_patterns/index_patterns/types.ts
@@ -0,0 +1,35 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export type AggregationRestrictions = Record<
+  string,
+  {
+    agg?: string;
+    interval?: number;
+    fixed_interval?: string;
+    calendar_interval?: string;
+    delay?: string;
+    time_zone?: string;
+  }
+>;
+
+export interface TypeMeta {
+  aggs?: Record<string, AggregationRestrictions>;
+  [key: string]: any;
+}
diff --git a/src/plugins/data/public/mocks.ts b/src/plugins/data/public/mocks.ts
index 847d79fdc87d1..726cd6cfb18f0 100644
--- a/src/plugins/data/public/mocks.ts
+++ b/src/plugins/data/public/mocks.ts
@@ -101,6 +101,8 @@ const createStartContract = (): Start => {
   return startContract;
 };
 
+export { searchSourceMock } from './search/mocks';
+
 export const dataPluginMock = {
   createSetupContract,
   createStartContract,
diff --git a/src/plugins/data/public/query/saved_query/saved_query_service.ts b/src/plugins/data/public/query/saved_query/saved_query_service.ts
index 434efe80ecd8c..80dec1c9373ea 100644
--- a/src/plugins/data/public/query/saved_query/saved_query_service.ts
+++ b/src/plugins/data/public/query/saved_query/saved_query_service.ts
@@ -112,8 +112,11 @@ export const createSavedQueryService = (
   };
 
   const getSavedQuery = async (id: string): Promise<SavedQuery> => {
-    const response = await savedObjectsClient.get<SerializedSavedQueryAttributes>('query', id);
-    return parseSavedQueryObject(response);
+    const savedObject = await savedObjectsClient.get<SerializedSavedQueryAttributes>('query', id);
+    if (savedObject.error) {
+      throw new Error(savedObject.error.message);
+    }
+    return parseSavedQueryObject(savedObject);
   };
 
   const deleteSavedQuery = async (id: string) => {
diff --git a/src/plugins/data/public/query/state_sync/index.ts b/src/plugins/data/public/query/state_sync/index.ts
index 7eefda0d0aec1..27e02940765cf 100644
--- a/src/plugins/data/public/query/state_sync/index.ts
+++ b/src/plugins/data/public/query/state_sync/index.ts
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { syncQuery } from './sync_query';
+export { syncQuery, getQueryStateContainer } from './sync_query';
 export { syncAppFilters } from './sync_app_filters';
diff --git a/src/plugins/data/public/query/state_sync/sync_query.test.ts b/src/plugins/data/public/query/state_sync/sync_query.test.ts
index 0973af13cacd5..4796da4f5fd4b 100644
--- a/src/plugins/data/public/query/state_sync/sync_query.test.ts
+++ b/src/plugins/data/public/query/state_sync/sync_query.test.ts
@@ -31,7 +31,7 @@ import {
 import { QueryService, QueryStart } from '../query_service';
 import { StubBrowserStorage } from 'test_utils/stub_browser_storage';
 import { TimefilterContract } from '../timefilter';
-import { QuerySyncState, syncQuery } from './sync_query';
+import { getQueryStateContainer, QuerySyncState, syncQuery } from './sync_query';
 
 const setupMock = coreMock.createSetup();
 const startMock = coreMock.createStart();
@@ -163,4 +163,69 @@ describe('sync_query', () => {
     expect(spy).not.toBeCalled();
     stop();
   });
+
+  describe('getQueryStateContainer', () => {
+    test('state is initialized with state from query service', () => {
+      const { stop, querySyncStateContainer, initialState } = getQueryStateContainer(
+        queryServiceStart
+      );
+      expect(querySyncStateContainer.getState()).toMatchInlineSnapshot(`
+        Object {
+          "filters": Array [],
+          "refreshInterval": Object {
+            "pause": true,
+            "value": 0,
+          },
+          "time": Object {
+            "from": "now-15m",
+            "to": "now",
+          },
+        }
+      `);
+      expect(initialState).toEqual(querySyncStateContainer.getState());
+      stop();
+    });
+
+    test('state takes initial overrides into account', () => {
+      const { stop, querySyncStateContainer, initialState } = getQueryStateContainer(
+        queryServiceStart,
+        {
+          time: { from: 'now-99d', to: 'now' },
+        }
+      );
+      expect(querySyncStateContainer.getState().time).toEqual({
+        from: 'now-99d',
+        to: 'now',
+      });
+      expect(initialState).toEqual(querySyncStateContainer.getState());
+      stop();
+    });
+
+    test('when filters change, state container contains updated global filters', () => {
+      const { stop, querySyncStateContainer } = getQueryStateContainer(queryServiceStart);
+      filterManager.setFilters([gF, aF]);
+      expect(querySyncStateContainer.getState().filters).toHaveLength(1);
+      stop();
+    });
+
+    test('when time range changes, state container contains updated time range', () => {
+      const { stop, querySyncStateContainer } = getQueryStateContainer(queryServiceStart);
+      timefilter.setTime({ from: 'now-30m', to: 'now' });
+      expect(querySyncStateContainer.getState().time).toEqual({
+        from: 'now-30m',
+        to: 'now',
+      });
+      stop();
+    });
+
+    test('when refresh interval changes, state container contains updated refresh interval', () => {
+      const { stop, querySyncStateContainer } = getQueryStateContainer(queryServiceStart);
+      timefilter.setRefreshInterval({ pause: true, value: 100 });
+      expect(querySyncStateContainer.getState().refreshInterval).toEqual({
+        pause: true,
+        value: 100,
+      });
+      stop();
+    });
+  });
 });
diff --git a/src/plugins/data/public/query/state_sync/sync_query.ts b/src/plugins/data/public/query/state_sync/sync_query.ts
index be641e89f9b76..9a4e9cbba2990 100644
--- a/src/plugins/data/public/query/state_sync/sync_query.ts
+++ b/src/plugins/data/public/query/state_sync/sync_query.ts
@@ -27,7 +27,7 @@ import {
 } from '../../../../kibana_utils/public';
 import { COMPARE_ALL_OPTIONS, compareFilters } from '../filter_manager/lib/compare_filters';
 import { esFilters, RefreshInterval, TimeRange } from '../../../common';
-import { QueryStart } from '../query_service';
+import { QuerySetup, QueryStart } from '../query_service';
 
 const GLOBAL_STATE_STORAGE_KEY = '_g';
 
@@ -40,16 +40,11 @@ export interface QuerySyncState {
 /**
  * Helper utility to set up syncing between query services and url's '_g' query param
  */
-export const syncQuery = (
-  { timefilter: { timefilter }, filterManager }: QueryStart,
-  urlStateStorage: IKbnUrlStateStorage
-) => {
-  const defaultState: QuerySyncState = {
-    time: timefilter.getTime(),
-    refreshInterval: timefilter.getRefreshInterval(),
-    filters: filterManager.getGlobalFilters(),
-  };
-
+export const syncQuery = (queryStart: QueryStart, urlStateStorage: IKbnUrlStateStorage) => {
+  const {
+    timefilter: { timefilter },
+    filterManager,
+  } = queryStart;
   // retrieve current state from `_g` url
   const initialStateFromUrl = urlStateStorage.get<QuerySyncState>(GLOBAL_STATE_STORAGE_KEY);
 
@@ -58,10 +53,82 @@ export const syncQuery = (
     initialStateFromUrl && Object.keys(initialStateFromUrl).length
   );
 
-  // prepare initial state, whatever was in URL takes precedences over current state in services
+  const {
+    querySyncStateContainer,
+    stop: stopPullQueryState,
+    initialState,
+  } = getQueryStateContainer(queryStart, initialStateFromUrl || {});
+
+  const pushQueryStateSubscription = querySyncStateContainer.state$.subscribe(
+    ({ time, filters: globalFilters, refreshInterval }) => {
+      // cloneDeep is required because services are mutating passed objects
+      // and state in state container is frozen
+      if (time && !_.isEqual(time, timefilter.getTime())) {
+        timefilter.setTime(_.cloneDeep(time));
+      }
+
+      if (refreshInterval && !_.isEqual(refreshInterval, timefilter.getRefreshInterval())) {
+        timefilter.setRefreshInterval(_.cloneDeep(refreshInterval));
+      }
+
+      if (
+        globalFilters &&
+        !compareFilters(globalFilters, filterManager.getGlobalFilters(), COMPARE_ALL_OPTIONS)
+      ) {
+        filterManager.setGlobalFilters(_.cloneDeep(globalFilters));
+      }
+    }
+  );
+
+  // if there weren't any initial state in url,
+  // then put _g key into url
+  if (!initialStateFromUrl) {
+    urlStateStorage.set<QuerySyncState>(GLOBAL_STATE_STORAGE_KEY, initialState, {
+      replace: true,
+    });
+  }
+
+  // trigger initial syncing from state container to services if needed
+  querySyncStateContainer.set(initialState);
+
+  const { start, stop: stopSyncState } = syncState({
+    stateStorage: urlStateStorage,
+    stateContainer: {
+      ...querySyncStateContainer,
+      set: state => {
+        if (state) {
+          // syncState utils requires to handle incoming "null" value
+          querySyncStateContainer.set(state);
+        }
+      },
+    },
+    storageKey: GLOBAL_STATE_STORAGE_KEY,
+  });
+
+  start();
+  return {
+    stop: () => {
+      stopSyncState();
+      pushQueryStateSubscription.unsubscribe();
+      stopPullQueryState();
+    },
+    hasInheritedQueryFromUrl,
+  };
+};
+
+export const getQueryStateContainer = (
+  { timefilter: { timefilter }, filterManager }: QuerySetup,
+  initialStateOverrides: Partial<QuerySyncState> = {}
+) => {
+  const defaultState: QuerySyncState = {
+    time: timefilter.getTime(),
+    refreshInterval: timefilter.getRefreshInterval(),
+    filters: filterManager.getGlobalFilters(),
+  };
+
   const initialState: QuerySyncState = {
     ...defaultState,
-    ...initialStateFromUrl,
+    ...initialStateOverrides,
   };
 
   // create state container, which will be used for syncing with syncState() util
@@ -109,59 +176,13 @@ export const syncQuery = (
       .subscribe(newGlobalFilters => {
         querySyncStateContainer.transitions.setFilters(newGlobalFilters);
       }),
-    querySyncStateContainer.state$.subscribe(
-      ({ time, filters: globalFilters, refreshInterval }) => {
-        // cloneDeep is required because services are mutating passed objects
-        // and state in state container is frozen
-        if (time && !_.isEqual(time, timefilter.getTime())) {
-          timefilter.setTime(_.cloneDeep(time));
-        }
-
-        if (refreshInterval && !_.isEqual(refreshInterval, timefilter.getRefreshInterval())) {
-          timefilter.setRefreshInterval(_.cloneDeep(refreshInterval));
-        }
-
-        if (
-          globalFilters &&
-          !compareFilters(globalFilters, filterManager.getGlobalFilters(), COMPARE_ALL_OPTIONS)
-        ) {
-          filterManager.setGlobalFilters(_.cloneDeep(globalFilters));
-        }
-      }
-    ),
   ];
 
-  // if there weren't any initial state in url,
-  // then put _g key into url
-  if (!initialStateFromUrl) {
-    urlStateStorage.set<QuerySyncState>(GLOBAL_STATE_STORAGE_KEY, initialState, {
-      replace: true,
-    });
-  }
-
-  // trigger initial syncing from state container to services if needed
-  querySyncStateContainer.set(initialState);
-
-  const { start, stop } = syncState({
-    stateStorage: urlStateStorage,
-    stateContainer: {
-      ...querySyncStateContainer,
-      set: state => {
-        if (state) {
-          // syncState utils requires to handle incoming "null" value
-          querySyncStateContainer.set(state);
-        }
-      },
-    },
-    storageKey: GLOBAL_STATE_STORAGE_KEY,
-  });
-
-  start();
   return {
+    querySyncStateContainer,
     stop: () => {
       subs.forEach(s => s.unsubscribe());
-      stop();
     },
-    hasInheritedQueryFromUrl,
+    initialState,
   };
 };
diff --git a/src/plugins/data/public/search/create_app_mount_context_search.test.ts b/src/plugins/data/public/search/create_app_mount_context_search.test.ts
index 15b85ee270bed..fa7cdbcda3082 100644
--- a/src/plugins/data/public/search/create_app_mount_context_search.test.ts
+++ b/src/plugins/data/public/search/create_app_mount_context_search.test.ts
@@ -18,35 +18,32 @@
  */
 
 import { createAppMountSearchContext } from './create_app_mount_context_search';
-import { from, BehaviorSubject } from 'rxjs';
+import { from } from 'rxjs';
 
 describe('Create app mount search context', () => {
   it('Returns search fn when there are no strategies', () => {
-    const context = createAppMountSearchContext({}, new BehaviorSubject(0));
+    const context = createAppMountSearchContext({});
     expect(context.search).toBeDefined();
   });
 
   it(`Search throws an error when the strategy doesn't exist`, () => {
-    const context = createAppMountSearchContext({}, new BehaviorSubject(0));
+    const context = createAppMountSearchContext({});
     expect(() => context.search({}, {}, 'noexist').toPromise()).toThrowErrorMatchingInlineSnapshot(
       `"Strategy with name noexist does not exist"`
     );
   });
 
   it(`Search fn is called on appropriate strategy name`, done => {
-    const context = createAppMountSearchContext(
-      {
-        mysearch: search =>
-          Promise.resolve({
-            search: () => from(Promise.resolve({ percentComplete: 98 })),
-          }),
-        anothersearch: search =>
-          Promise.resolve({
-            search: () => from(Promise.resolve({ percentComplete: 0 })),
-          }),
-      },
-      new BehaviorSubject(0)
-    );
+    const context = createAppMountSearchContext({
+      mysearch: search =>
+        Promise.resolve({
+          search: () => from(Promise.resolve({ percentComplete: 98 })),
+        }),
+      anothersearch: search =>
+        Promise.resolve({
+          search: () => from(Promise.resolve({ percentComplete: 0 })),
+        }),
+    });
 
     context.search({}, {}, 'mysearch').subscribe(response => {
       expect(response).toEqual({ percentComplete: 98 });
@@ -55,19 +52,16 @@ describe('Create app mount search context', () => {
   });
 
   it(`Search fn is called with the passed in request object`, done => {
-    const context = createAppMountSearchContext(
-      {
-        mysearch: search => {
-          return Promise.resolve({
-            search: request => {
-              expect(request).toEqual({ greeting: 'hi' });
-              return from(Promise.resolve({}));
-            },
-          });
-        },
+    const context = createAppMountSearchContext({
+      mysearch: search => {
+        return Promise.resolve({
+          search: request => {
+            expect(request).toEqual({ greeting: 'hi' });
+            return from(Promise.resolve({}));
+          },
+        });
       },
-      new BehaviorSubject(0)
-    );
+    });
     context.search({ greeting: 'hi' } as any, {}, 'mysearch').subscribe(
       response => {},
       () => {},
diff --git a/src/plugins/data/public/search/create_app_mount_context_search.ts b/src/plugins/data/public/search/create_app_mount_context_search.ts
index f480b8f3e042e..7a617e0bab837 100644
--- a/src/plugins/data/public/search/create_app_mount_context_search.ts
+++ b/src/plugins/data/public/search/create_app_mount_context_search.ts
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { mergeMap, tap } from 'rxjs/operators';
-import { from, BehaviorSubject } from 'rxjs';
+import { mergeMap } from 'rxjs/operators';
+import { from } from 'rxjs';
 import { ISearchAppMountContext } from './i_search_app_mount_context';
 import { ISearchGeneric } from './i_search';
 import {
@@ -30,8 +30,7 @@ import { TStrategyTypes } from './strategy_types';
 import { DEFAULT_SEARCH_STRATEGY } from '../../common/search';
 
 export const createAppMountSearchContext = (
-  searchStrategies: TSearchStrategiesMap,
-  loadingCount$: BehaviorSubject<number>
+  searchStrategies: TSearchStrategiesMap
 ): ISearchAppMountContext => {
   const getSearchStrategy = <K extends TStrategyTypes = typeof DEFAULT_SEARCH_STRATEGY>(
     strategyName?: K
@@ -47,17 +46,7 @@ export const createAppMountSearchContext = (
 
   const search: ISearchGeneric = (request, options, strategyName) => {
     const strategyPromise = getSearchStrategy(strategyName);
-    return from(strategyPromise).pipe(
-      mergeMap(strategy => {
-        loadingCount$.next(loadingCount$.getValue() + 1);
-        return strategy.search(request, options).pipe(
-          tap(
-            error => loadingCount$.next(loadingCount$.getValue() - 1),
-            complete => loadingCount$.next(loadingCount$.getValue() - 1)
-          )
-        );
-      })
-    );
+    return from(strategyPromise).pipe(mergeMap(strategy => strategy.search(request, options)));
   };
 
   return { search };
diff --git a/src/plugins/data/public/search/es_client/get_es_client.ts b/src/plugins/data/public/search/es_client/get_es_client.ts
index 6c271643ba012..93d9d24920271 100644
--- a/src/plugins/data/public/search/es_client/get_es_client.ts
+++ b/src/plugins/data/public/search/es_client/get_es_client.ts
@@ -25,8 +25,7 @@ import { BehaviorSubject } from 'rxjs';
 export function getEsClient(
   injectedMetadata: CoreStart['injectedMetadata'],
   http: CoreStart['http'],
-  packageInfo: PackageInfo,
-  loadingCount$: BehaviorSubject<number>
+  packageInfo: PackageInfo
 ) {
   const esRequestTimeout = injectedMetadata.getInjectedVar('esRequestTimeout') as number;
   const esApiVersion = injectedMetadata.getInjectedVar('esApiVersion') as string;
@@ -39,6 +38,9 @@ export function getEsClient(
     apiVersion: esApiVersion,
   });
 
+  const loadingCount$ = new BehaviorSubject(0);
+  http.addLoadingCountSource(loadingCount$);
+
   return {
     search: wrapEsClientMethod(client, 'search', loadingCount$),
     msearch: wrapEsClientMethod(client, 'msearch', loadingCount$),
diff --git a/src/plugins/data/public/search/mocks.ts b/src/plugins/data/public/search/mocks.ts
index 81a028007bc94..821bd45f731e8 100644
--- a/src/plugins/data/public/search/mocks.ts
+++ b/src/plugins/data/public/search/mocks.ts
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+export * from './search_source/mocks';
+
 export const searchSetupMock = {
   registerSearchStrategyContext: jest.fn(),
   registerSearchStrategyProvider: jest.fn(),
diff --git a/src/plugins/data/public/search/search_service.ts b/src/plugins/data/public/search/search_service.ts
index dad2b3d078aa0..dd67c04f1d7bd 100644
--- a/src/plugins/data/public/search/search_service.ts
+++ b/src/plugins/data/public/search/search_service.ts
@@ -16,7 +16,6 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { BehaviorSubject } from 'rxjs';
 import {
   Plugin,
   CoreSetup,
@@ -80,22 +79,17 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
   private contextContainer?: IContextContainer<TSearchStrategyProvider<any>>;
   private esClient?: LegacyApiCaller;
   private search?: ISearchGeneric;
-  private readonly loadingCount$ = new BehaviorSubject(0);
 
   constructor(private initializerContext: PluginInitializerContext) {}
 
   public setup(core: CoreSetup, packageInfo: PackageInfo): ISearchSetup {
-    core.http.addLoadingCountSource(this.loadingCount$);
-    const search = (this.search = createAppMountSearchContext(
-      this.searchStrategies,
-      this.loadingCount$
-    ).search);
+    const search = (this.search = createAppMountSearchContext(this.searchStrategies).search);
     core.application.registerMountContext<'search'>('search', () => {
       return { search };
     });
 
     this.contextContainer = core.context.createContextContainer();
-    this.esClient = getEsClient(core.injectedMetadata, core.http, packageInfo, this.loadingCount$);
+    this.esClient = getEsClient(core.injectedMetadata, core.http, packageInfo);
 
     const registerSearchStrategyProvider: TRegisterSearchStrategyProvider = <
       T extends TStrategyTypes
diff --git a/src/plugins/data/public/search/sync_search_strategy.ts b/src/plugins/data/public/search/sync_search_strategy.ts
index 65fe10f39aaa0..b895a177d8608 100644
--- a/src/plugins/data/public/search/sync_search_strategy.ts
+++ b/src/plugins/data/public/search/sync_search_strategy.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { from } from 'rxjs';
+import { BehaviorSubject, from } from 'rxjs';
 import { IKibanaSearchRequest, IKibanaSearchResponse } from '../../common/search';
 import { ISearchContext } from './i_search_context';
 import { ISearch, ISearchOptions } from './i_search';
@@ -31,11 +31,16 @@ export interface ISyncSearchRequest extends IKibanaSearchRequest {
 
 export const syncSearchStrategyProvider: TSearchStrategyProvider<typeof SYNC_SEARCH_STRATEGY> = (
   context: ISearchContext
-) => {
+): ISearchStrategy<typeof SYNC_SEARCH_STRATEGY> => {
+  const loadingCount$ = new BehaviorSubject(0);
+  context.core.http.addLoadingCountSource(loadingCount$);
+
   const search: ISearch<typeof SYNC_SEARCH_STRATEGY> = (
     request: ISyncSearchRequest,
     options: ISearchOptions = {}
   ) => {
+    loadingCount$.next(loadingCount$.getValue() + 1);
+
     const response: Promise<IKibanaSearchResponse> = context.core.http.fetch({
       path: `/internal/search/${request.serverStrategy}`,
       method: 'POST',
@@ -43,12 +48,10 @@ export const syncSearchStrategyProvider: TSearchStrategyProvider<typeof SYNC_SEA
       signal: options.signal,
     });
 
-    return from(response);
-  };
+    response.then(() => loadingCount$.next(loadingCount$.getValue() - 1));
 
-  const strategy: ISearchStrategy<typeof SYNC_SEARCH_STRATEGY> = {
-    search,
+    return from(response);
   };
 
-  return strategy;
+  return { search };
 };
diff --git a/src/plugins/data/public/types.ts b/src/plugins/data/public/types.ts
index e62aba5f2713d..80646bb4668d2 100644
--- a/src/plugins/data/public/types.ts
+++ b/src/plugins/data/public/types.ts
@@ -19,7 +19,7 @@
 
 import { CoreStart } from 'src/core/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
-import { IUiActionsSetup, IUiActionsStart } from 'src/plugins/ui_actions/public';
+import { UiActionsSetup, UiActionsStart } from 'src/plugins/ui_actions/public';
 import { AutocompleteSetup, AutocompleteStart } from './autocomplete';
 import { FieldFormatsSetup, FieldFormatsStart } from './field_formats';
 import { ISearchSetup, ISearchStart } from './search';
@@ -29,11 +29,11 @@ import { IndexPatternsContract } from './index_patterns';
 import { StatefulSearchBarProps } from './ui/search_bar/create_search_bar';
 
 export interface DataSetupDependencies {
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
 }
 
 export interface DataStartDependencies {
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
 }
 
 export interface DataPublicPluginSetup {
diff --git a/src/plugins/data/public/ui/filter_bar/filter_view/index.tsx b/src/plugins/data/public/ui/filter_bar/filter_view/index.tsx
index dd12789d15a9d..ed33afeca69c2 100644
--- a/src/plugins/data/public/ui/filter_bar/filter_view/index.tsx
+++ b/src/plugins/data/public/ui/filter_bar/filter_view/index.tsx
@@ -57,6 +57,7 @@ export const FilterView: FC<Props> = ({
   return (
     <EuiBadge
       title={title}
+      color="hollow"
       iconType="cross"
       iconSide="right"
       closeButtonProps={{
diff --git a/src/plugins/data/public/ui/search_bar/create_search_bar.tsx b/src/plugins/data/public/ui/search_bar/create_search_bar.tsx
index 6f1be2825dd01..71d76f4db49e2 100644
--- a/src/plugins/data/public/ui/search_bar/create_search_bar.tsx
+++ b/src/plugins/data/public/ui/search_bar/create_search_bar.tsx
@@ -18,13 +18,15 @@
  */
 
 import React, { useState, useEffect } from 'react';
-import { Subscription } from 'rxjs';
 import { CoreStart } from 'src/core/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { KibanaContextProvider } from '../../../../kibana_react/public';
-import { DataPublicPluginStart, esFilters } from '../..';
+import { DataPublicPluginStart, esFilters, Query, TimeRange, SavedQuery } from '../..';
 import { QueryStart } from '../../query';
 import { SearchBarOwnProps, SearchBar } from './search_bar';
+import { useFilterManager } from './lib/use_filter_manager';
+import { useTimefilter } from './lib/use_timefilter';
+import { useSavedQuery } from './lib/use_saved_query';
 
 interface StatefulSearchBarDeps {
   core: CoreStart;
@@ -34,16 +36,21 @@ interface StatefulSearchBarDeps {
 
 export type StatefulSearchBarProps = SearchBarOwnProps & {
   appName: string;
+  useDefaultBehaviors?: boolean;
+  savedQueryId?: string;
+  onSavedQueryIdChange?: (savedQueryId?: string) => void;
 };
 
-const defaultFiltersUpdated = (query: QueryStart) => {
+// Respond to user changing the filters
+const defaultFiltersUpdated = (queryService: QueryStart) => {
   return (filters: esFilters.Filter[]) => {
-    query.filterManager.setFilters(filters);
+    queryService.filterManager.setFilters(filters);
   };
 };
 
-const defaultOnRefreshChange = (query: QueryStart) => {
-  const { timefilter } = query.timefilter;
+// Respond to user changing the refresh settings
+const defaultOnRefreshChange = (queryService: QueryStart) => {
+  const { timefilter } = queryService.timefilter;
   return (options: { isPaused: boolean; refreshInterval: number }) => {
     timefilter.setRefreshInterval({
       value: options.refreshInterval,
@@ -52,53 +59,103 @@ const defaultOnRefreshChange = (query: QueryStart) => {
   };
 };
 
+// Respond to user changing the query string or time settings
+const defaultOnQuerySubmit = (
+  props: StatefulSearchBarProps,
+  queryService: QueryStart,
+  currentQuery: Query,
+  setQueryStringState: Function
+) => {
+  if (!props.useDefaultBehaviors) return props.onQuerySubmit;
+
+  const { timefilter } = queryService.timefilter;
+
+  return (payload: { dateRange: TimeRange; query?: Query }) => {
+    const isUpdate =
+      !_.isEqual(timefilter.getTime(), payload.dateRange) ||
+      !_.isEqual(payload.query, currentQuery);
+    if (isUpdate) {
+      timefilter.setTime(payload.dateRange);
+      setQueryStringState(payload.query);
+    } else {
+      // Refresh button triggered for an update
+      if (props.onQuerySubmit)
+        props.onQuerySubmit(
+          {
+            dateRange: timefilter.getTime(),
+            query: currentQuery,
+          },
+          false
+        );
+    }
+  };
+};
+
+// Respond to user clearing a saved query
+const defaultOnClearSavedQuery = (props: StatefulSearchBarProps, clearSavedQuery: Function) => {
+  if (!props.useDefaultBehaviors) return props.onClearSavedQuery;
+  return () => {
+    clearSavedQuery();
+    if (props.onSavedQueryIdChange) props.onSavedQueryIdChange();
+  };
+};
+
+// Respond to user saving or updating a saved query
+const defaultOnSavedQueryUpdated = (props: StatefulSearchBarProps, setSavedQuery: Function) => {
+  if (!props.useDefaultBehaviors) return props.onSavedQueryUpdated;
+  return (savedQuery: SavedQuery) => {
+    setSavedQuery(savedQuery);
+    if (props.onSavedQueryIdChange) props.onSavedQueryIdChange(savedQuery.id);
+  };
+};
+
+const overrideDefaultBehaviors = (props: StatefulSearchBarProps) => {
+  return props.useDefaultBehaviors ? {} : props;
+};
+
 export function createSearchBar({ core, storage, data }: StatefulSearchBarDeps) {
   // App name should come from the core application service.
   // Until it's available, we'll ask the user to provide it for the pre-wired component.
   return (props: StatefulSearchBarProps) => {
-    const { filterManager, timefilter } = data.query;
-    const tfRefreshInterval = timefilter.timefilter.getRefreshInterval();
-    const fmFilters = filterManager.getFilters();
-    const [refreshInterval, setRefreshInterval] = useState(tfRefreshInterval.value);
-    const [refreshPaused, setRefreshPaused] = useState(tfRefreshInterval.pause);
+    // Handle queries
+    const [query, setQuery] = useState<Query>(
+      props.query || {
+        query: '',
+        language: core.uiSettings.get('search:queryLanguage'),
+      }
+    );
 
-    const [filters, setFilters] = useState(fmFilters);
+    // handle service state updates.
+    // i.e. filters being added from a visualization directly to filterManager.
+    const { filters } = useFilterManager({
+      filters: props.filters,
+      filterManager: data.query.filterManager,
+    });
+    const { timeRange, refreshInterval } = useTimefilter({
+      timefilter: data.query.timefilter.timefilter,
+    });
 
-    // We do not really need to keep track of the time
-    // since this is just for initialization
-    const timeRange = timefilter.timefilter.getTime();
+    // Fetch and update UI from saved query
+    const { savedQuery, setSavedQuery, clearSavedQuery } = useSavedQuery({
+      queryService: data.query,
+      setQuery,
+      savedQueryId: props.savedQueryId,
+      notifications: core.notifications,
+      uiSettings: core.uiSettings,
+    });
 
+    // Fire onQuerySubmit on query or timerange change
     useEffect(() => {
-      let isSubscribed = true;
-      const subscriptions = new Subscription();
-      subscriptions.add(
-        timefilter.timefilter.getRefreshIntervalUpdate$().subscribe({
-          next: () => {
-            if (isSubscribed) {
-              const newRefreshInterval = timefilter.timefilter.getRefreshInterval();
-              setRefreshInterval(newRefreshInterval.value);
-              setRefreshPaused(newRefreshInterval.pause);
-            }
+      if (!props.useDefaultBehaviors) return;
+      if (props.onQuerySubmit)
+        props.onQuerySubmit(
+          {
+            dateRange: timeRange,
+            query,
           },
-        })
-      );
-
-      subscriptions.add(
-        filterManager.getUpdates$().subscribe({
-          next: () => {
-            if (isSubscribed) {
-              const newFilters = filterManager.getFilters();
-              setFilters(newFilters);
-            }
-          },
-        })
-      );
-
-      return () => {
-        isSubscribed = false;
-        subscriptions.unsubscribe();
-      };
-    }, [filterManager, timefilter.timefilter]);
+          true
+        );
+    }, [props, props.onQuerySubmit, props.useDefaultBehaviors, query, timeRange]);
 
     return (
       <KibanaContextProvider
@@ -110,15 +167,29 @@ export function createSearchBar({ core, storage, data }: StatefulSearchBarDeps)
         }}
       >
         <SearchBar
-          timeHistory={timefilter.history}
+          showAutoRefreshOnly={props.showAutoRefreshOnly}
+          showDatePicker={props.showDatePicker}
+          showFilterBar={props.showFilterBar}
+          showQueryBar={props.showQueryBar}
+          showQueryInput={props.showQueryInput}
+          showSaveQuery={props.showSaveQuery}
+          screenTitle={props.screenTitle}
+          indexPatterns={props.indexPatterns}
+          timeHistory={data.query.timefilter.history}
           dateRangeFrom={timeRange.from}
           dateRangeTo={timeRange.to}
-          refreshInterval={refreshInterval}
-          isRefreshPaused={refreshPaused}
+          refreshInterval={refreshInterval.value}
+          isRefreshPaused={refreshInterval.pause}
           filters={filters}
+          query={query}
           onFiltersUpdated={defaultFiltersUpdated(data.query)}
           onRefreshChange={defaultOnRefreshChange(data.query)}
-          {...props}
+          savedQuery={savedQuery}
+          onQuerySubmit={defaultOnQuerySubmit(props, data.query, query, setQuery)}
+          onClearSavedQuery={defaultOnClearSavedQuery(props, clearSavedQuery)}
+          onSavedQueryUpdated={defaultOnSavedQueryUpdated(props, setSavedQuery)}
+          onSaved={defaultOnSavedQueryUpdated(props, setSavedQuery)}
+          {...overrideDefaultBehaviors(props)}
         />
       </KibanaContextProvider>
     );
diff --git a/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.test.ts b/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.test.ts
new file mode 100644
index 0000000000000..ccfe5464b9598
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.test.ts
@@ -0,0 +1,50 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { clearStateFromSavedQuery } from './clear_saved_query';
+
+import { dataPluginMock } from '../../../mocks';
+import { DataPublicPluginStart } from '../../../types';
+import { Query } from '../../..';
+
+describe('clearStateFromSavedQuery', () => {
+  const DEFAULT_LANGUAGE = 'banana';
+  let dataMock: jest.Mocked<DataPublicPluginStart>;
+
+  beforeEach(() => {
+    dataMock = dataPluginMock.createStartContract();
+  });
+
+  it('should clear filters and query', async () => {
+    const setQueryState = jest.fn();
+    dataMock.query.filterManager.removeAll = jest.fn();
+    clearStateFromSavedQuery(dataMock.query, setQueryState, DEFAULT_LANGUAGE);
+    expect(setQueryState).toHaveBeenCalled();
+    expect(dataMock.query.filterManager.removeAll).toHaveBeenCalled();
+  });
+
+  it('should use search:queryLanguage', async () => {
+    const setQueryState = jest.fn();
+    dataMock.query.filterManager.removeAll = jest.fn();
+    clearStateFromSavedQuery(dataMock.query, setQueryState, DEFAULT_LANGUAGE);
+    expect(setQueryState).toHaveBeenCalled();
+    expect((setQueryState.mock.calls[0][0] as Query).language).toBe(DEFAULT_LANGUAGE);
+    expect(dataMock.query.filterManager.removeAll).toHaveBeenCalled();
+  });
+});
diff --git a/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.ts b/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.ts
new file mode 100644
index 0000000000000..b2c777261c257
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/clear_saved_query.ts
@@ -0,0 +1,31 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { QueryStart } from '../../../query';
+
+export const clearStateFromSavedQuery = (
+  queryService: QueryStart,
+  setQueryStringState: Function,
+  defaultLanguage: string
+) => {
+  queryService.filterManager.removeAll();
+  setQueryStringState({
+    query: '',
+    language: defaultLanguage,
+  });
+};
diff --git a/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.test.ts b/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.test.ts
new file mode 100644
index 0000000000000..3242b37becd95
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.test.ts
@@ -0,0 +1,115 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { populateStateFromSavedQuery } from './populate_state_from_saved_query';
+
+import { dataPluginMock } from '../../../mocks';
+import { DataPublicPluginStart } from '../../../types';
+import { SavedQuery, esFilters } from '../../..';
+import { getFilter } from '../../../query/filter_manager/test_helpers/get_stub_filter';
+
+describe('populateStateFromSavedQuery', () => {
+  let dataMock: jest.Mocked<DataPublicPluginStart>;
+
+  const baseSavedQuery: SavedQuery = {
+    id: 'test',
+    attributes: {
+      title: 'test',
+      description: 'test',
+      query: {
+        query: 'test',
+        language: 'kuery',
+      },
+    },
+  };
+
+  beforeEach(() => {
+    dataMock = dataPluginMock.createStartContract();
+    dataMock.query.filterManager.setFilters = jest.fn();
+    dataMock.query.filterManager.getGlobalFilters = jest.fn().mockReturnValue([]);
+  });
+
+  it('should set query', async () => {
+    const setQueryState = jest.fn();
+    const savedQuery: SavedQuery = {
+      ...baseSavedQuery,
+    };
+    populateStateFromSavedQuery(dataMock.query, setQueryState, savedQuery);
+    expect(setQueryState).toHaveBeenCalled();
+  });
+
+  it('should set filters', async () => {
+    const setQueryState = jest.fn();
+    const savedQuery: SavedQuery = {
+      ...baseSavedQuery,
+    };
+    const f1 = getFilter(esFilters.FilterStateStore.APP_STATE, false, false, 'age', 34);
+    savedQuery.attributes.filters = [f1];
+    populateStateFromSavedQuery(dataMock.query, setQueryState, savedQuery);
+    expect(setQueryState).toHaveBeenCalled();
+    expect(dataMock.query.filterManager.setFilters).toHaveBeenCalledWith([f1]);
+  });
+
+  it('should preserve global filters', async () => {
+    const globalFilter = getFilter(
+      esFilters.FilterStateStore.GLOBAL_STATE,
+      false,
+      false,
+      'age',
+      34
+    );
+    dataMock.query.filterManager.getGlobalFilters = jest.fn().mockReturnValue([globalFilter]);
+    const setQueryState = jest.fn();
+    const savedQuery: SavedQuery = {
+      ...baseSavedQuery,
+    };
+    const f1 = getFilter(esFilters.FilterStateStore.APP_STATE, false, false, 'age', 34);
+    savedQuery.attributes.filters = [f1];
+    populateStateFromSavedQuery(dataMock.query, setQueryState, savedQuery);
+    expect(setQueryState).toHaveBeenCalled();
+    expect(dataMock.query.filterManager.setFilters).toHaveBeenCalledWith([globalFilter, f1]);
+  });
+
+  it('should update timefilter', async () => {
+    const savedQuery: SavedQuery = {
+      ...baseSavedQuery,
+    };
+    savedQuery.attributes.timefilter = {
+      from: '2018',
+      to: '2019',
+      refreshInterval: {
+        pause: true,
+        value: 10,
+      },
+    };
+
+    dataMock.query.timefilter.timefilter.setTime = jest.fn();
+    dataMock.query.timefilter.timefilter.setRefreshInterval = jest.fn();
+
+    populateStateFromSavedQuery(dataMock.query, jest.fn(), savedQuery);
+
+    expect(dataMock.query.timefilter.timefilter.setTime).toHaveBeenCalledWith({
+      from: savedQuery.attributes.timefilter.from,
+      to: savedQuery.attributes.timefilter.to,
+    });
+    expect(dataMock.query.timefilter.timefilter.setRefreshInterval).toHaveBeenCalledWith(
+      savedQuery.attributes.timefilter.refreshInterval
+    );
+  });
+});
diff --git a/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.ts b/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.ts
new file mode 100644
index 0000000000000..fd1517097753e
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/populate_state_from_saved_query.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { QueryStart, SavedQuery } from '../../..';
+
+export const populateStateFromSavedQuery = (
+  queryService: QueryStart,
+  setQueryStringState: Function,
+  savedQuery: SavedQuery
+) => {
+  const {
+    timefilter: { timefilter },
+    filterManager,
+  } = queryService;
+  // timefilter
+  if (savedQuery.attributes.timefilter) {
+    timefilter.setTime({
+      from: savedQuery.attributes.timefilter.from,
+      to: savedQuery.attributes.timefilter.to,
+    });
+    if (savedQuery.attributes.timefilter.refreshInterval) {
+      timefilter.setRefreshInterval(savedQuery.attributes.timefilter.refreshInterval);
+    }
+  }
+
+  // query string
+  setQueryStringState(savedQuery.attributes.query);
+
+  // filters
+  const savedQueryFilters = savedQuery.attributes.filters || [];
+  const globalFilters = filterManager.getGlobalFilters();
+  filterManager.setFilters([...globalFilters, ...savedQueryFilters]);
+};
diff --git a/src/plugins/data/public/ui/search_bar/lib/use_filter_manager.ts b/src/plugins/data/public/ui/search_bar/lib/use_filter_manager.ts
new file mode 100644
index 0000000000000..e889583aef609
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/use_filter_manager.ts
@@ -0,0 +1,50 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useState, useEffect } from 'react';
+import { Subscription } from 'rxjs';
+import { DataPublicPluginStart, esFilters } from '../../..';
+
+interface UseFilterManagerProps {
+  filters?: esFilters.Filter[];
+  filterManager: DataPublicPluginStart['query']['filterManager'];
+}
+
+export const useFilterManager = (props: UseFilterManagerProps) => {
+  // Filters should be either what's passed in the initial state or the current state of the filter manager
+  const [filters, setFilters] = useState(props.filters || props.filterManager.getFilters());
+  useEffect(() => {
+    const subscriptions = new Subscription();
+
+    subscriptions.add(
+      props.filterManager.getUpdates$().subscribe({
+        next: () => {
+          const newFilters = props.filterManager.getFilters();
+          setFilters(newFilters);
+        },
+      })
+    );
+
+    return () => {
+      subscriptions.unsubscribe();
+    };
+  }, [props.filterManager]);
+
+  return { filters };
+};
diff --git a/src/plugins/data/public/ui/search_bar/lib/use_saved_query.ts b/src/plugins/data/public/ui/search_bar/lib/use_saved_query.ts
new file mode 100644
index 0000000000000..fdeeaab1dff06
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/use_saved_query.ts
@@ -0,0 +1,94 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useState, useEffect } from 'react';
+import { i18n } from '@kbn/i18n';
+import { CoreStart } from 'kibana/public';
+import { SavedQuery } from '../../../query';
+import { DataPublicPluginStart } from '../../..';
+import { populateStateFromSavedQuery } from './populate_state_from_saved_query';
+import { clearStateFromSavedQuery } from './clear_saved_query';
+
+interface UseSavedQueriesProps {
+  queryService: DataPublicPluginStart['query'];
+  setQuery: Function;
+  notifications: CoreStart['notifications'];
+  uiSettings: CoreStart['uiSettings'];
+  savedQueryId?: string;
+}
+
+interface UseSavedQueriesReturn {
+  savedQuery?: SavedQuery;
+  setSavedQuery: (savedQuery: SavedQuery) => void;
+  clearSavedQuery: () => void;
+}
+
+export const useSavedQuery = (props: UseSavedQueriesProps): UseSavedQueriesReturn => {
+  // Handle saved queries
+  const defaultLanguage = props.uiSettings.get('search:queryLanguage');
+  const [savedQuery, setSavedQuery] = useState<SavedQuery | undefined>();
+
+  // Effect is used to convert a saved query id into an object
+  useEffect(() => {
+    const fetchSavedQuery = async (savedQueryId: string) => {
+      try {
+        // fetch saved query
+        const newSavedQuery = await props.queryService.savedQueries.getSavedQuery(savedQueryId);
+        // Make sure we set the saved query to the most recent one
+        if (newSavedQuery && newSavedQuery.id === savedQueryId) {
+          setSavedQuery(newSavedQuery);
+          populateStateFromSavedQuery(props.queryService, props.setQuery, newSavedQuery);
+        }
+      } catch (error) {
+        // Clear saved query
+        setSavedQuery(undefined);
+        clearStateFromSavedQuery(props.queryService, props.setQuery, defaultLanguage);
+        // notify of saving error
+        props.notifications.toasts.addWarning({
+          title: i18n.translate('data.search.unableToGetSavedQueryToastTitle', {
+            defaultMessage: 'Unable to load saved query {savedQueryId}',
+            values: { savedQueryId },
+          }),
+          text: `${error.message}`,
+        });
+      }
+    };
+
+    if (props.savedQueryId) fetchSavedQuery(props.savedQueryId);
+  }, [
+    defaultLanguage,
+    props.notifications.toasts,
+    props.queryService,
+    props.queryService.savedQueries,
+    props.savedQueryId,
+    props.setQuery,
+  ]);
+
+  return {
+    savedQuery,
+    setSavedQuery: (q: SavedQuery) => {
+      setSavedQuery(q);
+      populateStateFromSavedQuery(props.queryService, props.setQuery, q);
+    },
+    clearSavedQuery: () => {
+      setSavedQuery(undefined);
+      clearStateFromSavedQuery(props.queryService, props.setQuery, defaultLanguage);
+    },
+  };
+};
diff --git a/src/plugins/data/public/ui/search_bar/lib/use_timefilter.ts b/src/plugins/data/public/ui/search_bar/lib/use_timefilter.ts
new file mode 100644
index 0000000000000..942902ebd7286
--- /dev/null
+++ b/src/plugins/data/public/ui/search_bar/lib/use_timefilter.ts
@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useState, useEffect } from 'react';
+import { Subscription } from 'rxjs';
+import { DataPublicPluginStart } from 'src/plugins/data/public';
+
+interface UseTimefilterProps {
+  timefilter: DataPublicPluginStart['query']['timefilter']['timefilter'];
+}
+
+export const useTimefilter = (props: UseTimefilterProps) => {
+  const [timeRange, setTimerange] = useState(props.timefilter.getTime());
+  const [refreshInterval, setRefreshInterval] = useState(props.timefilter.getRefreshInterval());
+
+  useEffect(() => {
+    const subscriptions = new Subscription();
+
+    subscriptions.add(
+      props.timefilter.getRefreshIntervalUpdate$().subscribe({
+        next: () => {
+          const newRefreshInterval = props.timefilter.getRefreshInterval();
+          setRefreshInterval(newRefreshInterval);
+        },
+      })
+    );
+
+    subscriptions.add(
+      props.timefilter.getTimeUpdate$().subscribe({
+        next: () => {
+          setTimerange(props.timefilter.getTime());
+        },
+      })
+    );
+
+    return () => {
+      subscriptions.unsubscribe();
+    };
+  }, [props.timefilter]);
+
+  return {
+    refreshInterval,
+    timeRange,
+  };
+};
diff --git a/src/plugins/data/public/ui/search_bar/search_bar.tsx b/src/plugins/data/public/ui/search_bar/search_bar.tsx
index ceaeb24e7fe7c..2f0cdb322912b 100644
--- a/src/plugins/data/public/ui/search_bar/search_bar.tsx
+++ b/src/plugins/data/public/ui/search_bar/search_bar.tsx
@@ -47,7 +47,6 @@ interface SearchBarInjectedDeps {
   timeHistory: TimeHistoryContract;
   // Filter bar
   onFiltersUpdated?: (filters: esFilters.Filter[]) => void;
-  filters?: esFilters.Filter[];
   // Date picker
   dateRangeFrom?: string;
   dateRangeTo?: string;
@@ -69,13 +68,14 @@ export interface SearchBarOwnProps {
   showFilterBar?: boolean;
   showDatePicker?: boolean;
   showAutoRefreshOnly?: boolean;
+  filters?: esFilters.Filter[];
   // Query bar - should be in SearchBarInjectedDeps
   query?: Query;
   // Show when user has privileges to save
   showSaveQuery?: boolean;
   savedQuery?: SavedQuery;
   onQueryChange?: (payload: { dateRange: TimeRange; query?: Query }) => void;
-  onQuerySubmit?: (payload: { dateRange: TimeRange; query?: Query }) => void;
+  onQuerySubmit?: (payload: { dateRange: TimeRange; query?: Query }, isUpdate?: boolean) => void;
   // User has saved the current state as a saved query
   onSaved?: (savedQuery: SavedQuery) => void;
   // User has modified the saved query, your app should persist the update
diff --git a/src/plugins/dev_tools/README.md b/src/plugins/dev_tools/README.md
index 1610411b9c98e..d04be5ee61e5c 100644
--- a/src/plugins/dev_tools/README.md
+++ b/src/plugins/dev_tools/README.md
@@ -1,6 +1,6 @@
 # Dev tools plugin
 
-The ui/registry/dev_tools is removed in favor of the `dev_tools` plugin which exposes a register method in the setup contract.
+The ui/registry/dev_tools is removed in favor of the `devTools` plugin which exposes a register method in the setup contract.
 Registering app works mostly the same as registering apps in core.application.register.
 Routing will be handled by the id of the dev tool - your dev tool will be mounted when the URL matches `/app/kibana#/dev_tools/<YOUR ID>`.
 This API doesn't support angular, for registering angular dev tools, bootstrap a local module on mount into the given HTML element.
@@ -14,15 +14,15 @@ not be used by other plugins.
 ```ts
 // For legacy plugins
 import { npSetup } from 'ui/new_platform';
-npSetup.plugins.dev_tools.register(/* same details here */);
+npSetup.plugins.devTools.register(/* same details here */);
 
-// For new plugins: first add 'dev_tools' to the list of `optionalPlugins` 
+// For new plugins: first add 'devTools' to the list of `optionalPlugins` 
 // in your kibana.json file. Then access the plugin directly in `setup`:
 
 class MyPlugin {
   setup(core, plugins) {
-    if (plugins.dev_tools) {
-      plugins.dev_tools.register(/* same details here. */);
+    if (plugins.devTools) {
+      plugins.devTools.register(/* same details here. */);
     }
   }
 }
diff --git a/src/plugins/dev_tools/kibana.json b/src/plugins/dev_tools/kibana.json
index df7b1e3a781b0..d83cabd0f0817 100644
--- a/src/plugins/dev_tools/kibana.json
+++ b/src/plugins/dev_tools/kibana.json
@@ -1,7 +1,7 @@
 {
-  "id": "dev_tools",
+  "id": "devTools",
   "version": "kibana",
   "server": false,
   "ui": true,
-  "requiredPlugins": ["kibana_legacy"]
+  "requiredPlugins": ["kibanaLegacy"]
 }
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 124c00c755904..2a2ae6385875f 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -94,8 +94,8 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, DevToolsStart> {
     return sortBy([...this.devTools.values()], 'order');
   }
 
-  public setup(core: CoreSetup, { kibana_legacy }: { kibana_legacy: KibanaLegacySetup }) {
-    kibana_legacy.registerLegacyApp({
+  public setup(core: CoreSetup, { kibanaLegacy }: { kibanaLegacy: KibanaLegacySetup }) {
+    kibanaLegacy.registerLegacyApp({
       id: 'dev_tools',
       title: 'Dev Tools',
       mount: async (appMountContext, params) => {
diff --git a/src/plugins/embeddable/public/bootstrap.ts b/src/plugins/embeddable/public/bootstrap.ts
index 1e0e7dfdb0933..3ca84549c559d 100644
--- a/src/plugins/embeddable/public/bootstrap.ts
+++ b/src/plugins/embeddable/public/bootstrap.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { IUiActionsSetup } from 'src/plugins/ui_actions/public';
+import { UiActionsSetup } from 'src/plugins/ui_actions/public';
 import {
   CONTEXT_MENU_TRIGGER,
   APPLY_FILTER_TRIGGER,
@@ -33,7 +33,7 @@ import {
  *
  * @param api
  */
-export const bootstrap = (uiActions: IUiActionsSetup) => {
+export const bootstrap = (uiActions: UiActionsSetup) => {
   const triggerContext = {
     id: CONTEXT_MENU_TRIGGER,
     title: 'Context menu',
diff --git a/src/plugins/embeddable/public/index.ts b/src/plugins/embeddable/public/index.ts
index ec71a1e724c7d..af6c2acd3a9b1 100644
--- a/src/plugins/embeddable/public/index.ts
+++ b/src/plugins/embeddable/public/index.ts
@@ -53,7 +53,6 @@ export {
   PanelNotFoundError,
   PanelState,
   PropertySpec,
-  SavedObjectMetaData,
   ViewMode,
   isErrorEmbeddable,
   openAddPanelFlyout,
diff --git a/src/plugins/embeddable/public/lib/actions/apply_filter_action.ts b/src/plugins/embeddable/public/lib/actions/apply_filter_action.ts
index e2592b70397f3..f471d70e5455a 100644
--- a/src/plugins/embeddable/public/lib/actions/apply_filter_action.ts
+++ b/src/plugins/embeddable/public/lib/actions/apply_filter_action.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { IAction, createAction, IncompatibleActionError } from '../ui_actions';
+import { Action, createAction, IncompatibleActionError } from '../ui_actions';
 import { IEmbeddable, EmbeddableInput } from '../embeddables';
 import { esFilters } from '../../../../../plugins/data/public';
 
@@ -38,7 +38,7 @@ async function isCompatible(context: ActionContext) {
   return Boolean(root.getInput().filters !== undefined && context.filters !== undefined);
 }
 
-export function createFilterAction(): IAction<ActionContext> {
+export function createFilterAction(): Action<ActionContext> {
   return createAction<ActionContext>({
     type: APPLY_FILTER_ACTION,
     id: APPLY_FILTER_ACTION,
diff --git a/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts b/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
index 1f3eb6355e247..767def76348c8 100644
--- a/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/actions/edit_panel_action.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { IAction } from 'src/plugins/ui_actions/public';
+import { Action } from 'src/plugins/ui_actions/public';
 import { GetEmbeddableFactory, ViewMode } from '../types';
 import { EmbeddableFactoryNotFoundError } from '../errors';
 import { IEmbeddable } from '../embeddables';
@@ -29,7 +29,7 @@ interface ActionContext {
   embeddable: IEmbeddable;
 }
 
-export class EditPanelAction implements IAction<ActionContext> {
+export class EditPanelAction implements Action<ActionContext> {
   public readonly type = EDIT_PANEL_ACTION_ID;
   public readonly id = EDIT_PANEL_ACTION_ID;
   public order = 15;
diff --git a/src/plugins/embeddable/public/lib/containers/embeddable_child_panel.tsx b/src/plugins/embeddable/public/lib/containers/embeddable_child_panel.tsx
index d3f9b07be4754..f604cb0c274ba 100644
--- a/src/plugins/embeddable/public/lib/containers/embeddable_child_panel.tsx
+++ b/src/plugins/embeddable/public/lib/containers/embeddable_child_panel.tsx
@@ -23,7 +23,7 @@ import React from 'react';
 import { EuiLoadingChart } from '@elastic/eui';
 import { Subscription } from 'rxjs';
 import { CoreStart } from 'src/core/public';
-import { TGetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
+import { GetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
 
 import { Start as InspectorStartContract } from 'src/plugins/inspector/public';
 import { ErrorEmbeddable, IEmbeddable } from '../embeddables';
@@ -35,7 +35,7 @@ export interface EmbeddableChildPanelProps {
   embeddableId: string;
   className?: string;
   container: IContainer;
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
diff --git a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
index acc2da1514483..162da75c228aa 100644
--- a/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/embeddable_factory.ts
@@ -18,7 +18,7 @@
  */
 
 import { SavedObjectAttributes } from 'src/core/public';
-import { SavedObjectMetaData } from '../types';
+import { SavedObjectMetaData } from '../../../../saved_objects/public';
 import { EmbeddableInput, EmbeddableOutput, IEmbeddable } from './i_embeddable';
 import { ErrorEmbeddable } from './error_embeddable';
 import { IContainer } from '../containers/i_container';
@@ -40,7 +40,7 @@ export interface OutputSpec {
   [key: string]: PropertySpec;
 }
 
-export interface EmbeddableFactoryOptions<T> {
+export interface EmbeddableFactoryOptions<T extends SavedObjectAttributes> {
   savedObjectMetaData?: SavedObjectMetaData<T>;
 }
 
diff --git a/src/plugins/embeddable/public/lib/panel/embeddable_panel.test.tsx b/src/plugins/embeddable/public/lib/panel/embeddable_panel.test.tsx
index 196d6f934134b..9982c632f36fb 100644
--- a/src/plugins/embeddable/public/lib/panel/embeddable_panel.test.tsx
+++ b/src/plugins/embeddable/public/lib/panel/embeddable_panel.test.tsx
@@ -25,7 +25,7 @@ import { nextTick } from 'test_utils/enzyme_helpers';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { I18nProvider } from '@kbn/i18n/react';
 import { CONTEXT_MENU_TRIGGER } from '../triggers';
-import { IAction, ITrigger, IUiActionsApi } from 'src/plugins/ui_actions/public';
+import { Action, UiActionsApi } from 'src/plugins/ui_actions/public';
 import { Trigger, GetEmbeddableFactory, ViewMode } from '../types';
 import { EmbeddableFactory, isErrorEmbeddable } from '../embeddables';
 import { EmbeddablePanel } from './embeddable_panel';
@@ -44,8 +44,8 @@ import {
 import { inspectorPluginMock } from 'src/plugins/inspector/public/mocks';
 import { EuiBadge } from '@elastic/eui';
 
-const actionRegistry = new Map<string, IAction>();
-const triggerRegistry = new Map<string, ITrigger>();
+const actionRegistry = new Map<string, Action>();
+const triggerRegistry = new Map<string, Trigger>();
 const embeddableFactories = new Map<string, EmbeddableFactory>();
 const getEmbeddableFactory: GetEmbeddableFactory = (id: string) => embeddableFactories.get(id);
 
@@ -177,7 +177,7 @@ test('HelloWorldContainer in view mode hides edit mode actions', async () => {
 
 const renderInEditModeAndOpenContextMenu = async (
   embeddableInputs: any,
-  getActions: IUiActionsApi['getTriggerCompatibleActions'] = () => Promise.resolve([])
+  getActions: UiActionsApi['getTriggerCompatibleActions'] = () => Promise.resolve([])
 ) => {
   const inspector = inspectorPluginMock.createStartContract();
 
diff --git a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
index 234d8508bb97a..c5f4265ac3b0d 100644
--- a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
+++ b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
@@ -20,11 +20,7 @@ import { EuiContextMenuPanelDescriptor, EuiPanel, htmlIdGenerator } from '@elast
 import classNames from 'classnames';
 import React from 'react';
 import { Subscription } from 'rxjs';
-import {
-  buildContextMenuForActions,
-  TGetActionsCompatibleWithTrigger,
-  IAction,
-} from '../ui_actions';
+import { buildContextMenuForActions, GetActionsCompatibleWithTrigger, Action } from '../ui_actions';
 import { CoreStart, OverlayStart } from '../../../../../core/public';
 import { toMountPoint } from '../../../../kibana_react/public';
 
@@ -43,7 +39,7 @@ import { CustomizePanelModal } from './panel_header/panel_actions/customize_titl
 
 interface Props {
   embeddable: IEmbeddable<any, any>;
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
@@ -59,7 +55,7 @@ interface State {
   viewMode: ViewMode;
   hidePanelTitles: boolean;
   closeContextMenu: boolean;
-  badges: IAction[];
+  badges: Action[];
 }
 
 export class EmbeddablePanel extends React.Component<Props, State> {
@@ -91,7 +87,7 @@ export class EmbeddablePanel extends React.Component<Props, State> {
   }
 
   private async refreshBadges() {
-    let badges: IAction[] = await this.props.getActions(PANEL_BADGE_TRIGGER, {
+    let badges: Action[] = await this.props.getActions(PANEL_BADGE_TRIGGER, {
       embeddable: this.props.embeddable,
     });
     if (!this.mounted) return;
@@ -235,7 +231,7 @@ export class EmbeddablePanel extends React.Component<Props, State> {
 
     // These actions are exposed on the context menu for every embeddable, they bypass the trigger
     // registry.
-    const extraActions: Array<IAction<{ embeddable: IEmbeddable }>> = [
+    const extraActions: Array<Action<{ embeddable: IEmbeddable }>> = [
       new CustomizePanelTitleAction(createGetUserData(this.props.overlays)),
       new AddPanelAction(
         this.props.getEmbeddableFactory,
@@ -249,7 +245,7 @@ export class EmbeddablePanel extends React.Component<Props, State> {
       new EditPanelAction(this.props.getEmbeddableFactory),
     ];
 
-    const sorted = actions.concat(extraActions).sort((a: IAction, b: IAction) => {
+    const sorted = actions.concat(extraActions).sort((a: Action, b: Action) => {
       const bOrder = b.order || 0;
       const aOrder = a.order || 0;
       return bOrder - aOrder;
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_action.ts b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_action.ts
index 9ecc4686c21b6..2759d4575da19 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/add_panel/add_panel_action.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 import { i18n } from '@kbn/i18n';
-import { IAction } from 'src/plugins/ui_actions/public';
+import { Action } from 'src/plugins/ui_actions/public';
 import { NotificationsStart, OverlayStart } from 'src/core/public';
 import { ViewMode, GetEmbeddableFactory, GetEmbeddableFactories } from '../../../../types';
 import { openAddPanelFlyout } from './open_add_panel_flyout';
@@ -29,7 +29,7 @@ interface ActionContext {
   embeddable: IContainer;
 }
 
-export class AddPanelAction implements IAction<ActionContext> {
+export class AddPanelAction implements Action<ActionContext> {
   public readonly type = ADD_PANEL_ACTION_ID;
   public readonly id = ADD_PANEL_ACTION_ID;
 
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/customize_title/customize_panel_action.ts b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/customize_title/customize_panel_action.ts
index 55aaca64d5db3..e0d34fc1f4b04 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/customize_title/customize_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/customize_title/customize_panel_action.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { IAction } from 'src/plugins/ui_actions/public';
+import { Action } from 'src/plugins/ui_actions/public';
 import { ViewMode } from '../../../../types';
 import { IEmbeddable } from '../../../../embeddables';
 
@@ -30,7 +30,7 @@ interface ActionContext {
   embeddable: IEmbeddable;
 }
 
-export class CustomizePanelTitleAction implements IAction<ActionContext> {
+export class CustomizePanelTitleAction implements Action<ActionContext> {
   public readonly type = CUSTOMIZE_PANEL_ACTION_ID;
   public id = CUSTOMIZE_PANEL_ACTION_ID;
   public order = 10;
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/inspect_panel_action.ts b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/inspect_panel_action.ts
index 8e4a43a01fc17..1433bb6f78280 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/inspect_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/inspect_panel_action.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { IAction } from 'src/plugins/ui_actions/public';
+import { Action } from 'src/plugins/ui_actions/public';
 import { Start as InspectorStartContract } from 'src/plugins/inspector/public';
 import { IEmbeddable } from '../../../embeddables';
 
@@ -28,7 +28,7 @@ interface ActionContext {
   embeddable: IEmbeddable;
 }
 
-export class InspectPanelAction implements IAction<ActionContext> {
+export class InspectPanelAction implements Action<ActionContext> {
   public readonly type = INSPECT_PANEL_ACTION_ID;
   public readonly id = INSPECT_PANEL_ACTION_ID;
   public order = 10;
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/remove_panel_action.ts b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/remove_panel_action.ts
index 498cd8d7136c6..ee7948f3d6a4a 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/remove_panel_action.ts
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_actions/remove_panel_action.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 import { i18n } from '@kbn/i18n';
-import { IAction, IncompatibleActionError } from '../../../ui_actions';
+import { Action, IncompatibleActionError } from '../../../ui_actions';
 import { ContainerInput, IContainer } from '../../../containers';
 import { ViewMode } from '../../../types';
 import { IEmbeddable } from '../../../embeddables';
@@ -38,7 +38,7 @@ function hasExpandedPanelInput(
   return (container as IContainer<{}, ExpandedPanelInput>).getInput().expandedPanelId !== undefined;
 }
 
-export class RemovePanelAction implements IAction<ActionContext> {
+export class RemovePanelAction implements Action<ActionContext> {
   public readonly type = REMOVE_PANEL_ACTION;
   public readonly id = REMOVE_PANEL_ACTION;
   public order = 5;
diff --git a/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx b/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
index eedd4ba142d82..cc0733a08dd78 100644
--- a/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
+++ b/src/plugins/embeddable/public/lib/panel/panel_header/panel_header.tsx
@@ -26,7 +26,7 @@ import {
 } from '@elastic/eui';
 import classNames from 'classnames';
 import React from 'react';
-import { IAction } from 'src/plugins/ui_actions/public';
+import { Action } from 'src/plugins/ui_actions/public';
 import { PanelOptionsMenu } from './panel_options_menu';
 import { IEmbeddable } from '../../embeddables';
 
@@ -36,12 +36,12 @@ export interface PanelHeaderProps {
   hidePanelTitles: boolean;
   getActionContextMenuPanel: () => Promise<EuiContextMenuPanelDescriptor>;
   closeContextMenu: boolean;
-  badges: IAction[];
+  badges: Action[];
   embeddable: IEmbeddable;
   headerId?: string;
 }
 
-function renderBadges(badges: IAction[], embeddable: IEmbeddable) {
+function renderBadges(badges: Action[], embeddable: IEmbeddable) {
   return badges.map(badge => (
     <EuiBadge
       key={badge.id}
diff --git a/src/plugins/embeddable/public/lib/test_samples/actions/say_hello_action.tsx b/src/plugins/embeddable/public/lib/test_samples/actions/say_hello_action.tsx
index 5b61a3a71a641..55615875528a4 100644
--- a/src/plugins/embeddable/public/lib/test_samples/actions/say_hello_action.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/actions/say_hello_action.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { IAction, IncompatibleActionError } from '../../ui_actions';
+import { Action, IncompatibleActionError } from '../../ui_actions';
 import { EmbeddableInput, Embeddable, EmbeddableOutput, IEmbeddable } from '../../embeddables';
 
 export const SAY_HELLO_ACTION = 'SAY_HELLO_ACTION';
@@ -40,7 +40,7 @@ interface ActionContext {
   message?: string;
 }
 
-export class SayHelloAction implements IAction<ActionContext> {
+export class SayHelloAction implements Action<ActionContext> {
   public readonly type = SAY_HELLO_ACTION;
   public readonly id = SAY_HELLO_ACTION;
 
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card.tsx b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card.tsx
index 51640749bc2b4..a8c760f7b9497 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card.tsx
@@ -22,12 +22,12 @@ import { EuiCard, EuiFlexItem, EuiFlexGroup, EuiFormRow } from '@elastic/eui';
 import { Subscription } from 'rxjs';
 import { EuiButton } from '@elastic/eui';
 import * as Rx from 'rxjs';
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 import { ContactCardEmbeddable, CONTACT_USER_TRIGGER } from './contact_card_embeddable';
 
 interface Props {
   embeddable: ContactCardEmbeddable;
-  execTrigger: TExecuteTriggerActions;
+  execTrigger: ExecuteTriggerActions;
 }
 
 interface State {
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable.tsx b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable.tsx
index de1befd1bdc1b..48f9cd2ce516d 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable.tsx
@@ -19,7 +19,7 @@
 import React from 'react';
 import ReactDom from 'react-dom';
 import { Subscription } from 'rxjs';
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 import { Container } from '../../../containers';
 import { EmbeddableOutput, Embeddable, EmbeddableInput } from '../../../embeddables';
 import { CONTACT_CARD_EMBEDDABLE } from './contact_card_embeddable_factory';
@@ -37,7 +37,7 @@ export interface ContactCardEmbeddableOutput extends EmbeddableOutput {
 }
 
 export interface ContactCardEmbeddableOptions {
-  execAction: TExecuteTriggerActions;
+  execAction: ExecuteTriggerActions;
 }
 
 function getFullName(input: ContactCardEmbeddableInput) {
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable_factory.tsx b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable_factory.tsx
index d1eea5d67fb41..838c8d7de8f12 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable_factory.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/contact_card_embeddable_factory.tsx
@@ -19,7 +19,7 @@
 
 import React from 'react';
 import { i18n } from '@kbn/i18n';
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 
 import { CoreStart } from 'src/core/public';
 import { toMountPoint } from '../../../../../../kibana_react/public';
@@ -36,7 +36,7 @@ export class ContactCardEmbeddableFactory extends EmbeddableFactory<ContactCardE
 
   constructor(
     options: EmbeddableFactoryOptions<any>,
-    private readonly execTrigger: TExecuteTriggerActions,
+    private readonly execTrigger: ExecuteTriggerActions,
     private readonly overlays: CoreStart['overlays']
   ) {
     super(options);
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/slow_contact_card_embeddable_factory.ts b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/slow_contact_card_embeddable_factory.ts
index 84806ff9cfde5..d16cd6dcd2187 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/slow_contact_card_embeddable_factory.ts
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/contact_card/slow_contact_card_embeddable_factory.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { TExecuteTriggerActions } from 'src/plugins/ui_actions/public';
+import { ExecuteTriggerActions } from 'src/plugins/ui_actions/public';
 import { Container, EmbeddableFactory } from '../../..';
 import { ContactCardEmbeddable, ContactCardEmbeddableInput } from './contact_card_embeddable';
 import { CONTACT_CARD_EMBEDDABLE } from './contact_card_embeddable_factory';
 
 interface SlowContactCardEmbeddableFactoryOptions {
-  execAction: TExecuteTriggerActions;
+  execAction: ExecuteTriggerActions;
   loadTickCount?: number;
 }
 
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container.tsx b/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container.tsx
index de486598470d3..7eca9f64bf937 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container.tsx
@@ -20,7 +20,7 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import { I18nProvider } from '@kbn/i18n/react';
 import { CoreStart } from 'src/core/public';
-import { TGetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
+import { GetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
 import { Start as InspectorStartContract } from 'src/plugins/inspector/public';
 import { Container, ViewMode, ContainerInput } from '../..';
 import { HelloWorldContainerComponent } from './hello_world_container_component';
@@ -45,7 +45,7 @@ interface HelloWorldContainerInput extends ContainerInput {
 }
 
 interface HelloWorldContainerOptions {
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
diff --git a/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container_component.tsx b/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container_component.tsx
index 7c0e09eff1d50..413a0914bff65 100644
--- a/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container_component.tsx
+++ b/src/plugins/embeddable/public/lib/test_samples/embeddables/hello_world_container_component.tsx
@@ -21,14 +21,14 @@ import { Subscription } from 'rxjs';
 
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import { CoreStart } from 'src/core/public';
-import { TGetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
+import { GetActionsCompatibleWithTrigger } from 'src/plugins/ui_actions/public';
 import { Start as InspectorStartContract } from 'src/plugins/inspector/public';
 import { IContainer, PanelState, EmbeddableChildPanel } from '../..';
 import { GetEmbeddableFactory, GetEmbeddableFactories } from '../../types';
 
 interface Props {
   container: IContainer;
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
diff --git a/src/plugins/embeddable/public/lib/types.ts b/src/plugins/embeddable/public/lib/types.ts
index 5fc01a62351c0..1bd71163db44c 100644
--- a/src/plugins/embeddable/public/lib/types.ts
+++ b/src/plugins/embeddable/public/lib/types.ts
@@ -42,16 +42,5 @@ export enum ViewMode {
 
 export { Adapters };
 
-// import { SavedObjectMetaData } from 'ui/saved_objects/components/saved_object_finder';
-// TODO: Figure out how to do this import in New Platform.
-export interface SavedObjectMetaData<T> {
-  type: string;
-  name: string;
-  getIconForSavedObject(savedObject: any): any;
-  getTooltipForSavedObject?(savedObject: any): any;
-  showSavedObject?(savedObject: any): boolean;
-  includeFields?: string[];
-}
-
 export type GetEmbeddableFactory = (id: string) => EmbeddableFactory | undefined;
 export type GetEmbeddableFactories = () => IterableIterator<EmbeddableFactory>;
diff --git a/src/plugins/embeddable/public/plugin.ts b/src/plugins/embeddable/public/plugin.ts
index df1f4e5080031..c84fb888412e1 100644
--- a/src/plugins/embeddable/public/plugin.ts
+++ b/src/plugins/embeddable/public/plugin.ts
@@ -17,14 +17,14 @@
  * under the License.
  */
 
-import { IUiActionsSetup } from 'src/plugins/ui_actions/public';
+import { UiActionsSetup } from 'src/plugins/ui_actions/public';
 import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from '../../../core/public';
 import { EmbeddableFactoryRegistry } from './types';
 import { createApi, EmbeddableApi } from './api';
 import { bootstrap } from './bootstrap';
 
 export interface IEmbeddableSetupDependencies {
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
 }
 
 export interface IEmbeddableSetup {
diff --git a/src/plugins/embeddable/public/tests/test_plugin.ts b/src/plugins/embeddable/public/tests/test_plugin.ts
index 49ee795bcb98a..d9e1a75d92bf3 100644
--- a/src/plugins/embeddable/public/tests/test_plugin.ts
+++ b/src/plugins/embeddable/public/tests/test_plugin.ts
@@ -20,7 +20,7 @@
 import { CoreSetup, CoreStart } from 'src/core/public';
 // eslint-disable-next-line
 import { uiActionsTestPlugin } from 'src/plugins/ui_actions/public/tests';
-import { IUiActionsApi } from 'src/plugins/ui_actions/public';
+import { UiActionsApi } from 'src/plugins/ui_actions/public';
 import { coreMock } from '../../../../core/public/mocks';
 import { EmbeddablePublicPlugin, IEmbeddableSetup, IEmbeddableStart } from '../plugin';
 
@@ -30,7 +30,7 @@ export interface TestPluginReturn {
   coreStart: CoreStart;
   setup: IEmbeddableSetup;
   doStart: (anotherCoreStart?: CoreStart) => IEmbeddableStart;
-  uiActions: IUiActionsApi;
+  uiActions: UiActionsApi;
 }
 
 export const testPlugin = (
diff --git a/src/plugins/home/server/tutorials/instructions/instruction_variant.ts b/src/plugins/home/common/instruction_variant.ts
similarity index 100%
rename from src/plugins/home/server/tutorials/instructions/instruction_variant.ts
rename to src/plugins/home/common/instruction_variant.ts
diff --git a/src/plugins/home/public/index.ts b/src/plugins/home/public/index.ts
index 114d442b40943..2a445cf242729 100644
--- a/src/plugins/home/public/index.ts
+++ b/src/plugins/home/public/index.ts
@@ -26,6 +26,7 @@ export {
   HomePublicPluginStart,
 } from './plugin';
 export { FeatureCatalogueEntry, FeatureCatalogueCategory, Environment } from './services';
+export * from '../common/instruction_variant';
 import { HomePublicPlugin } from './plugin';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
diff --git a/src/plugins/home/server/index.ts b/src/plugins/home/server/index.ts
index 02f4c91a414cc..75ace84344216 100644
--- a/src/plugins/home/server/index.ts
+++ b/src/plugins/home/server/index.ts
@@ -36,5 +36,5 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
 
 export const plugin = (initContext: PluginInitializerContext) => new HomeServerPlugin(initContext);
 
-export { INSTRUCTION_VARIANT } from './tutorials/instructions/instruction_variant';
+export { INSTRUCTION_VARIANT } from '../common/instruction_variant';
 export { ArtifactsSchema, TutorialsCategory } from './services/tutorials';
diff --git a/src/plugins/home/server/tutorials/instructions/auditbeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/auditbeat_instructions.ts
index 6a9dba69b193f..4c85ad3985b3d 100644
--- a/src/plugins/home/server/tutorials/instructions/auditbeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/auditbeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { Platform, TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/instructions/filebeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/filebeat_instructions.ts
index 176a3901821f1..66efa36ec9bcd 100644
--- a/src/plugins/home/server/tutorials/instructions/filebeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/filebeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { Platform, TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/instructions/functionbeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/functionbeat_instructions.ts
index 385880ba9780f..ee13b9c5eefd8 100644
--- a/src/plugins/home/server/tutorials/instructions/functionbeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/functionbeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { Platform, TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/instructions/heartbeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/heartbeat_instructions.ts
index 406bf55da4321..33f5defc0273f 100644
--- a/src/plugins/home/server/tutorials/instructions/heartbeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/heartbeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { Platform, TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/instructions/metricbeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/metricbeat_instructions.ts
index 77efe0958a615..9fdc70e0703a4 100644
--- a/src/plugins/home/server/tutorials/instructions/metricbeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/metricbeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/instructions/winlogbeat_instructions.ts b/src/plugins/home/server/tutorials/instructions/winlogbeat_instructions.ts
index cc18f2ce9705d..9d7d0660d3d6c 100644
--- a/src/plugins/home/server/tutorials/instructions/winlogbeat_instructions.ts
+++ b/src/plugins/home/server/tutorials/instructions/winlogbeat_instructions.ts
@@ -18,7 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { INSTRUCTION_VARIANT } from './instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createTrycloudOption1, createTrycloudOption2 } from './onprem_cloud_instructions';
 import { getSpaceIdForBeatsTutorial } from './get_space_id_for_beats_tutorial';
 import { TutorialContext } from '../../services/tutorials/lib/tutorials_registry_types';
diff --git a/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts b/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts
index ac64aef730004..fbedc6abfbb8a 100644
--- a/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts
+++ b/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 
-import { INSTRUCTION_VARIANT } from '../instructions/instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createLogstashInstructions } from '../instructions/logstash_instructions';
 import { createCommonNetflowInstructions } from './common_instructions';
 
diff --git a/src/plugins/home/server/tutorials/netflow/on_prem.ts b/src/plugins/home/server/tutorials/netflow/on_prem.ts
index c7cd36d073632..ef8c3e172af87 100644
--- a/src/plugins/home/server/tutorials/netflow/on_prem.ts
+++ b/src/plugins/home/server/tutorials/netflow/on_prem.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 
-import { INSTRUCTION_VARIANT } from '../instructions/instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createLogstashInstructions } from '../instructions/logstash_instructions';
 import { createCommonNetflowInstructions } from './common_instructions';
 
diff --git a/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts b/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts
index c01a9a5382f88..85aa694970491 100644
--- a/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts
+++ b/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts
@@ -19,7 +19,7 @@
 
 import { i18n } from '@kbn/i18n';
 
-import { INSTRUCTION_VARIANT } from '../instructions/instruction_variant';
+import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant';
 import { createLogstashInstructions } from '../instructions/logstash_instructions';
 import {
   createTrycloudOption1,
diff --git a/src/plugins/kibana_legacy/kibana.json b/src/plugins/kibana_legacy/kibana.json
index b6d11309a4f96..e96b4859a36d0 100644
--- a/src/plugins/kibana_legacy/kibana.json
+++ b/src/plugins/kibana_legacy/kibana.json
@@ -1,5 +1,5 @@
 {
-  "id": "kibana_legacy",
+  "id": "kibanaLegacy",
   "version": "kibana",
   "server": true,
   "ui": true
diff --git a/src/legacy/ui/public/legacy_compat/angular_config.tsx b/src/plugins/kibana_legacy/public/angular/angular_config.tsx
similarity index 89%
rename from src/legacy/ui/public/legacy_compat/angular_config.tsx
rename to src/plugins/kibana_legacy/public/angular/angular_config.tsx
index 7002b1c365eff..9a33cff82ed63 100644
--- a/src/legacy/ui/public/legacy_compat/angular_config.tsx
+++ b/src/plugins/kibana_legacy/public/angular/angular_config.tsx
@@ -28,26 +28,34 @@ import {
   IRootScopeService,
 } from 'angular';
 import $ from 'jquery';
-import _, { cloneDeep, forOwn, get, set } from 'lodash';
+import { cloneDeep, forOwn, get, set } from 'lodash';
 import React, { Fragment } from 'react';
 import * as Rx from 'rxjs';
+import { ChromeBreadcrumb } from 'kibana/public';
 
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { CoreStart, LegacyCoreStart } from 'kibana/public';
-
-import { fatalError } from 'ui/notify';
-import { RouteConfiguration } from 'ui/routes/route_manager';
-// @ts-ignore
-import { modifyUrl } from 'ui/url';
-import { toMountPoint } from '../../../../plugins/kibana_react/public';
-// @ts-ignore
-import { UrlOverflowService } from '../error_url_overflow';
-// @ts-ignore
-import { isSystemApiRequest } from '../system_api';
+import { modifyUrl } from '../../../../core/utils';
+import { toMountPoint } from '../../../kibana_react/public';
+import { isSystemApiRequest, UrlOverflowService } from '../utils';
+import { formatAngularHttpError, isAngularHttpError } from '../notify/lib';
 
 const URL_LIMIT_WARN_WITHIN = 1000;
 
+export interface RouteConfiguration {
+  controller?: string | ((...args: any[]) => void);
+  redirectTo?: string;
+  resolveRedirectTo?: (...args: any[]) => void;
+  reloadOnSearch?: boolean;
+  reloadOnUrl?: boolean;
+  outerAngularWrapperRoute?: boolean;
+  resolve?: object;
+  template?: string;
+  k7Breadcrumbs?: (...args: any[]) => ChromeBreadcrumb[];
+  requireUICapability?: string;
+}
+
 /**
  * Detects whether a given angular route is a dummy route that doesn't
  * require any action. There are two ways this can happen:
@@ -91,7 +99,7 @@ export const configureAppAngularModule = (
     .value('esUrl', getEsUrl(newPlatform))
     .value('uiCapabilities', newPlatform.application.capabilities)
     .config(setupCompileProvider(newPlatform))
-    .config(setupLocationProvider(newPlatform))
+    .config(setupLocationProvider())
     .config($setupXsrfRequestInterceptor(newPlatform))
     .run(capture$httpLoadingCount(newPlatform))
     .run($setupBreadcrumbsAutoClear(newPlatform, isLocalAngular))
@@ -122,9 +130,7 @@ const setupCompileProvider = (newPlatform: LegacyCoreStart) => (
   }
 };
 
-const setupLocationProvider = (newPlatform: CoreStart) => (
-  $locationProvider: ILocationProvider
-) => {
+const setupLocationProvider = () => ($locationProvider: ILocationProvider) => {
   $locationProvider.html5Mode({
     enabled: false,
     requireBase: false,
@@ -165,9 +171,6 @@ export const $setupXsrfRequestInterceptor = (newPlatform: LegacyCoreStart) => {
  * and adds a root-level watcher that will capture the count of
  * active $http requests on each digest loop and expose the count to
  * the core.loadingCount api
- * @param  {Angular.Scope} $rootScope
- * @param  {HttpService} $http
- * @return {undefined}
  */
 const capture$httpLoadingCount = (newPlatform: CoreStart) => (
   $rootScope: IRootScopeService,
@@ -260,7 +263,10 @@ const $setupBreadcrumbsAutoClear = (newPlatform: CoreStart, isLocalAngular: bool
     try {
       newPlatform.chrome.setBreadcrumbs($injector.invoke(k7BreadcrumbsProvider));
     } catch (error) {
-      fatalError(error);
+      if (isAngularHttpError(error)) {
+        error = formatAngularHttpError(error);
+      }
+      newPlatform.fatalErrors.add(error, 'location');
     }
   });
 };
@@ -302,7 +308,10 @@ const $setupBadgeAutoClear = (newPlatform: CoreStart, isLocalAngular: boolean) =
     try {
       newPlatform.chrome.setBadge($injector.invoke(badgeProvider));
     } catch (error) {
-      fatalError(error);
+      if (isAngularHttpError(error)) {
+        error = formatAngularHttpError(error);
+      }
+      newPlatform.fatalErrors.add(error, 'location');
     }
   });
 };
@@ -374,13 +383,13 @@ const $setupUrlOverflowHandling = (newPlatform: CoreStart, isLocalAngular: boole
     try {
       if (urlOverflow.check($location.absUrl()) <= URL_LIMIT_WARN_WITHIN) {
         newPlatform.notifications.toasts.addWarning({
-          title: i18n.translate('common.ui.chrome.bigUrlWarningNotificationTitle', {
+          title: i18n.translate('kibana_legacy.bigUrlWarningNotificationTitle', {
             defaultMessage: 'The URL is big and Kibana might stop working',
           }),
           text: toMountPoint(
             <Fragment>
               <FormattedMessage
-                id="common.ui.chrome.bigUrlWarningNotificationMessage"
+                id="kibana_legacy.bigUrlWarningNotificationMessage"
                 defaultMessage="Either enable the {storeInSessionStorageParam} option
                   in {advancedSettingsLink} or simplify the onscreen visuals."
                 values={{
@@ -388,7 +397,7 @@ const $setupUrlOverflowHandling = (newPlatform: CoreStart, isLocalAngular: boole
                   advancedSettingsLink: (
                     <a href="#/management/kibana/settings">
                       <FormattedMessage
-                        id="common.ui.chrome.bigUrlWarningNotificationMessage.advancedSettingsLinkText"
+                        id="kibana_legacy.bigUrlWarningNotificationMessage.advancedSettingsLinkText"
                         defaultMessage="advanced settings"
                       />
                     </a>
diff --git a/src/legacy/ui/public/legacy_compat/ensure_default_index_pattern.tsx b/src/plugins/kibana_legacy/public/angular/ensure_default_index_pattern.tsx
similarity index 97%
rename from src/legacy/ui/public/legacy_compat/ensure_default_index_pattern.tsx
rename to src/plugins/kibana_legacy/public/angular/ensure_default_index_pattern.tsx
index bb6b9f805b413..1a3bb84ae7575 100644
--- a/src/legacy/ui/public/legacy_compat/ensure_default_index_pattern.tsx
+++ b/src/plugins/kibana_legacy/public/angular/ensure_default_index_pattern.tsx
@@ -79,7 +79,7 @@ export async function ensureDefaultIndexPattern(
           <EuiCallOut
             color="warning"
             iconType="iInCircle"
-            title={i18n.translate('common.ui.indexPattern.bannerLabel', {
+            title={i18n.translate('kibana_legacy.indexPattern.bannerLabel', {
               defaultMessage:
                 "In order to visualize and explore data in Kibana, you'll need to create an index pattern to retrieve data from Elasticsearch.",
             })}
diff --git a/src/plugins/kibana_legacy/public/angular/index.ts b/src/plugins/kibana_legacy/public/angular/index.ts
new file mode 100644
index 0000000000000..0e18869f1c08b
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/angular/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+// @ts-ignore
+export { PromiseServiceCreator } from './promises';
+// @ts-ignore
+export { watchMultiDecorator } from './watch_multi';
+export * from './angular_config';
+export { ensureDefaultIndexPattern } from './ensure_default_index_pattern';
diff --git a/src/legacy/ui/public/promises/promises.js b/src/plugins/kibana_legacy/public/angular/promises.js
similarity index 94%
rename from src/legacy/ui/public/promises/promises.js
rename to src/plugins/kibana_legacy/public/angular/promises.js
index 95e4f1dafc973..4881f1c1e5533 100644
--- a/src/legacy/ui/public/promises/promises.js
+++ b/src/plugins/kibana_legacy/public/angular/promises.js
@@ -18,9 +18,6 @@
  */
 
 import _ from 'lodash';
-import { uiModules } from '../modules';
-
-const module = uiModules.get('kibana');
 
 export function PromiseServiceCreator($q, $timeout) {
   function Promise(fn) {
@@ -130,7 +127,3 @@ export function PromiseServiceCreator($q, $timeout) {
 
   return Promise;
 }
-
-// Provides a tiny subset of the excellent API from
-// bluebird, reimplemented using the $q service
-module.service('Promise', PromiseServiceCreator);
diff --git a/src/legacy/ui/public/directives/watch_multi/watch_multi.js b/src/plugins/kibana_legacy/public/angular/watch_multi.js
similarity index 97%
rename from src/legacy/ui/public/directives/watch_multi/watch_multi.js
rename to src/plugins/kibana_legacy/public/angular/watch_multi.js
index 54b5cf08a9397..9de0d5f03346e 100644
--- a/src/legacy/ui/public/directives/watch_multi/watch_multi.js
+++ b/src/plugins/kibana_legacy/public/angular/watch_multi.js
@@ -18,7 +18,6 @@
  */
 
 import _ from 'lodash';
-import { uiModules } from '../../modules';
 
 export function watchMultiDecorator($provide) {
   $provide.decorator('$rootScope', function($delegate) {
@@ -147,5 +146,3 @@ export function watchMultiDecorator($provide) {
     return $delegate;
   });
 }
-
-uiModules.get('kibana').config(watchMultiDecorator);
diff --git a/src/plugins/kibana_legacy/public/index.ts b/src/plugins/kibana_legacy/public/index.ts
index de8788808e74c..6e7a3cf87b87c 100644
--- a/src/plugins/kibana_legacy/public/index.ts
+++ b/src/plugins/kibana_legacy/public/index.ts
@@ -24,3 +24,6 @@ export const plugin = (initializerContext: PluginInitializerContext) =>
   new KibanaLegacyPlugin(initializerContext);
 
 export * from './plugin';
+export * from './angular';
+export * from './notify';
+export * from './utils';
diff --git a/src/plugins/kibana_legacy/public/notify/index.ts b/src/plugins/kibana_legacy/public/notify/index.ts
new file mode 100644
index 0000000000000..6aa4e36ab7227
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/notify/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+export * from './toasts';
+export * from './lib';
diff --git a/src/legacy/ui/public/notify/lib/format_angular_http_error.ts b/src/plugins/kibana_legacy/public/notify/lib/format_angular_http_error.ts
similarity index 91%
rename from src/legacy/ui/public/notify/lib/format_angular_http_error.ts
rename to src/plugins/kibana_legacy/public/notify/lib/format_angular_http_error.ts
index 1d3d0166cc2de..4436e2a156512 100644
--- a/src/legacy/ui/public/notify/lib/format_angular_http_error.ts
+++ b/src/plugins/kibana_legacy/public/notify/lib/format_angular_http_error.ts
@@ -36,7 +36,7 @@ export function formatAngularHttpError(error: AngularHttpError) {
   // is an Angular $http "error object"
   if (error.status === -1) {
     // status = -1 indicates that the request was failed to reach the server
-    return i18n.translate('common.ui.notify.fatalError.unavailableServerErrorMessage', {
+    return i18n.translate('kibana_legacy.notify.fatalError.unavailableServerErrorMessage', {
       defaultMessage:
         'An HTTP request has failed to connect. ' +
         'Please check if the Kibana server is running and that your browser has a working connection, ' +
@@ -44,7 +44,7 @@ export function formatAngularHttpError(error: AngularHttpError) {
     });
   }
 
-  return i18n.translate('common.ui.notify.fatalError.errorStatusMessage', {
+  return i18n.translate('kibana_legacy.notify.fatalError.errorStatusMessage', {
     defaultMessage: 'Error {errStatus} {errStatusText}: {errMessage}',
     values: {
       errStatus: error.status,
diff --git a/src/legacy/ui/public/notify/lib/format_es_msg.test.js b/src/plugins/kibana_legacy/public/notify/lib/format_es_msg.test.js
similarity index 100%
rename from src/legacy/ui/public/notify/lib/format_es_msg.test.js
rename to src/plugins/kibana_legacy/public/notify/lib/format_es_msg.test.js
diff --git a/src/legacy/ui/public/notify/lib/format_es_msg.js b/src/plugins/kibana_legacy/public/notify/lib/format_es_msg.ts
similarity index 78%
rename from src/legacy/ui/public/notify/lib/format_es_msg.js
rename to src/plugins/kibana_legacy/public/notify/lib/format_es_msg.ts
index b591d1dfe114a..7305bec5348e5 100644
--- a/src/legacy/ui/public/notify/lib/format_es_msg.js
+++ b/src/plugins/kibana_legacy/public/notify/lib/format_es_msg.ts
@@ -19,20 +19,19 @@
 
 import _ from 'lodash';
 
-const getRootCause = err => _.get(err, 'resp.error.root_cause');
+const getRootCause = (err: Record<string, any> | string) => _.get(err, 'resp.error.root_cause');
 
 /**
  * Utilize the extended error information returned from elasticsearch
  * @param  {Error|String} err
  * @returns {string}
  */
-export const formatESMsg = err => {
+export const formatESMsg = (err: Record<string, any> | string) => {
   const rootCause = getRootCause(err);
 
-  if (!rootCause) {
+  if (!Array.isArray(rootCause)) {
     return;
   }
 
-  const result = _.pluck(rootCause, 'reason').join('\n');
-  return result;
+  return rootCause.map((cause: Record<string, any>) => cause.reason).join('\n');
 };
diff --git a/src/legacy/ui/public/notify/lib/format_msg.test.js b/src/plugins/kibana_legacy/public/notify/lib/format_msg.test.js
similarity index 100%
rename from src/legacy/ui/public/notify/lib/format_msg.test.js
rename to src/plugins/kibana_legacy/public/notify/lib/format_msg.test.js
diff --git a/src/legacy/ui/public/notify/lib/format_msg.js b/src/plugins/kibana_legacy/public/notify/lib/format_msg.ts
similarity index 88%
rename from src/legacy/ui/public/notify/lib/format_msg.js
rename to src/plugins/kibana_legacy/public/notify/lib/format_msg.ts
index 09b0df5c818cf..8179c8f368b27 100644
--- a/src/legacy/ui/public/notify/lib/format_msg.js
+++ b/src/plugins/kibana_legacy/public/notify/lib/format_msg.ts
@@ -29,7 +29,7 @@ const has = _.has;
  * @param  {String} source - Prefix for message indicating source (optional)
  * @returns {string}
  */
-export function formatMsg(err, source) {
+export function formatMsg(err: Record<string, any> | string, source: string = '') {
   let message = '';
   if (source) {
     message += source + ': ';
@@ -47,14 +47,14 @@ export function formatMsg(err, source) {
     // is an Angular $http "error object"
     if (err.status === -1) {
       // status = -1 indicates that the request was failed to reach the server
-      message += i18n.translate('common.ui.notify.toaster.unavailableServerErrorMessage', {
+      message += i18n.translate('kibana_legacy.notify.toaster.unavailableServerErrorMessage', {
         defaultMessage:
           'An HTTP request has failed to connect. ' +
           'Please check if the Kibana server is running and that your browser has a working connection, ' +
           'or contact your system administrator.',
       });
     } else {
-      message += i18n.translate('common.ui.notify.toaster.errorStatusMessage', {
+      message += i18n.translate('kibana_legacy.notify.toaster.errorStatusMessage', {
         defaultMessage: 'Error {errStatus} {errStatusText}: {errMessage}',
         values: {
           errStatus: err.status,
@@ -68,7 +68,7 @@ export function formatMsg(err, source) {
   return message;
 }
 
-formatMsg.describeError = function(err) {
+formatMsg.describeError = function(err: Record<string, any>) {
   if (!err) return undefined;
   if (err.shortMessage) return err.shortMessage;
   if (err.body && err.body.message) return err.body.message;
diff --git a/src/legacy/ui/public/notify/lib/format_stack.js b/src/plugins/kibana_legacy/public/notify/lib/format_stack.ts
similarity index 85%
rename from src/legacy/ui/public/notify/lib/format_stack.js
rename to src/plugins/kibana_legacy/public/notify/lib/format_stack.ts
index 13a55228d61b9..472793e29bd50 100644
--- a/src/legacy/ui/public/notify/lib/format_stack.js
+++ b/src/plugins/kibana_legacy/public/notify/lib/format_stack.ts
@@ -20,9 +20,9 @@
 import { i18n } from '@kbn/i18n';
 
 // browsers format Error.stack differently; always include message
-export function formatStack(err) {
-  if (err.stack && !~err.stack.indexOf(err.message)) {
-    return i18n.translate('common.ui.notify.toaster.errorMessage', {
+export function formatStack(err: Record<string, any>) {
+  if (err.stack && err.stack.indexOf(err.message) === -1) {
+    return i18n.translate('kibana_legacy.notify.toaster.errorMessage', {
       defaultMessage: `Error: {errorMessage}
       {errorStack}`,
       values: {
diff --git a/src/legacy/ui/public/notify/lib/index.js b/src/plugins/kibana_legacy/public/notify/lib/index.ts
similarity index 89%
rename from src/legacy/ui/public/notify/lib/index.js
rename to src/plugins/kibana_legacy/public/notify/lib/index.ts
index 426cfbb88ed8d..c374b5926b64f 100644
--- a/src/legacy/ui/public/notify/lib/index.js
+++ b/src/plugins/kibana_legacy/public/notify/lib/index.ts
@@ -20,4 +20,8 @@
 export { formatESMsg } from './format_es_msg';
 export { formatMsg } from './format_msg';
 export { formatStack } from './format_stack';
-export { isAngularHttpError, formatAngularHttpError } from './format_angular_http_error';
+export {
+  isAngularHttpError,
+  formatAngularHttpError,
+  AngularHttpError,
+} from './format_angular_http_error';
diff --git a/src/legacy/ui/public/notify/toasts/TOAST_NOTIFICATIONS.md b/src/plugins/kibana_legacy/public/notify/toasts/TOAST_NOTIFICATIONS.md
similarity index 100%
rename from src/legacy/ui/public/notify/toasts/TOAST_NOTIFICATIONS.md
rename to src/plugins/kibana_legacy/public/notify/toasts/TOAST_NOTIFICATIONS.md
diff --git a/src/plugins/kibana_legacy/public/notify/toasts/index.ts b/src/plugins/kibana_legacy/public/notify/toasts/index.ts
new file mode 100644
index 0000000000000..bcf5bbb64eaf7
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/notify/toasts/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { ToastNotifications } from './toast_notifications';
diff --git a/src/legacy/ui/public/notify/toasts/toast_notifications.test.ts b/src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.test.ts
similarity index 98%
rename from src/legacy/ui/public/notify/toasts/toast_notifications.test.ts
rename to src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.test.ts
index ba39ee59e388c..6b162a41a9d03 100644
--- a/src/legacy/ui/public/notify/toasts/toast_notifications.test.ts
+++ b/src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.test.ts
@@ -19,7 +19,7 @@
 
 import { notificationServiceMock } from '../../../../../core/public/mocks';
 import { ToastNotifications } from './toast_notifications';
-import { Toast } from '../../../../../core/public';
+import { Toast } from 'kibana/public';
 import { BehaviorSubject } from 'rxjs';
 
 describe('ToastNotifications', () => {
diff --git a/src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.ts b/src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.ts
new file mode 100644
index 0000000000000..649e50c2d1d6f
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/notify/toasts/toast_notifications.ts
@@ -0,0 +1,48 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { NotificationsSetup, Toast, ToastInput, ErrorToastOptions } from 'kibana/public';
+
+export class ToastNotifications {
+  public list: Toast[] = [];
+
+  private onChangeCallback?: () => void;
+
+  constructor(private readonly toasts: NotificationsSetup['toasts']) {
+    toasts.get$().subscribe(list => {
+      this.list = list;
+
+      if (this.onChangeCallback) {
+        this.onChangeCallback();
+      }
+    });
+  }
+
+  public onChange = (callback: () => void) => {
+    this.onChangeCallback = callback;
+  };
+
+  public add = (toastOrTitle: ToastInput) => this.toasts.add(toastOrTitle);
+  public remove = (toast: Toast) => this.toasts.remove(toast);
+  public addSuccess = (toastOrTitle: ToastInput) => this.toasts.addSuccess(toastOrTitle);
+  public addWarning = (toastOrTitle: ToastInput) => this.toasts.addWarning(toastOrTitle);
+  public addDanger = (toastOrTitle: ToastInput) => this.toasts.addDanger(toastOrTitle);
+  public addError = (error: Error, options: ErrorToastOptions) =>
+    this.toasts.addError(error, options);
+}
diff --git a/src/plugins/kibana_legacy/public/plugin.ts b/src/plugins/kibana_legacy/public/plugin.ts
index b9a61a1c9b200..7c4b3428cbb6d 100644
--- a/src/plugins/kibana_legacy/public/plugin.ts
+++ b/src/plugins/kibana_legacy/public/plugin.ts
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { App, PluginInitializerContext } from 'kibana/public';
-
+import { App, AppBase, PluginInitializerContext, AppUpdatableFields } from 'kibana/public';
+import { Observable } from 'rxjs';
 import { ConfigSchema } from '../config';
 
 interface ForwardDefinition {
@@ -27,8 +27,26 @@ interface ForwardDefinition {
   keepPrefix: boolean;
 }
 
+export type AngularRenderedAppUpdater = (
+  app: AppBase
+) => Partial<AppUpdatableFields & { activeUrl: string }> | undefined;
+
+export interface AngularRenderedApp extends App {
+  /**
+   * Angular rendered apps are able to update the active url in the nav link (which is currently not
+   * possible for actual NP apps). When regular applications have the same functionality, this type
+   * override can be removed.
+   */
+  updater$?: Observable<AngularRenderedAppUpdater>;
+  /**
+   * If the active url is updated via the updater$ subject, the app id is assumed to be identical with
+   * the nav link id. If this is not the case, it is possible to provide another nav link id here.
+   */
+  navLinkId?: string;
+}
+
 export class KibanaLegacyPlugin {
-  private apps: App[] = [];
+  private apps: AngularRenderedApp[] = [];
   private forwards: ForwardDefinition[] = [];
 
   constructor(private readonly initializerContext: PluginInitializerContext<ConfigSchema>) {}
@@ -52,7 +70,7 @@ export class KibanaLegacyPlugin {
        *
        * @param app The app descriptor
        */
-      registerLegacyApp: (app: App) => {
+      registerLegacyApp: (app: AngularRenderedApp) => {
         this.apps.push(app);
       },
 
diff --git a/src/plugins/kibana_legacy/public/utils/index.ts b/src/plugins/kibana_legacy/public/utils/index.ts
new file mode 100644
index 0000000000000..886ae0e877c38
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/utils/index.ts
@@ -0,0 +1,28 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export * from './migrate_legacy_query';
+export * from './system_api';
+export * from './url_overflow_service';
+// @ts-ignore
+export { KbnAccessibleClickProvider } from './kbn_accessible_click';
+// @ts-ignore
+export { PrivateProvider, IPrivate } from './private';
+// @ts-ignore
+export { registerListenEventListener } from './register_listen_event_listener';
diff --git a/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js b/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js
new file mode 100644
index 0000000000000..26f41c9abac2b
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/utils/kbn_accessible_click.js
@@ -0,0 +1,70 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { accessibleClickKeys, keyCodes } from '@elastic/eui';
+
+export function KbnAccessibleClickProvider() {
+  return {
+    restrict: 'A',
+    controller: $element => {
+      $element.on('keydown', e => {
+        // Prevent a scroll from occurring if the user has hit space.
+        if (e.keyCode === keyCodes.SPACE) {
+          e.preventDefault();
+        }
+      });
+    },
+    link: (scope, element, attrs) => {
+      // The whole point of this directive is to hack in functionality that native buttons provide
+      // by default.
+      const elementType = element.prop('tagName');
+
+      if (elementType === 'BUTTON') {
+        throw new Error(`kbnAccessibleClick doesn't need to be used on a button.`);
+      }
+
+      if (elementType === 'A' && attrs.href !== undefined) {
+        throw new Error(
+          `kbnAccessibleClick doesn't need to be used on a link if it has a href attribute.`
+        );
+      }
+
+      // We're emulating a click action, so we should already have a regular click handler defined.
+      if (!attrs.ngClick) {
+        throw new Error('kbnAccessibleClick requires ng-click to be defined on its element.');
+      }
+
+      // If the developer hasn't already specified attributes required for accessibility, add them.
+      if (attrs.tabindex === undefined) {
+        element.attr('tabindex', '0');
+      }
+
+      if (attrs.role === undefined) {
+        element.attr('role', 'button');
+      }
+
+      element.on('keyup', e => {
+        // Support keyboard accessibility by emulating mouse click on ENTER or SPACE keypress.
+        if (accessibleClickKeys[e.keyCode]) {
+          // Delegate to the click handler on the element (assumed to be ng-click).
+          element.click();
+        }
+      });
+    },
+  };
+}
diff --git a/src/legacy/ui/public/utils/migrate_legacy_query.ts b/src/plugins/kibana_legacy/public/utils/migrate_legacy_query.ts
similarity index 100%
rename from src/legacy/ui/public/utils/migrate_legacy_query.ts
rename to src/plugins/kibana_legacy/public/utils/migrate_legacy_query.ts
diff --git a/src/legacy/ui/public/private/private.d.ts b/src/plugins/kibana_legacy/public/utils/private.d.ts
similarity index 100%
rename from src/legacy/ui/public/private/private.d.ts
rename to src/plugins/kibana_legacy/public/utils/private.d.ts
diff --git a/src/plugins/kibana_legacy/public/utils/private.js b/src/plugins/kibana_legacy/public/utils/private.js
new file mode 100644
index 0000000000000..18fdcb8c89215
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/utils/private.js
@@ -0,0 +1,208 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * # `Private()`
+ * Private module loader, used to merge angular and require js dependency styles
+ * by allowing a require.js module to export a single provider function that will
+ * create a value used within an angular application. This provider can declare
+ * angular dependencies by listing them as arguments, and can be require additional
+ * Private modules.
+ *
+ * ## Define a private module provider:
+ * ```js
+ * export default function PingProvider($http) {
+ *   this.ping = function () {
+ *     return $http.head('/health-check');
+ *   };
+ * };
+ * ```
+ *
+ * ## Require a private module:
+ * ```js
+ * export default function ServerHealthProvider(Private, Promise) {
+ *   let ping = Private(require('ui/ping'));
+ *   return {
+ *     check: Promise.method(function () {
+ *       let attempts = 0;
+ *       return (function attempt() {
+ *         attempts += 1;
+ *         return ping.ping()
+ *         .catch(function (err) {
+ *           if (attempts < 3) return attempt();
+ *         })
+ *       }())
+ *       .then(function () {
+ *         return true;
+ *       })
+ *       .catch(function () {
+ *         return false;
+ *       });
+ *     })
+ *   }
+ * };
+ * ```
+ *
+ * # `Private.stub(provider, newInstance)`
+ * `Private.stub()` replaces the instance of a module with another value. This is all we have needed until now.
+ *
+ * ```js
+ * beforeEach(inject(function ($injector, Private) {
+ *   Private.stub(
+ *     // since this module just exports a function, we need to change
+ *     // what Private returns in order to modify it's behavior
+ *     require('ui/agg_response/hierarchical/_build_split'),
+ *     sinon.stub().returns(fakeSplit)
+ *   );
+ * }));
+ * ```
+ *
+ * # `Private.swap(oldProvider, newProvider)`
+ * This new method does an 1-for-1 swap of module providers, unlike `stub()` which replaces a modules instance.
+ * Pass the module you want to swap out, and the one it should be replaced with, then profit.
+ *
+ * Note: even though this example shows `swap()` being called in a config
+ * function, it can be called from anywhere. It is particularly useful
+ * in this scenario though.
+ *
+ * ```js
+ * beforeEach(module('kibana', function (PrivateProvider) {
+ *   PrivateProvider.swap(
+ *     function StubbedRedirectProvider($decorate) {
+ *       // $decorate is a function that will instantiate the original module when called
+ *       return sinon.spy($decorate());
+ *     }
+ *   );
+ * }));
+ * ```
+ *
+ * @param {[type]} prov [description]
+ */
+import _ from 'lodash';
+
+const nextId = _.partial(_.uniqueId, 'privateProvider#');
+
+function name(fn) {
+  return (
+    fn.name ||
+    fn
+      .toString()
+      .split('\n')
+      .shift()
+  );
+}
+
+export function PrivateProvider() {
+  const provider = this;
+
+  // one cache/swaps per Provider
+  const cache = {};
+  const swaps = {};
+
+  // return the uniq id for this function
+  function identify(fn) {
+    if (typeof fn !== 'function') {
+      throw new TypeError('Expected private module "' + fn + '" to be a function');
+    }
+
+    if (fn.$$id) return fn.$$id;
+    else return (fn.$$id = nextId());
+  }
+
+  provider.stub = function(fn, instance) {
+    cache[identify(fn)] = instance;
+    return instance;
+  };
+
+  provider.swap = function(fn, prov) {
+    const id = identify(fn);
+    swaps[id] = prov;
+  };
+
+  provider.$get = [
+    '$injector',
+    function PrivateFactory($injector) {
+      // prevent circular deps by tracking where we came from
+      const privPath = [];
+      const pathToString = function() {
+        return privPath.map(name).join(' -> ');
+      };
+
+      // call a private provider and return the instance it creates
+      function instantiate(prov, locals) {
+        if (~privPath.indexOf(prov)) {
+          throw new Error(
+            'Circular reference to "' +
+              name(prov) +
+              '"' +
+              ' found while resolving private deps: ' +
+              pathToString()
+          );
+        }
+
+        privPath.push(prov);
+
+        const context = {};
+        let instance = $injector.invoke(prov, context, locals);
+        if (!_.isObject(instance)) instance = context;
+
+        privPath.pop();
+        return instance;
+      }
+
+      // retrieve an instance from cache or create and store on
+      function get(id, prov, $delegateId, $delegateProv) {
+        if (cache[id]) return cache[id];
+
+        let instance;
+
+        if ($delegateId != null && $delegateProv != null) {
+          instance = instantiate(prov, {
+            $decorate: _.partial(get, $delegateId, $delegateProv),
+          });
+        } else {
+          instance = instantiate(prov);
+        }
+
+        return (cache[id] = instance);
+      }
+
+      // main api, get the appropriate instance for a provider
+      function Private(prov) {
+        let id = identify(prov);
+        let $delegateId;
+        let $delegateProv;
+
+        if (swaps[id]) {
+          $delegateId = id;
+          $delegateProv = prov;
+
+          prov = swaps[$delegateId];
+          id = identify(prov);
+        }
+
+        return get(id, prov, $delegateId, $delegateProv);
+      }
+
+      Private.stub = provider.stub;
+      Private.swap = provider.swap;
+
+      return Private;
+    },
+  ];
+}
diff --git a/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js b/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js
new file mode 100644
index 0000000000000..cce6c98adbbfe
--- /dev/null
+++ b/src/plugins/kibana_legacy/public/utils/register_listen_event_listener.js
@@ -0,0 +1,35 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+export function registerListenEventListener($rootScope) {
+  /**
+   * Helper that registers an event listener, and removes that listener when
+   * the $scope is destroyed.
+   *
+   * @param  {SimpleEmitter} emitter - the event emitter to listen to
+   * @param  {string} eventName - the event name
+   * @param  {Function} handler - the event handler
+   * @return {undefined}
+   */
+  $rootScope.constructor.prototype.$listen = function(emitter, eventName, handler) {
+    emitter.on(eventName, handler);
+    this.$on('$destroy', function() {
+      emitter.off(eventName, handler);
+    });
+  };
+}
diff --git a/src/legacy/ui/public/system_api/system_api.js b/src/plugins/kibana_legacy/public/utils/system_api.ts
similarity index 83%
rename from src/legacy/ui/public/system_api/system_api.js
rename to src/plugins/kibana_legacy/public/utils/system_api.ts
index 8f68c53f8960e..397de4dcc2bb3 100644
--- a/src/legacy/ui/public/system_api/system_api.js
+++ b/src/plugins/kibana_legacy/public/utils/system_api.ts
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+import { IRequestConfig } from 'angular';
+
 const SYSTEM_API_HEADER_NAME = 'kbn-system-api';
 
 /**
@@ -24,7 +26,7 @@ const SYSTEM_API_HEADER_NAME = 'kbn-system-api';
  * @param originalHeaders Object representing set of headers
  * @return Object representing set of headers, with system API header added in
  */
-export function addSystemApiHeader(originalHeaders) {
+export function addSystemApiHeader(originalHeaders: Record<string, string>) {
   const systemApiHeaders = {
     [SYSTEM_API_HEADER_NAME]: true,
   };
@@ -40,6 +42,7 @@ export function addSystemApiHeader(originalHeaders) {
  * @param request Object Request object created by $http service
  * @return true if request is a system API request; false otherwise
  */
-export function isSystemApiRequest(request) {
-  return !!request.headers[SYSTEM_API_HEADER_NAME];
+export function isSystemApiRequest(request: IRequestConfig) {
+  const { headers } = request;
+  return headers && !!headers[SYSTEM_API_HEADER_NAME];
 }
diff --git a/src/legacy/ui/public/error_url_overflow/url_overflow_service.js b/src/plugins/kibana_legacy/public/utils/url_overflow_service.ts
similarity index 87%
rename from src/legacy/ui/public/error_url_overflow/url_overflow_service.js
rename to src/plugins/kibana_legacy/public/utils/url_overflow_service.ts
index bb0df4ee63f92..e0c0f93bf36cd 100644
--- a/src/legacy/ui/public/error_url_overflow/url_overflow_service.js
+++ b/src/plugins/kibana_legacy/public/utils/url_overflow_service.ts
@@ -22,6 +22,9 @@ const URL_MAX_OTHERS = 25000;
 export const IE_REGEX = /(; ?MSIE |Edge\/\d|Trident\/[\d+\.]+;.*rv:*11\.\d+)/;
 
 export class UrlOverflowService {
+  private readonly _ieLike: boolean;
+  private _val?: string | null;
+  private readonly _sync: () => void;
   constructor() {
     const key = 'error/url-overflow/url';
     const store = window.sessionStorage || {
@@ -37,8 +40,11 @@ export class UrlOverflowService {
 
     this._val = store.getItem(key);
     this._sync = () => {
-      if (this._val == null) store.removeItem(key);
-      else store.setItem(key, this._val);
+      if (typeof this._val === 'string') {
+        store.setItem(key, this._val);
+      } else {
+        store.removeItem(key);
+      }
     };
   }
 
@@ -46,7 +52,7 @@ export class UrlOverflowService {
     return this._ieLike ? URL_MAX_IE : URL_MAX_OTHERS;
   }
 
-  set(v) {
+  set(v: string) {
     this._val = v;
     this._sync();
   }
@@ -55,7 +61,7 @@ export class UrlOverflowService {
     return this._val;
   }
 
-  check(absUrl) {
+  check(absUrl: string) {
     if (!this.get()) {
       const urlLength = absUrl.length;
       const remaining = this.failLength() - urlLength;
diff --git a/src/plugins/kibana_legacy/server/index.ts b/src/plugins/kibana_legacy/server/index.ts
index 4d0fe8364a66c..ca8ad6410eec3 100644
--- a/src/plugins/kibana_legacy/server/index.ts
+++ b/src/plugins/kibana_legacy/server/index.ts
@@ -28,7 +28,7 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   schema: configSchema,
   deprecations: ({ renameFromRoot }) => [
     // TODO: Remove deprecation once defaultAppId is deleted
-    renameFromRoot('kibana.defaultAppId', 'kibana_legacy.defaultAppId', true),
+    renameFromRoot('kibana.defaultAppId', 'kibanaLegacy.defaultAppId', true),
   ],
 };
 
diff --git a/src/plugins/kibana_react/public/adapters/index.ts b/src/plugins/kibana_react/public/adapters/index.ts
new file mode 100644
index 0000000000000..9912967022793
--- /dev/null
+++ b/src/plugins/kibana_react/public/adapters/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export * from './react_to_ui_component';
+export * from './ui_to_react_component';
diff --git a/src/plugins/kibana_react/public/adapters/react_to_ui_component.test.tsx b/src/plugins/kibana_react/public/adapters/react_to_ui_component.test.tsx
new file mode 100644
index 0000000000000..14fe02c6bf652
--- /dev/null
+++ b/src/plugins/kibana_react/public/adapters/react_to_ui_component.test.tsx
@@ -0,0 +1,86 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as React from 'react';
+import { reactToUiComponent } from './react_to_ui_component';
+
+const ReactComp: React.FC<{ cnt?: number }> = ({ cnt = 0 }) => {
+  return <div>cnt: {cnt}</div>;
+};
+
+describe('reactToUiComponent', () => {
+  test('can render UI component', () => {
+    const UiComp = reactToUiComponent(ReactComp);
+    const div = document.createElement('div');
+
+    const instance = UiComp();
+    instance.render(div, {});
+
+    expect(div.innerHTML).toBe('<div>cnt: 0</div>');
+  });
+
+  test('can pass in props', async () => {
+    const UiComp = reactToUiComponent(ReactComp);
+    const div = document.createElement('div');
+
+    const instance = UiComp();
+    instance.render(div, { cnt: 5 });
+
+    expect(div.innerHTML).toBe('<div>cnt: 5</div>');
+  });
+
+  test('can re-render multiple times', async () => {
+    const UiComp = reactToUiComponent(ReactComp);
+    const div = document.createElement('div');
+    const instance = UiComp();
+
+    instance.render(div, { cnt: 1 });
+
+    expect(div.innerHTML).toBe('<div>cnt: 1</div>');
+
+    instance.render(div, { cnt: 2 });
+
+    expect(div.innerHTML).toBe('<div>cnt: 2</div>');
+  });
+
+  test('renders React component only when .render() method is called', () => {
+    let renderCnt = 0;
+    const MyReactComp: React.FC<{ cnt?: number }> = ({ cnt = 0 }) => {
+      renderCnt++;
+      return <div>cnt: {cnt}</div>;
+    };
+    const UiComp = reactToUiComponent(MyReactComp);
+    const instance = UiComp();
+    const div = document.createElement('div');
+
+    expect(renderCnt).toBe(0);
+
+    instance.render(div, { cnt: 1 });
+
+    expect(renderCnt).toBe(1);
+
+    instance.render(div, { cnt: 2 });
+
+    expect(renderCnt).toBe(2);
+
+    instance.render(div, { cnt: 3 });
+
+    expect(renderCnt).toBe(3);
+  });
+});
diff --git a/src/plugins/kibana_react/public/adapters/react_to_ui_component.ts b/src/plugins/kibana_react/public/adapters/react_to_ui_component.ts
new file mode 100644
index 0000000000000..b4007b30cf8ca
--- /dev/null
+++ b/src/plugins/kibana_react/public/adapters/react_to_ui_component.ts
@@ -0,0 +1,49 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { ComponentType, createElement as h } from 'react';
+import { render as renderReact, unmountComponentAtNode } from 'react-dom';
+import { UiComponent, UiComponentInstance } from '../../../kibana_utils/common';
+
+/**
+ * Transform a React component into a `UiComponent`.
+ *
+ * @param ReactComp A React component.
+ */
+export const reactToUiComponent = <Props extends object>(
+  ReactComp: ComponentType<Props>
+): UiComponent<Props> => () => {
+  let lastEl: HTMLElement | undefined;
+
+  const render: UiComponentInstance<Props>['render'] = (el, props) => {
+    lastEl = el;
+    renderReact(h(ReactComp, props), el);
+  };
+
+  const unmount: UiComponentInstance<Props>['unmount'] = () => {
+    if (lastEl) unmountComponentAtNode(lastEl);
+  };
+
+  const comp: UiComponentInstance<Props> = {
+    render,
+    unmount,
+  };
+
+  return comp;
+};
diff --git a/src/plugins/kibana_react/public/adapters/ui_to_react_component.test.tsx b/src/plugins/kibana_react/public/adapters/ui_to_react_component.test.tsx
new file mode 100644
index 0000000000000..939d372b9997f
--- /dev/null
+++ b/src/plugins/kibana_react/public/adapters/ui_to_react_component.test.tsx
@@ -0,0 +1,149 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import * as React from 'react';
+import * as ReactDOM from 'react-dom';
+import { UiComponent } from '../../../kibana_utils/common';
+import { uiToReactComponent } from './ui_to_react_component';
+import { reactToUiComponent } from './react_to_ui_component';
+
+const UiComp: UiComponent<{ cnt?: number }> = () => ({
+  render: (el, { cnt = 0 }) => {
+    el.innerHTML = `cnt: ${cnt}`;
+  },
+});
+
+describe('uiToReactComponent', () => {
+  test('can render React component', () => {
+    const ReactComp = uiToReactComponent(UiComp);
+    const div = document.createElement('div');
+
+    ReactDOM.render(<ReactComp />, div);
+
+    expect(div.innerHTML).toBe('<div>cnt: 0</div>');
+  });
+
+  test('can pass in props', async () => {
+    const ReactComp = uiToReactComponent(UiComp);
+    const div = document.createElement('div');
+
+    ReactDOM.render(<ReactComp cnt={5} />, div);
+
+    expect(div.innerHTML).toBe('<div>cnt: 5</div>');
+  });
+
+  test('re-renders when React component is re-rendered', async () => {
+    const ReactComp = uiToReactComponent(UiComp);
+    const div = document.createElement('div');
+
+    ReactDOM.render(<ReactComp cnt={1} />, div);
+
+    expect(div.innerHTML).toBe('<div>cnt: 1</div>');
+
+    ReactDOM.render(<ReactComp cnt={2} />, div);
+
+    expect(div.innerHTML).toBe('<div>cnt: 2</div>');
+  });
+
+  test('does not crash if .unmount() not provided', () => {
+    const UiComp2: UiComponent<{ cnt?: number }> = () => ({
+      render: (el, { cnt = 0 }) => {
+        el.innerHTML = `cnt: ${cnt}`;
+      },
+    });
+    const ReactComp = uiToReactComponent(UiComp2);
+    const div = document.createElement('div');
+
+    ReactDOM.render(<ReactComp cnt={1} />, div);
+    ReactDOM.unmountComponentAtNode(div);
+
+    expect(div.innerHTML).toBe('');
+  });
+
+  test('calls .unmount() method once when component un-mounts', () => {
+    const unmount = jest.fn();
+    const UiComp2: UiComponent<{ cnt?: number }> = () => ({
+      render: (el, { cnt = 0 }) => {
+        el.innerHTML = `cnt: ${cnt}`;
+      },
+      unmount,
+    });
+    const ReactComp = uiToReactComponent(UiComp2);
+    const div = document.createElement('div');
+
+    expect(unmount).toHaveBeenCalledTimes(0);
+
+    ReactDOM.render(<ReactComp cnt={1} />, div);
+
+    expect(unmount).toHaveBeenCalledTimes(0);
+
+    ReactDOM.unmountComponentAtNode(div);
+
+    expect(unmount).toHaveBeenCalledTimes(1);
+  });
+
+  test('calls .render() method only once when components mounts, and once on every re-render', () => {
+    const render = jest.fn((el, { cnt = 0 }) => {
+      el.innerHTML = `cnt: ${cnt}`;
+    });
+    const UiComp2: UiComponent<{ cnt?: number }> = () => ({
+      render,
+    });
+    const ReactComp = uiToReactComponent(UiComp2);
+    const div = document.createElement('div');
+
+    expect(render).toHaveBeenCalledTimes(0);
+
+    ReactDOM.render(<ReactComp cnt={1} />, div);
+
+    expect(render).toHaveBeenCalledTimes(1);
+
+    ReactDOM.render(<ReactComp cnt={2} />, div);
+
+    expect(render).toHaveBeenCalledTimes(2);
+
+    ReactDOM.render(<ReactComp cnt={3} />, div);
+
+    expect(render).toHaveBeenCalledTimes(3);
+  });
+
+  test('can specify wrapper element', async () => {
+    const ReactComp = uiToReactComponent(UiComp, 'span');
+    const div = document.createElement('div');
+
+    ReactDOM.render(<ReactComp cnt={5} />, div);
+
+    expect(div.innerHTML).toBe('<span>cnt: 5</span>');
+  });
+});
+
+test('can adapt component many times', () => {
+  const ReactComp = uiToReactComponent(
+    reactToUiComponent(uiToReactComponent(reactToUiComponent(uiToReactComponent(UiComp))))
+  );
+  const div = document.createElement('div');
+
+  ReactDOM.render(<ReactComp />, div);
+
+  expect(div.textContent).toBe('cnt: 0');
+
+  ReactDOM.render(<ReactComp cnt={123} />, div);
+
+  expect(div.textContent).toBe('cnt: 123');
+});
diff --git a/src/plugins/kibana_react/public/adapters/ui_to_react_component.ts b/src/plugins/kibana_react/public/adapters/ui_to_react_component.ts
new file mode 100644
index 0000000000000..9b34880cf4fe3
--- /dev/null
+++ b/src/plugins/kibana_react/public/adapters/ui_to_react_component.ts
@@ -0,0 +1,48 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { FC, createElement as h, useRef, useLayoutEffect, useMemo } from 'react';
+import { UiComponent, UiComponentInstance } from '../../../kibana_utils/common';
+
+/**
+ * Transforms `UiComponent` into a React component.
+ */
+export const uiToReactComponent = <Props extends object>(
+  Comp: UiComponent<Props>,
+  as: string = 'div'
+): FC<Props> => props => {
+  const ref = useRef<HTMLDivElement>();
+  const comp = useMemo<UiComponentInstance<Props>>(() => Comp(), [Comp]);
+
+  useLayoutEffect(() => {
+    if (!ref.current) return;
+    comp.render(ref.current, props);
+  });
+
+  useLayoutEffect(() => {
+    if (!comp.unmount) return;
+    return () => {
+      if (comp.unmount) comp.unmount();
+    };
+  }, [comp]);
+
+  return h(as, {
+    ref,
+  });
+};
diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts
index 81f2e694e8e5b..a9087a772a970 100644
--- a/src/plugins/kibana_react/public/index.ts
+++ b/src/plugins/kibana_react/public/index.ts
@@ -18,7 +18,6 @@
  */
 
 export * from './code_editor';
-export * from './saved_objects';
 export * from './exit_full_screen_button';
 export * from './context';
 export * from './overlays';
@@ -26,5 +25,6 @@ export * from './ui_settings';
 export * from './field_icon';
 export * from './table_list_view';
 export * from './split_panel';
+export { reactToUiComponent, uiToReactComponent } from './adapters';
 export { useUrlTracker } from './use_url_tracker';
 export { toMountPoint } from './util';
diff --git a/src/plugins/kibana_utils/README.md b/src/plugins/kibana_utils/README.md
index 5501505dbb7e2..72a8479c7ac3d 100644
--- a/src/plugins/kibana_utils/README.md
+++ b/src/plugins/kibana_utils/README.md
@@ -2,4 +2,5 @@
 
 Utilities for building Kibana plugins.
 
-- [State containers](./docs/state_containers/README.md).
+- [State containers](./docs/state_containers).
+- [State syncing utilities](./docs/state_sync).
diff --git a/src/plugins/kibana_utils/common/index.ts b/src/plugins/kibana_utils/common/index.ts
index 444c10194a8e3..fb608a0db1ac2 100644
--- a/src/plugins/kibana_utils/common/index.ts
+++ b/src/plugins/kibana_utils/common/index.ts
@@ -19,6 +19,7 @@
 
 export * from './defer';
 export * from './of';
+export * from './ui';
 export * from './state_containers';
 export { createGetterSetter, Get, Set } from './create_getter_setter';
 export { distinctUntilChangedWithInitialValue } from './distinct_until_changed_with_initial_value';
diff --git a/src/legacy/ui/public/collapsible_sidebar/index.js b/src/plugins/kibana_utils/common/ui/index.ts
similarity index 96%
rename from src/legacy/ui/public/collapsible_sidebar/index.js
rename to src/plugins/kibana_utils/common/ui/index.ts
index 9f818922f7136..0cfb2f13c8a5d 100644
--- a/src/legacy/ui/public/collapsible_sidebar/index.js
+++ b/src/plugins/kibana_utils/common/ui/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-import './collapsible_sidebar';
+export * from './ui_component';
diff --git a/src/plugins/kibana_utils/common/ui/ui_component.ts b/src/plugins/kibana_utils/common/ui/ui_component.ts
new file mode 100644
index 0000000000000..6984ab9b78e5f
--- /dev/null
+++ b/src/plugins/kibana_utils/common/ui/ui_component.ts
@@ -0,0 +1,51 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * In many places in Kibana we want to be agnostic to frontend view library,
+ * i.e. instead of exposing React-specific APIs we want to expose APIs that
+ * are orthogonal to any rendering library. This interface represents such UI
+ * components. UI component receives a DOM element and `props` through `render()`
+ * method, the `render()` method can be called many times.
+ *
+ * Although Kibana aims to be library agnostic, Kibana itself is written in React,
+ * thus here we define `UiComponent` which is an abstract unit of UI that can be
+ * implemented in any framework, but it maps easily to React components, i.e.
+ * `UiComponent<Props>` is like `React.ComponentType<Props>`.
+ */
+export type UiComponent<Props extends object = object> = () => UiComponentInstance<Props>;
+
+/**
+ * Instance of an UiComponent, corresponds to React virtual DOM node.
+ */
+export interface UiComponentInstance<Props extends object = object> {
+  /**
+   * Call this method on initial render and on all subsequent updates.
+   *
+   * @param el DOM element.
+   * @param props Component props, same as props in React.
+   */
+  render(el: HTMLElement, props: Props): void;
+
+  /**
+   * Un-mount UI component. Call it to remove view from DOM. Implementers of this
+   * interface should clear DOM from this UI component and destroy any internal state.
+   */
+  unmount?(): void;
+}
diff --git a/src/plugins/kibana_utils/docs/state_containers/README.md b/src/plugins/kibana_utils/docs/state_containers/README.md
index 583f8f65ce6b6..ee5ebde9258e6 100644
--- a/src/plugins/kibana_utils/docs/state_containers/README.md
+++ b/src/plugins/kibana_utils/docs/state_containers/README.md
@@ -12,7 +12,6 @@ your services or apps.
   container you can always access the latest state snapshot synchronously.
 - Unlike Redux, state containers are less verbose, see example below.
 
-
 ## Example
 
 ```ts
@@ -21,11 +20,11 @@ import { createStateContainer } from 'src/plugins/kibana_utils';
 const container = createStateContainer(
   { count: 0 },
   {
-    increment: (state: {count: number}) => (by: number) => ({ count: state.count + by }),
-    double: (state: {count: number}) => () => ({ count: state.count * 2 }),
+    increment: (state: { count: number }) => (by: number) => ({ count: state.count + by }),
+    double: (state: { count: number }) => () => ({ count: state.count * 2 }),
   },
   {
-    count: (state: {count: number}) => () => state.count,
+    count: (state: { count: number }) => () => state.count,
   }
 );
 
@@ -35,7 +34,6 @@ container.transitions.double();
 console.log(container.selectors.count()); // 10
 ```
 
-
 ## Demos
 
 See demos [here](../../demos/state_containers/).
@@ -47,11 +45,11 @@ npx -q ts-node src/plugins/kibana_utils/demos/state_containers/counter.ts
 npx -q ts-node src/plugins/kibana_utils/demos/state_containers/todomvc.ts
 ```
 
-
 ## Reference
 
 - [Creating a state container](./creation.md).
 - [State transitions](./transitions.md).
 - [Using with React](./react.md).
-- [Using without React`](./no_react.md).
+- [Using without React](./no_react.md).
 - [Parallels with Redux](./redux.md).
+- [Syncing state with URL or SessionStorage](../state_sync)
diff --git a/src/plugins/kibana_utils/docs/state_sync/README.md b/src/plugins/kibana_utils/docs/state_sync/README.md
new file mode 100644
index 0000000000000..acfe6dcf76fe9
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/README.md
@@ -0,0 +1,60 @@
+# State Syncing Utilities
+
+State syncing utilities are a set of helpers for syncing your application state
+with URL or browser storage.
+
+They are designed to work together with [state containers](../state_containers). But state containers are not required.
+
+State syncing utilities include:
+
+- `syncState` util which:
+  - Subscribes to state changes and pushes them to state storage.
+  - Optionally subscribes to state storage changes and pushes them to state.
+- Two types of storage compatible with `syncState`:
+  - [KbnUrlStateStorage](./storages/kbn_url_storage.md) - Serializes state and persists it to URL's query param in rison or hashed format.
+    Listens for state updates in the URL and pushes them back to state.
+  - [SessionStorageStateStorage](./storages/session_storage.md) - Serializes state and persists it to session storage.
+
+## Example
+
+```ts
+import {
+  createStateContainer,
+  syncState,
+  createKbnUrlStateStorage,
+} from 'src/plugins/kibana_utils/public';
+
+const stateContainer = createStateContainer({ count: 0 });
+const stateStorage = createKbnUrlStateStorage();
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage,
+});
+
+start();
+
+// state container change is synched to state storage
+// kbnUrlStateStorage updates the URL to "/#?_a=(count:2)"
+stateContainer.set({ count: 2 });
+
+stop();
+```
+
+## Demos Plugins
+
+See demos plugins [here](../../../../../examples/state_containers_examples).
+
+To run them, start kibana with `--run-examples` flag.
+
+## Reference
+
+- [Syncing state with URL](./storages/kbn_url_storage.md).
+- [Syncing state with sessionStorage](./storages/session_storage.md).
+- [Setting up initial state](./initial_state.md).
+- [Using without state containers](./no_state_containers.md).
+- [Handling empty or incomplete incoming state](./empty_or_incomplete_incoming_state.md).
+- [On-the-fly state migrations](./on_fly_state_migrations.md).
+- [syncStates helper](./sync_states.md).
+- [Helpers for Data plugin (syncing TimeRange, RefreshInterval and Filters)](./data_plugin_helpers.md).
diff --git a/src/plugins/kibana_utils/docs/state_sync/data_plugin_helpers.md b/src/plugins/kibana_utils/docs/state_sync/data_plugin_helpers.md
new file mode 100644
index 0000000000000..a6abf19c58401
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/data_plugin_helpers.md
@@ -0,0 +1,7 @@
+# Helpers for syncing state with data plugins (TimeRange, RefreshInterval and Filters)
+
+```ts
+// TODO: Waiting for
+// https://github.com/elastic/kibana/issues/55977
+// https://github.com/elastic/kibana/pull/56128
+```
diff --git a/src/plugins/kibana_utils/docs/state_sync/empty_or_incomplete_incoming_state.md b/src/plugins/kibana_utils/docs/state_sync/empty_or_incomplete_incoming_state.md
new file mode 100644
index 0000000000000..22163d6f51ead
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/empty_or_incomplete_incoming_state.md
@@ -0,0 +1,54 @@
+# Handling empty or incomplete incoming state
+
+Users have direct access to storages where we sync our state to.
+For example, in the URL, a user can manually change the URL and remove or corrupt important data which we expect to be there.
+URLs may also be programmatically generated, increasing the risk for mistakes which application can't handle.
+
+`syncState` doesn't handle such edge cases passing input from storage to the state container as is.
+It is up to the application to handle such scenarios.
+
+Consider the following example:
+
+```ts
+// window.location.href is "/#?_a=(count:0"
+const defaultState = { count: 0 }; // default application state
+
+const stateContainer = createStateContainer(defaultState);
+const stateStorage = createKbnUrlStateStorage();
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage,
+});
+
+start();
+
+// At this point, state and storage are in sync
+// state: {count: 0}
+// storage: {count: 0}
+
+// Now user changes the URL manually to "/#?_a=(corrupt:0)",
+// triggering a state update with {corrupt: 0}
+```
+
+The application could, for example, handle this gracefully, by using simple composition during setup:
+
+```ts
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer: {
+    ...stateContainer,
+    set: state => stateContainer.set({ ...defaultState, ...state }),
+  },
+  stateStorage,
+});
+```
+
+In this case, the corrupt value will not get into state, preventing misshaped state.
+
+To help application developers remember such edge cases,
+`syncState` util sets a constraint,
+that setter to state container should be able to handle `null` value (see [IStateSyncConfig](../../public/state_sync/types.ts)).
+Incoming `null` value from state storage usually means that state is empty (e.g. URL without `storageKey` query param).
+So when using `syncState` util applications are required to at least handle incoming `null`.
diff --git a/src/plugins/kibana_utils/docs/state_sync/initial_state.md b/src/plugins/kibana_utils/docs/state_sync/initial_state.md
new file mode 100644
index 0000000000000..306c9313178f3
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/initial_state.md
@@ -0,0 +1,71 @@
+# Setting up initial state
+
+The `syncState` util doesn't do any initial state syncing between state and storage.
+Consider the following scenario:
+
+```ts
+// window.location.href is "/#?_a=(count:2)"
+const defaultState = { count: 0 }; // default application state
+
+const stateContainer = createStateContainer(defaultState);
+const stateStorage = createKbnUrlStateStorage();
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage,
+});
+
+start();
+
+// Now the storage and state are out of sync
+// state: {count: 0}
+// storage: {count: 2}
+```
+
+It is up to the application to decide, how initial state should be synced and which state should take precedence, depending on the specific use case.
+
+Questions to consider:
+
+1. Should default state take precedence over URL?
+2. Should URL take precedence?
+3. Do we have to do any state migrations for what is coming from the URL?
+4. If URL doesn't have the whole state, should we merge it with default one or leave it behind?
+5. Is there any other state loading in parallel (e.g. from a `SavedObject`)? How should we merge those?
+6. Are we storing the state both in the URL and in the `sessionStorage`? Which one should take precedence and in which case?
+
+A possible synchronization for the state conflict above could look like this:
+
+```ts
+// window.location.href is "/#?_a=(count:2)"
+const defaultState = { count: 0 }; // default application state
+
+const urlStateStorage = createKbnUrlStateStorage();
+
+const initialStateFromUrl = urlStateStorage.get('_a');
+
+// merge the default state and initial state from the url and use it as initial application state
+const initialState = {
+  ...defaultState,
+  ...initialStateFromUrl,
+};
+
+const stateContainer = createStateContainer(initialState);
+
+// preserve initial application state in the URL
+if (!initialStateFromUrl) {
+  urlStateStorage.set('_a', initialState, { replace: true });
+}
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage: urlStateStorage,
+});
+
+start();
+
+// Now the storage and state are in sync
+// state: {count: 2}
+// storage: {count: 2}
+```
diff --git a/src/plugins/kibana_utils/docs/state_sync/no_state_containers.md b/src/plugins/kibana_utils/docs/state_sync/no_state_containers.md
new file mode 100644
index 0000000000000..ad78774435825
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/no_state_containers.md
@@ -0,0 +1,51 @@
+# Using state syncing utilities without state containers
+
+It is possible to use `syncState` utility even if your app is not using [state containers](../state_containers).
+The `state` which is passed into `syncState` function should implement this simple interface:
+
+```ts
+export interface BaseStateContainer<State extends BaseState> {
+  get: () => State;
+  set: (state: State | null) => void;
+  state$: Observable<State>;
+}
+```
+
+For example, assuming you have a custom state manager, setting up syncing state with the URL could look something like this:
+
+```ts
+// my_state_manager.ts
+import { Subject } from 'rxjs';
+import { map } from 'rxjs/operators';
+
+export class MyStateManager {
+  private count: number = 0;
+
+  updated$ = new Subject();
+
+  setCount(count: number) {
+    if (this.count !== count) {
+      this.count = count;
+      this.updated$.next();
+    }
+  }
+
+  getCount() {
+    return this.count;
+  }
+}
+```
+
+```ts
+// app.ts
+import { syncState, createKbnUrlStateStorage } from 'src/plugins/kibana_utils/public';
+import { MyStateManager } from './my_state_manager';
+
+const myStateManager = new MyStateManager();
+
+syncState({
+  get: () => ({ count: myStateManager.getCount() }),
+  set: state => state && myStateManager.setCount(state.count),
+  state$: myStateManager.updated$.pipe(map(() => ({ count: myStateManager.getCount() }))),
+});
+```
diff --git a/src/plugins/kibana_utils/docs/state_sync/on_fly_state_migrations.md b/src/plugins/kibana_utils/docs/state_sync/on_fly_state_migrations.md
new file mode 100644
index 0000000000000..65d1bce588eed
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/on_fly_state_migrations.md
@@ -0,0 +1,48 @@
+# On-the-fly state migrations
+
+When retrieving initial state from storage we shouldn't forget about possible outdated state.
+Consider the scenario, where user launches application from a bookmarked link, which contains outdated state.
+
+Similar to [handling initial state](./initial_state.md) example, applications could handle migrations during Initialization.
+
+```ts
+import { migrate } from '../app/state_helpers';
+const urlStateStorage = createKbnUrlStateStorage();
+const initialStateFromUrl = urlStateStorage.get('_a');
+
+// merge default state and initial state and migrate it to the current version
+const initialState = migrate({
+  ...defaultState,
+  ...initialStateFromUrl,
+});
+
+const stateContainer = createStateContainer(initialState);
+```
+
+It is also possible to apply migrations for any incoming state, similar to [handling empty or incomplete state](./empty_or_incomplete_incoming_state.md).
+
+Imagine an edge case scenario, where a user is working in your application, and then pastes an old link for the same application, containing older state with a different structure.
+Since no application remount will happen, we need to transition to a new state on-the-fly, by applying necessary migrations.
+
+```ts
+import { migrate } from '../app/state_helpers';
+
+const urlStateStorage = createKbnUrlStateStorage();
+const initialStateFromUrl = urlStateStorage.get('_a');
+
+// merge default state and initial state and migrate them to current version if needed
+const initialState = migrate({
+  ...defaultState,
+  ...initialStateFromUrl,
+});
+
+const stateContainer = createStateContainer(initialState);
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer: {
+    ...stateContainer,
+    set: state => stateContainer.set(migrate({ ...defaultState, ...state })),
+  },
+  stateStorage,
+});
+```
diff --git a/src/plugins/kibana_utils/docs/state_sync/storages/README.md b/src/plugins/kibana_utils/docs/state_sync/storages/README.md
new file mode 100644
index 0000000000000..8cfffa31350f7
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/storages/README.md
@@ -0,0 +1,7 @@
+# State Storage
+
+Two types of storage compatible with `syncState`:
+
+- [KbnUrlStateStorage](./kbn_url_storage.md) - Serialises state and persists it to URL's query param in rison or hashed format (similar to what AppState & GlobalState did in legacy world).
+  Listens for state updates in the URL and pushes updates back to state.
+- [SessionStorageStateStorage](./session_storage.md) - Serializes state and persists it to session storage.
diff --git a/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md b/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md
new file mode 100644
index 0000000000000..3a31f5a326edb
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/storages/kbn_url_storage.md
@@ -0,0 +1,162 @@
+# Kbn Url Storage
+
+`KbnUrlStateStorage` is a state storage for `syncState` utility which:
+
+- Keeps state in sync with the URL.
+- Serializes data and stores it in the URL in one of the supported formats:
+  1. [Rison](https://github.com/w33ble/rison-node) encoded.
+  2. Hashed URL: In URL we store only the hash from the serialized state, but the state itself is stored in `sessionStorage`.
+     See kibana's advanced option for more context `state:storeInSessionStorage`
+- Takes care of listening to the URL updates and notifies state about the updates.
+- Takes care of batching URL updates to prevent redundant browser history records.
+
+### Basic Example
+
+With state sync utility:
+
+```ts
+import {
+  createStateContainer,
+  syncState,
+  createKbnUrlStateStorage,
+} from 'src/plugins/kibana_utils/public';
+
+const stateContainer = createStateContainer({ count: 0 });
+const stateStorage = createKbnUrlStateStorage();
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage,
+});
+
+start();
+
+// state container change is synced to state storage
+// in this case, kbnUrlStateStorage updates the URL to "/#?_a=(count:2)"
+stateContainer.set({ count: 2 });
+
+stop();
+```
+
+Or just by itself:
+
+```ts
+// assuming url is "/#?_a=(count:2)"
+const stateStorage = createKbnUrlStateStorage();
+
+stateStorage.get('_a'); // returns {count: a}
+stateStorage.set('_a', { count: 0 }); // updates url to "/#?_a=(count:0)"
+```
+
+### Setting URL format option
+
+```ts
+const stateStorage = createKbnUrlStateStorage({
+  useHash: core.uiSettings.get('state:storeInSessionStorage'), // put the complete encoded rison or just the hash into the URL
+});
+```
+
+### Passing [history](https://github.com/ReactTraining/history) instance
+
+Under the hood `kbnUrlStateStorage` uses [history](https://github.com/ReactTraining/history) for updating the URL and for listening to the URL updates.
+To prevent bugs caused by missing history updates, make sure your app uses one instance of history for URL changes which may interfere with each other.
+
+For example, if you use `react-router`:
+
+```tsx
+const App = props => {
+  useEffect(() => {
+    const stateStorage = createKbnUrlStateStorage({
+      useHash: props.uiSettings.get('state:storeInSessionStorage'),
+      history: props.history,
+    });
+
+    //....
+  });
+
+  return <Router history={props.history} />;
+};
+```
+
+### Url updates batching
+
+`kbnUrlStateStorage` batches synchronous URL updates. Consider the example.
+
+```ts
+const urlStateStorage = createKbnUrlStateStorage();
+
+urlStateStorage.set('_a', { state: 1 });
+urlStateStorage.set('_b', { state: 2 });
+
+// URL hasn't been updated yet
+setTimeout(() => {
+  // now URL is actually "/#?_a=(state:1)&_b=(state:2)"
+  // and 2 updates were batched into 1 history.push() call
+}, 0);
+```
+
+For cases, where granular control over URL updates is needed, `kbnUrlStateStorage` provides these advanced apis:
+
+- `kbnUrlStateStorage.flush({replace: boolean})` - allows to synchronously apply any pending updates.
+  `replace` option allows to use `history.replace()` instead of `history.push()`. Returned boolean indicates if any update happened
+- `kbnUrlStateStorage.cancel()` - cancels any pending updates
+
+### Sharing one `kbnUrlStateStorage` instance
+
+`kbnUrlStateStorage` is stateful, as it keeps track of pending updates.
+So if there are multiple state syncs happening in the same time, then one instance of `kbnUrlStateStorage` should be used to make sure, that the same update queue is used.
+Otherwise it could cause redundant browser history records.
+
+```ts
+// wrong:
+
+const { start, stop } = syncStates([
+  {
+    storageKey: '_a',
+    stateContainerA,
+    stateStorage: createKbnUrlStateStorage(),
+  },
+  {
+    storageKey: '_b',
+    stateContainerB,
+    stateStorage: createKbnUrlStateStorage(),
+  },
+]);
+
+// better:
+
+const kbnUrlStateStorage = createKbnUrlStateStorage();
+const { start, stop } = syncStates([
+  {
+    storageKey: '_a',
+    stateContainerA,
+    stateStorage: kbnUrlStateStorage,
+  },
+  {
+    storageKey: '_b',
+    stateContainerB,
+    stateStorage: kbnUrlStateStorage,
+  },
+]);
+
+// the best:
+
+import { createBrowserHistory } from 'history';
+const history = createBrowserHistory();
+const kbnUrlStateStorage = createKbnUrlStateStorage({ history });
+const { start, stop } = syncStates([
+  {
+    storageKey: '_a',
+    stateContainerA,
+    stateStorage: kbnUrlStateStorage,
+  },
+  {
+    storageKey: '_b',
+    stateContainerB,
+    stateStorage: kbnUrlStateStorage,
+  },
+]);
+
+<Router history={history} />;
+```
diff --git a/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md b/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md
new file mode 100644
index 0000000000000..cfefc6688f09d
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/storages/session_storage.md
@@ -0,0 +1,39 @@
+# Session Storage
+
+To sync state from state containers to `sessionStorage` use `createSessionStorageStateStorage`.
+
+```ts
+import {
+  createStateContainer,
+  syncState,
+  createSessionStorageStateStorage,
+} from 'src/plugins/kibana_utils/public';
+
+const stateContainer = createStateContainer({ count: 0 });
+const stateStorage = createSessionStorageStateStorage();
+
+const { start, stop } = syncState({
+  storageKey: '_a',
+  stateContainer,
+  stateStorage,
+});
+
+start();
+
+// state container change is synced to state storage
+// in this case, stateStorage serialises state and stores it in `window.sessionStorage` by key `_a`
+stateContainer.set({ count: 2 });
+
+stop();
+```
+
+You can also use `createSessionStorageStateStorage` imperatively:
+
+```ts
+const stateStorage = createSessionStorageStateStorage();
+
+stateStorage.set('_a', { count: 2 });
+stateStorage.get('_a');
+```
+
+**Note**: external changes to `sessionStorageStateStorage` or `window.sessionStorage` don't trigger state container updates.
diff --git a/src/plugins/kibana_utils/docs/state_sync/sync_states.md b/src/plugins/kibana_utils/docs/state_sync/sync_states.md
new file mode 100644
index 0000000000000..9a040cb9ba405
--- /dev/null
+++ b/src/plugins/kibana_utils/docs/state_sync/sync_states.md
@@ -0,0 +1,34 @@
+# Sync states utility
+
+In case you need to sync multiple states or one state to multiple storages, there is a handy util for that.
+It saves a bit of boilerplate by returning `start` and `stop` functions for all `syncState` configs at once.
+
+```ts
+import {
+  createStateContainer,
+  syncStates,
+  createKbnUrlStateStorage,
+  createSessionStorageStateStorage,
+} from 'src/plugins/kibana_utils/public';
+
+const stateContainer = createStateContainer({ count: 0 });
+const urlStateStorage = createKbnUrlStateStorage();
+const sessionStorageStateStorage = createSessionStorageStateStorage();
+
+const { start, stop } = syncStates([
+  {
+    storageKey: '_a',
+    stateContainer,
+    stateStorage: urlStateStorage,
+  },
+  {
+    storageKey: '_a',
+    stateContainer,
+    stateStorage: sessionStorageStateStorage,
+  },
+]);
+
+start(); // start syncing to all storages at once
+
+stop(); // stop syncing to all storages at once
+```
diff --git a/src/plugins/kibana_utils/public/index.ts b/src/plugins/kibana_utils/public/index.ts
index 5b6d304e14c2e..883f28da45223 100644
--- a/src/plugins/kibana_utils/public/index.ts
+++ b/src/plugins/kibana_utils/public/index.ts
@@ -17,7 +17,16 @@
  * under the License.
  */
 
-export { defer, Defer, of, createGetterSetter, Get, Set } from '../common';
+export {
+  defer,
+  Defer,
+  of,
+  createGetterSetter,
+  Get,
+  Set,
+  UiComponent,
+  UiComponentInstance,
+} from '../common';
 export * from './core';
 export * from './errors';
 export * from './field_mapping';
@@ -40,6 +49,7 @@ export {
   unhashUrl,
   unhashQuery,
   createUrlTracker,
+  createKbnUrlTracker,
   createKbnUrlControls,
   getStateFromKbnUrl,
   getStatesFromKbnUrl,
diff --git a/src/plugins/kibana_utils/public/state_management/url/index.ts b/src/plugins/kibana_utils/public/state_management/url/index.ts
index 40491bf7a274b..e28d183c6560a 100644
--- a/src/plugins/kibana_utils/public/state_management/url/index.ts
+++ b/src/plugins/kibana_utils/public/state_management/url/index.ts
@@ -25,4 +25,5 @@ export {
   getStatesFromKbnUrl,
   IKbnUrlControls,
 } from './kbn_url_storage';
+export { createKbnUrlTracker } from './kbn_url_tracker';
 export { createUrlTracker } from './url_tracker';
diff --git a/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts
new file mode 100644
index 0000000000000..4b17d8517328b
--- /dev/null
+++ b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.test.ts
@@ -0,0 +1,184 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { StubBrowserStorage } from 'test_utils/stub_browser_storage';
+import { createMemoryHistory, History } from 'history';
+import { createKbnUrlTracker, KbnUrlTracker } from './kbn_url_tracker';
+import { BehaviorSubject, Subject } from 'rxjs';
+import { AppBase, ToastsSetup } from 'kibana/public';
+import { coreMock } from '../../../../../core/public/mocks';
+import { unhashUrl } from './hash_unhash_url';
+
+jest.mock('./hash_unhash_url', () => ({
+  unhashUrl: jest.fn(x => x),
+}));
+
+describe('kbnUrlTracker', () => {
+  let storage: StubBrowserStorage;
+  let history: History;
+  let urlTracker: KbnUrlTracker;
+  let state1Subject: Subject<{ key1: string }>;
+  let state2Subject: Subject<{ key2: string }>;
+  let navLinkUpdaterSubject: BehaviorSubject<(app: AppBase) => { activeUrl?: string } | undefined>;
+  let toastService: jest.Mocked<ToastsSetup>;
+
+  function createTracker() {
+    urlTracker = createKbnUrlTracker({
+      baseUrl: '/app/test',
+      defaultSubUrl: '#/start',
+      storageKey: 'storageKey',
+      history,
+      storage,
+      stateParams: [
+        {
+          kbnUrlKey: 'state1',
+          stateUpdate$: state1Subject.asObservable(),
+        },
+        {
+          kbnUrlKey: 'state2',
+          stateUpdate$: state2Subject.asObservable(),
+        },
+      ],
+      navLinkUpdater$: navLinkUpdaterSubject,
+      toastNotifications: toastService,
+    });
+  }
+
+  function getActiveNavLinkUrl() {
+    return navLinkUpdaterSubject.getValue()({} as AppBase)?.activeUrl;
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    toastService = coreMock.createSetup().notifications.toasts;
+    storage = new StubBrowserStorage();
+    history = createMemoryHistory();
+    state1Subject = new Subject<{ key1: string }>();
+    state2Subject = new Subject<{ key2: string }>();
+    navLinkUpdaterSubject = new BehaviorSubject<
+      (app: AppBase) => { activeUrl?: string } | undefined
+    >(() => undefined);
+  });
+
+  test('do not touch nav link to default if nothing else is set', () => {
+    createTracker();
+    expect(getActiveNavLinkUrl()).toEqual(undefined);
+  });
+
+  test('set nav link to session storage value if defined', () => {
+    storage.setItem('storageKey', '#/deep/path');
+    createTracker();
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/deep/path');
+  });
+
+  test('set nav link to default if app gets mounted', () => {
+    storage.setItem('storageKey', '#/deep/path');
+    createTracker();
+    urlTracker.appMounted();
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/start');
+  });
+
+  test('keep nav link to default if path gets changed while app mounted', () => {
+    storage.setItem('storageKey', '#/deep/path');
+    createTracker();
+    urlTracker.appMounted();
+    history.push('/deep/path/2');
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/start');
+  });
+
+  test('change nav link to last visited url within app after unmount', () => {
+    createTracker();
+    urlTracker.appMounted();
+    history.push('/deep/path/2');
+    history.push('/deep/path/3');
+    urlTracker.appUnMounted();
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/deep/path/3');
+  });
+
+  test('unhash all urls that are recorded while app is mounted', () => {
+    (unhashUrl as jest.Mock).mockImplementation(x => x + '?unhashed');
+    createTracker();
+    urlTracker.appMounted();
+    history.push('/deep/path/2');
+    history.push('/deep/path/3');
+    urlTracker.appUnMounted();
+    expect(unhashUrl).toHaveBeenCalledTimes(2);
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/deep/path/3?unhashed');
+  });
+
+  test('show warning and use hashed url if unhashing does not work', () => {
+    (unhashUrl as jest.Mock).mockImplementation(() => {
+      throw new Error('unhash broke');
+    });
+    createTracker();
+    urlTracker.appMounted();
+    history.push('/deep/path/2');
+    urlTracker.appUnMounted();
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/deep/path/2');
+    expect(toastService.addDanger).toHaveBeenCalledWith('unhash broke');
+  });
+
+  test('change nav link back to default if app gets mounted again', () => {
+    createTracker();
+    urlTracker.appMounted();
+    history.push('/deep/path/2');
+    history.push('/deep/path/3');
+    urlTracker.appUnMounted();
+    urlTracker.appMounted();
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/start');
+  });
+
+  test('update state param when app is not mounted', () => {
+    createTracker();
+    state1Subject.next({ key1: 'abc' });
+    expect(getActiveNavLinkUrl()).toMatchInlineSnapshot(`"/app/test#/start?state1=(key1:abc)"`);
+  });
+
+  test('update state param without overwriting rest of the url when app is not mounted', () => {
+    storage.setItem('storageKey', '#/deep/path?extrastate=1');
+    createTracker();
+    state1Subject.next({ key1: 'abc' });
+    expect(getActiveNavLinkUrl()).toMatchInlineSnapshot(
+      `"/app/test#/deep/path?extrastate=1&state1=(key1:abc)"`
+    );
+  });
+
+  test('not update state param when app is mounted', () => {
+    createTracker();
+    urlTracker.appMounted();
+    state1Subject.next({ key1: 'abc' });
+    expect(getActiveNavLinkUrl()).toEqual('/app/test#/start');
+  });
+
+  test('update state param multiple times when app is not mounted', () => {
+    createTracker();
+    state1Subject.next({ key1: 'abc' });
+    state1Subject.next({ key1: 'def' });
+    expect(getActiveNavLinkUrl()).toMatchInlineSnapshot(`"/app/test#/start?state1=(key1:def)"`);
+  });
+
+  test('update multiple state params when app is not mounted', () => {
+    createTracker();
+    state1Subject.next({ key1: 'abc' });
+    state2Subject.next({ key2: 'def' });
+    expect(getActiveNavLinkUrl()).toMatchInlineSnapshot(
+      `"/app/test#/start?state1=(key1:abc)&state2=(key2:def)"`
+    );
+  });
+});
diff --git a/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.ts b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.ts
new file mode 100644
index 0000000000000..6f3f64ea7b941
--- /dev/null
+++ b/src/plugins/kibana_utils/public/state_management/url/kbn_url_tracker.ts
@@ -0,0 +1,192 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createHashHistory, History, UnregisterCallback } from 'history';
+import { BehaviorSubject, Observable, Subscription } from 'rxjs';
+import { AppBase, ToastsSetup } from 'kibana/public';
+import { setStateToKbnUrl } from './kbn_url_storage';
+import { unhashUrl } from './hash_unhash_url';
+
+export interface KbnUrlTracker {
+  /**
+   * Callback to invoke when the app is mounted
+   */
+  appMounted: () => void;
+  /**
+   * Callback to invoke when the app is unmounted
+   */
+  appUnMounted: () => void;
+  /**
+   * Unregistering the url tracker. This won't reset the current state of the nav link
+   */
+  stop: () => void;
+}
+
+/**
+ * Listens to history changes and optionally to global state changes and updates the nav link url of
+ * a given app to point to the last visited page within the app.
+ *
+ * This includes the following parts:
+ * * When the app is currently active, the nav link points to the configurable default url of the app.
+ * * When the app is not active the last visited url is set to the nav link.
+ * * When a provided observable emits a new value, the state parameter in the url of the nav link is updated
+ * as long as the app is not active.
+ */
+export function createKbnUrlTracker({
+  baseUrl,
+  defaultSubUrl,
+  storageKey,
+  stateParams,
+  navLinkUpdater$,
+  toastNotifications,
+  history,
+  storage,
+}: {
+  /**
+   * Base url of the current app. This will be used as a prefix for the
+   * nav link in the side bar
+   */
+  baseUrl: string;
+  /**
+   * Default sub url for this app. If the app is currently active or no sub url is already stored in session storage and the app hasn't been visited yet, the nav link will be set to this url.
+   */
+  defaultSubUrl: string;
+  /**
+   * List of URL mapped states that should get updated even when the app is not currently active
+   */
+  stateParams: Array<{
+    /**
+     * Key of the query parameter containing the state
+     */
+    kbnUrlKey: string;
+    /**
+     * Observable providing updates to the state
+     */
+    stateUpdate$: Observable<unknown>;
+  }>;
+  /**
+   * Key used to store the current sub url in session storage. This key should only be used for one active url tracker at any given ntime.
+   */
+  storageKey: string;
+  /**
+   * App updater subject passed into the application definition to change nav link url.
+   */
+  navLinkUpdater$: BehaviorSubject<(app: AppBase) => { activeUrl?: string } | undefined>;
+  /**
+   * Toast notifications service to show toasts in error cases.
+   */
+  toastNotifications: ToastsSetup;
+  /**
+   * History object to use to track url changes. If this isn't provided, a local history instance will be created.
+   */
+  history?: History;
+  /**
+   * Storage object to use to persist currently active url. If this isn't provided, the browser wide session storage instance will be used.
+   */
+  storage?: Storage;
+}): KbnUrlTracker {
+  const historyInstance = history || createHashHistory();
+  const storageInstance = storage || sessionStorage;
+
+  // local state storing current listeners and active url
+  let activeUrl: string = '';
+  let unsubscribeURLHistory: UnregisterCallback | undefined;
+  let unsubscribeGlobalState: Subscription[] | undefined;
+
+  function setNavLink(hash: string) {
+    navLinkUpdater$.next(() => ({ activeUrl: baseUrl + hash }));
+  }
+
+  function getActiveSubUrl(url: string) {
+    // remove baseUrl prefix (just storing the sub url part)
+    return url.substr(baseUrl.length);
+  }
+
+  function unsubscribe() {
+    if (unsubscribeURLHistory) {
+      unsubscribeURLHistory();
+      unsubscribeURLHistory = undefined;
+    }
+
+    if (unsubscribeGlobalState) {
+      unsubscribeGlobalState.forEach(sub => sub.unsubscribe());
+      unsubscribeGlobalState = undefined;
+    }
+  }
+
+  function onMountApp() {
+    unsubscribe();
+    // track current hash when within app
+    unsubscribeURLHistory = historyInstance.listen(location => {
+      const urlWithHashes = baseUrl + '#' + location.pathname + location.search;
+      let urlWithStates = '';
+      try {
+        urlWithStates = unhashUrl(urlWithHashes);
+      } catch (e) {
+        toastNotifications.addDanger(e.message);
+      }
+
+      activeUrl = getActiveSubUrl(urlWithStates || urlWithHashes);
+      storageInstance.setItem(storageKey, activeUrl);
+    });
+  }
+
+  function onUnmountApp() {
+    unsubscribe();
+    // propagate state updates when in other apps
+    unsubscribeGlobalState = stateParams.map(({ stateUpdate$, kbnUrlKey }) =>
+      stateUpdate$.subscribe(state => {
+        const updatedUrl = setStateToKbnUrl(
+          kbnUrlKey,
+          state,
+          { useHash: false },
+          baseUrl + (activeUrl || defaultSubUrl)
+        );
+        // remove baseUrl prefix (just storing the sub url part)
+        activeUrl = getActiveSubUrl(updatedUrl);
+        storageInstance.setItem(storageKey, activeUrl);
+        setNavLink(activeUrl);
+      })
+    );
+  }
+
+  // register listeners for unmounted app initially
+  onUnmountApp();
+
+  // initialize nav link and internal state
+  const storedUrl = storageInstance.getItem(storageKey);
+  if (storedUrl) {
+    activeUrl = storedUrl;
+    setNavLink(storedUrl);
+  }
+
+  return {
+    appMounted() {
+      onMountApp();
+      setNavLink(defaultSubUrl);
+    },
+    appUnMounted() {
+      onUnmountApp();
+      setNavLink(activeUrl);
+    },
+    stop() {
+      unsubscribe();
+    },
+  };
+}
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync.test.ts b/src/plugins/kibana_utils/public/state_sync/state_sync.test.ts
index c55c60f9b0f89..1a172d76926cc 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync.test.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync.test.ts
@@ -151,6 +151,28 @@ describe('state_sync', () => {
 
       stop();
     });
+
+    it('storage change with incomplete or differently shaped object should notify state and set new object as is', () => {
+      container.set({ todos: [{ completed: false, id: 1, text: 'changed' }] });
+      const { stop, start } = syncStates([
+        {
+          stateContainer: container,
+          storageKey: '_s',
+          stateStorage: testStateStorage,
+        },
+      ]);
+      start();
+
+      const differentlyShapedObject = {
+        different: 'test',
+      };
+      (testStateStorage.get as jest.Mock).mockImplementation(() => differentlyShapedObject);
+      storageChange$.next(differentlyShapedObject as any);
+
+      expect(container.getState()).toStrictEqual(differentlyShapedObject);
+
+      stop();
+    });
   });
 
   describe('integration', () => {
diff --git a/src/plugins/management/kibana.json b/src/plugins/management/kibana.json
index 80135f1bfb6c8..4bbf2039c8f38 100644
--- a/src/plugins/management/kibana.json
+++ b/src/plugins/management/kibana.json
@@ -3,5 +3,5 @@
   "version": "kibana",
   "server": false,
   "ui": true,
-  "requiredPlugins": ["kibana_legacy"]
+  "requiredPlugins": ["kibanaLegacy"]
 }
diff --git a/src/plugins/management/public/management_service.test.ts b/src/plugins/management/public/management_service.test.ts
index b34e76474cec2..ceb91837921eb 100644
--- a/src/plugins/management/public/management_service.test.ts
+++ b/src/plugins/management/public/management_service.test.ts
@@ -25,7 +25,7 @@ jest.mock('ui/new_platform');
 
 test('Provides default sections', () => {
   const service = new ManagementService().setup(
-    npSetup.plugins.kibana_legacy,
+    npSetup.plugins.kibanaLegacy,
     () => {},
     coreMock.createSetup().getStartServices
   );
@@ -37,7 +37,7 @@ test('Provides default sections', () => {
 
 test('Register section, enable and disable', () => {
   const service = new ManagementService().setup(
-    npSetup.plugins.kibana_legacy,
+    npSetup.plugins.kibanaLegacy,
     () => {},
     coreMock.createSetup().getStartServices
   );
diff --git a/src/plugins/management/public/plugin.ts b/src/plugins/management/public/plugin.ts
index 195d96c11d8d9..ce6959ec31345 100644
--- a/src/plugins/management/public/plugin.ts
+++ b/src/plugins/management/public/plugin.ts
@@ -28,10 +28,10 @@ export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart
   private managementSections = new ManagementService();
   private legacyManagement = new LegacyManagementAdapter();
 
-  public setup(core: CoreSetup, { kibana_legacy }: { kibana_legacy: KibanaLegacySetup }) {
+  public setup(core: CoreSetup, { kibanaLegacy }: { kibanaLegacy: KibanaLegacySetup }) {
     return {
       sections: this.managementSections.setup(
-        kibana_legacy,
+        kibanaLegacy,
         this.legacyManagement.getManagement,
         core.getStartServices
       ),
diff --git a/src/plugins/saved_objects/public/_index.scss b/src/plugins/saved_objects/public/_index.scss
new file mode 100644
index 0000000000000..fc7bb35f38b10
--- /dev/null
+++ b/src/plugins/saved_objects/public/_index.scss
@@ -0,0 +1 @@
+@import './save_modal/index';
diff --git a/src/legacy/ui/public/compat/index.js b/src/plugins/saved_objects/public/finder/index.ts
similarity index 88%
rename from src/legacy/ui/public/compat/index.js
rename to src/plugins/saved_objects/public/finder/index.ts
index 87f87f751f1da..54a05cdfbadc3 100644
--- a/src/legacy/ui/public/compat/index.js
+++ b/src/plugins/saved_objects/public/finder/index.ts
@@ -18,6 +18,7 @@
  */
 
 export {
-  InitAfterBindingsWorkaround,
-  callAfterBindingsWorkaround,
-} from './init_after_bindings_workaround';
+  SavedObjectMetaData,
+  SavedObjectFinderUi,
+  getSavedObjectFinder,
+} from './saved_object_finder';
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx b/src/plugins/saved_objects/public/finder/saved_object_finder.test.tsx
similarity index 99%
rename from src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx
rename to src/plugins/saved_objects/public/finder/saved_object_finder.test.tsx
index 58b396d57639b..97ac25dca8cf1 100644
--- a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx
+++ b/src/plugins/saved_objects/public/finder/saved_object_finder.test.tsx
@@ -36,7 +36,6 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import * as sinon from 'sinon';
 import { SavedObjectFinderUi as SavedObjectFinder } from './saved_object_finder';
-// eslint-disable-next-line
 import { coreMock } from '../../../../core/public/mocks';
 
 describe('SavedObjectsFinder', () => {
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx b/src/plugins/saved_objects/public/finder/saved_object_finder.tsx
similarity index 89%
rename from src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx
rename to src/plugins/saved_objects/public/finder/saved_object_finder.tsx
index 2a43f29024ba7..0658ed64df84c 100644
--- a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx
+++ b/src/plugins/saved_objects/public/finder/saved_object_finder.tsx
@@ -22,10 +22,8 @@ import PropTypes from 'prop-types';
 import React from 'react';
 
 import {
-  CommonProps,
   EuiContextMenuItem,
   EuiContextMenuPanel,
-  EuiContextMenuPanelProps,
   EuiEmptyPrompt,
   EuiFieldSearch,
   EuiFilterButton,
@@ -44,19 +42,13 @@ import {
 import { Direction } from '@elastic/eui/src/services/sort/sort_direction';
 import { i18n } from '@kbn/i18n';
 
-import { SavedObjectAttributes } from '../../../../core/public';
-import { SimpleSavedObject, CoreStart } from '../../../../core/public';
-import { useKibana } from '../context';
-
-// TODO the typings for EuiListGroup are incorrect - maxWidth is missing. This can be removed when the types are adjusted
-const FixedEuiListGroup = (EuiListGroup as any) as React.FunctionComponent<
-  CommonProps & { maxWidth: boolean }
->;
-
-// TODO the typings for EuiContextMenuPanel are incorrect - watchedItemProps is missing. This can be removed when the types are adjusted
-const FixedEuiContextMenuPanel = (EuiContextMenuPanel as any) as React.FunctionComponent<
-  EuiContextMenuPanelProps & { watchedItemProps: string[] }
->;
+import {
+  SavedObjectAttributes,
+  SimpleSavedObject,
+  CoreStart,
+  IUiSettingsClient,
+  SavedObjectsStart,
+} from '../../../../core/public';
 
 export interface SavedObjectMetaData<T extends SavedObjectAttributes> {
   type: string;
@@ -299,7 +291,7 @@ class SavedObjectFinderUi extends React.Component<
           });
         }}
       >
-        {i18n.translate('kibana-react.savedObjects.finder.sortAsc', {
+        {i18n.translate('savedObjects.finder.sortAsc', {
           defaultMessage: 'Ascending',
         })}
       </EuiContextMenuItem>,
@@ -312,7 +304,7 @@ class SavedObjectFinderUi extends React.Component<
           });
         }}
       >
-        {i18n.translate('kibana-react.savedObjects.finder.sortDesc', {
+        {i18n.translate('savedObjects.finder.sortDesc', {
           defaultMessage: 'Descending',
         })}
       </EuiContextMenuItem>,
@@ -328,7 +320,7 @@ class SavedObjectFinderUi extends React.Component<
             });
           }}
         >
-          {i18n.translate('kibana-react.savedObjects.finder.sortAuto', {
+          {i18n.translate('savedObjects.finder.sortAuto', {
             defaultMessage: 'Best match',
           })}
         </EuiContextMenuItem>
@@ -344,10 +336,10 @@ class SavedObjectFinderUi extends React.Component<
       <EuiFlexGroup gutterSize="m">
         <EuiFlexItem grow={true}>
           <EuiFieldSearch
-            placeholder={i18n.translate('kibana-react.savedObjects.finder.searchPlaceholder', {
+            placeholder={i18n.translate('savedObjects.finder.searchPlaceholder', {
               defaultMessage: 'Search…',
             })}
-            aria-label={i18n.translate('kibana-react.savedObjects.finder.searchPlaceholder', {
+            aria-label={i18n.translate('savedObjects.finder.searchPlaceholder', {
               defaultMessage: 'Search…',
             })}
             fullWidth
@@ -383,13 +375,13 @@ class SavedObjectFinderUi extends React.Component<
                   isSelected={this.state.sortOpen}
                   data-test-subj="savedObjectFinderSortButton"
                 >
-                  {i18n.translate('kibana-react.savedObjects.finder.sortButtonLabel', {
+                  {i18n.translate('savedObjects.finder.sortButtonLabel', {
                     defaultMessage: 'Sort',
                   })}
                 </EuiFilterButton>
               }
             >
-              <FixedEuiContextMenuPanel
+              <EuiContextMenuPanel
                 watchedItemProps={['icon', 'disabled']}
                 items={this.getSortOptions()}
               />
@@ -415,13 +407,13 @@ class SavedObjectFinderUi extends React.Component<
                     hasActiveFilters={this.state.filteredTypes.length > 0}
                     numActiveFilters={this.state.filteredTypes.length}
                   >
-                    {i18n.translate('kibana-react.savedObjects.finder.filterButtonLabel', {
+                    {i18n.translate('savedObjects.finder.filterButtonLabel', {
                       defaultMessage: 'Types',
                     })}
                   </EuiFilterButton>
                 }
               >
-                <FixedEuiContextMenuPanel
+                <EuiContextMenuPanel
                   watchedItemProps={['icon', 'disabled']}
                   items={this.props.savedObjectMetaData.map(metaData => (
                     <EuiContextMenuItem
@@ -465,7 +457,7 @@ class SavedObjectFinderUi extends React.Component<
           </EuiFlexGroup>
         )}
         {items.length > 0 ? (
-          <FixedEuiListGroup data-test-subj="savedObjectFinderItemList" maxWidth={false}>
+          <EuiListGroup data-test-subj="savedObjectFinderItemList" maxWidth={false}>
             {items.map(item => {
               const currentSavedObjectMetaData = savedObjectMetaData.find(
                 metaData => metaData.type === item.type
@@ -496,7 +488,7 @@ class SavedObjectFinderUi extends React.Component<
                 />
               );
             })}
-          </FixedEuiListGroup>
+          </EuiListGroup>
         ) : (
           !this.state.isFetchingItems && <EuiEmptyPrompt body={this.props.noItemsMessage} />
         )}
@@ -534,15 +526,10 @@ class SavedObjectFinderUi extends React.Component<
   }
 }
 
-const SavedObjectFinder = (props: SavedObjectFinderProps) => {
-  const { services } = useKibana();
-  return (
-    <SavedObjectFinderUi
-      {...props}
-      savedObjects={services.savedObject}
-      uiSettings={services.uiSettings}
-    />
+const getSavedObjectFinder = (savedObject: SavedObjectsStart, uiSettings: IUiSettingsClient) => {
+  return (props: SavedObjectFinderProps) => (
+    <SavedObjectFinderUi {...props} savedObjects={savedObject} uiSettings={uiSettings} />
   );
 };
 
-export { SavedObjectFinder, SavedObjectFinderUi };
+export { getSavedObjectFinder, SavedObjectFinderUi };
diff --git a/src/plugins/saved_objects/public/index.ts b/src/plugins/saved_objects/public/index.ts
new file mode 100644
index 0000000000000..5dae8b055d2db
--- /dev/null
+++ b/src/plugins/saved_objects/public/index.ts
@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { OnSaveProps, SavedObjectSaveModal, SaveResult, showSaveModal } from './save_modal';
+export { getSavedObjectFinder, SavedObjectFinderUi, SavedObjectMetaData } from './finder';
diff --git a/src/plugins/kibana_react/public/saved_objects/__snapshots__/saved_object_save_modal.test.tsx.snap b/src/plugins/saved_objects/public/save_modal/__snapshots__/saved_object_save_modal.test.tsx.snap
similarity index 90%
rename from src/plugins/kibana_react/public/saved_objects/__snapshots__/saved_object_save_modal.test.tsx.snap
rename to src/plugins/saved_objects/public/save_modal/__snapshots__/saved_object_save_modal.test.tsx.snap
index 307c0760de7ba..eff5ab4f1e2c7 100644
--- a/src/plugins/kibana_react/public/saved_objects/__snapshots__/saved_object_save_modal.test.tsx.snap
+++ b/src/plugins/saved_objects/public/save_modal/__snapshots__/saved_object_save_modal.test.tsx.snap
@@ -14,7 +14,7 @@ exports[`SavedObjectSaveModal should render matching snapshot 1`] = `
         <EuiModalHeaderTitle>
           <FormattedMessage
             defaultMessage="Save {objectType}"
-            id="kibana-react.savedObjects.saveModal.saveTitle"
+            id="savedObjects.saveModal.saveTitle"
             values={
               Object {
                 "objectType": "visualization",
@@ -34,7 +34,7 @@ exports[`SavedObjectSaveModal should render matching snapshot 1`] = `
             label={
               <FormattedMessage
                 defaultMessage="Title"
-                id="kibana-react.savedObjects.saveModal.titleLabel"
+                id="savedObjects.saveModal.titleLabel"
                 values={Object {}}
               />
             }
@@ -58,7 +58,7 @@ exports[`SavedObjectSaveModal should render matching snapshot 1`] = `
             label={
               <FormattedMessage
                 defaultMessage="Description"
-                id="kibana-react.savedObjects.saveModal.descriptionLabel"
+                id="savedObjects.saveModal.descriptionLabel"
                 values={Object {}}
               />
             }
@@ -79,7 +79,7 @@ exports[`SavedObjectSaveModal should render matching snapshot 1`] = `
         >
           <FormattedMessage
             defaultMessage="Cancel"
-            id="kibana-react.savedObjects.saveModal.cancelButtonLabel"
+            id="savedObjects.saveModal.cancelButtonLabel"
             values={Object {}}
           />
         </EuiButtonEmpty>
diff --git a/src/plugins/kibana_react/public/saved_objects/_index.scss b/src/plugins/saved_objects/public/save_modal/_index.scss
similarity index 100%
rename from src/plugins/kibana_react/public/saved_objects/_index.scss
rename to src/plugins/saved_objects/public/save_modal/_index.scss
diff --git a/src/legacy/ui/public/vis/config/index.ts b/src/plugins/saved_objects/public/save_modal/index.ts
similarity index 83%
rename from src/legacy/ui/public/vis/config/index.ts
rename to src/plugins/saved_objects/public/save_modal/index.ts
index ee7385518a85d..f26aa732f30a1 100644
--- a/src/legacy/ui/public/vis/config/index.ts
+++ b/src/plugins/saved_objects/public/save_modal/index.ts
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { editorConfigProviders, EditorConfigProviderRegistry } from './editor_config_providers';
-export * from './types';
+export { SavedObjectSaveModal, OnSaveProps } from './saved_object_save_modal';
+export { showSaveModal, SaveResult } from './show_saved_object_save_modal';
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.scss b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.scss
similarity index 100%
rename from src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.scss
rename to src/plugins/saved_objects/public/save_modal/saved_object_save_modal.scss
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.test.tsx b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.test.tsx
similarity index 100%
rename from src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.test.tsx
rename to src/plugins/saved_objects/public/save_modal/saved_object_save_modal.test.tsx
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.tsx b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
similarity index 93%
rename from src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.tsx
rename to src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
index cdbc2bb9b5473..da70d9fe89525 100644
--- a/src/plugins/kibana_react/public/saved_objects/saved_object_save_modal.tsx
+++ b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
@@ -97,7 +97,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
             <EuiModalHeader>
               <EuiModalHeaderTitle>
                 <FormattedMessage
-                  id="kibana-react.savedObjects.saveModal.saveTitle"
+                  id="savedObjects.saveModal.saveTitle"
                   defaultMessage="Save {objectType}"
                   values={{ objectType: this.props.objectType }}
                 />
@@ -119,7 +119,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
                   fullWidth
                   label={
                     <FormattedMessage
-                      id="kibana-react.savedObjects.saveModal.titleLabel"
+                      id="savedObjects.saveModal.titleLabel"
                       defaultMessage="Title"
                     />
                   }
@@ -146,7 +146,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
             <EuiModalFooter>
               <EuiButtonEmpty data-test-subj="saveCancelButton" onClick={this.props.onClose}>
                 <FormattedMessage
-                  id="kibana-react.savedObjects.saveModal.cancelButtonLabel"
+                  id="savedObjects.saveModal.cancelButtonLabel"
                   defaultMessage="Cancel"
                 />
               </EuiButtonEmpty>
@@ -169,7 +169,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
         fullWidth
         label={
           <FormattedMessage
-            id="kibana-react.savedObjects.saveModal.descriptionLabel"
+            id="savedObjects.saveModal.descriptionLabel"
             defaultMessage="Description"
           />
         }
@@ -243,7 +243,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
     const { isLoading, title } = this.state;
 
     let confirmLabel: string | React.ReactNode = i18n.translate(
-      'kibana-react.savedObjects.saveModal.saveButtonLabel',
+      'savedObjects.saveModal.saveButtonLabel',
       {
         defaultMessage: 'Save',
       }
@@ -277,7 +277,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
           <EuiCallOut
             title={
               <FormattedMessage
-                id="kibana-react.savedObjects.saveModal.duplicateTitleLabel"
+                id="savedObjects.saveModal.duplicateTitleLabel"
                 defaultMessage="A {objectType} with the title '{title}' already exists"
                 values={{ objectType: this.props.objectType, title: this.state.title }}
               />
@@ -288,7 +288,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
           >
             <p>
               <FormattedMessage
-                id="kibana-react.savedObjects.saveModal.duplicateTitleDescription"
+                id="savedObjects.saveModal.duplicateTitleDescription"
                 defaultMessage="Clicking {confirmSaveLabel} overwrites the existing {objectType}."
                 values={{
                   objectType: this.props.objectType,
@@ -296,7 +296,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
                     <strong>
                       {this.props.confirmButtonLabel
                         ? this.props.confirmButtonLabel
-                        : i18n.translate('kibana-react.savedObjects.saveModal.saveButtonLabel', {
+                        : i18n.translate('savedObjects.saveModal.saveButtonLabel', {
                             defaultMessage: 'Save',
                           })}
                     </strong>
@@ -324,7 +324,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
           onChange={this.onCopyOnSaveChange}
           label={
             <FormattedMessage
-              id="kibana-react.savedObjects.saveModal.saveAsNewLabel"
+              id="savedObjects.saveModal.saveAsNewLabel"
               defaultMessage="Save as new {objectType}"
               values={{ objectType: this.props.objectType }}
             />
diff --git a/src/legacy/ui/public/saved_objects/show_saved_object_save_modal.tsx b/src/plugins/saved_objects/public/save_modal/show_saved_object_save_modal.tsx
similarity index 91%
rename from src/legacy/ui/public/saved_objects/show_saved_object_save_modal.tsx
rename to src/plugins/saved_objects/public/save_modal/show_saved_object_save_modal.tsx
index 3c691c692948a..66705985c7b99 100644
--- a/src/legacy/ui/public/saved_objects/show_saved_object_save_modal.tsx
+++ b/src/plugins/saved_objects/public/save_modal/show_saved_object_save_modal.tsx
@@ -19,7 +19,8 @@
 
 import React from 'react';
 import ReactDOM from 'react-dom';
-import { I18nContext } from 'ui/i18n';
+
+import { I18nStart } from '../../../../core/public';
 
 /**
  * Represents the result of trying to persist the saved object.
@@ -34,12 +35,15 @@ function isSuccess(result: SaveResult): result is { id?: string } {
   return 'id' in result;
 }
 
-export interface MinimalSaveModalProps {
+interface MinimalSaveModalProps {
   onSave: (...args: any[]) => Promise<SaveResult>;
   onClose: () => void;
 }
 
-export function showSaveModal(saveModal: React.ReactElement<MinimalSaveModalProps>) {
+export function showSaveModal(
+  saveModal: React.ReactElement<MinimalSaveModalProps>,
+  I18nContext: I18nStart['Context']
+) {
   const container = document.createElement('div');
   const closeModal = () => {
     ReactDOM.unmountComponentAtNode(container);
diff --git a/src/plugins/ui_actions/public/actions/i_action.ts b/src/plugins/ui_actions/public/actions/action.ts
similarity index 83%
rename from src/plugins/ui_actions/public/actions/i_action.ts
rename to src/plugins/ui_actions/public/actions/action.ts
index 20fdda9033f6a..22530f003f2cd 100644
--- a/src/plugins/ui_actions/public/actions/i_action.ts
+++ b/src/plugins/ui_actions/public/actions/action.ts
@@ -17,7 +17,9 @@
  * under the License.
  */
 
-export interface IAction<ActionContext extends {} = {}> {
+import { UiComponent } from 'src/plugins/kibana_utils/common';
+
+export interface Action<ActionContext extends {} = {}> {
   /**
    * Determined the order when there is more than one action matched to a trigger.
    * Higher numbers are displayed first.
@@ -39,6 +41,12 @@ export interface IAction<ActionContext extends {} = {}> {
    */
   getDisplayName(context: ActionContext): string;
 
+  /**
+   * `UiComponent` to render when displaying this action as a context menu item.
+   * If not provided, `getDisplayName` will be used instead.
+   */
+  MenuItem?: UiComponent<{ context: ActionContext }>;
+
   /**
    * Returns a promise that resolves to true if this action is compatible given the context,
    * otherwise resolves to false.
diff --git a/src/plugins/ui_actions/public/actions/create_action.ts b/src/plugins/ui_actions/public/actions/create_action.ts
index 3ac7b8cbbdec1..0cec076745334 100644
--- a/src/plugins/ui_actions/public/actions/create_action.ts
+++ b/src/plugins/ui_actions/public/actions/create_action.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { IAction } from './i_action';
+import { Action } from './action';
 
 export function createAction<ActionContext extends {} = {}>(
-  action: { type: string; execute: IAction<ActionContext>['execute'] } & Partial<
-    IAction<ActionContext>
+  action: { type: string; execute: Action<ActionContext>['execute'] } & Partial<
+    Action<ActionContext>
   >
-): IAction<ActionContext> {
+): Action<ActionContext> {
   return {
     getIconType: () => undefined,
     order: 0,
diff --git a/src/plugins/ui_actions/public/actions/index.ts b/src/plugins/ui_actions/public/actions/index.ts
index 67bdbed9e6785..feb9a8de62eb3 100644
--- a/src/plugins/ui_actions/public/actions/index.ts
+++ b/src/plugins/ui_actions/public/actions/index.ts
@@ -17,5 +17,5 @@
  * under the License.
  */
 
-export { IAction } from './i_action';
+export { Action } from './action';
 export { createAction } from './create_action';
diff --git a/src/plugins/ui_actions/public/actions/register_action.ts b/src/plugins/ui_actions/public/actions/register_action.ts
index c8d5eddac9873..5738be63c9592 100644
--- a/src/plugins/ui_actions/public/actions/register_action.ts
+++ b/src/plugins/ui_actions/public/actions/register_action.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 
-export const registerAction: IUiActionsApiPure['registerAction'] = ({ actions }) => action => {
+export const registerAction: UiActionsApiPure['registerAction'] = ({ actions }) => action => {
   if (actions.has(action.id)) {
     throw new Error(`Action [action.id = ${action.id}] already registered.`);
   }
diff --git a/src/plugins/ui_actions/public/api.ts b/src/plugins/ui_actions/public/api.ts
index 39580efd9e272..9a6fd04b14e10 100644
--- a/src/plugins/ui_actions/public/api.ts
+++ b/src/plugins/ui_actions/public/api.ts
@@ -18,10 +18,10 @@
  */
 
 import {
-  IUiActionsApi,
-  IUiActionsDependenciesInternal,
-  IUiActionsDependencies,
-  IUiActionsApiPure,
+  UiActionsApi,
+  UiActionsDependenciesInternal,
+  UiActionsDependencies,
+  UiActionsApiPure,
 } from './types';
 import { attachAction } from './triggers/attach_action';
 import { detachAction } from './triggers/detach_action';
@@ -32,7 +32,7 @@ import { getTriggerCompatibleActions } from './triggers/get_trigger_compatible_a
 import { registerAction } from './actions/register_action';
 import { registerTrigger } from './triggers/register_trigger';
 
-export const pureApi: IUiActionsApiPure = {
+export const pureApi: UiActionsApiPure = {
   attachAction,
   detachAction,
   executeTriggerActions,
@@ -43,13 +43,13 @@ export const pureApi: IUiActionsApiPure = {
   registerTrigger,
 };
 
-export const createApi = (deps: IUiActionsDependencies) => {
-  const partialApi: Partial<IUiActionsApi> = {};
-  const depsInternal: IUiActionsDependenciesInternal = { ...deps, api: partialApi };
+export const createApi = (deps: UiActionsDependencies) => {
+  const partialApi: Partial<UiActionsApi> = {};
+  const depsInternal: UiActionsDependenciesInternal = { ...deps, api: partialApi };
   for (const [key, fn] of Object.entries(pureApi)) {
     (partialApi as any)[key] = fn(depsInternal);
   }
   Object.freeze(partialApi);
-  const api = partialApi as IUiActionsApi;
+  const api = partialApi as UiActionsApi;
   return { api, depsInternal };
 };
diff --git a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.ts b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
similarity index 86%
rename from src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.ts
rename to src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
index 8de447f5acf9c..7b80a8ea830c0 100644
--- a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.ts
+++ b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
@@ -17,10 +17,12 @@
  * under the License.
  */
 
+import * as React from 'react';
 import { EuiContextMenuPanelDescriptor, EuiContextMenuPanelItemDescriptor } from '@elastic/eui';
 import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { IAction } from '../actions';
+import { uiToReactComponent } from '../../../kibana_react/public';
+import { Action } from '../actions';
 
 /**
  * Transforms an array of Actions to the shape EuiContextMenuPanel expects.
@@ -30,7 +32,7 @@ export async function buildContextMenuForActions<A>({
   actionContext,
   closeMenu,
 }: {
-  actions: Array<IAction<A>>;
+  actions: Array<Action<A>>;
   actionContext: A;
   closeMenu: () => void;
 }): Promise<EuiContextMenuPanelDescriptor> {
@@ -57,7 +59,7 @@ async function buildEuiContextMenuPanelItems<A>({
   actionContext,
   closeMenu,
 }: {
-  actions: Array<IAction<A>>;
+  actions: Array<Action<A>>;
   actionContext: A;
   closeMenu: () => void;
 }) {
@@ -93,12 +95,17 @@ function convertPanelActionToContextMenuItem<A>({
   actionContext,
   closeMenu,
 }: {
-  action: IAction<A>;
+  action: Action<A>;
   actionContext: A;
   closeMenu: () => void;
 }): EuiContextMenuPanelItemDescriptor {
   const menuPanelItem: EuiContextMenuPanelItemDescriptor = {
-    name: action.getDisplayName(actionContext),
+    name: action.MenuItem
+      ? // Cast to `any` because `name` typed to string.
+        (React.createElement(uiToReactComponent(action.MenuItem), {
+          context: actionContext,
+        }) as any)
+      : action.getDisplayName(actionContext),
     icon: action.getIconType(actionContext),
     panel: _.get(action, 'childContextMenuPanel.id'),
     'data-test-subj': `embeddablePanelAction-${action.id}`,
diff --git a/src/plugins/ui_actions/public/index.ts b/src/plugins/ui_actions/public/index.ts
index f0d21cade422d..427dbecb7aee4 100644
--- a/src/plugins/ui_actions/public/index.ts
+++ b/src/plugins/ui_actions/public/index.ts
@@ -24,13 +24,13 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new UiActionsPlugin(initializerContext);
 }
 
-export { IUiActionsSetup, IUiActionsStart } from './plugin';
+export { UiActionsSetup, UiActionsStart } from './plugin';
 export {
-  IAction,
-  ITrigger,
-  IUiActionsApi,
-  TGetActionsCompatibleWithTrigger,
-  TExecuteTriggerActions,
+  Action,
+  Trigger,
+  UiActionsApi,
+  GetActionsCompatibleWithTrigger,
+  ExecuteTriggerActions,
 } from './types';
 export { createAction } from './actions';
 export { buildContextMenuForActions } from './context_menu';
diff --git a/src/plugins/ui_actions/public/mocks.ts b/src/plugins/ui_actions/public/mocks.ts
index 4a46fa54e2ac8..273c5dcf83e81 100644
--- a/src/plugins/ui_actions/public/mocks.ts
+++ b/src/plugins/ui_actions/public/mocks.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { IUiActionsSetup, IUiActionsStart } from '.';
+import { UiActionsSetup, UiActionsStart } from '.';
 import { plugin as pluginInitializer } from '.';
 // eslint-disable-next-line
 import { coreMock } from '../../../core/public/mocks';
 
-export type Setup = jest.Mocked<IUiActionsSetup>;
-export type Start = jest.Mocked<IUiActionsStart>;
+export type Setup = jest.Mocked<UiActionsSetup>;
+export type Start = jest.Mocked<UiActionsStart>;
 
 const createSetupContract = (): Setup => {
   const setupContract: Setup = {
diff --git a/src/plugins/ui_actions/public/plugin.ts b/src/plugins/ui_actions/public/plugin.ts
index 374acaaab3999..12a9b7cbc6526 100644
--- a/src/plugins/ui_actions/public/plugin.ts
+++ b/src/plugins/ui_actions/public/plugin.ts
@@ -18,28 +18,28 @@
  */
 
 import { CoreStart, PluginInitializerContext, CoreSetup, Plugin } from 'src/core/public';
-import { IUiActionsApi, IActionRegistry, ITriggerRegistry } from './types';
+import { UiActionsApi, ActionRegistry, TriggerRegistry } from './types';
 import { createApi } from './api';
 
-export interface IUiActionsSetup {
-  attachAction: IUiActionsApi['attachAction'];
-  detachAction: IUiActionsApi['detachAction'];
-  registerAction: IUiActionsApi['registerAction'];
-  registerTrigger: IUiActionsApi['registerTrigger'];
+export interface UiActionsSetup {
+  attachAction: UiActionsApi['attachAction'];
+  detachAction: UiActionsApi['detachAction'];
+  registerAction: UiActionsApi['registerAction'];
+  registerTrigger: UiActionsApi['registerTrigger'];
 }
 
-export type IUiActionsStart = IUiActionsApi;
+export type UiActionsStart = UiActionsApi;
 
-export class UiActionsPlugin implements Plugin<IUiActionsSetup, IUiActionsStart> {
-  private readonly triggers: ITriggerRegistry = new Map();
-  private readonly actions: IActionRegistry = new Map();
-  private api!: IUiActionsApi;
+export class UiActionsPlugin implements Plugin<UiActionsSetup, UiActionsStart> {
+  private readonly triggers: TriggerRegistry = new Map();
+  private readonly actions: ActionRegistry = new Map();
+  private api!: UiActionsApi;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.api = createApi({ triggers: this.triggers, actions: this.actions }).api;
   }
 
-  public setup(core: CoreSetup): IUiActionsSetup {
+  public setup(core: CoreSetup): UiActionsSetup {
     return {
       registerTrigger: this.api.registerTrigger,
       registerAction: this.api.registerAction,
@@ -48,7 +48,7 @@ export class UiActionsPlugin implements Plugin<IUiActionsSetup, IUiActionsStart>
     };
   }
 
-  public start(core: CoreStart): IUiActionsStart {
+  public start(core: CoreStart): UiActionsStart {
     return this.api;
   }
 
diff --git a/src/plugins/ui_actions/public/tests/helpers.ts b/src/plugins/ui_actions/public/tests/helpers.ts
index abbc846736cd0..d1a4a71705a81 100644
--- a/src/plugins/ui_actions/public/tests/helpers.ts
+++ b/src/plugins/ui_actions/public/tests/helpers.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import { IUiActionsDependencies } from '../types';
+import { UiActionsDependencies } from '../types';
 
-export const createDeps = (): IUiActionsDependencies => {
-  const deps: IUiActionsDependencies = {
+export const createDeps = (): UiActionsDependencies => {
+  const deps: UiActionsDependencies = {
     actions: new Map<any, any>(),
     triggers: new Map<any, any>(),
   };
diff --git a/src/plugins/ui_actions/public/tests/test_plugin.ts b/src/plugins/ui_actions/public/tests/test_plugin.ts
index d1995262ce514..dcc42fd9f6fb2 100644
--- a/src/plugins/ui_actions/public/tests/test_plugin.ts
+++ b/src/plugins/ui_actions/public/tests/test_plugin.ts
@@ -18,20 +18,20 @@
  */
 
 import { CoreSetup, CoreStart } from 'src/core/public';
-import { UiActionsPlugin, IUiActionsSetup, IUiActionsStart } from '../plugin';
+import { UiActionsPlugin, UiActionsSetup, UiActionsStart } from '../plugin';
 
-export interface IUiActionsTestPluginReturn {
+export interface UiActionsTestPluginReturn {
   plugin: UiActionsPlugin;
   coreSetup: CoreSetup;
   coreStart: CoreStart;
-  setup: IUiActionsSetup;
-  doStart: (anotherCoreStart?: CoreStart) => IUiActionsStart;
+  setup: UiActionsSetup;
+  doStart: (anotherCoreStart?: CoreStart) => UiActionsStart;
 }
 
 export const uiActionsTestPlugin = (
   coreSetup: CoreSetup = {} as CoreSetup,
   coreStart: CoreStart = {} as CoreStart
-): IUiActionsTestPluginReturn => {
+): UiActionsTestPluginReturn => {
   const initializerContext = {} as any;
   const plugin = new UiActionsPlugin(initializerContext);
   const setup = plugin.setup(coreSetup);
diff --git a/src/plugins/ui_actions/public/tests/test_samples/hello_world_action.tsx b/src/plugins/ui_actions/public/tests/test_samples/hello_world_action.tsx
index 9e3d206c9a6dc..196f3e2d5cdc1 100644
--- a/src/plugins/ui_actions/public/tests/test_samples/hello_world_action.tsx
+++ b/src/plugins/ui_actions/public/tests/test_samples/hello_world_action.tsx
@@ -18,16 +18,31 @@
  */
 
 import React from 'react';
-import { EuiFlyout } from '@elastic/eui';
+import { EuiFlyout, EuiFlexGroup, EuiFlexItem, EuiBadge } from '@elastic/eui';
 import { CoreStart } from 'src/core/public';
-import { createAction, IAction } from '../../actions';
-import { toMountPoint } from '../../../../kibana_react/public';
+import { createAction, Action } from '../../actions';
+import { toMountPoint, reactToUiComponent } from '../../../../kibana_react/public';
+
+const ReactMenuItem: React.FC = () => {
+  return (
+    <EuiFlexGroup alignItems="center">
+      <EuiFlexItem>Hello world!</EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiBadge color={'danger'}>{'secret'}</EuiBadge>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+const UiMenuItem = reactToUiComponent(ReactMenuItem);
 
 export const HELLO_WORLD_ACTION_ID = 'HELLO_WORLD_ACTION_ID';
 
-export function createHelloWorldAction(overlays: CoreStart['overlays']): IAction {
+export function createHelloWorldAction(overlays: CoreStart['overlays']): Action {
   return createAction({
     type: HELLO_WORLD_ACTION_ID,
+    getIconType: () => 'lock',
+    MenuItem: UiMenuItem,
     execute: async () => {
       const flyoutSession = overlays.openFlyout(
         toMountPoint(
diff --git a/src/plugins/ui_actions/public/tests/test_samples/restricted_action.ts b/src/plugins/ui_actions/public/tests/test_samples/restricted_action.ts
index 2e863b43e0917..aa65d3af98163 100644
--- a/src/plugins/ui_actions/public/tests/test_samples/restricted_action.ts
+++ b/src/plugins/ui_actions/public/tests/test_samples/restricted_action.ts
@@ -17,11 +17,11 @@
  * under the License.
  */
 
-import { IAction, createAction } from '../../actions';
+import { Action, createAction } from '../../actions';
 
 export const RESTRICTED_ACTION = 'RESTRICTED_ACTION';
 
-export function createRestrictedAction<C>(isCompatibleIn: (context: C) => boolean): IAction<C> {
+export function createRestrictedAction<C>(isCompatibleIn: (context: C) => boolean): Action<C> {
   return createAction<C>({
     type: RESTRICTED_ACTION,
     isCompatible: async context => isCompatibleIn(context),
diff --git a/src/plugins/ui_actions/public/tests/test_samples/say_hello_action.tsx b/src/plugins/ui_actions/public/tests/test_samples/say_hello_action.tsx
index e984dd8fb64cc..f1265fed54b38 100644
--- a/src/plugins/ui_actions/public/tests/test_samples/say_hello_action.tsx
+++ b/src/plugins/ui_actions/public/tests/test_samples/say_hello_action.tsx
@@ -20,12 +20,12 @@
 import React from 'react';
 import { EuiFlyout } from '@elastic/eui';
 import { CoreStart } from 'src/core/public';
-import { IAction, createAction } from '../../actions';
+import { Action, createAction } from '../../actions';
 import { toMountPoint } from '../../../../kibana_react/public';
 
 export const SAY_HELLO_ACTION = 'SAY_HELLO_ACTION';
 
-export function createSayHelloAction(overlays: CoreStart['overlays']): IAction<{ name: string }> {
+export function createSayHelloAction(overlays: CoreStart['overlays']): Action<{ name: string }> {
   return createAction<{ name: string }>({
     type: SAY_HELLO_ACTION,
     getDisplayName: ({ name }) => `Hello, ${name}`,
diff --git a/src/plugins/ui_actions/public/triggers/attach_action.ts b/src/plugins/ui_actions/public/triggers/attach_action.ts
index 17793d46c5a42..6c0beeae2bcd7 100644
--- a/src/plugins/ui_actions/public/triggers/attach_action.ts
+++ b/src/plugins/ui_actions/public/triggers/attach_action.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 
-export const attachAction: IUiActionsApiPure['attachAction'] = ({ triggers }) => (
+export const attachAction: UiActionsApiPure['attachAction'] = ({ triggers }) => (
   triggerId,
   actionId
 ) => {
diff --git a/src/plugins/ui_actions/public/triggers/detach_action.ts b/src/plugins/ui_actions/public/triggers/detach_action.ts
index cb9bf685cdc00..710dcf9f5621b 100644
--- a/src/plugins/ui_actions/public/triggers/detach_action.ts
+++ b/src/plugins/ui_actions/public/triggers/detach_action.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 
-export const detachAction: IUiActionsApiPure['detachAction'] = ({ triggers }) => (
+export const detachAction: UiActionsApiPure['detachAction'] = ({ triggers }) => (
   triggerId,
   actionId
 ) => {
diff --git a/src/plugins/ui_actions/public/triggers/execute_trigger_actions.test.ts b/src/plugins/ui_actions/public/triggers/execute_trigger_actions.test.ts
index f96a11d5f8cfe..7f2506daee268 100644
--- a/src/plugins/ui_actions/public/triggers/execute_trigger_actions.test.ts
+++ b/src/plugins/ui_actions/public/triggers/execute_trigger_actions.test.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IAction, createAction } from '../actions';
+import { Action, createAction } from '../actions';
 import { openContextMenu } from '../context_menu';
-import { IUiActionsTestPluginReturn, uiActionsTestPlugin } from '../tests/test_plugin';
+import { UiActionsTestPluginReturn, uiActionsTestPlugin } from '../tests/test_plugin';
 
 jest.mock('../context_menu');
 
@@ -28,7 +28,7 @@ const openContextMenuSpy = (openContextMenu as any) as jest.SpyInstance;
 
 const CONTACT_USER_TRIGGER = 'CONTACT_USER_TRIGGER';
 
-function createTestAction<A>(id: string, checkCompatibility: (context: A) => boolean): IAction<A> {
+function createTestAction<A>(id: string, checkCompatibility: (context: A) => boolean): Action<A> {
   return createAction<A>({
     type: 'testAction',
     id,
@@ -37,7 +37,7 @@ function createTestAction<A>(id: string, checkCompatibility: (context: A) => boo
   });
 }
 
-let uiActions: IUiActionsTestPluginReturn;
+let uiActions: UiActionsTestPluginReturn;
 const reset = () => {
   uiActions = uiActionsTestPlugin();
 
diff --git a/src/plugins/ui_actions/public/triggers/execute_trigger_actions.ts b/src/plugins/ui_actions/public/triggers/execute_trigger_actions.ts
index ab938eeb9cffd..71f69eb3bdc29 100644
--- a/src/plugins/ui_actions/public/triggers/execute_trigger_actions.ts
+++ b/src/plugins/ui_actions/public/triggers/execute_trigger_actions.ts
@@ -17,11 +17,11 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 import { buildContextMenuForActions, openContextMenu } from '../context_menu';
-import { IAction } from '../actions';
+import { Action } from '../actions';
 
-const executeSingleAction = async <A extends {} = {}>(action: IAction<A>, actionContext: A) => {
+const executeSingleAction = async <A extends {} = {}>(action: Action<A>, actionContext: A) => {
   const href = action.getHref && action.getHref(actionContext);
 
   // TODO: Do we need a `getHref()` special case?
@@ -33,9 +33,10 @@ const executeSingleAction = async <A extends {} = {}>(action: IAction<A>, action
   await action.execute(actionContext);
 };
 
-export const executeTriggerActions: IUiActionsApiPure['executeTriggerActions'] = ({
-  api,
-}) => async (triggerId, actionContext) => {
+export const executeTriggerActions: UiActionsApiPure['executeTriggerActions'] = ({ api }) => async (
+  triggerId,
+  actionContext
+) => {
   const actions = await api.getTriggerCompatibleActions!(triggerId, actionContext);
 
   if (!actions.length) {
diff --git a/src/plugins/ui_actions/public/triggers/get_trigger.ts b/src/plugins/ui_actions/public/triggers/get_trigger.ts
index d5e2b25ce6c19..5c96200261a90 100644
--- a/src/plugins/ui_actions/public/triggers/get_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/get_trigger.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 
-export const getTrigger: IUiActionsApiPure['getTrigger'] = ({ triggers }) => id => {
+export const getTrigger: UiActionsApiPure['getTrigger'] = ({ triggers }) => id => {
   const trigger = triggers.get(id);
 
   if (!trigger) {
diff --git a/src/plugins/ui_actions/public/triggers/get_trigger_actions.test.ts b/src/plugins/ui_actions/public/triggers/get_trigger_actions.test.ts
index 8288bf9686fad..aef4114ffb4c6 100644
--- a/src/plugins/ui_actions/public/triggers/get_trigger_actions.test.ts
+++ b/src/plugins/ui_actions/public/triggers/get_trigger_actions.test.ts
@@ -17,15 +17,15 @@
  * under the License.
  */
 
-import { IAction } from '../actions';
+import { Action } from '../actions';
 import { uiActionsTestPlugin } from '../tests/test_plugin';
 
-const action1: IAction = {
+const action1: Action = {
   id: 'action1',
   order: 1,
   type: 'type1',
 } as any;
-const action2: IAction = {
+const action2: Action = {
   id: 'action2',
   order: 2,
   type: 'type2',
diff --git a/src/plugins/ui_actions/public/triggers/get_trigger_actions.ts b/src/plugins/ui_actions/public/triggers/get_trigger_actions.ts
index 31b401a863663..37d7d5534c8c1 100644
--- a/src/plugins/ui_actions/public/triggers/get_trigger_actions.ts
+++ b/src/plugins/ui_actions/public/triggers/get_trigger_actions.ts
@@ -17,13 +17,13 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
-import { IAction } from '../actions';
+import { UiActionsApiPure } from '../types';
+import { Action } from '../actions';
 
-export const getTriggerActions: IUiActionsApiPure['getTriggerActions'] = ({
+export const getTriggerActions: UiActionsApiPure['getTriggerActions'] = ({
   api,
   actions,
 }) => id => {
   const trigger = api.getTrigger!(id);
-  return trigger.actionIds.map(actionId => actions.get(actionId)).filter(Boolean) as IAction[];
+  return trigger.actionIds.map(actionId => actions.get(actionId)).filter(Boolean) as Action[];
 };
diff --git a/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.test.ts b/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.test.ts
index ea89ba328f406..f4d2ea48ff6b9 100644
--- a/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.test.ts
+++ b/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.test.ts
@@ -18,12 +18,12 @@
  */
 
 import { createSayHelloAction } from '../tests/test_samples/say_hello_action';
-import { IUiActionsTestPluginReturn, uiActionsTestPlugin } from '../tests/test_plugin';
+import { UiActionsTestPluginReturn, uiActionsTestPlugin } from '../tests/test_plugin';
 import { createRestrictedAction, createHelloWorldAction } from '../tests/test_samples';
-import { IAction } from '../actions';
+import { Action } from '../actions';
 
-let action: IAction<{ name: string }>;
-let uiActions: IUiActionsTestPluginReturn;
+let action: Action<{ name: string }>;
+let uiActions: UiActionsTestPluginReturn;
 beforeEach(() => {
   uiActions = uiActionsTestPlugin();
   action = createSayHelloAction({} as any);
diff --git a/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.ts b/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.ts
index 7843b9284eb02..8be0db7561db9 100644
--- a/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.ts
+++ b/src/plugins/ui_actions/public/triggers/get_trigger_compatible_actions.ts
@@ -17,15 +17,15 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
-import { IAction } from '../actions/i_action';
+import { UiActionsApiPure } from '../types';
+import { Action } from '../actions/action';
 
-export const getTriggerCompatibleActions: IUiActionsApiPure['getTriggerCompatibleActions'] = ({
+export const getTriggerCompatibleActions: UiActionsApiPure['getTriggerCompatibleActions'] = ({
   api,
 }) => async (triggerId, context) => {
   const actions = api.getTriggerActions!(triggerId);
   const isCompatibles = await Promise.all(actions.map(action => action.isCompatible(context)));
-  return actions.reduce<IAction[]>(
+  return actions.reduce<Action[]>(
     (acc, action, i) => (isCompatibles[i] ? [...acc, action] : acc),
     []
   );
diff --git a/src/plugins/ui_actions/public/triggers/register_trigger.ts b/src/plugins/ui_actions/public/triggers/register_trigger.ts
index 252513a779d2c..c9a7bb211d05a 100644
--- a/src/plugins/ui_actions/public/triggers/register_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/register_trigger.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { IUiActionsApiPure } from '../types';
+import { UiActionsApiPure } from '../types';
 
-export const registerTrigger: IUiActionsApiPure['registerTrigger'] = ({ triggers }) => trigger => {
+export const registerTrigger: UiActionsApiPure['registerTrigger'] = ({ triggers }) => trigger => {
   if (triggers.has(trigger.id)) {
     throw new Error(`Trigger [trigger.id = ${trigger.id}] already registered.`);
   }
diff --git a/src/plugins/ui_actions/public/triggers/i_trigger.ts b/src/plugins/ui_actions/public/triggers/trigger.ts
similarity index 96%
rename from src/plugins/ui_actions/public/triggers/i_trigger.ts
rename to src/plugins/ui_actions/public/triggers/trigger.ts
index 61284dc39e525..3db11953053d5 100644
--- a/src/plugins/ui_actions/public/triggers/i_trigger.ts
+++ b/src/plugins/ui_actions/public/triggers/trigger.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-export interface ITrigger {
+export interface Trigger {
   id: string;
   title?: string;
   description?: string;
diff --git a/src/plugins/ui_actions/public/types.ts b/src/plugins/ui_actions/public/types.ts
index d7395b1b5ccf7..ed4728342b751 100644
--- a/src/plugins/ui_actions/public/types.ts
+++ b/src/plugins/ui_actions/public/types.ts
@@ -17,42 +17,42 @@
  * under the License.
  */
 
-import { IAction } from './actions/i_action';
-import { ITrigger } from './triggers/i_trigger';
+import { Action } from './actions/action';
+import { Trigger } from './triggers/trigger';
 
-export { IAction } from './actions';
-export { ITrigger } from './triggers/i_trigger';
+export { Action } from './actions';
+export { Trigger } from './triggers/trigger';
 
-export type TExecuteTriggerActions = <A>(triggerId: string, actionContext: A) => Promise<void>;
+export type ExecuteTriggerActions = <A>(triggerId: string, actionContext: A) => Promise<void>;
 
-export type TGetActionsCompatibleWithTrigger = <C>(
+export type GetActionsCompatibleWithTrigger = <C>(
   triggerId: string,
   context: C
-) => Promise<IAction[]>;
+) => Promise<Action[]>;
 
-export interface IUiActionsApi {
+export interface UiActionsApi {
   attachAction: (triggerId: string, actionId: string) => void;
   detachAction: (triggerId: string, actionId: string) => void;
-  executeTriggerActions: TExecuteTriggerActions;
-  getTrigger: (id: string) => ITrigger;
-  getTriggerActions: (id: string) => IAction[];
-  getTriggerCompatibleActions: <C>(triggerId: string, context: C) => Promise<Array<IAction<C>>>;
-  registerAction: (action: IAction) => void;
-  registerTrigger: (trigger: ITrigger) => void;
+  executeTriggerActions: ExecuteTriggerActions;
+  getTrigger: (id: string) => Trigger;
+  getTriggerActions: (id: string) => Action[];
+  getTriggerCompatibleActions: <C>(triggerId: string, context: C) => Promise<Array<Action<C>>>;
+  registerAction: (action: Action) => void;
+  registerTrigger: (trigger: Trigger) => void;
 }
 
-export interface IUiActionsDependencies {
-  actions: IActionRegistry;
-  triggers: ITriggerRegistry;
+export interface UiActionsDependencies {
+  actions: ActionRegistry;
+  triggers: TriggerRegistry;
 }
 
-export interface IUiActionsDependenciesInternal extends IUiActionsDependencies {
-  api: Readonly<Partial<IUiActionsApi>>;
+export interface UiActionsDependenciesInternal extends UiActionsDependencies {
+  api: Readonly<Partial<UiActionsApi>>;
 }
 
-export type IUiActionsApiPure = {
-  [K in keyof IUiActionsApi]: (deps: IUiActionsDependenciesInternal) => IUiActionsApi[K];
+export type UiActionsApiPure = {
+  [K in keyof UiActionsApi]: (deps: UiActionsDependenciesInternal) => UiActionsApi[K];
 };
 
-export type ITriggerRegistry = Map<string, ITrigger>;
-export type IActionRegistry = Map<string, IAction>;
+export type TriggerRegistry = Map<string, Trigger>;
+export type ActionRegistry = Map<string, Action>;
diff --git a/src/plugins/usage_collection/server/collector/collector.js b/src/plugins/usage_collection/server/collector/collector.ts
similarity index 59%
rename from src/plugins/usage_collection/server/collector/collector.js
rename to src/plugins/usage_collection/server/collector/collector.ts
index 54d18ec2b8a7f..e102dc2a64ee8 100644
--- a/src/plugins/usage_collection/server/collector/collector.js
+++ b/src/plugins/usage_collection/server/collector/collector.ts
@@ -17,7 +17,30 @@
  * under the License.
  */
 
-export class Collector {
+import { Logger } from 'kibana/server';
+import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+
+export type CollectorFormatForBulkUpload<T, U> = (result: T) => { type: string; payload: U };
+
+export interface CollectorOptions<T = unknown, U = T> {
+  type: string;
+  init?: Function;
+  fetch: (callCluster: CallCluster) => Promise<T> | T;
+  /*
+   * A hook for allowing the fetched data payload to be organized into a typed
+   * data model for internal bulk upload. See defaultFormatterForBulkUpload for
+   * a generic example.
+   */
+  formatForBulkUpload?: CollectorFormatForBulkUpload<T, U>;
+  isReady: () => Promise<boolean> | boolean;
+}
+
+export class Collector<T = unknown, U = T> {
+  public readonly type: CollectorOptions<T, U>['type'];
+  public readonly init?: CollectorOptions<T, U>['init'];
+  public readonly fetch: CollectorOptions<T, U>['fetch'];
+  private readonly _formatForBulkUpload?: CollectorFormatForBulkUpload<T, U>;
+  public readonly isReady: CollectorOptions<T, U>['isReady'];
   /*
    * @param {Object} logger - logger object
    * @param {String} options.type - property name as the key for the data
@@ -27,8 +50,8 @@ export class Collector {
    * @param {Function} options.rest - optional other properties
    */
   constructor(
-    logger,
-    { type, init, fetch, formatForBulkUpload = null, isReady = null, ...options } = {}
+    protected readonly log: Logger,
+    { type, init, fetch, formatForBulkUpload, isReady, ...options }: CollectorOptions<T, U>
   ) {
     if (type === undefined) {
       throw new Error('Collector must be instantiated with a options.type string property');
@@ -42,41 +65,27 @@ export class Collector {
       throw new Error('Collector must be instantiated with a options.fetch function property');
     }
 
-    this.log = logger;
-
     Object.assign(this, options); // spread in other properties and mutate "this"
 
     this.type = type;
     this.init = init;
     this.fetch = fetch;
-
-    const defaultFormatterForBulkUpload = result => ({ type, payload: result });
-    this._formatForBulkUpload = formatForBulkUpload || defaultFormatterForBulkUpload;
-    if (typeof isReady === 'function') {
-      this.isReady = isReady;
-    }
+    this.isReady = typeof isReady === 'function' ? isReady : () => true;
+    this._formatForBulkUpload = formatForBulkUpload;
   }
 
-  /*
-   * @param {Function} callCluster - callCluster function
-   */
-  fetchInternal(callCluster) {
-    if (typeof callCluster !== 'function') {
-      throw new Error('A `callCluster` function must be passed to the fetch methods of collectors');
+  public formatForBulkUpload(result: T) {
+    if (this._formatForBulkUpload) {
+      return this._formatForBulkUpload(result);
+    } else {
+      return this.defaultFormatterForBulkUpload(result);
     }
-    return this.fetch(callCluster);
-  }
-
-  /*
-   * A hook for allowing the fetched data payload to be organized into a typed
-   * data model for internal bulk upload. See defaultFormatterForBulkUpload for
-   * a generic example.
-   */
-  formatForBulkUpload(result) {
-    return this._formatForBulkUpload(result);
   }
 
-  isReady() {
-    throw `isReady() must be implemented in ${this.type} collector`;
+  protected defaultFormatterForBulkUpload(result: T) {
+    return {
+      type: this.type,
+      payload: result,
+    };
   }
 }
diff --git a/src/plugins/usage_collection/server/collector/__tests__/collector_set.js b/src/plugins/usage_collection/server/collector/collector_set.test.ts
similarity index 53%
rename from src/plugins/usage_collection/server/collector/__tests__/collector_set.js
rename to src/plugins/usage_collection/server/collector/collector_set.test.ts
index 397499650e054..c85880c34d72b 100644
--- a/src/plugins/usage_collection/server/collector/__tests__/collector_set.js
+++ b/src/plugins/usage_collection/server/collector/collector_set.test.ts
@@ -18,58 +18,62 @@
  */
 
 import { noop } from 'lodash';
-import sinon from 'sinon';
-import expect from '@kbn/expect';
-import { Collector } from '../collector';
-import { CollectorSet } from '../collector_set';
-import { UsageCollector } from '../usage_collector';
-
-const mockLogger = () => ({
-  debug: sinon.spy(),
-  warn: sinon.spy(),
-});
+import { Collector } from './collector';
+import { CollectorSet } from './collector_set';
+import { UsageCollector } from './usage_collector';
+import { loggingServiceMock } from '../../../../core/server/mocks';
+
+const logger = loggingServiceMock.createLogger();
+
+const loggerSpies = {
+  debug: jest.spyOn(logger, 'debug'),
+  warn: jest.spyOn(logger, 'warn'),
+};
 
 describe('CollectorSet', () => {
   describe('registers a collector set and runs lifecycle events', () => {
-    let init;
-    let fetch;
+    let init: Function;
+    let fetch: Function;
     beforeEach(() => {
       init = noop;
       fetch = noop;
+      loggerSpies.debug.mockRestore();
+      loggerSpies.warn.mockRestore();
     });
 
+    const mockCallCluster = () => Promise.resolve({ passTest: 1000 });
+
     it('should throw an error if non-Collector type of object is registered', () => {
-      const logger = mockLogger();
       const collectors = new CollectorSet({ logger });
       const registerPojo = () => {
         collectors.registerCollector({
           type: 'type_collector_test',
           init,
           fetch,
-        });
+        } as any); // We are intentionally sending it wrong.
       };
 
-      expect(registerPojo).to.throwException(({ message }) => {
-        expect(message).to.be('CollectorSet can only have Collector instances registered');
-      });
+      expect(registerPojo).toThrowError(
+        'CollectorSet can only have Collector instances registered'
+      );
     });
 
     it('should log debug status of fetching from the collector', async () => {
-      const mockCallCluster = () => Promise.resolve({ passTest: 1000 });
-      const logger = mockLogger();
       const collectors = new CollectorSet({ logger });
       collectors.registerCollector(
         new Collector(logger, {
           type: 'MY_TEST_COLLECTOR',
-          fetch: caller => caller(),
+          fetch: (caller: any) => caller(),
+          isReady: () => true,
         })
       );
 
-      const result = await collectors.bulkFetch(mockCallCluster);
-      const calls = logger.debug.getCalls();
-      expect(calls.length).to.be(1);
-      expect(calls[0].args).to.eql(['Fetching data from MY_TEST_COLLECTOR collector']);
-      expect(result).to.eql([
+      const result = await collectors.bulkFetch(mockCallCluster as any);
+      expect(loggerSpies.debug).toHaveBeenCalledTimes(1);
+      expect(loggerSpies.debug).toHaveBeenCalledWith(
+        'Fetching data from MY_TEST_COLLECTOR collector'
+      );
+      expect(result).toStrictEqual([
         {
           type: 'MY_TEST_COLLECTOR',
           result: { passTest: 1000 },
@@ -78,32 +82,90 @@ describe('CollectorSet', () => {
     });
 
     it('should gracefully handle a collector fetch method throwing an error', async () => {
-      const mockCallCluster = () => Promise.resolve({ passTest: 1000 });
-      const logger = mockLogger();
       const collectors = new CollectorSet({ logger });
       collectors.registerCollector(
         new Collector(logger, {
           type: 'MY_TEST_COLLECTOR',
           fetch: () => new Promise((_resolve, reject) => reject()),
+          isReady: () => true,
         })
       );
 
       let result;
       try {
-        result = await collectors.bulkFetch(mockCallCluster);
+        result = await collectors.bulkFetch(mockCallCluster as any);
       } catch (err) {
         // Do nothing
       }
       // This must return an empty object instead of null/undefined
-      expect(result).to.eql([]);
+      expect(result).toStrictEqual([]);
+    });
+
+    it('should not break if isReady is not a function', async () => {
+      const collectors = new CollectorSet({ logger });
+      collectors.registerCollector(
+        new Collector(logger, {
+          type: 'MY_TEST_COLLECTOR',
+          fetch: () => ({ test: 1 }),
+          isReady: true as any,
+        })
+      );
+
+      const result = await collectors.bulkFetch(mockCallCluster as any);
+      expect(result).toStrictEqual([
+        {
+          type: 'MY_TEST_COLLECTOR',
+          result: { test: 1 },
+        },
+      ]);
+    });
+
+    it('should not break if isReady is not provided', async () => {
+      const collectors = new CollectorSet({ logger });
+      collectors.registerCollector(
+        new Collector(logger, {
+          type: 'MY_TEST_COLLECTOR',
+          fetch: () => ({ test: 1 }),
+        } as any)
+      );
+
+      const result = await collectors.bulkFetch(mockCallCluster as any);
+      expect(result).toStrictEqual([
+        {
+          type: 'MY_TEST_COLLECTOR',
+          result: { test: 1 },
+        },
+      ]);
+    });
+
+    it('should infer the types from the implementations of fetch and formatForBulkUpload', async () => {
+      const collectors = new CollectorSet({ logger });
+      collectors.registerCollector(
+        new Collector(logger, {
+          type: 'MY_TEST_COLLECTOR',
+          fetch: () => ({ test: 1 }),
+          formatForBulkUpload: result => ({
+            type: 'MY_TEST_COLLECTOR',
+            payload: { test: result.test * 2 },
+          }),
+          isReady: () => true,
+        })
+      );
+
+      const result = await collectors.bulkFetch(mockCallCluster as any);
+      expect(result).toStrictEqual([
+        {
+          type: 'MY_TEST_COLLECTOR',
+          result: { test: 1 }, // It matches the return of `fetch`. `formatForBulkUpload` is used later on
+        },
+      ]);
     });
   });
 
   describe('toApiFieldNames', () => {
-    let collectorSet;
+    let collectorSet: CollectorSet;
 
     beforeEach(() => {
-      const logger = mockLogger();
       collectorSet = new CollectorSet({ logger });
     });
 
@@ -126,7 +188,7 @@ describe('CollectorSet', () => {
       };
 
       const result = collectorSet.toApiFieldNames(apiData);
-      expect(result).to.eql({
+      expect(result).toStrictEqual({
         os: {
           load: { '15m': 2.3525390625, '1m': 2.22412109375, '5m': 2.4462890625 },
           memory: { free_bytes: 458280960, total_bytes: 17179869184, used_bytes: 16721588224 },
@@ -155,7 +217,7 @@ describe('CollectorSet', () => {
       };
 
       const result = collectorSet.toApiFieldNames(apiData);
-      expect(result).to.eql({
+      expect(result).toStrictEqual({
         days_of_the_week: [
           { day_index: 1, day_name: 'monday' },
           { day_index: 2, day_name: 'tuesday' },
@@ -166,21 +228,20 @@ describe('CollectorSet', () => {
   });
 
   describe('isUsageCollector', () => {
-    const collectorOptions = { type: 'MY_TEST_COLLECTOR', fetch: () => {} };
+    const collectorOptions = { type: 'MY_TEST_COLLECTOR', fetch: () => {}, isReady: () => true };
 
     it('returns true only for UsageCollector instances', () => {
-      const logger = mockLogger();
       const collectors = new CollectorSet({ logger });
       const usageCollector = new UsageCollector(logger, collectorOptions);
       const collector = new Collector(logger, collectorOptions);
       const randomClass = new (class Random {})();
-      expect(collectors.isUsageCollector(usageCollector)).to.be(true);
-      expect(collectors.isUsageCollector(collector)).to.be(false);
-      expect(collectors.isUsageCollector(randomClass)).to.be(false);
-      expect(collectors.isUsageCollector({})).to.be(false);
-      expect(collectors.isUsageCollector(null)).to.be(false);
-      expect(collectors.isUsageCollector('')).to.be(false);
-      expect(collectors.isUsageCollector()).to.be(false);
+      expect(collectors.isUsageCollector(usageCollector)).toEqual(true);
+      expect(collectors.isUsageCollector(collector)).toEqual(false);
+      expect(collectors.isUsageCollector(randomClass)).toEqual(false);
+      expect(collectors.isUsageCollector({})).toEqual(false);
+      expect(collectors.isUsageCollector(null)).toEqual(false);
+      expect(collectors.isUsageCollector('')).toEqual(false);
+      expect(collectors.isUsageCollector(void 0)).toEqual(false);
     });
   });
 });
diff --git a/src/plugins/usage_collection/server/collector/collector_set.ts b/src/plugins/usage_collection/server/collector/collector_set.ts
index a87accc47535e..6cc5d057b080a 100644
--- a/src/plugins/usage_collection/server/collector/collector_set.ts
+++ b/src/plugins/usage_collection/server/collector/collector_set.ts
@@ -20,39 +20,37 @@
 import { snakeCase } from 'lodash';
 import { Logger } from 'kibana/server';
 import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
-// @ts-ignore
-import { Collector } from './collector';
-// @ts-ignore
+import { Collector, CollectorOptions } from './collector';
 import { UsageCollector } from './usage_collector';
 
 interface CollectorSetConfig {
   logger: Logger;
-  maximumWaitTimeForAllCollectorsInS: number;
-  collectors?: Collector[];
+  maximumWaitTimeForAllCollectorsInS?: number;
+  collectors?: Array<Collector<any, any>>;
 }
 
 export class CollectorSet {
   private _waitingForAllCollectorsTimestamp?: number;
   private logger: Logger;
   private readonly maximumWaitTimeForAllCollectorsInS: number;
-  private collectors: Collector[] = [];
+  private collectors: Array<Collector<any, any>> = [];
   constructor({ logger, maximumWaitTimeForAllCollectorsInS, collectors = [] }: CollectorSetConfig) {
     this.logger = logger;
     this.collectors = collectors;
     this.maximumWaitTimeForAllCollectorsInS = maximumWaitTimeForAllCollectorsInS || 60;
   }
 
-  public makeStatsCollector = (options: any) => {
+  public makeStatsCollector = <T, U>(options: CollectorOptions<T, U>) => {
     return new Collector(this.logger, options);
   };
-  public makeUsageCollector = (options: any) => {
+  public makeUsageCollector = <T, U>(options: CollectorOptions<T, U>) => {
     return new UsageCollector(this.logger, options);
   };
 
   /*
    * @param collector {Collector} collector object
    */
-  public registerCollector = (collector: Collector) => {
+  public registerCollector = <T, U>(collector: Collector<T, U>) => {
     // check instanceof
     if (!(collector instanceof Collector)) {
       throw new Error('CollectorSet can only have Collector instances registered');
@@ -115,7 +113,7 @@ export class CollectorSet {
 
   public bulkFetch = async (
     callCluster: CallCluster,
-    collectors: Collector[] = this.collectors
+    collectors: Array<Collector<any, any>> = this.collectors
   ) => {
     const responses = [];
     for (const collector of collectors) {
@@ -123,7 +121,7 @@ export class CollectorSet {
       try {
         responses.push({
           type: collector.type,
-          result: await collector.fetchInternal(callCluster),
+          result: await collector.fetch(callCluster),
         });
       } catch (err) {
         this.logger.warn(err);
@@ -148,14 +146,13 @@ export class CollectorSet {
   };
 
   // convert an array of fetched stats results into key/object
-  public toObject = (statsData: any) => {
-    if (!statsData) return {};
-    return statsData.reduce((accumulatedStats: any, { type, result }: any) => {
+  public toObject = <Result, T>(statsData: Array<{ type: string; result: T }> = []) => {
+    return statsData.reduce<Result>((accumulatedStats, { type, result }) => {
       return {
         ...accumulatedStats,
         [type]: result,
       };
-    }, {});
+    }, {} as Result);
   };
 
   // rename fields to use api conventions
diff --git a/src/plugins/usage_collection/server/collector/index.ts b/src/plugins/usage_collection/server/collector/index.ts
index 962f61474c250..0d3939e1dc681 100644
--- a/src/plugins/usage_collection/server/collector/index.ts
+++ b/src/plugins/usage_collection/server/collector/index.ts
@@ -18,7 +18,5 @@
  */
 
 export { CollectorSet } from './collector_set';
-// @ts-ignore
 export { Collector } from './collector';
-// @ts-ignore
 export { UsageCollector } from './usage_collector';
diff --git a/src/plugins/usage_collection/server/collector/usage_collector.js b/src/plugins/usage_collection/server/collector/usage_collector.js
deleted file mode 100644
index 54863474dbd01..0000000000000
--- a/src/plugins/usage_collection/server/collector/usage_collector.js
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { KIBANA_STATS_TYPE } from '../../common/constants';
-import { Collector } from './collector';
-
-export class UsageCollector extends Collector {
-  /*
-   * @param {Object} logger - logger object
-   * @param {String} options.type - property name as the key for the data
-   * @param {Function} options.init (optional) - initialization function
-   * @param {Function} options.fetch - function to query data
-   * @param {Function} options.formatForBulkUpload - optional
-   * @param {Function} options.rest - optional other properties
-   */
-  constructor(logger, { type, init, fetch, formatForBulkUpload = null, ...options } = {}) {
-    super(logger, { type, init, fetch, formatForBulkUpload, ...options });
-
-    /*
-     * Currently, for internal bulk uploading, usage stats are part of
-     * `kibana_stats` type, under the `usage` namespace in the document.
-     */
-    const defaultUsageFormatterForBulkUpload = result => {
-      return {
-        type: KIBANA_STATS_TYPE,
-        payload: {
-          usage: {
-            [type]: result,
-          },
-        },
-      };
-    };
-    this._formatForBulkUpload = formatForBulkUpload || defaultUsageFormatterForBulkUpload;
-  }
-}
diff --git a/src/plugins/usage_collection/server/collector/usage_collector.ts b/src/plugins/usage_collection/server/collector/usage_collector.ts
new file mode 100644
index 0000000000000..05c701bd3abf4
--- /dev/null
+++ b/src/plugins/usage_collection/server/collector/usage_collector.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { KIBANA_STATS_TYPE } from '../../common/constants';
+import { Collector } from './collector';
+
+export class UsageCollector<T = unknown, U = { usage: { [key: string]: T } }> extends Collector<
+  T,
+  U
+> {
+  protected defaultUsageFormatterForBulkUpload(result: T) {
+    return {
+      type: KIBANA_STATS_TYPE,
+      payload: {
+        usage: {
+          [this.type]: result,
+        },
+      },
+    };
+  }
+}
diff --git a/test/api_integration/apis/saved_objects/migrations.js b/test/api_integration/apis/saved_objects/migrations.js
index 58a07fd87c0f9..bd207ccb41b20 100644
--- a/test/api_integration/apis/saved_objects/migrations.js
+++ b/test/api_integration/apis/saved_objects/migrations.js
@@ -27,8 +27,10 @@ import {
   DocumentMigrator,
   IndexMigrator,
 } from '../../../../src/core/server/saved_objects/migrations/core';
-import { SavedObjectsSerializer } from '../../../../src/core/server/saved_objects/serialization';
-import { SavedObjectsSchema } from '../../../../src/core/server/saved_objects/schema';
+import {
+  SavedObjectsSerializer,
+  SavedObjectTypeRegistry,
+} from '../../../../src/core/server/saved_objects';
 
 export default ({ getService }) => {
   const es = getService('legacyEs');
@@ -350,10 +352,15 @@ async function migrateIndex({
   validateDoc,
   obsoleteIndexTemplatePattern,
 }) {
+  const typeRegistry = new SavedObjectTypeRegistry();
+  const types = migrationsToTypes(migrations);
+  types.forEach(type => typeRegistry.registerType(type));
+
   const documentMigrator = new DocumentMigrator({
     kibanaVersion: '99.9.9',
-    migrations,
+    typeRegistry,
     validateDoc: validateDoc || _.noop,
+    log: { info: _.noop, debug: _.noop, warn: _.noop },
   });
 
   const migrator = new IndexMigrator({
@@ -366,12 +373,22 @@ async function migrateIndex({
     log: { info: _.noop, debug: _.noop, warn: _.noop },
     pollInterval: 50,
     scrollDuration: '5m',
-    serializer: new SavedObjectsSerializer(new SavedObjectsSchema()),
+    serializer: new SavedObjectsSerializer(typeRegistry),
   });
 
   return await migrator.migrate();
 }
 
+function migrationsToTypes(migrations) {
+  return Object.entries(migrations).map(([type, migrations]) => ({
+    name: type,
+    hidden: false,
+    namespaceAgnostic: false,
+    mappings: { properties: {} },
+    migrations: { ...migrations },
+  }));
+}
+
 async function fetchDocs({ callCluster, index }) {
   const {
     hits: { hits },
diff --git a/test/functional/apps/visualize/_chart_types.ts b/test/functional/apps/visualize/_chart_types.ts
index 5a3c54ccff1fc..b69ed3fff3ebb 100644
--- a/test/functional/apps/visualize/_chart_types.ts
+++ b/test/functional/apps/visualize/_chart_types.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
+import _ from 'lodash';
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
@@ -34,7 +35,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
     });
 
     it('should show the correct chart types', async function() {
-      const expectedChartTypes = [
+      let expectedChartTypes = [
         'Area',
         'Controls',
         'Coordinate Map',
@@ -55,13 +56,19 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
         'Vertical Bar',
       ];
       if (!isOss) {
-        expectedChartTypes.push('Maps');
+        expectedChartTypes.push('Maps', 'Lens');
+        expectedChartTypes = _.remove(expectedChartTypes, function(n) {
+          return n !== 'Coordinate Map';
+        });
+        expectedChartTypes = _.remove(expectedChartTypes, function(n) {
+          return n !== 'Region Map';
+        });
         expectedChartTypes.sort();
       }
       log.debug('oss= ' + isOss);
 
       // find all the chart types and make sure there all there
-      const chartTypes = await PageObjects.visualize.getChartTypes();
+      const chartTypes = (await PageObjects.visualize.getChartTypes()).sort();
       log.debug('returned chart types = ' + chartTypes);
       log.debug('expected chart types = ' + expectedChartTypes);
       expect(chartTypes).to.eql(expectedChartTypes);
diff --git a/test/functional/apps/visualize/_tsvb_chart.ts b/test/functional/apps/visualize/_tsvb_chart.ts
index 8dbe356889568..6a4bed3ba5892 100644
--- a/test/functional/apps/visualize/_tsvb_chart.ts
+++ b/test/functional/apps/visualize/_tsvb_chart.ts
@@ -116,8 +116,7 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
         await esArchiver.unload('kibana_sample_data_flights');
       });
 
-      // FLAKY: https://github.com/elastic/kibana/issues/43150
-      it.skip('should be able to switch between index patterns', async () => {
+      it('should be able to switch between index patterns', async () => {
         const value = await PageObjects.visualBuilder.getMetricValue();
         expect(value).to.eql('156');
         await PageObjects.visualBuilder.clickPanelOptions('metric');
diff --git a/test/functional/page_objects/visual_builder_page.ts b/test/functional/page_objects/visual_builder_page.ts
index 2fa59d5fd89d8..ee0cafb51d455 100644
--- a/test/functional/page_objects/visual_builder_page.ts
+++ b/test/functional/page_objects/visual_builder_page.ts
@@ -414,6 +414,19 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
       await PageObjects.header.waitUntilLoadingHasFinished();
     }
 
+    public async setIntervalValue(value: string) {
+      const el = await testSubjects.find('metricsIndexPatternInterval');
+      await el.clearValue();
+      await el.type(value);
+      await PageObjects.header.waitUntilLoadingHasFinished();
+    }
+
+    public async setDropLastBucket(value: boolean) {
+      const option = await testSubjects.find(`metricsDropLastBucket-${value ? 'yes' : 'no'}`);
+      (await option.findByCssSelector('label')).click();
+      await PageObjects.header.waitUntilLoadingHasFinished();
+    }
+
     public async selectIndexPatternTimeField(timeField: string) {
       await retry.try(async () => {
         await comboBox.clearInputField('metricsIndexPatternFieldsSelect');
diff --git a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/app.tsx b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/app.tsx
index 381590af142f7..dde58eaf44f88 100644
--- a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/app.tsx
+++ b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/app.tsx
@@ -23,12 +23,12 @@ import {
   GetEmbeddableFactory,
   GetEmbeddableFactories,
 } from 'src/legacy/core_plugins/embeddable_api/public/np_ready/public';
-import { TGetActionsCompatibleWithTrigger } from '../../../../../../../../src/plugins/ui_actions/public';
+import { GetActionsCompatibleWithTrigger } from '../../../../../../../../src/plugins/ui_actions/public';
 import { DashboardContainerExample } from './dashboard_container_example';
 import { Start as InspectorStartContract } from '../../../../../../../../src/plugins/inspector/public';
 
 export interface AppProps {
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
diff --git a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/dashboard_container_example.tsx b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/dashboard_container_example.tsx
index 5cfaa1c22f4e5..0237df63351cf 100644
--- a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/dashboard_container_example.tsx
+++ b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/app/dashboard_container_example.tsx
@@ -35,10 +35,10 @@ import {
 import { CoreStart } from '../../../../../../../../src/core/public';
 import { dashboardInput } from './dashboard_input';
 import { Start as InspectorStartContract } from '../../../../../../../../src/plugins/inspector/public';
-import { TGetActionsCompatibleWithTrigger } from '../../../../../../../../src/plugins/ui_actions/public';
+import { GetActionsCompatibleWithTrigger } from '../../../../../../../../src/plugins/ui_actions/public';
 
 interface Props {
-  getActions: TGetActionsCompatibleWithTrigger;
+  getActions: GetActionsCompatibleWithTrigger;
   getEmbeddableFactory: GetEmbeddableFactory;
   getAllEmbeddableFactories: GetEmbeddableFactories;
   overlays: CoreStart['overlays'];
diff --git a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
index 8f22e54bac3c1..2c58abba60558 100644
--- a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
+++ b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
@@ -19,7 +19,7 @@
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { CoreSetup, CoreStart, Plugin } from 'src/core/public';
-import { IUiActionsStart } from '../../../../../../../src/plugins/ui_actions/public';
+import { UiActionsStart } from '../../../../../../../src/plugins/ui_actions/public';
 import { createHelloWorldAction } from '../../../../../../../src/plugins/ui_actions/public/tests/test_samples';
 
 import {
@@ -37,10 +37,7 @@ import {
   ContactCardEmbeddableFactory,
 } from './embeddable_api';
 import { App } from './app';
-import {
-  SavedObjectFinderProps,
-  SavedObjectFinderUi,
-} from '../../../../../../../src/plugins/kibana_react/public/saved_objects';
+import { getSavedObjectFinder } from '../../../../../../../src/plugins/saved_objects/public';
 import { HelloWorldEmbeddableFactory } from '../../../../../../../examples/embeddable_examples/public';
 import {
   IEmbeddableStart,
@@ -57,7 +54,7 @@ export interface SetupDependencies {
 
 interface StartDependencies {
   embeddable: IEmbeddableStart;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
   inspector: InspectorStartContract;
   __LEGACY: {
     ExitFullScreenButton: React.ComponentType<any>;
@@ -101,13 +98,6 @@ export class EmbeddableExplorerPublicPlugin
 
     plugins.__LEGACY.onRenderComplete(() => {
       const root = document.getElementById(REACT_ROOT_ID);
-      const SavedObjectFinder = (props: SavedObjectFinderProps) => (
-        <SavedObjectFinderUi
-          {...props}
-          savedObjects={core.savedObjects}
-          uiSettings={core.uiSettings}
-        />
-      );
       ReactDOM.render(
         <App
           getActions={plugins.uiActions.getTriggerCompatibleActions}
@@ -116,7 +106,7 @@ export class EmbeddableExplorerPublicPlugin
           notifications={core.notifications}
           overlays={core.overlays}
           inspector={plugins.inspector}
-          SavedObjectFinder={SavedObjectFinder}
+          SavedObjectFinder={getSavedObjectFinder(core.savedObjects, core.uiSettings)}
           I18nContext={core.i18n.Context}
         />,
         root
diff --git a/test/plugin_functional/plugins/kbn_tp_sample_panel_action/public/sample_panel_link.ts b/test/plugin_functional/plugins/kbn_tp_sample_panel_action/public/sample_panel_link.ts
index f042d466c794a..7a3fb7fa85546 100644
--- a/test/plugin_functional/plugins/kbn_tp_sample_panel_action/public/sample_panel_link.ts
+++ b/test/plugin_functional/plugins/kbn_tp_sample_panel_action/public/sample_panel_link.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 import { npStart } from 'ui/new_platform';
-import { IAction, createAction } from '../../../../../src/plugins/ui_actions/public';
+import { Action, createAction } from '../../../../../src/plugins/ui_actions/public';
 import { CONTEXT_MENU_TRIGGER } from '../../../../../src/plugins/embeddable/public';
 
-export const createSamplePanelLink = (): IAction =>
+export const createSamplePanelLink = (): Action =>
   createAction({
     type: 'samplePanelLink',
     getDisplayName: () => 'Sample panel Link',
diff --git a/test/plugin_functional/test_suites/core_plugins/rendering.ts b/test/plugin_functional/test_suites/core_plugins/rendering.ts
index 643964999017f..91495c4024f3a 100644
--- a/test/plugin_functional/test_suites/core_plugins/rendering.ts
+++ b/test/plugin_functional/test_suites/core_plugins/rendering.ts
@@ -62,8 +62,12 @@ export default function({ getService, getPageObjects }: PluginFunctionalProvider
       return JSON.parse(document.querySelector('kbn-injected-metadata')!.getAttribute('data')!)
         .legacyMetadata.uiSettings.user;
     });
-  const exists = (selector: string) => testSubjects.exists(selector, { timeout: 2000 });
+  const exists = (selector: string) => testSubjects.exists(selector, { timeout: 5000 });
   const findLoadingMessage = () => testSubjects.find('kbnLoadingMessage', 5000);
+  const getRenderingSession = () =>
+    browser.execute(() => {
+      return window.__RENDERING_SESSION__;
+    });
 
   describe('rendering service', () => {
     it('renders "core" application', async () => {
@@ -136,8 +140,7 @@ export default function({ getService, getPageObjects }: PluginFunctionalProvider
       expect(await exists('renderingHeader')).to.be(false);
     });
 
-    // Flaky: https://github.com/elastic/kibana/issues/55750
-    it.skip('navigates between standard application and one with custom appRoute', async () => {
+    it('navigates between standard application and one with custom appRoute', async () => {
       await navigateTo('/');
       await find.waitForElementStale(await findLoadingMessage());
 
@@ -153,15 +156,14 @@ export default function({ getService, getPageObjects }: PluginFunctionalProvider
       expect(await exists('appStatusApp')).to.be(true);
       expect(await exists('renderingHeader')).to.be(false);
 
-      expect(
-        await browser.execute(() => {
-          return window.__RENDERING_SESSION__;
-        })
-      ).to.eql(['/app/app_status', '/render/core', '/app/app_status']);
+      expect(await getRenderingSession()).to.eql([
+        '/app/app_status',
+        '/render/core',
+        '/app/app_status',
+      ]);
     });
 
-    // Flaky: https://github.com/elastic/kibana/issues/55736
-    it.skip('navigates between applications with custom appRoutes', async () => {
+    it('navigates between applications with custom appRoutes', async () => {
       await navigateTo('/');
       await find.waitForElementStale(await findLoadingMessage());
 
@@ -170,18 +172,18 @@ export default function({ getService, getPageObjects }: PluginFunctionalProvider
       expect(await exists('customAppRouteHeader')).to.be(false);
 
       await navigateToApp('Custom App Route');
-      expect(await exists('renderingHeader')).to.be(false);
       expect(await exists('customAppRouteHeader')).to.be(true);
+      expect(await exists('renderingHeader')).to.be(false);
 
       await navigateToApp('Rendering');
       expect(await exists('renderingHeader')).to.be(true);
       expect(await exists('customAppRouteHeader')).to.be(false);
 
-      expect(
-        await browser.execute(() => {
-          return window.__RENDERING_SESSION__;
-        })
-      ).to.eql(['/render/core', '/custom/appRoute', '/render/core']);
+      expect(await getRenderingSession()).to.eql([
+        '/render/core',
+        '/custom/appRoute',
+        '/render/core',
+      ]);
     });
   });
 }
diff --git a/x-pack/.i18nrc.json b/x-pack/.i18nrc.json
index 32ff4908629eb..68f4498ff2374 100644
--- a/x-pack/.i18nrc.json
+++ b/x-pack/.i18nrc.json
@@ -4,7 +4,7 @@
     "xpack.actions": "plugins/actions",
     "xpack.advancedUiActions": "plugins/advanced_ui_actions",
     "xpack.alerting": "legacy/plugins/alerting",
-    "xpack.triggersActionsUI": "legacy/plugins/triggers_actions_ui",
+    "xpack.triggersActionsUI": "plugins/triggers_actions_ui",
     "xpack.apm": ["legacy/plugins/apm", "plugins/apm"],
     "xpack.beatsManagement": "legacy/plugins/beats_management",
     "xpack.canvas": "legacy/plugins/canvas",
@@ -18,7 +18,7 @@
     "xpack.idxMgmt": "legacy/plugins/index_management",
     "xpack.indexLifecycleMgmt": "legacy/plugins/index_lifecycle_management",
     "xpack.infra": "legacy/plugins/infra",
-    "xpack.kueryAutocomplete": "legacy/plugins/kuery_autocomplete",
+    "xpack.data": "plugins/data_enhanced",
     "xpack.lens": "legacy/plugins/lens",
     "xpack.licenseMgmt": "legacy/plugins/license_management",
     "xpack.licensing": "plugins/licensing",
diff --git a/x-pack/index.js b/x-pack/index.js
index 68b1df6b2d71f..1d311e1ad39fb 100644
--- a/x-pack/index.js
+++ b/x-pack/index.js
@@ -23,7 +23,6 @@ import { licenseManagement } from './legacy/plugins/license_management';
 import { indexManagement } from './legacy/plugins/index_management';
 import { indexLifecycleManagement } from './legacy/plugins/index_lifecycle_management';
 import { spaces } from './legacy/plugins/spaces';
-import { kueryAutocompleteInitializer } from './legacy/plugins/kuery_autocomplete';
 import { canvas } from './legacy/plugins/canvas';
 import { infra } from './legacy/plugins/infra';
 import { taskManager } from './legacy/plugins/task_manager';
@@ -33,7 +32,6 @@ import { remoteClusters } from './legacy/plugins/remote_clusters';
 import { crossClusterReplication } from './legacy/plugins/cross_cluster_replication';
 import { upgradeAssistant } from './legacy/plugins/upgrade_assistant';
 import { uptime } from './legacy/plugins/uptime';
-import { ossTelemetry } from './legacy/plugins/oss_telemetry';
 import { fileUpload } from './legacy/plugins/file_upload';
 import { encryptedSavedObjects } from './legacy/plugins/encrypted_saved_objects';
 import { snapshotRestore } from './legacy/plugins/snapshot_restore';
@@ -66,7 +64,6 @@ module.exports = function(kibana) {
     licenseManagement(kibana),
     indexManagement(kibana),
     indexLifecycleManagement(kibana),
-    kueryAutocompleteInitializer(kibana),
     infra(kibana),
     taskManager(kibana),
     rollup(kibana),
@@ -76,7 +73,6 @@ module.exports = function(kibana) {
     crossClusterReplication(kibana),
     upgradeAssistant(kibana),
     uptime(kibana),
-    ossTelemetry(kibana),
     fileUpload(kibana),
     encryptedSavedObjects(kibana),
     lens(kibana),
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts b/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
index a5d9f6fb6e6a6..56ccf08d6a44f 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client.test.ts
@@ -1465,6 +1465,13 @@ describe('delete()', () => {
       },
     ],
   };
+  const existingDecryptedAlert = {
+    ...existingAlert,
+    attributes: {
+      ...existingAlert.attributes,
+      apiKey: Buffer.from('123:abc').toString('base64'),
+    },
+  };
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
@@ -1472,13 +1479,7 @@ describe('delete()', () => {
     savedObjectsClient.delete.mockResolvedValue({
       success: true,
     });
-    encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue({
-      ...existingAlert,
-      attributes: {
-        ...existingAlert.attributes,
-        apiKey: Buffer.from('123:abc').toString('base64'),
-      },
-    });
+    encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingDecryptedAlert);
   });
 
   test('successfully removes an alert', async () => {
@@ -1487,13 +1488,31 @@ describe('delete()', () => {
     expect(savedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
     expect(taskManager.remove).toHaveBeenCalledWith('task-123');
     expect(alertsClientParams.invalidateAPIKey).toHaveBeenCalledWith({ id: '123' });
+    expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
+      namespace: 'default',
+    });
+    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+  });
+
+  test('falls back to SOC.get when getDecryptedAsInternalUser throws an error', async () => {
+    encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
+
+    const result = await alertsClient.delete({ id: '1' });
+    expect(result).toEqual({ success: true });
+    expect(savedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
+    expect(taskManager.remove).toHaveBeenCalledWith('task-123');
+    expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
+    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
+      'delete(): Failed to load API key to invalidate on alert 1: Fail'
+    );
   });
 
   test(`doesn't remove a task when scheduledTaskId is null`, async () => {
-    savedObjectsClient.get.mockResolvedValue({
-      ...existingAlert,
+    encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue({
+      ...existingDecryptedAlert,
       attributes: {
-        ...existingAlert.attributes,
+        ...existingDecryptedAlert.attributes,
         scheduledTaskId: null,
       },
     });
@@ -1536,6 +1555,7 @@ describe('delete()', () => {
   });
 
   test('throws error when savedObjectsClient.get throws an error', async () => {
+    encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
     savedObjectsClient.get.mockRejectedValue(new Error('SOC Fail'));
 
     await expect(alertsClient.delete({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client.ts b/x-pack/legacy/plugins/alerting/server/alerts_client.ts
index 12d60b162d58e..40125f3067ee3 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client.ts
@@ -226,27 +226,30 @@ export class AlertsClient {
   }
 
   public async delete({ id }: { id: string }) {
-    const [taskIdToRemove, apiKeyToInvalidate] = await Promise.all([
-      this.savedObjectsClient
-        .get<RawAlert>('alert', id)
-        .then(result => result.attributes.scheduledTaskId),
-      // We'll try and load the decrypted saved object but if this fails we'll only log
-      // and skip invalidating the API key.
-      this.encryptedSavedObjectsPlugin
-        .getDecryptedAsInternalUser<RawAlert>('alert', id, { namespace: this.namespace })
-        .then(result => result.attributes.apiKey)
-        .catch(e =>
-          this.logger.error(
-            `delete(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
-          )
-        ),
-    ]);
+    let taskIdToRemove: string | undefined;
+    let apiKeyToInvalidate: string | null = null;
+
+    try {
+      const decryptedAlert = await this.encryptedSavedObjectsPlugin.getDecryptedAsInternalUser<
+        RawAlert
+      >('alert', id, { namespace: this.namespace });
+      apiKeyToInvalidate = decryptedAlert.attributes.apiKey;
+      taskIdToRemove = decryptedAlert.attributes.scheduledTaskId;
+    } catch (e) {
+      // We'll skip invalidating the API key since we failed to load the decrypted saved object
+      this.logger.error(
+        `delete(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
+      );
+      // Still attempt to load the scheduledTaskId using SOC
+      const alert = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      taskIdToRemove = alert.attributes.scheduledTaskId;
+    }
 
     const removeResult = await this.savedObjectsClient.delete('alert', id);
 
     await Promise.all([
-      taskIdToRemove && this.taskManager.remove(taskIdToRemove),
-      apiKeyToInvalidate && this.invalidateApiKey({ apiKey: apiKeyToInvalidate }),
+      taskIdToRemove ? this.taskManager.remove(taskIdToRemove) : null,
+      apiKeyToInvalidate ? this.invalidateApiKey({ apiKey: apiKeyToInvalidate }) : null,
     ]);
 
     return removeResult;
diff --git a/x-pack/legacy/plugins/alerting/server/alerts_client_factory.test.ts b/x-pack/legacy/plugins/alerting/server/alerts_client_factory.test.ts
index 754e02a3f1e5e..14c685237bf92 100644
--- a/x-pack/legacy/plugins/alerting/server/alerts_client_factory.test.ts
+++ b/x-pack/legacy/plugins/alerting/server/alerts_client_factory.test.ts
@@ -86,7 +86,7 @@ test('getUserName() returns a name when security is enabled', async () => {
   factory.create(KibanaRequest.from(fakeRequest), fakeRequest);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
-  securityPluginSetup.authc.getCurrentUser.mockResolvedValueOnce({ username: 'bob' });
+  securityPluginSetup.authc.getCurrentUser.mockReturnValueOnce({ username: 'bob' });
   const userNameResult = await constructorCall.getUserName();
   expect(userNameResult).toEqual('bob');
 });
diff --git a/x-pack/legacy/plugins/alerting/server/index.ts b/x-pack/legacy/plugins/alerting/server/index.ts
index 2f8356c0e9d01..44ae1964ec98a 100644
--- a/x-pack/legacy/plugins/alerting/server/index.ts
+++ b/x-pack/legacy/plugins/alerting/server/index.ts
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { AlertsClient as AlertsClientClass } from './alerts_client';
+
+export type AlertsClient = PublicMethodsOf<AlertsClientClass>;
+
 export { init } from './init';
 export { AlertType, AlertingPlugin, AlertExecutorOptions } from './types';
-export { AlertsClient } from './alerts_client';
 export { PluginSetupContract, PluginStartContract } from './plugin';
diff --git a/x-pack/legacy/plugins/alerting/server/plugin.test.ts b/x-pack/legacy/plugins/alerting/server/plugin.test.ts
new file mode 100644
index 0000000000000..50142434a86dd
--- /dev/null
+++ b/x-pack/legacy/plugins/alerting/server/plugin.test.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin } from './plugin';
+import { coreMock } from '../../../../../src/core/server/mocks';
+import { licensingMock } from '../../../../plugins/licensing/server/mocks';
+import { encryptedSavedObjectsMock } from '../../../../plugins/encrypted_saved_objects/server/mocks';
+
+describe('Alerting Plugin', () => {
+  describe('start()', () => {
+    /**
+     * HACK: This test has put together to ensuire the function "getAlertsClientWithRequest"
+     * throws when needed. There's a lot of blockers for writing a proper test like
+     * misisng plugin start/setup mocks for taskManager and actions plugin, core.http.route
+     * is actually not a function in Kibana Platform, etc. This test contains what is needed
+     * to get to the necessary function within start().
+     */
+    describe('getAlertsClientWithRequest()', () => {
+      it('throws error when encryptedSavedObjects plugin has usingEphemeralEncryptionKey set to true', async () => {
+        const context = coreMock.createPluginInitializerContext();
+        const plugin = new Plugin(context);
+
+        const coreSetup = coreMock.createSetup();
+        const encryptedSavedObjectsSetup = encryptedSavedObjectsMock.createSetup();
+        await plugin.setup(
+          {
+            ...coreSetup,
+            http: {
+              ...coreSetup.http,
+              route: jest.fn(),
+            },
+          } as any,
+          {
+            licensing: licensingMock.createSetup(),
+            encryptedSavedObjects: encryptedSavedObjectsSetup,
+          } as any
+        );
+
+        const startContract = plugin.start(
+          coreMock.createStart() as any,
+          {
+            actions: {
+              execute: jest.fn(),
+              getActionsClientWithRequest: jest.fn(),
+            },
+          } as any
+        );
+
+        expect(encryptedSavedObjectsSetup.usingEphemeralEncryptionKey).toEqual(true);
+        expect(() =>
+          startContract.getAlertsClientWithRequest({} as any)
+        ).toThrowErrorMatchingInlineSnapshot(
+          `"Unable to create alerts client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml"`
+        );
+      });
+
+      it(`doesn't throw error when encryptedSavedObjects plugin has usingEphemeralEncryptionKey set to false`, async () => {
+        const context = coreMock.createPluginInitializerContext();
+        const plugin = new Plugin(context);
+
+        const coreSetup = coreMock.createSetup();
+        const encryptedSavedObjectsSetup = {
+          ...encryptedSavedObjectsMock.createSetup(),
+          usingEphemeralEncryptionKey: false,
+        };
+        await plugin.setup(
+          {
+            ...coreSetup,
+            http: {
+              ...coreSetup.http,
+              route: jest.fn(),
+            },
+          } as any,
+          {
+            licensing: licensingMock.createSetup(),
+            encryptedSavedObjects: encryptedSavedObjectsSetup,
+          } as any
+        );
+
+        const startContract = plugin.start(
+          coreMock.createStart() as any,
+          {
+            actions: {
+              execute: jest.fn(),
+              getActionsClientWithRequest: jest.fn(),
+            },
+            spaces: () => null,
+          } as any
+        );
+
+        const fakeRequest = {
+          headers: {},
+          getBasePath: () => '',
+          path: '/',
+          route: { settings: {} },
+          url: {
+            href: '/',
+          },
+          raw: {
+            req: {
+              url: '/',
+            },
+          },
+          getSavedObjectsClient: jest.fn(),
+        };
+        await startContract.getAlertsClientWithRequest(fakeRequest as any);
+      });
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/alerting/server/plugin.ts b/x-pack/legacy/plugins/alerting/server/plugin.ts
index 3218d9eeb2ef4..a4de7af376fb0 100644
--- a/x-pack/legacy/plugins/alerting/server/plugin.ts
+++ b/x-pack/legacy/plugins/alerting/server/plugin.ts
@@ -42,7 +42,7 @@ export interface PluginSetupContract {
 }
 export interface PluginStartContract {
   listTypes: AlertTypeRegistry['list'];
-  getAlertsClientWithRequest(request: Hapi.Request): AlertsClient;
+  getAlertsClientWithRequest(request: Hapi.Request): PublicMethodsOf<AlertsClient>;
 }
 
 export class Plugin {
@@ -52,6 +52,7 @@ export class Plugin {
   private adminClient?: IClusterClient;
   private serverBasePath?: string;
   private licenseState: LicenseState | null = null;
+  private isESOUsingEphemeralEncryptionKey?: boolean;
 
   constructor(initializerContext: AlertingPluginInitializerContext) {
     this.logger = initializerContext.logger.get('plugins', 'alerting');
@@ -63,8 +64,9 @@ export class Plugin {
     plugins: AlertingPluginsSetup
   ): Promise<PluginSetupContract> {
     this.adminClient = core.elasticsearch.adminClient;
-
     this.licenseState = new LicenseState(plugins.licensing.license$);
+    this.isESOUsingEphemeralEncryptionKey =
+      plugins.encryptedSavedObjects.usingEphemeralEncryptionKey;
 
     // Encrypted attributes
     plugins.encryptedSavedObjects.registerType({
@@ -106,7 +108,7 @@ export class Plugin {
   }
 
   public start(core: AlertingCoreStart, plugins: AlertingPluginsStart): PluginStartContract {
-    const { adminClient, serverBasePath } = this;
+    const { adminClient, serverBasePath, isESOUsingEphemeralEncryptionKey } = this;
 
     function spaceIdToNamespace(spaceId?: string): string | undefined {
       const spacesPlugin = plugins.spaces();
@@ -147,8 +149,14 @@ export class Plugin {
 
     return {
       listTypes: this.alertTypeRegistry!.list.bind(this.alertTypeRegistry!),
-      getAlertsClientWithRequest: (request: Hapi.Request) =>
-        alertsClientFactory!.create(KibanaRequest.from(request), request),
+      getAlertsClientWithRequest: (request: Hapi.Request) => {
+        if (isESOUsingEphemeralEncryptionKey === true) {
+          throw new Error(
+            `Unable to create alerts client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml`
+          );
+        }
+        return alertsClientFactory!.create(KibanaRequest.from(request), request);
+      },
     };
   }
 
diff --git a/x-pack/legacy/plugins/apm/common/projections/typings.ts b/x-pack/legacy/plugins/apm/common/projections/typings.ts
index 2b55395b70c6b..08a7bee5412a5 100644
--- a/x-pack/legacy/plugins/apm/common/projections/typings.ts
+++ b/x-pack/legacy/plugins/apm/common/projections/typings.ts
@@ -4,11 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESSearchRequest, ESSearchBody } from '../../typings/elasticsearch';
+import {
+  ESSearchRequest,
+  ESSearchBody
+} from '../../../../../plugins/apm/typings/elasticsearch';
 import {
   AggregationOptionsByType,
   AggregationInputMap
-} from '../../typings/elasticsearch/aggregations';
+} from '../../../../../plugins/apm/typings/elasticsearch/aggregations';
 
 export type Projection = Omit<ESSearchRequest, 'body'> & {
   body: Omit<ESSearchBody, 'aggs'> & {
diff --git a/x-pack/legacy/plugins/apm/common/projections/util/merge_projection/index.ts b/x-pack/legacy/plugins/apm/common/projections/util/merge_projection/index.ts
index 6a5089733bb33..ef6089872b786 100644
--- a/x-pack/legacy/plugins/apm/common/projections/util/merge_projection/index.ts
+++ b/x-pack/legacy/plugins/apm/common/projections/util/merge_projection/index.ts
@@ -5,11 +5,11 @@
  */
 import { merge, isPlainObject, cloneDeep } from 'lodash';
 import { DeepPartial } from 'utility-types';
-import { AggregationInputMap } from '../../../../typings/elasticsearch/aggregations';
+import { AggregationInputMap } from '../../../../../../../plugins/apm/typings/elasticsearch/aggregations';
 import {
   ESSearchRequest,
   ESSearchBody
-} from '../../../../typings/elasticsearch';
+} from '../../../../../../../plugins/apm/typings/elasticsearch';
 import { Projection } from '../../typings';
 
 type PlainObject = Record<string | number | symbol, any>;
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Permission/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Permission/index.tsx
new file mode 100644
index 0000000000000..177002e7e49bb
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Permission/index.tsx
@@ -0,0 +1,140 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButton,
+  EuiEmptyPrompt,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLink,
+  EuiPanel,
+  EuiTitle
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useState } from 'react';
+import styled from 'styled-components';
+import { FETCH_STATUS, useFetcher } from '../../../hooks/useFetcher';
+import { fontSize, pct, px, units } from '../../../style/variables';
+import { ElasticDocsLink } from '../../shared/Links/ElasticDocsLink';
+import { SetupInstructionsLink } from '../../shared/Links/SetupInstructionsLink';
+
+export const Permission: React.FC = ({ children }) => {
+  const [isPermissionPageEnabled, setIsPermissionsPageEnabled] = useState(true);
+
+  const { data, status } = useFetcher(callApmApi => {
+    return callApmApi({
+      pathname: '/api/apm/security/permissions'
+    });
+  }, []);
+
+  // Return null until receive the reponse of the api.
+  if (status === FETCH_STATUS.LOADING || status === FETCH_STATUS.PENDING) {
+    return null;
+  }
+  // When the user doesn't have the appropriate permissions and they
+  // did not use the escape hatch, show the missing permissions page
+  if (data?.hasPermission === false && isPermissionPageEnabled) {
+    return (
+      <PermissionPage
+        onEscapeHatchClick={() => setIsPermissionsPageEnabled(false)}
+      />
+    );
+  }
+
+  return <>{children}</>;
+};
+
+const CentralizedContainer = styled.div`
+  height: ${pct(100)};
+  display: flex;
+  justify-content: center;
+  align-items: center;
+`;
+
+const EscapeHatch = styled.div`
+  width: ${pct(100)};
+  margin-top: ${px(units.plus)};
+  justify-content: center;
+  display: flex;
+`;
+
+interface Props {
+  onEscapeHatchClick: () => void;
+}
+
+const PermissionPage = ({ onEscapeHatchClick }: Props) => {
+  return (
+    <div style={{ height: pct(95) }}>
+      <EuiFlexGroup alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiTitle size="l">
+            <h1>
+              {i18n.translate('xpack.apm.permission.apm', {
+                defaultMessage: 'APM'
+              })}
+            </h1>
+          </EuiTitle>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <SetupInstructionsLink />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <CentralizedContainer>
+        <div>
+          <EuiPanel paddingSize="none">
+            <EuiEmptyPrompt
+              iconType="apmApp"
+              iconColor={''}
+              title={
+                <h2>
+                  {i18n.translate('xpack.apm.permission.title', {
+                    defaultMessage: 'Missing permissions to access APM'
+                  })}
+                </h2>
+              }
+              body={
+                <p>
+                  {i18n.translate('xpack.apm.permission.description', {
+                    defaultMessage:
+                      "We've detected your current role in Kibana does not grant you access to the APM data. Please check with your Kibana administrator to get the proper privileges granted in order to start using APM."
+                  })}
+                </p>
+              }
+              actions={
+                <>
+                  <ElasticDocsLink
+                    section="/apm/server"
+                    path="/feature-roles.html"
+                  >
+                    {(href: string) => (
+                      <EuiButton color="primary" fill href={href}>
+                        {i18n.translate('xpack.apm.permission.learnMore', {
+                          defaultMessage: 'Learn more about APM permissions'
+                        })}
+                      </EuiButton>
+                    )}
+                  </ElasticDocsLink>
+
+                  <EscapeHatch>
+                    <EuiLink
+                      color="subdued"
+                      onClick={onEscapeHatchClick}
+                      style={{ fontSize }}
+                    >
+                      {i18n.translate('xpack.apm.permission.dismissWarning', {
+                        defaultMessage: 'Dismiss warning'
+                      })}
+                    </EuiLink>
+                  </EscapeHatch>
+                </>
+              }
+            />
+          </EuiPanel>
+        </div>
+      </CentralizedContainer>
+    </div>
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Controls.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Controls.tsx
index 07ea97f442b7f..38e86e4a0d1c9 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Controls.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Controls.tsx
@@ -11,7 +11,6 @@ import React, { useContext, useEffect, useState } from 'react';
 import styled from 'styled-components';
 import { CytoscapeContext } from './Cytoscape';
 import { animationOptions, nodeHeight } from './cytoscapeOptions';
-import { FullscreenPanel } from './FullscreenPanel';
 
 const ControlsContainer = styled('div')`
   left: ${theme.gutterTypes.gutterMedium};
@@ -87,7 +86,6 @@ export function Controls() {
   const minZoom = cy.minZoom();
   const isMinZoom = zoom === minZoom;
   const increment = (maxZoom - minZoom) / steps;
-  const mapDomElement = cy.container();
   const zoomInLabel = i18n.translate('xpack.apm.serviceMap.zoomIn', {
     defaultMessage: 'Zoom in'
   });
@@ -127,7 +125,6 @@ export function Controls() {
           title={centerLabel}
         />
       </EuiPanel>
-      <FullscreenPanel element={mapDomElement} />
     </ControlsContainer>
   );
 }
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/FullscreenPanel.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/FullscreenPanel.tsx
deleted file mode 100644
index 851bf0ebf56fd..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/FullscreenPanel.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { EuiButtonIcon, EuiPanel } from '@elastic/eui';
-import styled from 'styled-components';
-import theme from '@elastic/eui/dist/eui_theme_light.json';
-import { i18n } from '@kbn/i18n';
-
-const Button = styled(EuiButtonIcon)`
-  display: block;
-  margin: ${theme.paddingSizes.xs};
-`;
-
-interface FullscreenPanelProps {
-  element: Element | null;
-}
-
-export function FullscreenPanel({ element }: FullscreenPanelProps) {
-  const canDoFullscreen =
-    element && element.ownerDocument && element.ownerDocument.fullscreenEnabled;
-
-  if (!canDoFullscreen) {
-    return null;
-  }
-
-  function doFullscreen() {
-    if (element && element.ownerDocument && canDoFullscreen) {
-      const isFullscreen = element.ownerDocument.fullscreenElement !== null;
-
-      if (isFullscreen) {
-        element.ownerDocument.exitFullscreen();
-      } else {
-        element.requestFullscreen();
-      }
-    }
-  }
-
-  const label = i18n.translate('xpack.apm.serviceMap.fullscreen', {
-    defaultMessage: 'Full screen'
-  });
-
-  return (
-    <EuiPanel hasShadow={true} paddingSize="none">
-      <Button
-        aria-label={label}
-        color="text"
-        iconType="fullScreen"
-        onClick={doFullscreen}
-        title={label}
-      />
-    </EuiPanel>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
index e8e37cfdfb1f0..329dd45029608 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
@@ -26,20 +26,22 @@ export function Popover({ focusedServiceName }: PopoverProps) {
   const [selectedNode, setSelectedNode] = useState<
     cytoscape.NodeSingular | undefined
   >(undefined);
-  const deselect = useCallback(() => setSelectedNode(undefined), [
-    setSelectedNode
-  ]);
+  const deselect = useCallback(() => {
+    if (cy) {
+      cy.elements().unselect();
+    }
+    setSelectedNode(undefined);
+  }, [cy, setSelectedNode]);
   const renderedHeight = selectedNode?.renderedHeight() ?? 0;
   const renderedWidth = selectedNode?.renderedWidth() ?? 0;
-  const { x, y } = selectedNode?.renderedPosition() ?? { x: 0, y: 0 };
+  const { x, y } = selectedNode?.renderedPosition() ?? { x: -10000, y: -10000 };
   const isOpen = !!selectedNode;
   const isService = selectedNode?.data('type') === 'service';
   const triggerStyle: CSSProperties = {
     background: 'transparent',
     height: renderedHeight,
     position: 'absolute',
-    width: renderedWidth,
-    border: '3px dotted red'
+    width: renderedWidth
   };
   const trigger = <div style={triggerStyle} />;
   const zoom = cy?.zoom() ?? 1;
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
index 722f64c6a7e58..7d362f92154fb 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
@@ -46,10 +46,23 @@ const serviceIcons: { [key: string]: string } = {
 
 export const defaultIcon = getAvatarIcon();
 
+// IE 11 does not properly load some SVGs, which causes a runtime error and the
+// map to not work at all. We would prefer to do some kind of feature detection
+// rather than browser detection, but IE 11 does support SVG, just not well
+// enough for our use in loading icons.
+//
+// This method of detecting IE is from a Stack Overflow answer:
+// https://stackoverflow.com/a/21825207
+//
+// @ts-ignore `documentMode` is not recognized as a valid property of `document`.
+const isIE11 = !!window.MSInputMethodContext && !!document.documentMode;
+
 export function iconForNode(node: cytoscape.NodeSingular) {
   const type = node.data('type');
   if (type === 'service') {
     return serviceIcons[node.data('agentName') as string];
+  } else if (isIE11) {
+    return defaultIcon;
   } else {
     return icons[type];
   }
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/documents.svg b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/documents.svg
index b0648d14f20ba..debe180e45661 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/documents.svg
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/documents.svg
@@ -1 +1 @@
-<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" class="euiIcon euiIcon--medium euiIcon-isLoaded" focusable="false" role="img" aria-hidden="true"><title></title><path d="M8.8 0c.274 0 .537.113.726.312l3.2 3.428c.176.186.274.433.274.689V13a1 1 0 01-1 1H2a1 1 0 01-1-1V1a1 1 0 011-1h6.8zM12 5H8.5a.5.5 0 01-.5-.5V1H2v12h10V5zm-7.5 6a.5.5 0 110-1h5a.5.5 0 110 1h-5zm0-3a.5.5 0 010-1h5a.5.5 0 110 1h-5zm1 8a.5.5 0 110-1H14V6.5a.5.5 0 111 0V15a1 1 0 01-1 1H5.5z"></path></svg>
+<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M8.8 0c.274 0 .537.113.726.312l3.2 3.428c.176.186.274.433.274.689V13a1 1 0 01-1 1H2a1 1 0 01-1-1V1a1 1 0 011-1h6.8zM12 5H8.5a.5.5 0 01-.5-.5V1H2v12h10V5zm-7.5 6a.5.5 0 110-1h5a.5.5 0 110 1h-5zm0-3a.5.5 0 010-1h5a.5.5 0 110 1h-5zm1 8a.5.5 0 110-1H14V6.5a.5.5 0 111 0V15a1 1 0 01-1 1H5.5z"></path></svg>
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/get_bool_filter.ts b/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/get_bool_filter.ts
index f4628524cced5..23feeed4b0418 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/get_bool_filter.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/get_bool_filter.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import {
   TRANSACTION_TYPE,
   ERROR_GROUP_ID,
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx b/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
index efae8982c2235..d97a2331e457b 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
@@ -16,8 +16,12 @@ interface Props extends EuiLinkAnchorProps {
   path: string;
 }
 
-export function ElasticDocsLink({ section, path, ...rest }: Props) {
+export function ElasticDocsLink({ section, path, children, ...rest }: Props) {
   const { version } = useApmPluginContext().packageInfo;
   const href = `https://www.elastic.co/guide/en${section}/${version}${path}`;
-  return <EuiLink href={href} {...rest} />;
+  return (
+    <EuiLink href={href} {...rest}>
+      {typeof children === 'function' ? children(href) : children}
+    </EuiLink>
+  );
 }
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/sections.ts b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/sections.ts
index 18751efc6e1c1..3a9a21356ba35 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/sections.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/sections.ts
@@ -10,6 +10,7 @@ import {
   LABELS,
   HTTP,
   HOST,
+  CLIENT,
   CONTAINER,
   SERVICE,
   PROCESS,
@@ -27,6 +28,7 @@ export const TRANSACTION_METADATA_SECTIONS: Section[] = [
   TRANSACTION,
   HTTP,
   HOST,
+  CLIENT,
   CONTAINER,
   SERVICE,
   PROCESS,
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/sections.ts b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/sections.ts
index ac8e9559357e3..d6c0a72b8bb08 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/sections.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/sections.ts
@@ -34,6 +34,14 @@ export const HOST: Section = {
   })
 };
 
+export const CLIENT: Section = {
+  key: 'client',
+  label: i18n.translate('xpack.apm.metadataTable.section.clientLabel', {
+    defaultMessage: 'Client'
+  }),
+  properties: ['ip']
+};
+
 export const CONTAINER: Section = {
   key: 'container',
   label: i18n.translate('xpack.apm.metadataTable.section.containerLabel', {
diff --git a/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx b/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
index 45d533348f80b..58a41014f2fe9 100644
--- a/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
+++ b/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
@@ -37,6 +37,7 @@ import { getConfigFromInjectedMetadata } from './getConfigFromInjectedMetadata';
 import { setHelpExtension } from './setHelpExtension';
 import { toggleAppLinkInNav } from './toggleAppLinkInNav';
 import { setReadonlyBadge } from './updateBadge';
+import { Permission } from '../components/app/Permission';
 
 export const REACT_APP_ROOT_ID = 'react-apm-root';
 
@@ -51,11 +52,14 @@ const App = () => {
     <MainContainer data-test-subj="apmMainContainer" role="main">
       <UpdateBreadcrumbs routes={routes} />
       <Route component={ScrollToTopOnPathChange} />
-      <Switch>
-        {routes.map((route, i) => (
-          <ApmRoute key={i} {...route} />
-        ))}
-      </Switch>
+      {/* Check if user has the appropriate permissions to use the APM UI. */}
+      <Permission>
+        <Switch>
+          {routes.map((route, i) => (
+            <ApmRoute key={i} {...route} />
+          ))}
+        </Switch>
+      </Permission>
     </MainContainer>
   );
 };
diff --git a/x-pack/legacy/plugins/apm/public/services/rest/ml.ts b/x-pack/legacy/plugins/apm/public/services/rest/ml.ts
index e42b9536362e0..187a051b1b044 100644
--- a/x-pack/legacy/plugins/apm/public/services/rest/ml.ts
+++ b/x-pack/legacy/plugins/apm/public/services/rest/ml.ts
@@ -12,7 +12,7 @@ import {
 } from '../../../common/elasticsearch_fieldnames';
 import { getMlJobId, getMlPrefix } from '../../../common/ml_job_constants';
 import { callApi } from './callApi';
-import { ESFilter } from '../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../plugins/apm/typings/elasticsearch';
 import { createCallApmApi, APMClient } from './createCallApmApi';
 
 interface MlResponseItem {
diff --git a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
index 862c982d6b5ac..3d34f016c6591 100644
--- a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
+++ b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
@@ -23,7 +23,7 @@ import {
   ESFilter,
   ESSearchResponse,
   ESSearchRequest
-} from '../../typings/elasticsearch';
+} from '../../../../../plugins/apm/typings/elasticsearch';
 import {
   ApmPluginContext,
   ApmPluginContextValue
diff --git a/x-pack/legacy/plugins/apm/server/lib/errors/distribution/get_buckets.ts b/x-pack/legacy/plugins/apm/server/lib/errors/distribution/get_buckets.ts
index 9274f96d58d83..0f6ace39aeca3 100644
--- a/x-pack/legacy/plugins/apm/server/lib/errors/distribution/get_buckets.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/errors/distribution/get_buckets.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import {
   ERROR_GROUP_ID,
   PROCESSOR_EVENT,
diff --git a/x-pack/legacy/plugins/apm/server/lib/errors/get_error_groups.ts b/x-pack/legacy/plugins/apm/server/lib/errors/get_error_groups.ts
index aaa4ca9fb8223..92ee6a0a71f00 100644
--- a/x-pack/legacy/plugins/apm/server/lib/errors/get_error_groups.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/errors/get_error_groups.ts
@@ -20,7 +20,7 @@ import {
 } from '../helpers/setup_request';
 import { getErrorGroupsProjection } from '../../../common/projections/errors';
 import { mergeProjection } from '../../../common/projections/util/merge_projection';
-import { SortOptions } from '../../../typings/elasticsearch/aggregations';
+import { SortOptions } from '../../../../../../plugins/apm/typings/elasticsearch/aggregations';
 
 export type ErrorGroupListAPIResponse = PromiseReturnType<
   typeof getErrorGroups
diff --git a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/__test__/get_environment_ui_filter_es.test.ts b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/__test__/get_environment_ui_filter_es.test.ts
index 0f0a11a868d6d..b5061e303a40d 100644
--- a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/__test__/get_environment_ui_filter_es.test.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/__test__/get_environment_ui_filter_es.test.ts
@@ -7,7 +7,7 @@
 import { getEnvironmentUiFilterES } from '../get_environment_ui_filter_es';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../../../common/environment_filter_values';
 import { SERVICE_ENVIRONMENT } from '../../../../../common/elasticsearch_fieldnames';
-import { ESFilter } from '../../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../../plugins/apm/typings/elasticsearch';
 
 describe('getEnvironmentUiFilterES', () => {
   it('should return undefined, when environment is undefined', () => {
diff --git a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
index 57feaf6a6fd0e..dcf2334ab4de2 100644
--- a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_environment_ui_filter_es.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../../common/environment_filter_values';
 import { SERVICE_ENVIRONMENT } from '../../../../common/elasticsearch_fieldnames';
 
diff --git a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_ui_filters_es.ts b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_ui_filters_es.ts
index a6f6d36ecfc81..126ee49fd4218 100644
--- a/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_ui_filters_es.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/helpers/convert_ui_filters/get_ui_filters_es.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import { UIFilters } from '../../../../typings/ui-filters';
 import { getEnvironmentUiFilterES } from './get_environment_ui_filter_es';
 import {
diff --git a/x-pack/legacy/plugins/apm/server/lib/helpers/es_client.ts b/x-pack/legacy/plugins/apm/server/lib/helpers/es_client.ts
index 737eeac95516e..2795c95a50034 100644
--- a/x-pack/legacy/plugins/apm/server/lib/helpers/es_client.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/helpers/es_client.ts
@@ -18,7 +18,7 @@ import { OBSERVER_VERSION_MAJOR } from '../../../common/elasticsearch_fieldnames
 import {
   ESSearchResponse,
   ESSearchRequest
-} from '../../../typings/elasticsearch';
+} from '../../../../../../plugins/apm/typings/elasticsearch';
 import { APMRequestHandlerContext } from '../../routes/typings';
 import { pickKeys } from '../../../public/utils/pickKeys';
 import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
diff --git a/x-pack/legacy/plugins/apm/server/lib/helpers/setup_request.ts b/x-pack/legacy/plugins/apm/server/lib/helpers/setup_request.ts
index 56c9255844009..f8946997e6e18 100644
--- a/x-pack/legacy/plugins/apm/server/lib/helpers/setup_request.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/helpers/setup_request.ts
@@ -12,7 +12,7 @@ import {
   getApmIndices,
   ApmIndicesConfig
 } from '../settings/apm_indices/get_apm_indices';
-import { ESFilter } from '../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../plugins/apm/typings/elasticsearch';
 import { ESClient } from './es_client';
 import { getUiFiltersES } from './convert_ui_filters/get_ui_filters_es';
 import { APMRequestHandlerContext } from '../../routes/typings';
diff --git a/x-pack/legacy/plugins/apm/server/lib/metrics/fetch_and_transform_metrics.ts b/x-pack/legacy/plugins/apm/server/lib/metrics/fetch_and_transform_metrics.ts
index 76460bb40bedb..410d659a924fd 100644
--- a/x-pack/legacy/plugins/apm/server/lib/metrics/fetch_and_transform_metrics.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/metrics/fetch_and_transform_metrics.ts
@@ -15,7 +15,7 @@ import { ChartBase } from './types';
 import { transformDataToMetricsChart } from './transform_metrics_chart';
 import { getMetricsProjection } from '../../../common/projections/metrics';
 import { mergeProjection } from '../../../common/projections/util/merge_projection';
-import { AggregationOptionsByType } from '../../../typings/elasticsearch/aggregations';
+import { AggregationOptionsByType } from '../../../../../../plugins/apm/typings/elasticsearch/aggregations';
 
 interface Aggs {
   [key: string]: Unionize<{
diff --git a/x-pack/legacy/plugins/apm/server/lib/metrics/transform_metrics_chart.ts b/x-pack/legacy/plugins/apm/server/lib/metrics/transform_metrics_chart.ts
index 03f21e4f26e7b..8e7c969eec96a 100644
--- a/x-pack/legacy/plugins/apm/server/lib/metrics/transform_metrics_chart.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/metrics/transform_metrics_chart.ts
@@ -9,8 +9,8 @@ import { ChartBase } from './types';
 import {
   ESSearchResponse,
   ESSearchRequest
-} from '../../../typings/elasticsearch';
-import { AggregationOptionsByType } from '../../../typings/elasticsearch/aggregations';
+} from '../../../../../../plugins/apm/typings/elasticsearch';
+import { AggregationOptionsByType } from '../../../../../../plugins/apm/typings/elasticsearch/aggregations';
 import { getVizColorForIndex } from '../../../common/viz_colors';
 
 export type GenericMetricsChart = ReturnType<
diff --git a/x-pack/legacy/plugins/apm/server/lib/security/getPermissions.ts b/x-pack/legacy/plugins/apm/server/lib/security/getPermissions.ts
new file mode 100644
index 0000000000000..ed2a1f64e7f84
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/server/lib/security/getPermissions.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Setup } from '../helpers/setup_request';
+
+export async function getPermissions(setup: Setup) {
+  const { client, indices } = setup;
+
+  const params = {
+    index: Object.values(indices),
+    body: {
+      size: 0,
+      query: {
+        match_all: {}
+      }
+    }
+  };
+
+  try {
+    await client.search(params);
+    return { hasPermission: true };
+  } catch (e) {
+    // If 403, it means the user doesnt have permission.
+    if (e.status === 403) {
+      return { hasPermission: false };
+    }
+    // if any other error happens, throw it.
+    throw e;
+  }
+}
diff --git a/x-pack/legacy/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts b/x-pack/legacy/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
index 6c4d540103cec..cff2d8570349e 100644
--- a/x-pack/legacy/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/service_map/get_service_map_service_node_info.ts
@@ -5,7 +5,7 @@
  */
 
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
-import { ESFilter } from '../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../plugins/apm/typings/elasticsearch';
 import { rangeFilter } from '../helpers/range_filter';
 import {
   PROCESSOR_EVENT,
diff --git a/x-pack/legacy/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts b/x-pack/legacy/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
index acf113b426608..bb5fcabb6c9d7 100644
--- a/x-pack/legacy/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
@@ -10,7 +10,7 @@ import {
   SetupTimeRange
 } from '../helpers/setup_request';
 import { rangeFilter } from '../helpers/range_filter';
-import { ESFilter } from '../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../plugins/apm/typings/elasticsearch';
 import {
   PROCESSOR_EVENT,
   SERVICE_NAME,
diff --git a/x-pack/legacy/plugins/apm/server/lib/services/annotations/index.ts b/x-pack/legacy/plugins/apm/server/lib/services/annotations/index.ts
index c03746ca220ee..9c8e4f2281b5e 100644
--- a/x-pack/legacy/plugins/apm/server/lib/services/annotations/index.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/services/annotations/index.ts
@@ -5,7 +5,7 @@
  */
 import { isNumber } from 'lodash';
 import { Annotation, AnnotationType } from '../../../../common/annotations';
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import {
   SERVICE_NAME,
   SERVICE_ENVIRONMENT,
diff --git a/x-pack/legacy/plugins/apm/server/lib/settings/agent_configuration/search.ts b/x-pack/legacy/plugins/apm/server/lib/settings/agent_configuration/search.ts
index 766baead006b6..3f4225eaf22d6 100644
--- a/x-pack/legacy/plugins/apm/server/lib/settings/agent_configuration/search.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/settings/agent_configuration/search.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { ESSearchHit } from '../../../../typings/elasticsearch';
+import { ESSearchHit } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import {
   SERVICE_NAME,
   SERVICE_ENVIRONMENT
diff --git a/x-pack/legacy/plugins/apm/server/lib/transaction_groups/fetcher.ts b/x-pack/legacy/plugins/apm/server/lib/transaction_groups/fetcher.ts
index a4885f2884976..18c61df0cfa7e 100644
--- a/x-pack/legacy/plugins/apm/server/lib/transaction_groups/fetcher.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/transaction_groups/fetcher.ts
@@ -13,7 +13,7 @@ import {
 import { getTransactionGroupsProjection } from '../../../common/projections/transaction_groups';
 import { mergeProjection } from '../../../common/projections/util/merge_projection';
 import { PromiseReturnType } from '../../../typings/common';
-import { SortOptions } from '../../../typings/elasticsearch/aggregations';
+import { SortOptions } from '../../../../../../plugins/apm/typings/elasticsearch/aggregations';
 import { Transaction } from '../../../typings/es_schemas/ui/Transaction';
 import {
   Setup,
diff --git a/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts b/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
index 3f0f8a84dc62f..9a9bfc31c21d4 100644
--- a/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/__fixtures__/responses.ts
@@ -7,7 +7,7 @@
 import {
   ESSearchResponse,
   ESSearchRequest
-} from '../../../../../typings/elasticsearch';
+} from '../../../../../../../../plugins/apm/typings/elasticsearch';
 
 export const response = ({
   hits: {
diff --git a/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts b/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
index 8a96a25aef50e..9b0d704dbb43e 100644
--- a/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../plugins/apm/typings/elasticsearch';
 import { PromiseReturnType } from '../../../../typings/common';
 import {
   PROCESSOR_EVENT,
diff --git a/x-pack/legacy/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts b/x-pack/legacy/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
index 8a2e01c9a7891..67b807da59b9b 100644
--- a/x-pack/legacy/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/transactions/charts/get_timeseries_data/fetcher.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESFilter } from '../../../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../../../plugins/apm/typings/elasticsearch';
 import {
   PROCESSOR_EVENT,
   SERVICE_NAME,
diff --git a/x-pack/legacy/plugins/apm/server/lib/ui_filters/get_environments.ts b/x-pack/legacy/plugins/apm/server/lib/ui_filters/get_environments.ts
index 50c1926d1e4a0..05985ee95a207 100644
--- a/x-pack/legacy/plugins/apm/server/lib/ui_filters/get_environments.ts
+++ b/x-pack/legacy/plugins/apm/server/lib/ui_filters/get_environments.ts
@@ -12,7 +12,7 @@ import {
 import { rangeFilter } from '../helpers/range_filter';
 import { Setup, SetupTimeRange } from '../helpers/setup_request';
 import { ENVIRONMENT_NOT_DEFINED } from '../../../common/environment_filter_values';
-import { ESFilter } from '../../../typings/elasticsearch';
+import { ESFilter } from '../../../../../../plugins/apm/typings/elasticsearch';
 
 export async function getEnvironments(
   setup: Setup & SetupTimeRange,
diff --git a/x-pack/legacy/plugins/apm/server/routes/create_apm_api.ts b/x-pack/legacy/plugins/apm/server/routes/create_apm_api.ts
index cf27d20c24360..3ac9629f59edf 100644
--- a/x-pack/legacy/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/legacy/plugins/apm/server/routes/create_apm_api.ts
@@ -59,6 +59,7 @@ import {
 } from './ui_filters';
 import { createApi } from './create_api';
 import { serviceMapRoute, serviceMapServiceNodeRoute } from './service_map';
+import { permissionsRoute } from './security';
 
 const createApmApi = () => {
   const api = createApi()
@@ -124,7 +125,10 @@ const createApmApi = () => {
 
     // Service map
     .add(serviceMapRoute)
-    .add(serviceMapServiceNodeRoute);
+    .add(serviceMapServiceNodeRoute)
+
+    // security
+    .add(permissionsRoute);
 
   return api;
 };
diff --git a/x-pack/legacy/plugins/apm/server/routes/security.ts b/x-pack/legacy/plugins/apm/server/routes/security.ts
new file mode 100644
index 0000000000000..5f803fb438e31
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/server/routes/security.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createRoute } from './create_route';
+import { setupRequest } from '../lib/helpers/setup_request';
+import { getPermissions } from '../lib/security/getPermissions';
+
+export const permissionsRoute = createRoute(() => ({
+  path: '/api/apm/security/permissions',
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    return getPermissions(setup);
+  }
+}));
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx b/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
index 8642ebd901bb4..549e69e57e921 100644
--- a/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable/embeddable.tsx
@@ -17,10 +17,7 @@ import {
 import { start } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public/legacy';
 import { EmbeddableExpression } from '../../expression_types/embeddable';
 import { RendererStrings } from '../../../i18n';
-import {
-  SavedObjectFinderProps,
-  SavedObjectFinderUi,
-} from '../../../../../../../src/plugins/kibana_react/public';
+import { getSavedObjectFinder } from '../../../../../../../src/plugins/saved_objects/public';
 
 const { embeddable: strings } = RendererStrings;
 import { embeddableInputToExpression } from './embeddable_input_to_expression';
@@ -32,13 +29,6 @@ const embeddablesRegistry: {
 } = {};
 
 const renderEmbeddable = (embeddableObject: IEmbeddable, domNode: HTMLElement) => {
-  const SavedObjectFinder = (props: SavedObjectFinderProps) => (
-    <SavedObjectFinderUi
-      {...props}
-      savedObjects={npStart.core.savedObjects}
-      uiSettings={npStart.core.uiSettings}
-    />
-  );
   return (
     <div
       className="embeddable"
@@ -53,7 +43,10 @@ const renderEmbeddable = (embeddableObject: IEmbeddable, domNode: HTMLElement) =
           notifications={npStart.core.notifications}
           overlays={npStart.core.overlays}
           inspector={npStart.plugins.inspector}
-          SavedObjectFinder={SavedObjectFinder}
+          SavedObjectFinder={getSavedObjectFinder(
+            npStart.core.savedObjects,
+            npStart.core.uiSettings
+          )}
         />
       </I18nContext>
     </div>
@@ -70,7 +63,9 @@ const embeddable = () => ({
     { input, embeddableType }: EmbeddableExpression<EmbeddableInput>,
     handlers: RendererHandlers
   ) => {
-    if (!embeddablesRegistry[input.id]) {
+    const uniqueId = handlers.getElementId();
+
+    if (!embeddablesRegistry[uniqueId]) {
       const factory = Array.from(start.getEmbeddableFactories()).find(
         embeddableFactory => embeddableFactory.type === embeddableType
       ) as EmbeddableFactory<EmbeddableInput>;
@@ -82,7 +77,7 @@ const embeddable = () => ({
 
       const embeddableObject = await factory.createFromSavedObject(input.id, input);
 
-      embeddablesRegistry[input.id] = embeddableObject;
+      embeddablesRegistry[uniqueId] = embeddableObject;
       ReactDOM.unmountComponentAtNode(domNode);
 
       const subscription = embeddableObject.getInput$().subscribe(function(updatedInput) {
@@ -100,12 +95,12 @@ const embeddable = () => ({
         subscription.unsubscribe();
         handlers.onEmbeddableDestroyed();
 
-        delete embeddablesRegistry[input.id];
+        delete embeddablesRegistry[uniqueId];
 
         return ReactDOM.unmountComponentAtNode(domNode);
       });
     } else {
-      embeddablesRegistry[input.id].updateInput(input);
+      embeddablesRegistry[uniqueId].updateInput(input);
     }
   },
 });
diff --git a/x-pack/legacy/plugins/canvas/public/components/element_content/element_content.js b/x-pack/legacy/plugins/canvas/public/components/element_content/element_content.js
index 1926fb4aaa5eb..114a457d167e7 100644
--- a/x-pack/legacy/plugins/canvas/public/components/element_content/element_content.js
+++ b/x-pack/legacy/plugins/canvas/public/components/element_content/element_content.js
@@ -54,6 +54,7 @@ export const ElementContent = compose(
     onComplete,
     onEmbeddableInputChange,
     onEmbeddableDestroyed,
+    getElementId,
   } = handlers;
 
   return Style.it(
@@ -76,7 +77,14 @@ export const ElementContent = compose(
           config={renderable.value}
           css={renderable.css} // This is an actual CSS stylesheet string, it will be scoped by RenderElement
           size={size} // Size is only passed for the purpose of triggering the resize event, it isn't really used otherwise
-          handlers={{ getFilter, setFilter, done, onEmbeddableInputChange, onEmbeddableDestroyed }}
+          handlers={{
+            getFilter,
+            setFilter,
+            done,
+            onEmbeddableInputChange,
+            onEmbeddableDestroyed,
+            getElementId,
+          }}
         />
       </ElementShareContainer>
     </div>
diff --git a/x-pack/legacy/plugins/canvas/public/components/element_wrapper/index.js b/x-pack/legacy/plugins/canvas/public/components/element_wrapper/index.js
index 60c7e731691fa..85882377b7684 100644
--- a/x-pack/legacy/plugins/canvas/public/components/element_wrapper/index.js
+++ b/x-pack/legacy/plugins/canvas/public/components/element_wrapper/index.js
@@ -58,12 +58,10 @@ function selectorFactory(dispatch) {
 export const ElementWrapper = compose(
   connectAdvanced(selectorFactory),
   withPropsOnChange(
-    (props, nextProps) =>
-      !isEqual(props.element, nextProps.element) ||
-      !isEqual(props.selectedPage, nextProps.selectedPage),
+    (props, nextProps) => !isEqual(props.element, nextProps.element),
     props => {
       const { element, createHandlers } = props;
-      const handlers = createHandlers(element, props.selectedPage);
+      const handlers = createHandlers(element);
       // this removes element and createHandlers from passed props
       return { handlers };
     }
diff --git a/x-pack/legacy/plugins/canvas/public/components/element_wrapper/lib/handlers.js b/x-pack/legacy/plugins/canvas/public/components/element_wrapper/lib/handlers.js
index e93cea597901f..8ea90974e2c53 100644
--- a/x-pack/legacy/plugins/canvas/public/components/element_wrapper/lib/handlers.js
+++ b/x-pack/legacy/plugins/canvas/public/components/element_wrapper/lib/handlers.js
@@ -16,7 +16,7 @@ export const createHandlers = dispatch => {
   let oldElement;
   let completeFn = () => {};
 
-  return (element, pageId) => {
+  return element => {
     // reset isComplete when element changes
     if (!isEqual(oldElement, element)) {
       isComplete = false;
@@ -25,7 +25,7 @@ export const createHandlers = dispatch => {
 
     return {
       setFilter(text) {
-        dispatch(setFilter(text, element.id, pageId, true));
+        dispatch(setFilter(text, element.id, true));
       },
 
       getFilter() {
@@ -36,6 +36,8 @@ export const createHandlers = dispatch => {
         completeFn = fn;
       },
 
+      getElementId: () => element.id,
+
       onEmbeddableInputChange(embeddableExpression) {
         dispatch(updateEmbeddableExpression({ elementId: element.id, embeddableExpression }));
       },
diff --git a/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx b/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
index 786403f2748fa..576c7c4794b08 100644
--- a/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
+++ b/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
@@ -10,7 +10,7 @@ import { EuiFlyout, EuiFlyoutHeader, EuiFlyoutBody, EuiTitle } from '@elastic/eu
 import {
   SavedObjectFinderUi,
   SavedObjectMetaData,
-} from '../../../../../../../src/plugins/kibana_react/public/saved_objects'; // eslint-disable-line
+} from '../../../../../../../src/plugins/saved_objects/public/';
 import { start } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public/legacy';
 import { ComponentStrings } from '../../../i18n';
 import { CoreStart } from '../../../../../../../src/core/public';
diff --git a/x-pack/legacy/plugins/canvas/public/legacy.ts b/x-pack/legacy/plugins/canvas/public/legacy.ts
index 254fba0f23ad2..cbd2aa54627ee 100644
--- a/x-pack/legacy/plugins/canvas/public/legacy.ts
+++ b/x-pack/legacy/plugins/canvas/public/legacy.ts
@@ -12,7 +12,7 @@ import chrome, { loadingCount } from 'ui/chrome'; // eslint-disable-line import/
 import { absoluteToParsedUrl } from 'ui/url/absolute_to_parsed_url'; // eslint-disable-line import/order
 import { Storage } from '../../../../../src/plugins/kibana_utils/public'; // eslint-disable-line import/order
 // @ts-ignore Untyped Kibana Lib
-import { formatMsg } from 'ui/notify/lib/format_msg'; // eslint-disable-line import/order
+import { formatMsg } from '../../../../../src/plugins/kibana_legacy/public'; // eslint-disable-line import/order
 // @ts-ignore Untyped Kibana Lib
 import { QueryString } from 'ui/utils/query_string'; // eslint-disable-line import/order
 
diff --git a/x-pack/legacy/plugins/canvas/public/state/actions/elements.js b/x-pack/legacy/plugins/canvas/public/state/actions/elements.js
index 7b7e87b027af5..8b49d16e87b21 100644
--- a/x-pack/legacy/plugins/canvas/public/state/actions/elements.js
+++ b/x-pack/legacy/plugins/canvas/public/state/actions/elements.js
@@ -254,9 +254,9 @@ export const removeElements = createThunk(
 
 export const setFilter = createThunk(
   'setFilter',
-  ({ dispatch }, filter, elementId, pageId, doRender = true) => {
+  ({ dispatch }, filter, elementId, doRender = true) => {
     const _setFilter = createAction('setFilter');
-    dispatch(_setFilter({ filter, elementId, pageId }));
+    dispatch(_setFilter({ filter, elementId }));
 
     if (doRender === true) {
       dispatch(fetchAllRenderables());
diff --git a/x-pack/legacy/plugins/canvas/public/state/reducers/elements.js b/x-pack/legacy/plugins/canvas/public/state/reducers/elements.js
index c7e8a5c2ff2d8..630694a860aad 100644
--- a/x-pack/legacy/plugins/canvas/public/state/reducers/elements.js
+++ b/x-pack/legacy/plugins/canvas/public/state/reducers/elements.js
@@ -87,6 +87,18 @@ const trimElement = ({ id, position, expression, filter }) => ({
   ...(filter !== void 0 && { filter }),
 });
 
+const getPageWithElementId = (workpad, elementId) => {
+  const matchingPage = workpad.pages.find(page =>
+    page.elements.map(element => element.id).includes(elementId)
+  );
+
+  if (matchingPage) {
+    return matchingPage.id;
+  }
+
+  return undefined;
+};
+
 export const elementsReducer = handleActions(
   {
     // TODO: This takes the entire element, which is not necessary, it could just take the id.
@@ -95,7 +107,8 @@ export const elementsReducer = handleActions(
       return assignNodeProperties(workpadState, pageId, elementId, { expression });
     },
     [actions.setFilter]: (workpadState, { payload }) => {
-      const { filter, pageId, elementId } = payload;
+      const { filter, elementId } = payload;
+      const pageId = getPageWithElementId(workpadState, elementId);
       return assignNodeProperties(workpadState, pageId, elementId, { filter });
     },
     [actions.setMultiplePositions]: (workpadState, { payload }) =>
diff --git a/x-pack/legacy/plugins/canvas/shareable_runtime/components/rendered_element.tsx b/x-pack/legacy/plugins/canvas/shareable_runtime/components/rendered_element.tsx
index 317a3417841b8..c4a009db3a376 100644
--- a/x-pack/legacy/plugins/canvas/shareable_runtime/components/rendered_element.tsx
+++ b/x-pack/legacy/plugins/canvas/shareable_runtime/components/rendered_element.tsx
@@ -67,6 +67,7 @@ export class RenderedElementComponent extends PureComponent<Props> {
         done: () => {},
         onDestroy: () => {},
         onResize: () => {},
+        getElementId: () => '',
         setFilter: () => {},
         getFilter: () => '',
         onEmbeddableInputChange: () => {},
diff --git a/x-pack/legacy/plugins/canvas/types/renderers.ts b/x-pack/legacy/plugins/canvas/types/renderers.ts
index af1710e69c257..2564b045d1cf7 100644
--- a/x-pack/legacy/plugins/canvas/types/renderers.ts
+++ b/x-pack/legacy/plugins/canvas/types/renderers.ts
@@ -9,6 +9,8 @@ type GenericCallback = (callback: () => void) => void;
 export interface RendererHandlers {
   /** Handler to invoke when an element has finished rendering */
   done: () => void;
+  /** Get the id of the element being rendered.  Can be used as a unique ID in a render function */
+  getElementId: () => string;
   /** Handler to invoke when an element is deleted or changes to a different render type */
   onDestroy: GenericCallback;
   /** Handler to invoke when an element's dimensions have changed*/
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/auto_follow_pattern_list.test.js b/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/auto_follow_pattern_list.test.js
index dbb4a51bbb73e..1003569733d91 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/auto_follow_pattern_list.test.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/auto_follow_pattern_list.test.js
@@ -4,13 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  setupEnvironment,
-  pageHelpers,
-  nextTick,
-  findTestSubject,
-  getRandomString,
-} from './helpers';
+import { setupEnvironment, pageHelpers, nextTick, getRandomString } from './helpers';
 
 import { getAutoFollowPatternClientMock } from '../../fixtures/auto_follow_pattern';
 
@@ -136,6 +130,7 @@ describe('<AutoFollowPatternList />', () => {
         [
           '', // Empty because the first column is the checkbox to select row
           autoFollowPattern1.name,
+          ' Paused', // Default paused
           autoFollowPattern1.remoteCluster,
           autoFollowPattern1.leaderIndexPatterns.join(', '),
           testPrefix,
@@ -145,6 +140,7 @@ describe('<AutoFollowPatternList />', () => {
         [
           '',
           autoFollowPattern2.name,
+          ' Paused', // Default paused
           autoFollowPattern2.remoteCluster,
           autoFollowPattern2.leaderIndexPatterns.join(', '),
           '', // no prefix
@@ -154,21 +150,21 @@ describe('<AutoFollowPatternList />', () => {
       ]);
     });
 
-    describe('bulk delete button', () => {
+    describe('manage patterns context menu button', () => {
       test('should be visible when an auto-follow pattern is selected', () => {
-        expect(exists('bulkDeleteButton')).toBe(false);
+        expect(exists('autoFollowPatternActionMenuButton')).toBe(false);
 
         actions.selectAutoFollowPatternAt(0);
 
-        expect(exists('bulkDeleteButton')).toBe(true);
+        expect(exists('autoFollowPatternActionMenuButton')).toBe(true);
       });
 
       test('should update the button label according to the number of patterns selected', () => {
         actions.selectAutoFollowPatternAt(0); // 1 auto-follow pattern selected
-        expect(find('bulkDeleteButton').text()).toEqual('Delete auto-follow pattern');
+        expect(find('autoFollowPatternActionMenuButton').text()).toEqual('Manage pattern');
 
         actions.selectAutoFollowPatternAt(1); // 2 auto-follow patterns selected
-        expect(find('bulkDeleteButton').text()).toEqual('Delete auto-follow patterns');
+        expect(find('autoFollowPatternActionMenuButton').text()).toEqual('Manage patterns');
       });
 
       test('should open a confirmation modal when clicking the delete button', () => {
@@ -204,21 +200,26 @@ describe('<AutoFollowPatternList />', () => {
     });
 
     describe('table row actions', () => {
-      test('should have a "delete" and an "edit" action button on each row', () => {
+      test('should have a "pause", "delete" and "edit" action button on each row', () => {
         const indexLastColumn = rows[0].columns.length - 1;
         const tableCellActions = rows[0].columns[indexLastColumn].reactWrapper;
+        const contextMenuButton = tableCellActions.find('button');
+        contextMenuButton.simulate('click');
 
-        const deleteButton = findTestSubject(tableCellActions, 'deleteButton');
-        const editButton = findTestSubject(tableCellActions, 'editButton');
-
-        expect(deleteButton.length).toBe(1);
-        expect(editButton.length).toBe(1);
+        expect(exists('contextMenuDeleteButton')).toBe(true);
+        expect(exists('contextMenuEditButton')).toBe(true);
+        expect(exists('contextMenuResumeButton')).toBe(true);
       });
 
       test('should open a confirmation modal when clicking on "delete" button', async () => {
         expect(exists('deleteAutoFollowPatternConfirmation')).toBe(false);
 
-        actions.clickRowActionButtonAt(0, 'delete');
+        const indexLastColumn = rows[0].columns.length - 1;
+        const tableCellActions = rows[0].columns[indexLastColumn].reactWrapper;
+        const contextMenuButton = tableCellActions.find('button');
+        contextMenuButton.simulate('click');
+
+        find('contextMenuDeleteButton').simulate('click');
 
         expect(exists('deleteAutoFollowPatternConfirmation')).toBe(true);
       });
@@ -281,11 +282,13 @@ describe('<AutoFollowPatternList />', () => {
         );
       });
 
-      test('should have a "close", "delete" and "edit" button in the footer', () => {
+      test('should have a "close", "delete", "edit" and "resume" button in the footer', () => {
         actions.clickAutoFollowPatternAt(0);
+        find('autoFollowPatternActionMenuButton').simulate('click');
         expect(exists('autoFollowPatternDetail.closeFlyoutButton')).toBe(true);
-        expect(exists('autoFollowPatternDetail.deleteButton')).toBe(true);
-        expect(exists('autoFollowPatternDetail.editButton')).toBe(true);
+        expect(actions.getPatternsActionMenuItemText(0)).toEqual('Resume pattern');
+        expect(actions.getPatternsActionMenuItemText(1)).toEqual('Edit pattern');
+        expect(actions.getPatternsActionMenuItemText(2)).toEqual('Delete pattern');
       });
 
       test('should close the detail panel when clicking the "close" button', () => {
@@ -301,7 +304,7 @@ describe('<AutoFollowPatternList />', () => {
         actions.clickAutoFollowPatternAt(0);
         expect(exists('deleteAutoFollowPatternConfirmation')).toBe(false);
 
-        find('autoFollowPatternDetail.deleteButton').simulate('click');
+        actions.clickPatternsActionMenuItem(2);
 
         expect(exists('deleteAutoFollowPatternConfirmation')).toBe(true);
       });
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/helpers/auto_follow_pattern_list.helpers.js b/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/helpers/auto_follow_pattern_list.helpers.js
index 6150ac0ecd7ad..c0d29e8af2549 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/helpers/auto_follow_pattern_list.helpers.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/__jest__/client_integration/helpers/auto_follow_pattern_list.helpers.js
@@ -33,8 +33,22 @@ export const setup = props => {
     checkBox.simulate('change', { target: { checked: true } });
   };
 
+  const getPatternsActionMenuItem = (index = 0) => {
+    testBed.find('autoFollowPatternActionMenuButton').simulate('click');
+    const contextMenu = testBed.find('autoFollowPatternActionContextMenu');
+    return contextMenu.find('button').at(index);
+  };
+
+  const clickPatternsActionMenuItem = (index = 0) => {
+    getPatternsActionMenuItem(index).simulate('click');
+  };
+
+  const getPatternsActionMenuItemText = (index = 0) => {
+    return getPatternsActionMenuItem(index).text();
+  };
+
   const clickBulkDeleteButton = () => {
-    testBed.find('bulkDeleteButton').simulate('click');
+    clickPatternsActionMenuItem(1);
   };
 
   const clickConfirmModalDeleteAutoFollowPattern = () => {
@@ -78,6 +92,8 @@ export const setup = props => {
       clickConfirmModalDeleteAutoFollowPattern,
       clickRowActionButtonAt,
       clickAutoFollowPatternAt,
+      getPatternsActionMenuItemText,
+      clickPatternsActionMenuItem,
     },
   };
 };
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/common/services/auto_follow_pattern_serialization.js b/x-pack/legacy/plugins/cross_cluster_replication/common/services/auto_follow_pattern_serialization.js
index 36a2b79361c34..ae13c625a7d80 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/common/services/auto_follow_pattern_serialization.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/common/services/auto_follow_pattern_serialization.js
@@ -8,6 +8,7 @@ export const deserializeAutoFollowPattern = (
   {
     name,
     pattern: {
+      active,
       // eslint-disable-next-line camelcase
       remote_cluster,
       // eslint-disable-next-line camelcase
@@ -20,6 +21,7 @@ export const deserializeAutoFollowPattern = (
   }
 ) => ({
   name,
+  active,
   remoteCluster: remote_cluster,
   leaderIndexPatterns: leader_index_patterns,
   followIndexPattern: follow_index_pattern,
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.container.ts b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.container.ts
new file mode 100644
index 0000000000000..1d8c4bbea3121
--- /dev/null
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.container.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { connect } from 'react-redux';
+import {
+  AutoFollowPatternActionMenu as AutoFollowPatternActionMenuView,
+  Props,
+} from './auto_follow_pattern_action_menu';
+
+// @ts-ignore
+import { pauseAutoFollowPattern, resumeAutoFollowPattern } from '../../store/actions';
+
+const mapDispatchToProps = (dispatch: (action: any) => void) => {
+  return {
+    pauseAutoFollowPattern: (ids: string[]) => {
+      dispatch(pauseAutoFollowPattern(ids));
+    },
+    resumeAutoFollowPattern: (ids: string[]) => {
+      dispatch(resumeAutoFollowPattern(ids));
+    },
+  };
+};
+
+export const AutoFollowPatternActionMenu = connect<null, any, Pick<Props, 'patterns'>>(
+  null,
+  mapDispatchToProps
+)(AutoFollowPatternActionMenuView);
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.tsx b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.tsx
new file mode 100644
index 0000000000000..7c129eac9cbd9
--- /dev/null
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/auto_follow_pattern_action_menu.tsx
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent, useState } from 'react';
+import { EuiButton, EuiContextMenu, EuiPopover, EuiIcon } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { AutoFollowPatternDeleteProvider } from '../auto_follow_pattern_delete_provider';
+
+// @ts-ignore
+import routing from '../../services/routing';
+
+const actionsAriaLabel = i18n.translate(
+  'xpack.crossClusterReplication.autoFollowActionMenu.autoFollowPatternActionMenuButtonAriaLabel',
+  {
+    defaultMessage: 'Auto-follow pattern options',
+  }
+);
+
+export interface Props {
+  edit: boolean;
+  patterns: Array<{ name: string; active: boolean }>;
+  deleteAutoFollowPattern: (id: string[]) => void;
+  pauseAutoFollowPattern: (id: string[]) => void;
+  resumeAutoFollowPattern: (id: string[]) => void;
+  arrowDirection: 'up' | 'down';
+}
+
+const allValuesSame = (values: boolean[]) => {
+  if (!values.length) {
+    return false;
+  }
+  const [firstValue, ...restValues] = values;
+
+  for (const value of restValues) {
+    if (firstValue !== value) {
+      return false;
+    }
+  }
+
+  return true;
+};
+
+const AutoFollowPatternActionMenuUI: FunctionComponent<Props> = ({
+  patterns,
+  deleteAutoFollowPattern,
+  pauseAutoFollowPattern,
+  resumeAutoFollowPattern,
+  arrowDirection,
+  edit,
+}) => {
+  const [showPopover, setShowPopover] = useState(false);
+
+  const allActiveValuesSame = allValuesSame(patterns.filter(Boolean).map(({ active }) => active));
+
+  const closePopoverViaAction = () => {
+    setShowPopover(false);
+  };
+
+  const panelItems = [
+    /**
+     * Resume or pause pattern
+     */
+    allActiveValuesSame
+      ? patterns[0].active
+        ? {
+            name: i18n.translate('xpack.crossClusterReplication.pauseAutoFollowPatternsLabel', {
+              defaultMessage: 'Pause {total, plural, one {pattern} other {patterns}}',
+              values: { total: patterns.length },
+            }),
+            icon: <EuiIcon type="pause" />,
+            onClick: () => {
+              pauseAutoFollowPattern(patterns.map(({ name }) => name));
+              closePopoverViaAction();
+            },
+          }
+        : {
+            name: i18n.translate('xpack.crossClusterReplication.resumeAutoFollowPatternsLabel', {
+              defaultMessage: 'Resume {total, plural, one {pattern} other {patterns}}',
+              values: { total: patterns.length },
+            }),
+            icon: <EuiIcon type="play" />,
+            onClick: () => {
+              resumeAutoFollowPattern(patterns.map(({ name }) => name));
+              closePopoverViaAction();
+            },
+          }
+      : null,
+    /**
+     * Navigate to edit a pattern
+     */
+    edit && patterns.length === 1
+      ? {
+          name: i18n.translate('xpack.crossClusterReplication.editAutoFollowPatternButtonLabel', {
+            defaultMessage: 'Edit pattern',
+          }),
+          icon: <EuiIcon type="pencil" />,
+          onClick: () => {
+            window.location.hash = routing.getAutoFollowPatternPath(patterns[0].name);
+          },
+        }
+      : null,
+    /**
+     * Delete a pattern
+     */
+    {
+      name: i18n.translate('xpack.crossClusterReplication.deleteAutoFollowPatternButtonLabel', {
+        defaultMessage: 'Delete {total, plural, one {pattern} other {patterns}}',
+        values: {
+          total: patterns.length,
+        },
+      }),
+      icon: <EuiIcon type="trash" />,
+      onClick: () => {
+        deleteAutoFollowPattern(patterns.map(({ name }) => name));
+        closePopoverViaAction();
+      },
+    },
+  ].filter(Boolean);
+
+  const button = (
+    <EuiButton
+      data-test-subj="autoFollowPatternActionMenuButton"
+      aria-label={actionsAriaLabel}
+      onClick={() => setShowPopover(!showPopover)}
+      iconType={arrowDirection === 'up' ? 'arrowUp' : 'arrowDown'}
+      iconSide="right"
+      fill
+    >
+      {i18n.translate('xpack.crossClusterReplication.autoFollowPatternActionMenu.buttonLabel', {
+        defaultMessage: 'Manage {patterns, plural, one {pattern} other {patterns}}',
+        values: { patterns: patterns.length },
+      })}
+    </EuiButton>
+  );
+
+  return (
+    <EuiPopover
+      isOpen={showPopover}
+      closePopover={() => setShowPopover(false)}
+      button={button}
+      panelPaddingSize="none"
+      withTitle
+      repositionOnScroll
+    >
+      <EuiContextMenu
+        initialPanelId={0}
+        data-test-subj="autoFollowPatternActionContextMenu"
+        panels={[
+          {
+            id: 0,
+            title: i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPatternActionMenu.panelTitle',
+              {
+                defaultMessage: 'Pattern options',
+              }
+            ),
+            items: panelItems as any,
+          },
+        ]}
+      />
+    </EuiPopover>
+  );
+};
+
+export const AutoFollowPatternActionMenu = (props: Omit<Props, 'deleteAutoFollowPatterns'>) => (
+  <AutoFollowPatternDeleteProvider>
+    {(deleteAutoFollowPattern: (ids: string[]) => void) => (
+      <AutoFollowPatternActionMenuUI deleteAutoFollowPattern={deleteAutoFollowPattern} {...props} />
+    )}
+  </AutoFollowPatternDeleteProvider>
+);
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/index.ts b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/index.ts
new file mode 100644
index 0000000000000..6ef790cb5cf19
--- /dev/null
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_action_menu/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { AutoFollowPatternActionMenu } from './auto_follow_pattern_action_menu.container';
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/action_groups.ts b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_delete_provider.d.ts
similarity index 69%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/action_groups.ts
rename to x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_delete_provider.d.ts
index 83a03010d55ad..ffab0e708f050 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/action_groups.ts
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/auto_follow_pattern_delete_provider.d.ts
@@ -3,9 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { FunctionComponent } from 'react';
 
-export enum ACTION_GROUPS {
-  ALERT = 'alert',
-  WARNING = 'warning',
-  UNACKNOWLEDGED = 'unacknowledged',
-}
+declare const AutoFollowPatternDeleteProvider: FunctionComponent;
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/index.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/index.js
index 88abffed346f2..6d971bff03981 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/index.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/components/index.js
@@ -19,3 +19,4 @@ export { FollowerIndexForm } from './follower_index_form';
 export { FollowerIndexPageTitle } from './follower_index_page_title';
 export { FormEntryRow } from './form_entry_row';
 export { RemoteClustersFormField } from './remote_clusters_form_field';
+export { AutoFollowPatternActionMenu } from './auto_follow_pattern_action_menu';
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/constants/ui_metric.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/constants/ui_metric.js
index d5c9d4dc70cfc..3f44a3793d741 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/constants/ui_metric.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/constants/ui_metric.js
@@ -22,4 +22,8 @@ export const UIM_AUTO_FOLLOW_PATTERN_CREATE = 'auto_follow_pattern_create';
 export const UIM_AUTO_FOLLOW_PATTERN_UPDATE = 'auto_follow_pattern_update';
 export const UIM_AUTO_FOLLOW_PATTERN_DELETE = 'auto_follow_pattern_delete';
 export const UIM_AUTO_FOLLOW_PATTERN_DELETE_MANY = 'auto_follow_pattern_delete_many';
+export const UIM_AUTO_FOLLOW_PATTERN_PAUSE = 'auto_follow_pattern_pause';
+export const UIM_AUTO_FOLLOW_PATTERN_PAUSE_MANY = 'auto_follow_pattern_pause_many';
+export const UIM_AUTO_FOLLOW_PATTERN_RESUME = 'auto_follow_pattern_resume';
+export const UIM_AUTO_FOLLOW_PATTERN_RESUME_MANY = 'auto_follow_pattern_resume_many';
 export const UIM_AUTO_FOLLOW_PATTERN_SHOW_DETAILS_CLICK = 'auto_follow_pattern_show_details_click';
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/auto_follow_pattern_list.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/auto_follow_pattern_list.js
index 08b99795905bb..e9e14f57e814f 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/auto_follow_pattern_list.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/auto_follow_pattern_list.js
@@ -243,12 +243,12 @@ export class AutoFollowPatternList extends PureComponent {
     const { isDetailPanelOpen } = this.state;
 
     return (
-      <Fragment>
+      <>
         <AutoFollowPatternTable autoFollowPatterns={autoFollowPatterns} />
         {isDetailPanelOpen && (
           <DetailPanel closeDetailPanel={() => selectAutoFollowPattern(null)} />
         )}
-      </Fragment>
+      </>
     );
   }
 
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.container.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.container.js
index 5e0817ddcb390..d3a596c7422f2 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.container.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.container.js
@@ -7,7 +7,11 @@
 import { connect } from 'react-redux';
 
 import { SECTIONS } from '../../../../../constants';
-import { selectDetailAutoFollowPattern } from '../../../../../store/actions';
+import {
+  selectDetailAutoFollowPattern,
+  pauseAutoFollowPattern,
+  resumeAutoFollowPattern,
+} from '../../../../../store/actions';
 import { getApiStatus } from '../../../../../store/selectors';
 import { AutoFollowPatternTable as AutoFollowPatternTableComponent } from './auto_follow_pattern_table';
 
@@ -19,6 +23,8 @@ const mapStateToProps = state => ({
 
 const mapDispatchToProps = dispatch => ({
   selectAutoFollowPattern: name => dispatch(selectDetailAutoFollowPattern(name)),
+  pauseAutoFollowPattern: name => dispatch(pauseAutoFollowPattern(name)),
+  resumeAutoFollowPattern: name => dispatch(resumeAutoFollowPattern(name)),
 });
 
 export const AutoFollowPatternTable = connect(
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
index d1a1296b885b9..08b1770e39963 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/auto_follow_pattern_table/auto_follow_pattern_table.js
@@ -7,18 +7,19 @@
 import React, { PureComponent, Fragment } from 'react';
 import PropTypes from 'prop-types';
 import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
 import {
-  EuiButton,
-  EuiButtonIcon,
   EuiInMemoryTable,
   EuiLink,
   EuiLoadingKibana,
-  EuiToolTip,
   EuiOverlayMask,
+  EuiHealth,
+  EuiIcon,
 } from '@elastic/eui';
 import { API_STATUS, UIM_AUTO_FOLLOW_PATTERN_SHOW_DETAILS_CLICK } from '../../../../../constants';
-import { AutoFollowPatternDeleteProvider } from '../../../../../components';
+import {
+  AutoFollowPatternDeleteProvider,
+  AutoFollowPatternActionMenu,
+} from '../../../../../components';
 import routing from '../../../../../services/routing';
 import { trackUiMetric, METRIC_TYPE } from '../../../../../services/track_ui_metric';
 
@@ -26,6 +27,8 @@ export class AutoFollowPatternTable extends PureComponent {
   static propTypes = {
     autoFollowPatterns: PropTypes.array,
     selectAutoFollowPattern: PropTypes.func.isRequired,
+    pauseAutoFollowPattern: PropTypes.func.isRequired,
+    resumeAutoFollowPattern: PropTypes.func.isRequired,
   };
 
   state = {
@@ -93,6 +96,35 @@ export class AutoFollowPatternTable extends PureComponent {
           );
         },
       },
+      {
+        field: 'active',
+        dataType: 'boolean',
+        name: i18n.translate(
+          'xpack.crossClusterReplication.autoFollowPatternList.table.statusTitle',
+          {
+            defaultMessage: 'Status',
+          }
+        ),
+        render: active => {
+          const statusText = active
+            ? i18n.translate(
+                'xpack.crossClusterReplication.autoFollowPatternList.table.statusTextActive',
+                { defaultMessage: 'Active' }
+              )
+            : i18n.translate(
+                'xpack.crossClusterReplication.autoFollowPatternList.table.statusTextPaused',
+                { defaultMessage: 'Paused' }
+              );
+
+          return (
+            <>
+              <EuiHealth color={active ? 'success' : 'subdued'} />
+              &nbsp;{statusText}
+            </>
+          );
+        },
+        sortable: true,
+      },
       {
         field: 'remoteCluster',
         name: i18n.translate(
@@ -142,6 +174,46 @@ export class AutoFollowPatternTable extends PureComponent {
           }
         ),
         actions: [
+          {
+            render: ({ name, active }) => {
+              const label = active
+                ? i18n.translate(
+                    'xpack.crossClusterReplication.autoFollowPatternList.table.actionPauseDescription',
+                    {
+                      defaultMessage: 'Pause auto-follow pattern',
+                    }
+                  )
+                : i18n.translate(
+                    'xpack.crossClusterReplication.autoFollowPatternList.table.actionResumeDescription',
+                    {
+                      defaultMessage: 'Resume auto-follow pattern',
+                    }
+                  );
+
+              return (
+                <span
+                  onClick={event => {
+                    if (event.stopPropagation) {
+                      event.stopPropagation();
+                    }
+                    if (active) {
+                      this.props.pauseAutoFollowPattern(name);
+                    } else {
+                      this.props.resumeAutoFollowPattern(name);
+                    }
+                  }}
+                  data-test-subj={active ? 'contextMenuPauseButton' : 'contextMenuResumeButton'}
+                >
+                  <EuiIcon
+                    aria-label={label}
+                    type={active ? 'pause' : 'play'}
+                    className="euiContextMenu__icon"
+                  />
+                  <span>{label}</span>
+                </span>
+              );
+            },
+          },
           {
             render: ({ name }) => {
               const label = i18n.translate(
@@ -152,15 +224,13 @@ export class AutoFollowPatternTable extends PureComponent {
               );
 
               return (
-                <EuiToolTip content={label} delay="long">
-                  <EuiButtonIcon
-                    aria-label={label}
-                    iconType="pencil"
-                    color="primary"
-                    href={routing.getAutoFollowPatternPath(name)}
-                    data-test-subj="editButton"
-                  />
-                </EuiToolTip>
+                <span
+                  onClick={() => (window.location.hash = routing.getAutoFollowPatternPath(name))}
+                  data-test-subj="contextMenuEditButton"
+                >
+                  <EuiIcon aria-label={label} type="pencil" className="euiContextMenu__icon" />
+                  <span>{label}</span>
+                </span>
               );
             },
           },
@@ -174,19 +244,17 @@ export class AutoFollowPatternTable extends PureComponent {
               );
 
               return (
-                <EuiToolTip content={label} delay="long">
-                  <AutoFollowPatternDeleteProvider>
-                    {deleteAutoFollowPattern => (
-                      <EuiButtonIcon
-                        aria-label={label}
-                        iconType="trash"
-                        color="danger"
-                        onClick={() => deleteAutoFollowPattern(name)}
-                        data-test-subj="deleteButton"
-                      />
-                    )}
-                  </AutoFollowPatternDeleteProvider>
-                </EuiToolTip>
+                <AutoFollowPatternDeleteProvider>
+                  {deleteAutoFollowPattern => (
+                    <span
+                      onClick={() => deleteAutoFollowPattern(name)}
+                      data-test-subj="contextMenuDeleteButton"
+                    >
+                      <EuiIcon aria-label={label} type="trash" className="euiContextMenu__icon" />
+                      <span>{label}</span>
+                    </span>
+                  )}
+                </AutoFollowPatternDeleteProvider>
               );
             },
           },
@@ -225,29 +293,18 @@ export class AutoFollowPatternTable extends PureComponent {
     };
 
     const selection = {
-      onSelectionChange: selectedItems => this.setState({ selectedItems }),
+      onSelectionChange: selectedItems =>
+        this.setState({ selectedItems: selectedItems.map(({ name }) => name) }),
     };
 
+    const items = this.getFilteredPatterns();
+
     const search = {
       toolsLeft: selectedItems.length ? (
-        <AutoFollowPatternDeleteProvider>
-          {deleteAutoFollowPattern => (
-            <EuiButton
-              iconType="trash"
-              color="danger"
-              onClick={() => deleteAutoFollowPattern(selectedItems.map(({ name }) => name))}
-              data-test-subj="bulkDeleteButton"
-            >
-              <FormattedMessage
-                id="xpack.crossClusterReplication.deleteAutoFollowPatternButtonLabel"
-                defaultMessage="Delete auto-follow {total, plural, one {pattern} other {patterns}}"
-                values={{
-                  total: selectedItems.length,
-                }}
-              />
-            </EuiButton>
-          )}
-        </AutoFollowPatternDeleteProvider>
+        <AutoFollowPatternActionMenu
+          arrowDirection="down"
+          patterns={this.state.selectedItems.map(name => items.find(item => item.name === name))}
+        />
       ) : (
         undefined
       ),
@@ -260,7 +317,7 @@ export class AutoFollowPatternTable extends PureComponent {
     return (
       <Fragment>
         <EuiInMemoryTable
-          items={this.getFilteredPatterns()}
+          items={items}
           itemId="name"
           columns={this.getTableColumns()}
           search={search}
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/detail_panel/detail_panel.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/detail_panel/detail_panel.js
index 70bbfd7296476..cd107be408727 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/detail_panel/detail_panel.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/auto_follow_pattern_list/components/detail_panel/detail_panel.js
@@ -10,7 +10,6 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { getIndexListUri } from '../../../../../../../../index_management/public/app/services/navigation';
 
 import {
-  EuiButton,
   EuiButtonEmpty,
   EuiDescriptionList,
   EuiDescriptionListDescription,
@@ -21,6 +20,7 @@ import {
   EuiFlyoutBody,
   EuiFlyoutFooter,
   EuiFlyoutHeader,
+  EuiHealth,
   EuiIcon,
   EuiLink,
   EuiSpacer,
@@ -31,11 +31,9 @@ import {
 
 import {
   AutoFollowPatternIndicesPreview,
-  AutoFollowPatternDeleteProvider,
+  AutoFollowPatternActionMenu,
 } from '../../../../../components';
 
-import routing from '../../../../../services/routing';
-
 export class DetailPanel extends Component {
   static propTypes = {
     apiStatus: PropTypes.string,
@@ -49,105 +47,140 @@ export class DetailPanel extends Component {
     followIndexPatternSuffix,
     remoteCluster,
     leaderIndexPatterns,
+    active,
   }) {
     return (
-      <section
-        aria-labelledby="ccrAutoFollowPatternDetailSettingsTitle"
-        data-test-subj="settingsSection"
-      >
-        <EuiTitle size="s">
-          <h3 id="ccrAutoFollowPatternDetailSettingsTitle">
-            <FormattedMessage
-              id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.statusTitle"
-              defaultMessage="Settings"
-            />
-          </h3>
-        </EuiTitle>
-
-        <EuiSpacer size="s" />
+      <>
+        <section>
+          <EuiDescriptionList>
+            <EuiDescriptionListTitle>
+              <EuiTitle size="xs">
+                <FormattedMessage
+                  id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.statusLabel"
+                  defaultMessage="Status"
+                />
+              </EuiTitle>
+            </EuiDescriptionListTitle>
 
-        <EuiDescriptionList data-test-subj="settingsValues">
-          <EuiFlexGroup>
-            <EuiFlexItem>
-              <EuiDescriptionListTitle>
-                <EuiTitle size="xs">
+            <EuiDescriptionListDescription data-test-subj="status">
+              {!active ? (
+                <EuiHealth color="subdued">
                   <FormattedMessage
-                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.remoteClusterLabel"
-                    defaultMessage="Remote cluster"
+                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.pausedStatus"
+                    defaultMessage="Paused"
                   />
-                </EuiTitle>
-              </EuiDescriptionListTitle>
-
-              <EuiDescriptionListDescription data-test-subj="remoteCluster">
-                {remoteCluster}
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
-
-            <EuiFlexItem>
-              <EuiDescriptionListTitle>
-                <EuiTitle size="xs">
+                </EuiHealth>
+              ) : (
+                <EuiHealth color="success">
                   <FormattedMessage
-                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.leaderPatternsLabel"
-                    defaultMessage="Leader patterns"
+                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.activeStatus"
+                    defaultMessage="Active"
                   />
-                </EuiTitle>
-              </EuiDescriptionListTitle>
+                </EuiHealth>
+              )}
+            </EuiDescriptionListDescription>
+          </EuiDescriptionList>
+        </section>
 
-              <EuiDescriptionListDescription data-test-subj="leaderIndexPatterns">
-                {leaderIndexPatterns.join(', ')}
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
-          </EuiFlexGroup>
+        <EuiSpacer size="s" />
+        <section
+          aria-labelledby="ccrAutoFollowPatternDetailSettingsTitle"
+          data-test-subj="settingsSection"
+        >
+          <EuiTitle size="s">
+            <h3 id="ccrAutoFollowPatternDetailSettingsTitle">
+              <FormattedMessage
+                id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.statusTitle"
+                defaultMessage="Settings"
+              />
+            </h3>
+          </EuiTitle>
 
           <EuiSpacer size="s" />
 
-          <EuiFlexGroup>
-            <EuiFlexItem>
-              <EuiDescriptionListTitle>
-                <EuiTitle size="xs">
-                  <FormattedMessage
-                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixLabel"
-                    defaultMessage="Prefix"
-                  />
-                </EuiTitle>
-              </EuiDescriptionListTitle>
+          <EuiDescriptionList data-test-subj="settingsValues">
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiDescriptionListTitle>
+                  <EuiTitle size="xs">
+                    <FormattedMessage
+                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.remoteClusterLabel"
+                      defaultMessage="Remote cluster"
+                    />
+                  </EuiTitle>
+                </EuiDescriptionListTitle>
+
+                <EuiDescriptionListDescription data-test-subj="remoteCluster">
+                  {remoteCluster}
+                </EuiDescriptionListDescription>
+              </EuiFlexItem>
 
-              <EuiDescriptionListDescription data-test-subj="patternPrefix">
-                {followIndexPatternPrefix || (
-                  <em>
+              <EuiFlexItem>
+                <EuiDescriptionListTitle>
+                  <EuiTitle size="xs">
                     <FormattedMessage
-                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixEmptyValue"
-                      defaultMessage="No prefix"
+                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.leaderPatternsLabel"
+                      defaultMessage="Leader patterns"
                     />
-                  </em>
-                )}
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
+                  </EuiTitle>
+                </EuiDescriptionListTitle>
 
-            <EuiFlexItem>
-              <EuiDescriptionListTitle>
-                <EuiTitle size="xs">
-                  <FormattedMessage
-                    id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.suffixLabel"
-                    defaultMessage="Suffix"
-                  />
-                </EuiTitle>
-              </EuiDescriptionListTitle>
+                <EuiDescriptionListDescription data-test-subj="leaderIndexPatterns">
+                  {leaderIndexPatterns.join(', ')}
+                </EuiDescriptionListDescription>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+
+            <EuiSpacer size="s" />
 
-              <EuiDescriptionListDescription data-test-subj="patternSuffix">
-                {followIndexPatternSuffix || (
-                  <em>
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiDescriptionListTitle>
+                  <EuiTitle size="xs">
                     <FormattedMessage
-                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.suffixEmptyValue"
-                      defaultMessage="No suffix"
+                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixLabel"
+                      defaultMessage="Prefix"
                     />
-                  </em>
-                )}
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiDescriptionList>
-      </section>
+                  </EuiTitle>
+                </EuiDescriptionListTitle>
+
+                <EuiDescriptionListDescription data-test-subj="patternPrefix">
+                  {followIndexPatternPrefix || (
+                    <em>
+                      <FormattedMessage
+                        id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixEmptyValue"
+                        defaultMessage="No prefix"
+                      />
+                    </em>
+                  )}
+                </EuiDescriptionListDescription>
+              </EuiFlexItem>
+
+              <EuiFlexItem>
+                <EuiDescriptionListTitle>
+                  <EuiTitle size="xs">
+                    <FormattedMessage
+                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.suffixLabel"
+                      defaultMessage="Suffix"
+                    />
+                  </EuiTitle>
+                </EuiDescriptionListTitle>
+
+                <EuiDescriptionListDescription data-test-subj="patternSuffix">
+                  {followIndexPatternSuffix || (
+                    <em>
+                      <FormattedMessage
+                        id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.suffixEmptyValue"
+                        defaultMessage="No suffix"
+                      />
+                    </em>
+                  )}
+                </EuiDescriptionListDescription>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiDescriptionList>
+        </section>
+      </>
     );
   }
 
@@ -298,34 +331,11 @@ export class DetailPanel extends Component {
             <EuiFlexItem grow={false}>
               <EuiFlexGroup alignItems="center">
                 <EuiFlexItem grow={false}>
-                  <AutoFollowPatternDeleteProvider>
-                    {deleteAutoFollowPattern => (
-                      <EuiButtonEmpty
-                        color="danger"
-                        onClick={() => deleteAutoFollowPattern(autoFollowPattern.name)}
-                        data-test-subj="deleteButton"
-                      >
-                        <FormattedMessage
-                          id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.deleteButtonLabel"
-                          defaultMessage="Delete"
-                        />
-                      </EuiButtonEmpty>
-                    )}
-                  </AutoFollowPatternDeleteProvider>
-                </EuiFlexItem>
-
-                <EuiFlexItem grow={false}>
-                  <EuiButton
-                    fill
-                    color="primary"
-                    href={routing.getAutoFollowPatternPath(autoFollowPattern.name)}
-                    data-test-subj="editButton"
-                  >
-                    <FormattedMessage
-                      id="xpack.crossClusterReplication.autoFollowPatternDetailPanel.editButtonLabel"
-                      defaultMessage="Edit"
-                    />
-                  </EuiButton>
+                  <AutoFollowPatternActionMenu
+                    edit
+                    arrowDirection="up"
+                    patterns={[autoFollowPattern]}
+                  />
                 </EuiFlexItem>
               </EuiFlexGroup>
             </EuiFlexItem>
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
index 95f89095315bb..60feac5ec8c6e 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/sections/home/follower_indices_list/components/follower_indices_table/follower_indices_table.js
@@ -9,8 +9,8 @@ import PropTypes from 'prop-types';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
-  EuiHealth,
   EuiIcon,
+  EuiHealth,
   EuiInMemoryTable,
   EuiLink,
   EuiLoadingKibana,
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/services/api.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/services/api.js
index b4a4d9172bc25..52576387444fd 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/services/api.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/services/api.js
@@ -25,6 +25,10 @@ import {
   UIM_AUTO_FOLLOW_PATTERN_UPDATE,
   UIM_AUTO_FOLLOW_PATTERN_DELETE,
   UIM_AUTO_FOLLOW_PATTERN_DELETE_MANY,
+  UIM_AUTO_FOLLOW_PATTERN_PAUSE,
+  UIM_AUTO_FOLLOW_PATTERN_PAUSE_MANY,
+  UIM_AUTO_FOLLOW_PATTERN_RESUME,
+  UIM_AUTO_FOLLOW_PATTERN_RESUME_MANY,
 } from '../constants';
 import { trackUserRequest } from './track_ui_metric';
 import { areAllSettingsDefault } from './follower_index_default_settings';
@@ -88,6 +92,26 @@ export const deleteAutoFollowPattern = id => {
   return trackUserRequest(request, uiMetric).then(extractData);
 };
 
+export const pauseAutoFollowPattern = id => {
+  const ids = arrify(id);
+  const idString = ids.map(encodeURIComponent).join(',');
+  const request = httpClient.post(`${apiPrefix}/auto_follow_patterns/${idString}/pause`);
+
+  const uiMetric =
+    ids.length > 1 ? UIM_AUTO_FOLLOW_PATTERN_PAUSE_MANY : UIM_AUTO_FOLLOW_PATTERN_PAUSE;
+  return trackUserRequest(request, uiMetric).then(extractData);
+};
+
+export const resumeAutoFollowPattern = id => {
+  const ids = arrify(id);
+  const idString = ids.map(encodeURIComponent).join(',');
+  const request = httpClient.post(`${apiPrefix}/auto_follow_patterns/${idString}/resume`);
+
+  const uiMetric =
+    ids.length > 1 ? UIM_AUTO_FOLLOW_PATTERN_RESUME_MANY : UIM_AUTO_FOLLOW_PATTERN_RESUME;
+  return trackUserRequest(request, uiMetric).then(extractData);
+};
+
 /* Follower Index */
 export const loadFollowerIndices = () =>
   httpClient.get(`${apiPrefix}/follower_indices`).then(extractData);
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/action_types.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/action_types.js
index 3a9a9c33bafc2..91a3198e45d88 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/action_types.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/action_types.js
@@ -18,6 +18,8 @@ export const AUTO_FOLLOW_PATTERN_GET = 'AUTO_FOLLOW_PATTERN_GET';
 export const AUTO_FOLLOW_PATTERN_CREATE = 'AUTO_FOLLOW_PATTERN_CREATE';
 export const AUTO_FOLLOW_PATTERN_UPDATE = 'AUTO_FOLLOW_PATTERN_UPDATE';
 export const AUTO_FOLLOW_PATTERN_DELETE = 'AUTO_FOLLOW_PATTERN_DELETE';
+export const AUTO_FOLLOW_PATTERN_PAUSE = 'AUTO_FOLLOW_PATTERN_PAUSE';
+export const AUTO_FOLLOW_PATTERN_RESUME = 'AUTO_FOLLOW_PATTERN_RESUME';
 
 // Follower index
 export const FOLLOWER_INDEX_SELECT_DETAIL = 'FOLLOWER_INDEX_SELECT_DETAIL';
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/actions/auto_follow_pattern.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/actions/auto_follow_pattern.js
index 2e229c7aa7cc5..439858ad98ba3 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/actions/auto_follow_pattern.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/actions/auto_follow_pattern.js
@@ -12,6 +12,8 @@ import {
   createAutoFollowPattern as createAutoFollowPatternRequest,
   updateAutoFollowPattern as updateAutoFollowPatternRequest,
   deleteAutoFollowPattern as deleteAutoFollowPatternRequest,
+  pauseAutoFollowPattern as pauseAutoFollowPatternRequest,
+  resumeAutoFollowPattern as resumeAutoFollowPatternRequest,
 } from '../../services/api';
 import routing from '../../services/routing';
 import * as t from '../action_types';
@@ -141,3 +143,115 @@ export const deleteAutoFollowPattern = id =>
       }
     },
   });
+
+export const pauseAutoFollowPattern = id =>
+  sendApiRequest({
+    label: t.AUTO_FOLLOW_PATTERN_PAUSE,
+    scope: `${scope}-pause`,
+    status: API_STATUS.UPDATING,
+    handler: () => pauseAutoFollowPatternRequest(id),
+    onSuccess: response => {
+      /**
+       * We can have 1 or more auto-follow pattern pause operations
+       * that can fail or succeed. We will show 1 toast notification for each.
+       */
+      if (response.errors.length) {
+        const hasMultipleErrors = response.errors.length > 1;
+        const errorMessage = hasMultipleErrors
+          ? i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.pauseAction.errorMultipleNotificationTitle',
+              {
+                defaultMessage: `Error pausing {count} auto-follow patterns`,
+                values: { count: response.errors.length },
+              }
+            )
+          : i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.pauseAction.errorSingleNotificationTitle',
+              {
+                defaultMessage: `Error pausing the '{name}' auto-follow pattern`,
+                values: { name: response.errors[0].id },
+              }
+            );
+
+        toastNotifications.addDanger(errorMessage);
+      }
+
+      if (response.itemsPaused.length) {
+        const hasMultiple = response.itemsPaused.length > 1;
+
+        const successMessage = hasMultiple
+          ? i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.pauseAction.successMultipleNotificationTitle',
+              {
+                defaultMessage: `{count} auto-follow patterns were paused`,
+                values: { count: response.itemsPaused.length },
+              }
+            )
+          : i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.pauseAction.successSingleNotificationTitle',
+              {
+                defaultMessage: `Auto-follow pattern '{name}' was paused`,
+                values: { name: response.itemsPaused[0] },
+              }
+            );
+
+        toastNotifications.addSuccess(successMessage);
+      }
+    },
+  });
+
+export const resumeAutoFollowPattern = id =>
+  sendApiRequest({
+    label: t.AUTO_FOLLOW_PATTERN_RESUME,
+    scope: `${scope}-resume`,
+    status: API_STATUS.UPDATING,
+    handler: () => resumeAutoFollowPatternRequest(id),
+    onSuccess: response => {
+      /**
+       * We can have 1 or more auto-follow pattern resume operations
+       * that can fail or succeed. We will show 1 toast notification for each.
+       */
+      if (response.errors.length) {
+        const hasMultipleErrors = response.errors.length > 1;
+        const errorMessage = hasMultipleErrors
+          ? i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.resumeAction.errorMultipleNotificationTitle',
+              {
+                defaultMessage: `Error resuming {count} auto-follow patterns`,
+                values: { count: response.errors.length },
+              }
+            )
+          : i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.resumeAction.errorSingleNotificationTitle',
+              {
+                defaultMessage: `Error resuming the '{name}' auto-follow pattern`,
+                values: { name: response.errors[0].id },
+              }
+            );
+
+        toastNotifications.addDanger(errorMessage);
+      }
+
+      if (response.itemsResumed.length) {
+        const hasMultiple = response.itemsResumed.length > 1;
+
+        const successMessage = hasMultiple
+          ? i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.resumeAction.successMultipleNotificationTitle',
+              {
+                defaultMessage: `{count} auto-follow patterns were resumed`,
+                values: { count: response.itemsResumed.length },
+              }
+            )
+          : i18n.translate(
+              'xpack.crossClusterReplication.autoFollowPattern.resumeAction.successSingleNotificationTitle',
+              {
+                defaultMessage: `Auto-follow pattern '{name}' was resumed`,
+                values: { name: response.itemsResumed[0] },
+              }
+            );
+
+        toastNotifications.addSuccess(successMessage);
+      }
+    },
+  });
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/reducers/auto_follow_pattern.js b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/reducers/auto_follow_pattern.js
index 95b6515acbd11..bd082f1b0372b 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/reducers/auto_follow_pattern.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/public/app/store/reducers/auto_follow_pattern.js
@@ -16,6 +16,14 @@ const initialState = {
 
 const success = action => `${action}_SUCCESS`;
 
+const setActiveForIds = (ids, byId, active) => {
+  const shallowCopyByIds = { ...byId };
+  ids.forEach(id => {
+    shallowCopyByIds[id].active = active;
+  });
+  return shallowCopyByIds;
+};
+
 const parseAutoFollowPattern = autoFollowPattern => {
   // Extract prefix and suffix from follow index pattern
   const { followIndexPatternPrefix, followIndexPatternSuffix } = getPrefixSuffixFromFollowPattern(
@@ -51,6 +59,14 @@ export const reducer = (state = initialState, action) => {
       itemsDeleted.forEach(id => delete byId[id]);
       return { ...state, byId };
     }
+    case success(t.AUTO_FOLLOW_PATTERN_PAUSE): {
+      const { itemsPaused } = action.payload;
+      return { ...state, byId: setActiveForIds(itemsPaused, state.byId, false) };
+    }
+    case success(t.AUTO_FOLLOW_PATTERN_RESUME): {
+      const { itemsResumed } = action.payload;
+      return { ...state, byId: setActiveForIds(itemsResumed, state.byId, true) };
+    }
     default:
       return state;
   }
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/server/client/elasticsearch_ccr.js b/x-pack/legacy/plugins/cross_cluster_replication/server/client/elasticsearch_ccr.js
index c9df1fa0a4203..91527b8eb7cc5 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/server/client/elasticsearch_ccr.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/server/client/elasticsearch_ccr.js
@@ -73,6 +73,34 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     method: 'DELETE',
   });
 
+  ccr.pauseAutoFollowPattern = ca({
+    urls: [
+      {
+        fmt: '/_ccr/auto_follow/<%=id%>/pause',
+        req: {
+          id: {
+            type: 'string',
+          },
+        },
+      },
+    ],
+    method: 'POST',
+  });
+
+  ccr.resumeAutoFollowPattern = ca({
+    urls: [
+      {
+        fmt: '/_ccr/auto_follow/<%=id%>/resume',
+        req: {
+          id: {
+            type: 'string',
+          },
+        },
+      },
+    ],
+    method: 'POST',
+  });
+
   ccr.info = ca({
     urls: [
       {
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.js b/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.js
index 235cb065e51d9..4667f0a110c1f 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.js
@@ -177,4 +177,80 @@ export const registerAutoFollowPatternRoutes = server => {
       };
     },
   });
+
+  /**
+   * Pause auto-follow pattern(s)
+   */
+  server.route({
+    path: `${API_BASE_PATH}/auto_follow_patterns/{id}/pause`,
+    method: 'POST',
+    config: {
+      pre: [licensePreRouting],
+    },
+    handler: async request => {
+      const callWithRequest = callWithRequestFactory(server, request);
+      const { id } = request.params;
+      const ids = id.split(',');
+
+      const itemsPaused = [];
+      const errors = [];
+
+      await Promise.all(
+        ids.map(_id =>
+          callWithRequest('ccr.pauseAutoFollowPattern', { id: _id })
+            .then(() => itemsPaused.push(_id))
+            .catch(err => {
+              if (isEsError(err)) {
+                errors.push({ id: _id, error: wrapEsError(err) });
+              } else {
+                errors.push({ id: _id, error: wrapUnknownError(err) });
+              }
+            })
+        )
+      );
+
+      return {
+        itemsPaused,
+        errors,
+      };
+    },
+  });
+
+  /**
+   * Resume auto-follow pattern(s)
+   */
+  server.route({
+    path: `${API_BASE_PATH}/auto_follow_patterns/{id}/resume`,
+    method: 'POST',
+    config: {
+      pre: [licensePreRouting],
+    },
+    handler: async request => {
+      const callWithRequest = callWithRequestFactory(server, request);
+      const { id } = request.params;
+      const ids = id.split(',');
+
+      const itemsResumed = [];
+      const errors = [];
+
+      await Promise.all(
+        ids.map(_id =>
+          callWithRequest('ccr.resumeAutoFollowPattern', { id: _id })
+            .then(() => itemsResumed.push(_id))
+            .catch(err => {
+              if (isEsError(err)) {
+                errors.push({ id: _id, error: wrapEsError(err) });
+              } else {
+                errors.push({ id: _id, error: wrapUnknownError(err) });
+              }
+            })
+        )
+      );
+
+      return {
+        itemsResumed,
+        errors,
+      };
+    },
+  });
 };
diff --git a/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.test.js b/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.test.js
index 7adf94b281fa6..c610039cfd2ac 100644
--- a/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.test.js
+++ b/x-pack/legacy/plugins/cross_cluster_replication/server/routes/api/auto_follow_pattern.test.js
@@ -36,6 +36,8 @@ const registerHandlers = () => {
     2: 'update',
     3: 'get',
     4: 'delete',
+    5: 'pause',
+    6: 'resume',
   };
 
   const server = {
@@ -228,4 +230,82 @@ describe('[CCR API Routes] Auto Follow Pattern', () => {
       expect(response.errors[0].id).toEqual('b');
     });
   });
+
+  describe('pause()', () => {
+    beforeEach(() => {
+      resetHttpRequestResponses();
+      routeHandler = routeHandlers.pause;
+    });
+
+    it('accept a single item', async () => {
+      setHttpRequestResponse(null, { acknowledge: true });
+
+      const response = await routeHandler({ params: { id: 'a' } });
+
+      expect(response.itemsPaused).toEqual(['a']);
+      expect(response.errors).toEqual([]);
+    });
+
+    it('should accept a list of items to pause', async () => {
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(null, { acknowledge: true });
+
+      const response = await routeHandler({ params: { id: 'a,b,c' } });
+
+      expect(response.itemsPaused).toEqual(['a', 'b', 'c']);
+    });
+
+    it('should catch error and return them in array', async () => {
+      const error = new Error('something went wrong');
+      error.response = '{ "error": {} }';
+
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(error);
+
+      const response = await routeHandler({ params: { id: 'a,b' } });
+
+      expect(response.itemsPaused).toEqual(['a']);
+      expect(response.errors[0].id).toEqual('b');
+    });
+  });
+
+  describe('resume()', () => {
+    beforeEach(() => {
+      resetHttpRequestResponses();
+      routeHandler = routeHandlers.resume;
+    });
+
+    it('accept a single item', async () => {
+      setHttpRequestResponse(null, { acknowledge: true });
+
+      const response = await routeHandler({ params: { id: 'a' } });
+
+      expect(response.itemsResumed).toEqual(['a']);
+      expect(response.errors).toEqual([]);
+    });
+
+    it('should accept a list of items to pause', async () => {
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(null, { acknowledge: true });
+
+      const response = await routeHandler({ params: { id: 'a,b,c' } });
+
+      expect(response.itemsResumed).toEqual(['a', 'b', 'c']);
+    });
+
+    it('should catch error and return them in array', async () => {
+      const error = new Error('something went wrong');
+      error.response = '{ "error": {} }';
+
+      setHttpRequestResponse(null, { acknowledge: true });
+      setHttpRequestResponse(error);
+
+      const response = await routeHandler({ params: { id: 'a,b' } });
+
+      expect(response.itemsResumed).toEqual(['a']);
+      expect(response.errors[0].id).toEqual('b');
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/dashboard_mode/public/dashboard_viewer.js b/x-pack/legacy/plugins/dashboard_mode/public/dashboard_viewer.js
index 4215f96c8de4a..44c4b81c8ad93 100644
--- a/x-pack/legacy/plugins/dashboard_mode/public/dashboard_viewer.js
+++ b/x-pack/legacy/plugins/dashboard_mode/public/dashboard_viewer.js
@@ -60,7 +60,7 @@ uiModules.get('kibana').run(showAppRedirectNotification);
  * show that dashboard, otherwise, we'll show the default dasbhoard landing page.
  */
 function defaultUrl() {
-  const defaultAppId = npStart.plugins.kibana_legacy.config.defaultAppId || '';
+  const defaultAppId = npStart.plugins.kibanaLegacy.config.defaultAppId || '';
   const isDashboardId = defaultAppId.startsWith(dashboardAppIdPrefix());
   return isDashboardId ? `/${defaultAppId}` : DashboardConstants.LANDING_PAGE_PATH;
 }
diff --git a/x-pack/legacy/plugins/file_upload/public/kibana_services.js b/x-pack/legacy/plugins/file_upload/public/kibana_services.js
index 1645040629195..b48b7e49e7912 100644
--- a/x-pack/legacy/plugins/file_upload/public/kibana_services.js
+++ b/x-pack/legacy/plugins/file_upload/public/kibana_services.js
@@ -11,12 +11,12 @@ export const indexPatternService = npStart.plugins.data.indexPatterns;
 
 export let savedObjectsClient;
 export let basePath;
-export let apiBasePath;
 export let kbnVersion;
+export let kbnFetch;
 
 export const initServicesAndConstants = ({ savedObjects, http, injectedMetadata }) => {
   savedObjectsClient = savedObjects.client;
   basePath = http.basePath.basePath;
-  apiBasePath = http.basePath.prepend('/api');
   kbnVersion = injectedMetadata.getKibanaVersion(DEFAULT_KBN_VERSION);
+  kbnFetch = http.fetch;
 };
diff --git a/x-pack/legacy/plugins/file_upload/public/util/http_service.js b/x-pack/legacy/plugins/file_upload/public/util/http_service.js
index ca35508e1bdb2..4bf9ec2d4c6d5 100644
--- a/x-pack/legacy/plugins/file_upload/public/util/http_service.js
+++ b/x-pack/legacy/plugins/file_upload/public/util/http_service.js
@@ -4,11 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-// service for interacting with the server
-
-import { addSystemApiHeader } from 'ui/system_api';
 import { i18n } from '@kbn/i18n';
-import { kbnVersion } from '../kibana_services';
+import { kbnFetch } from '../kibana_services';
 
 export async function http(options) {
   if (!(options && options.url)) {
@@ -17,11 +14,10 @@ export async function http(options) {
     });
   }
   const url = options.url || '';
-  const headers = addSystemApiHeader({
+  const headers = {
     'Content-Type': 'application/json',
-    'kbn-version': kbnVersion,
     ...options.headers,
-  });
+  };
 
   const allHeaders = options.headers === undefined ? headers : { ...options.headers, ...headers };
   const body = options.data === undefined ? null : JSON.stringify(options.data);
@@ -30,6 +26,7 @@ export async function http(options) {
     method: options.method || 'GET',
     headers: allHeaders,
     credentials: 'same-origin',
+    query: options.query,
   };
 
   if (body !== null) {
@@ -40,8 +37,7 @@ export async function http(options) {
 
 async function doFetch(url, payload) {
   try {
-    const resp = await fetch(url, payload);
-    return resp.json();
+    return await kbnFetch(url, payload);
   } catch (err) {
     return {
       failures: [
diff --git a/x-pack/legacy/plugins/file_upload/public/util/indexing_service.js b/x-pack/legacy/plugins/file_upload/public/util/indexing_service.js
index e766948daf8a3..bfaea00bc6694 100644
--- a/x-pack/legacy/plugins/file_upload/public/util/indexing_service.js
+++ b/x-pack/legacy/plugins/file_upload/public/util/indexing_service.js
@@ -5,7 +5,7 @@
  */
 
 import { http as httpService } from './http_service';
-import { indexPatternService, apiBasePath, savedObjectsClient } from '../kibana_services';
+import { indexPatternService, savedObjectsClient } from '../kibana_services';
 import { getGeoJsonIndexingDetails } from './geo_processing';
 import { sizeLimitedChunking } from './size_limited_chunking';
 import { i18n } from '@kbn/i18n';
@@ -37,11 +37,9 @@ export async function indexData(parsedFile, transformDetails, indexName, dataTyp
     data: [],
     index: indexName,
   });
-  let id;
+  const id = createdIndex && createdIndex.id;
   try {
-    if (createdIndex && createdIndex.id) {
-      id = createdIndex.id;
-    } else {
+    if (!id) {
       throw i18n.translate('xpack.fileUpload.indexingService.errorCreatingIndex', {
         defaultMessage: 'Error creating index',
       });
@@ -117,12 +115,13 @@ function transformDataByFormatForIndexing(transform, parsedFile, dataType) {
 }
 
 async function writeToIndex(indexingDetails) {
-  const paramString = indexingDetails.id !== undefined ? `?id=${indexingDetails.id}` : '';
+  const query = indexingDetails.id ? { id: indexingDetails.id } : null;
   const { appName, index, data, settings, mappings, ingestPipeline } = indexingDetails;
 
   return await httpService({
-    url: `${apiBasePath}/fileupload/import${paramString}`,
+    url: `/api/fileupload/import`,
     method: 'POST',
+    ...(query ? { query } : {}),
     data: {
       index,
       data,
@@ -227,7 +226,7 @@ async function getIndexPatternId(name) {
 
 export const getExistingIndexNames = async () => {
   const indexes = await httpService({
-    url: `${apiBasePath}/index_management/indices`,
+    url: `/api/index_management/indices`,
     method: 'GET',
   });
   return indexes ? indexes.map(({ name }) => name) : [];
diff --git a/x-pack/legacy/plugins/file_upload/server/models/import_data/import_data.js b/x-pack/legacy/plugins/file_upload/server/models/import_data/import_data.js
index c33c0c0bd140e..69216722eece6 100644
--- a/x-pack/legacy/plugins/file_upload/server/models/import_data/import_data.js
+++ b/x-pack/legacy/plugins/file_upload/server/models/import_data/import_data.js
@@ -16,7 +16,7 @@ export function importDataProvider(callWithRequest) {
     try {
       const { id: pipelineId, pipeline } = ingestPipeline;
 
-      if (id === undefined) {
+      if (!id) {
         // first chunk of data, create the index and id to return
         id = uuid.v1();
 
diff --git a/x-pack/legacy/plugins/file_upload/server/plugin.js b/x-pack/legacy/plugins/file_upload/server/plugin.js
index 542399da62370..23fb8bda897f0 100644
--- a/x-pack/legacy/plugins/file_upload/server/plugin.js
+++ b/x-pack/legacy/plugins/file_upload/server/plugin.js
@@ -4,24 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getImportRouteHandler } from './routes/file_upload';
-import { MAX_BYTES } from '../common/constants/file_import';
+import { initRoutes } from './routes/file_upload';
 import { registerFileUploadUsageCollector } from './telemetry';
 
 export class FileUploadPlugin {
   setup(core, plugins, __LEGACY) {
     const elasticsearchPlugin = __LEGACY.plugins.elasticsearch;
     const getSavedObjectsRepository = __LEGACY.savedObjects.getSavedObjectsRepository;
+    const router = core.http.createRouter();
 
-    // Set up route
-    __LEGACY.route({
-      method: 'POST',
-      path: '/api/fileupload/import',
-      handler: getImportRouteHandler(elasticsearchPlugin, getSavedObjectsRepository),
-      config: {
-        payload: { maxBytes: MAX_BYTES },
-      },
-    });
+    initRoutes(router, elasticsearchPlugin, getSavedObjectsRepository);
 
     registerFileUploadUsageCollector(plugins.usageCollection, {
       elasticsearchPlugin,
diff --git a/x-pack/legacy/plugins/file_upload/server/routes/file_upload.js b/x-pack/legacy/plugins/file_upload/server/routes/file_upload.js
index 26f5b8827b602..1c27c2d7d68e9 100644
--- a/x-pack/legacy/plugins/file_upload/server/routes/file_upload.js
+++ b/x-pack/legacy/plugins/file_upload/server/routes/file_upload.js
@@ -5,43 +5,126 @@
  */
 
 import { callWithRequestFactory } from '../client/call_with_request_factory';
-import { wrapError } from '../client/errors';
 import { importDataProvider } from '../models/import_data';
 import { updateTelemetry } from '../telemetry/telemetry';
+import { MAX_BYTES } from '../../common/constants/file_import';
+import { schema } from '@kbn/config-schema';
 
-function importData({ callWithRequest, id, index, settings, mappings, ingestPipeline, data }) {
-  const { importData: importDataFunc } = importDataProvider(callWithRequest);
-  return importDataFunc(id, index, settings, mappings, ingestPipeline, data);
-}
-
-export function getImportRouteHandler(elasticsearchPlugin, getSavedObjectsRepository) {
-  return async request => {
-    const requestObj = {
-      query: request.query,
-      payload: request.payload,
-      params: request.payload,
-      auth: request.auth,
-      headers: request.headers,
-    };
-
-    // `id` being `undefined` tells us that this is a new import due to create a new index.
-    // follow-up import calls to just add additional data will include the `id` of the created
-    // index, we'll ignore those and don't increment the counter.
-    const { id } = requestObj.query;
-    if (id === undefined) {
-      await updateTelemetry({ elasticsearchPlugin, getSavedObjectsRepository });
-    }
+export const IMPORT_ROUTE = '/api/fileupload/import';
+
+export const querySchema = schema.maybe(
+  schema.object({
+    id: schema.nullable(schema.string()),
+  })
+);
+
+export const bodySchema = schema.object(
+  {
+    app: schema.maybe(schema.string()),
+    index: schema.string(),
+    fileType: schema.string(),
+    ingestPipeline: schema.maybe(
+      schema.object(
+        {},
+        {
+          defaultValue: {},
+          allowUnknowns: true,
+        }
+      )
+    ),
+  },
+  { allowUnknowns: true }
+);
+
+const options = {
+  body: {
+    maxBytes: MAX_BYTES,
+    accepts: ['application/json'],
+  },
+};
+
+export const idConditionalValidation = (body, boolHasId) =>
+  schema
+    .object(
+      {
+        data: boolHasId
+          ? schema.arrayOf(schema.object({}, { allowUnknowns: true }), { minSize: 1 })
+          : schema.any(),
+        settings: boolHasId
+          ? schema.any()
+          : schema.object(
+              {},
+              {
+                defaultValue: {
+                  number_of_shards: 1,
+                },
+                allowUnknowns: true,
+              }
+            ),
+        mappings: boolHasId
+          ? schema.any()
+          : schema.object(
+              {},
+              {
+                defaultValue: {},
+                allowUnknowns: true,
+              }
+            ),
+      },
+      { allowUnknowns: true }
+    )
+    .validate(body);
 
-    const requestContentWithDefaults = {
-      id,
-      callWithRequest: callWithRequestFactory(elasticsearchPlugin, requestObj),
-      index: undefined,
-      settings: {},
-      mappings: {},
-      ingestPipeline: {},
-      data: [],
-      ...requestObj.payload,
-    };
-    return importData(requestContentWithDefaults).catch(wrapError);
+const finishValidationAndProcessReq = (elasticsearchPlugin, getSavedObjectsRepository) => {
+  return async (con, req, { ok, badRequest }) => {
+    const {
+      query: { id },
+      body,
+    } = req;
+    const boolHasId = !!id;
+
+    let resp;
+    try {
+      const validIdReqData = idConditionalValidation(body, boolHasId);
+      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, req);
+      const { importData: importDataFunc } = importDataProvider(callWithRequest);
+
+      const { index, settings, mappings, ingestPipeline, data } = validIdReqData;
+      const processedReq = await importDataFunc(
+        id,
+        index,
+        settings,
+        mappings,
+        ingestPipeline,
+        data
+      );
+
+      if (processedReq.success) {
+        resp = ok({ body: processedReq });
+        // If no id's been established then this is a new index, update telemetry
+        if (!boolHasId) {
+          await updateTelemetry({ elasticsearchPlugin, getSavedObjectsRepository });
+        }
+      } else {
+        resp = badRequest(`Error processing request 1: ${processedReq.error.message}`, ['body']);
+      }
+    } catch (e) {
+      resp = badRequest(`Error processing request 2: : ${e.message}`, ['body']);
+    }
+    return resp;
   };
-}
+};
+
+export const initRoutes = (router, esPlugin, getSavedObjectsRepository) => {
+  router.post(
+    {
+      path: `${IMPORT_ROUTE}{id?}`,
+      validate: {
+        query: querySchema,
+        body: bodySchema,
+      },
+      options,
+    },
+    finishValidationAndProcessReq(esPlugin, getSavedObjectsRepository)
+  );
+};
diff --git a/x-pack/legacy/plugins/file_upload/server/routes/file_upload.test.js b/x-pack/legacy/plugins/file_upload/server/routes/file_upload.test.js
new file mode 100644
index 0000000000000..b03b93fe9d979
--- /dev/null
+++ b/x-pack/legacy/plugins/file_upload/server/routes/file_upload.test.js
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { querySchema, bodySchema, idConditionalValidation } from './file_upload';
+
+const queryWithId = {
+  id: '123',
+};
+
+const bodyWithoutQueryId = {
+  index: 'islandofone',
+  data: [],
+  settings: { number_of_shards: 1 },
+  mappings: { coordinates: { type: 'geo_point' } },
+  ingestPipeline: {},
+  fileType: 'json',
+  app: 'Maps',
+};
+
+const bodyWithQueryId = {
+  index: 'islandofone2',
+  data: [{ coordinates: [], name: 'islandofone2' }],
+  settings: {},
+  mappings: {},
+  ingestPipeline: {},
+  fileType: 'json',
+};
+
+describe('route validation', () => {
+  it(`validates query with id`, async () => {
+    const validationResult = querySchema.validate(queryWithId);
+    expect(validationResult.id).toBe(queryWithId.id);
+  });
+
+  it(`validates query without id`, async () => {
+    const validationResult = querySchema.validate({});
+    expect(validationResult.id).toBeNull();
+  });
+
+  it(`throws when query contains content other than an id`, async () => {
+    expect(() => querySchema.validate({ notAnId: 123 })).toThrowError(
+      `[notAnId]: definition for this key is missing`
+    );
+  });
+
+  it(`validates body with valid fields`, async () => {
+    const validationResult = bodySchema.validate(bodyWithoutQueryId);
+    expect(validationResult).toEqual(bodyWithoutQueryId);
+  });
+
+  it(`throws if an expected field is missing`, async () => {
+    /* eslint-disable no-unused-vars */
+    const { index, ...bodyWithoutIndexField } = bodyWithoutQueryId;
+    expect(() => bodySchema.validate(bodyWithoutIndexField)).toThrowError(
+      `[index]: expected value of type [string] but got [undefined]`
+    );
+  });
+
+  it(`validates conditional fields when id has been provided in query`, async () => {
+    const validationResult = idConditionalValidation(bodyWithQueryId, true);
+    expect(validationResult).toEqual(bodyWithQueryId);
+  });
+
+  it(`validates conditional fields when no id has been provided in query`, async () => {
+    const validationResultWhenIdPresent = idConditionalValidation(bodyWithoutQueryId, false);
+    expect(validationResultWhenIdPresent).toEqual(bodyWithoutQueryId);
+    // Conditions for no id are more strict since this query sets up the index,
+    // expect it to throw if expected fields aren't present
+    expect(() => idConditionalValidation(bodyWithoutQueryId, true)).toThrowError(
+      `[data]: array size is [0], but cannot be smaller than [1]`
+    );
+  });
+});
diff --git a/x-pack/legacy/plugins/graph/public/app.js b/x-pack/legacy/plugins/graph/public/app.js
index d0dbf34abc055..38a601daa178e 100644
--- a/x-pack/legacy/plugins/graph/public/app.js
+++ b/x-pack/legacy/plugins/graph/public/app.js
@@ -12,7 +12,7 @@ import { Provider } from 'react-redux';
 import { isColorDark, hexToRgb } from '@elastic/eui';
 
 import { toMountPoint } from '../../../../../src/plugins/kibana_react/public';
-import { showSaveModal } from './legacy_imports';
+import { showSaveModal } from '../../../../../src/plugins/saved_objects/public';
 
 import appTemplate from './angular/templates/index.html';
 import listingTemplate from './angular/templates/listing_ng_wrapper.html';
@@ -290,6 +290,7 @@ export function initGraphApp(angularModule, deps) {
         $scope.$digest();
       },
       chrome,
+      I18nContext: coreStart.i18n.Context,
     });
 
     // register things on scope passed down to react components
diff --git a/x-pack/legacy/plugins/graph/public/components/save_modal.tsx b/x-pack/legacy/plugins/graph/public/components/save_modal.tsx
index b60a444453f7d..3dede69d0ca93 100644
--- a/x-pack/legacy/plugins/graph/public/components/save_modal.tsx
+++ b/x-pack/legacy/plugins/graph/public/components/save_modal.tsx
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 import {
   SavedObjectSaveModal,
   OnSaveProps,
-} from '../../../../../../src/plugins/kibana_react/public';
+} from '../../../../../../src/plugins/saved_objects/public';
 
 import { GraphSavePolicy } from '../types/config';
 
diff --git a/x-pack/legacy/plugins/graph/public/components/source_picker.tsx b/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
index de920af8a48a5..65a431202fc98 100644
--- a/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
+++ b/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
@@ -8,7 +8,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 
 import { CoreStart } from 'src/core/public';
-import { SavedObjectFinderUi } from '../../../../../../src/plugins/kibana_react/public';
+import { SavedObjectFinderUi } from '../../../../../../src/plugins/saved_objects/public';
 import { IndexPatternSavedObject } from '../types';
 
 export interface SourcePickerProps {
diff --git a/x-pack/legacy/plugins/graph/public/legacy_imports.ts b/x-pack/legacy/plugins/graph/public/legacy_imports.ts
index 7ea2cf6dd901b..f1839d62a0667 100644
--- a/x-pack/legacy/plugins/graph/public/legacy_imports.ts
+++ b/x-pack/legacy/plugins/graph/public/legacy_imports.ts
@@ -8,13 +8,11 @@ import 'ui/angular-bootstrap';
 import 'ace';
 
 export { SavedObject, SavedObjectKibanaServices } from 'ui/saved_objects/types';
-export { configureAppAngularModule } from 'ui/legacy_compat';
 // @ts-ignore
 export { createTopNavDirective, createTopNavHelper } from 'ui/kbn_top_nav/kbn_top_nav';
 // @ts-ignore
 export { confirmModalFactory } from 'ui/modals/confirm_modal';
 // @ts-ignore
 export { addAppRedirectMessageToUrl } from 'ui/notify';
-export { SaveResult } from 'ui/saved_objects/show_saved_object_save_modal';
 export { createSavedObjectClass } from 'ui/saved_objects/saved_object';
-export { showSaveModal } from 'ui/saved_objects/show_saved_object_save_modal';
+export { configureAppAngularModule } from '../../../../../src/plugins/kibana_legacy/public';
diff --git a/x-pack/legacy/plugins/graph/public/services/save_modal.tsx b/x-pack/legacy/plugins/graph/public/services/save_modal.tsx
index d949ac1d4a600..127ff6a2b4c37 100644
--- a/x-pack/legacy/plugins/graph/public/services/save_modal.tsx
+++ b/x-pack/legacy/plugins/graph/public/services/save_modal.tsx
@@ -5,9 +5,10 @@
  */
 
 import React from 'react';
+import { I18nStart } from 'src/core/public';
+import { SaveResult } from 'src/plugins/saved_objects/public';
 import { GraphWorkspaceSavedObject, GraphSavePolicy } from '../types';
 import { SaveModal, OnSaveGraphProps } from '../components/save_modal';
-import { SaveResult } from '../legacy_imports';
 
 export type SaveWorkspaceHandler = (
   saveOptions: {
@@ -24,12 +25,14 @@ export function openSaveModal({
   workspace,
   saveWorkspace,
   showSaveModal,
+  I18nContext,
 }: {
   savePolicy: GraphSavePolicy;
   hasData: boolean;
   workspace: GraphWorkspaceSavedObject;
   saveWorkspace: SaveWorkspaceHandler;
-  showSaveModal: (el: React.ReactNode) => void;
+  showSaveModal: (el: React.ReactNode, I18nContext: I18nStart['Context']) => void;
+  I18nContext: I18nStart['Context'];
 }) {
   const currentTitle = workspace.title;
   const currentDescription = workspace.description;
@@ -67,6 +70,7 @@ export function openSaveModal({
       title={workspace.title}
       description={workspace.description}
       showCopyOnSave={Boolean(workspace.id)}
-    />
+    />,
+    I18nContext
   );
 }
diff --git a/x-pack/legacy/plugins/graph/public/state_management/mocks.ts b/x-pack/legacy/plugins/graph/public/state_management/mocks.ts
index 5a4f0d033aa42..01d6927b9b886 100644
--- a/x-pack/legacy/plugins/graph/public/state_management/mocks.ts
+++ b/x-pack/legacy/plugins/graph/public/state_management/mocks.ts
@@ -63,6 +63,9 @@ export function createMockGraphStore({
     indexPatterns: [
       ({ id: '123', attributes: { title: 'test-pattern' } } as unknown) as IndexPatternSavedObject,
     ],
+    I18nContext: jest
+      .fn()
+      .mockImplementation(({ children }: { children: React.ReactNode }) => children),
     notifications: ({
       toasts: {
         addDanger: jest.fn(),
diff --git a/x-pack/legacy/plugins/graph/public/state_management/persistence.ts b/x-pack/legacy/plugins/graph/public/state_management/persistence.ts
index 0bc7827358b81..0f72186af031f 100644
--- a/x-pack/legacy/plugins/graph/public/state_management/persistence.ts
+++ b/x-pack/legacy/plugins/graph/public/state_management/persistence.ts
@@ -199,5 +199,6 @@ function showModal(
     workspace: savedWorkspace,
     showSaveModal: deps.showSaveModal,
     saveWorkspace: saveWorkspaceHandler,
+    I18nContext: deps.I18nContext,
   });
 }
diff --git a/x-pack/legacy/plugins/graph/public/state_management/store.ts b/x-pack/legacy/plugins/graph/public/state_management/store.ts
index bb01f20196f87..ecb7335fee5aa 100644
--- a/x-pack/legacy/plugins/graph/public/state_management/store.ts
+++ b/x-pack/legacy/plugins/graph/public/state_management/store.ts
@@ -6,7 +6,7 @@
 
 import createSagaMiddleware, { SagaMiddleware } from 'redux-saga';
 import { combineReducers, createStore, Store, AnyAction, Dispatch, applyMiddleware } from 'redux';
-import { ChromeStart } from 'kibana/public';
+import { ChromeStart, I18nStart } from 'kibana/public';
 import { CoreStart } from 'src/core/public';
 import {
   fieldsReducer,
@@ -54,7 +54,7 @@ export interface GraphStoreDependencies {
   getSavedWorkspace: () => GraphWorkspaceSavedObject;
   notifications: CoreStart['notifications'];
   http: CoreStart['http'];
-  showSaveModal: (el: React.ReactNode) => void;
+  showSaveModal: (el: React.ReactNode, I18nContext: I18nStart['Context']) => void;
   savePolicy: GraphSavePolicy;
   changeUrl: (newUrl: string) => void;
   notifyAngular: () => void;
@@ -62,6 +62,7 @@ export interface GraphStoreDependencies {
   setUrlTemplates: (templates: UrlTemplate[]) => void;
   setWorkspaceInitialized: () => void;
   chrome: ChromeStart;
+  I18nContext: I18nStart['Context'];
 }
 
 export function createRootReducer(basePath: string) {
diff --git a/x-pack/legacy/plugins/grokdebugger/public/register.js b/x-pack/legacy/plugins/grokdebugger/public/register.js
index 8201fed5b2220..74679d65e52d2 100644
--- a/x-pack/legacy/plugins/grokdebugger/public/register.js
+++ b/x-pack/legacy/plugins/grokdebugger/public/register.js
@@ -8,7 +8,7 @@ import { i18n } from '@kbn/i18n';
 import { xpackInfo } from 'plugins/xpack_main/services/xpack_info';
 import { npSetup, npStart } from 'ui/new_platform';
 
-npSetup.plugins.dev_tools.register({
+npSetup.plugins.devTools.register({
   order: 6,
   title: i18n.translate('xpack.grokDebugger.displayName', {
     defaultMessage: 'Grok Debugger',
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap
index bd42346e36135..92aaa171551a0 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap
+++ b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/__snapshots__/extend_index_management.test.js.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`ilm banner extension should return extension when any index has lifecycle error 1`] = `
+exports[`extend index management ilm banner extension should return extension when any index has lifecycle error 1`] = `
 Object {
   "filter": Query {
     "ast": _AST {
@@ -45,7 +45,7 @@ Object {
 }
 `;
 
-exports[`ilm filter extension should return extension when any index has lifecycle policy 1`] = `
+exports[`extend index management ilm filter extension should return extension when any index has lifecycle policy 1`] = `
 Array [
   Object {
     "field": "ilm.managed",
@@ -66,7 +66,7 @@ Array [
 ]
 `;
 
-exports[`ilm summary extension should return extension when index has lifecycle error 1`] = `
+exports[`extend index management ilm summary extension should return extension when index has lifecycle error 1`] = `
 <IndexLifecycleSummary
   index={
     Object {
@@ -551,7 +551,7 @@ exports[`ilm summary extension should return extension when index has lifecycle
 </IndexLifecycleSummary>
 `;
 
-exports[`ilm summary extension should return extension when index has lifecycle policy 1`] = `
+exports[`extend index management ilm summary extension should return extension when index has lifecycle policy 1`] = `
 <IndexLifecycleSummary
   index={
     Object {
@@ -852,7 +852,7 @@ exports[`ilm summary extension should return extension when index has lifecycle
 </IndexLifecycleSummary>
 `;
 
-exports[`remove lifecycle action extension should return extension when all indices have lifecycle policy 1`] = `
+exports[`extend index management remove lifecycle action extension should return extension when all indices have lifecycle policy 1`] = `
 Object {
   "buttonLabel": "Remove lifecycle policy",
   "icon": "stopFilled",
@@ -866,7 +866,7 @@ Object {
 }
 `;
 
-exports[`retry lifecycle action extension should return extension when all indices have lifecycle errors 1`] = `
+exports[`extend index management retry lifecycle action extension should return extension when all indices have lifecycle errors 1`] = `
 Object {
   "buttonLabel": "Retry lifecycle step",
   "icon": "play",
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js
index 2c0ea7fe699b8..9d143c4d3fc8e 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/edit_policy.test.js
@@ -7,17 +7,19 @@
 import React from 'react';
 import moment from 'moment-timezone';
 import { Provider } from 'react-redux';
-import { fetchedPolicies, fetchedNodes } from '../../public/store/actions';
-import { indexLifecycleManagementStore } from '../../public/store';
-import { mountWithIntl } from '../../../../../test_utils/enzyme_helpers';
-import { EditPolicy } from '../../public/sections/edit_policy';
 // axios has a $http like interface so using it to simulate $http
 import axios from 'axios';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-import { setHttpClient } from '../../public/services/api';
-setHttpClient(axios.create({ adapter: axiosXhrAdapter }));
 import sinon from 'sinon';
 import { findTestSubject } from '@elastic/eui/lib/test';
+
+import { mountWithIntl } from '../../../../../test_utils/enzyme_helpers';
+import { fetchedPolicies, fetchedNodes } from '../../public/np_ready/application/store/actions';
+import { indexLifecycleManagementStore } from '../../public/np_ready/application/store';
+import { EditPolicy } from '../../public/np_ready/application/sections/edit_policy';
+import { init as initHttp } from '../../public/np_ready/application/services/http';
+import { init as initUiMetric } from '../../public/np_ready/application/services/ui_metric';
+import { init as initNotification } from '../../public/np_ready/application/services/notification';
 import {
   positiveNumbersAboveZeroErrorMessage,
   positiveNumberRequiredMessage,
@@ -31,7 +33,13 @@ import {
   policyNameMustBeDifferentErrorMessage,
   policyNameAlreadyUsedErrorMessage,
   maximumDocumentsRequiredMessage,
-} from '../../public/store/selectors/lifecycle';
+} from '../../public/np_ready/application/store/selectors/lifecycle';
+
+initHttp(axios.create({ adapter: axiosXhrAdapter }), path => path);
+initUiMetric(() => () => {});
+initNotification({
+  addDanger: () => {},
+});
 
 jest.mock('ui/new_platform');
 
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js
index bdb412eace9f8..a3a9c5e59bfa4 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/components/policy_table.test.js
@@ -6,18 +6,24 @@
 import moment from 'moment-timezone';
 import React from 'react';
 import { Provider } from 'react-redux';
-import { fetchedPolicies } from '../../public/store/actions';
-import { indexLifecycleManagementStore } from '../../public/store';
-import { mountWithIntl } from '../../../../../test_utils/enzyme_helpers';
-import { PolicyTable } from '../../public/sections/policy_table';
-import { findTestSubject, takeMountedSnapshot } from '@elastic/eui/lib/test';
 // axios has a $http like interface so using it to simulate $http
 import axios from 'axios';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-import { setHttpClient } from '../../public/services/api';
-setHttpClient(axios.create({ adapter: axiosXhrAdapter }));
 import sinon from 'sinon';
+import { findTestSubject, takeMountedSnapshot } from '@elastic/eui/lib/test';
+
+import { mountWithIntl } from '../../../../../test_utils/enzyme_helpers';
+import { fetchedPolicies } from '../../public/np_ready/application/store/actions';
+import { indexLifecycleManagementStore } from '../../public/np_ready/application/store';
+import { PolicyTable } from '../../public/np_ready/application/sections/policy_table';
+import { init as initHttp } from '../../public/np_ready/application/services/http';
+import { init as initUiMetric } from '../../public/np_ready/application/services/ui_metric';
+
+initHttp(axios.create({ adapter: axiosXhrAdapter }), path => path);
+initUiMetric(() => () => {});
+
 jest.mock('ui/new_platform');
+
 let server = null;
 
 let store = null;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js
index e23fe59568e14..cfae072b57a26 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/__jest__/extend_index_management.test.js
@@ -4,8 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { mountWithIntl } from '../../../../test_utils/enzyme_helpers';
 import moment from 'moment-timezone';
+import axios from 'axios';
+import axiosXhrAdapter from 'axios/lib/adapters/xhr';
+import { mountWithIntl } from '../../../../test_utils/enzyme_helpers';
 import {
   retryLifecycleActionExtension,
   removeLifecyclePolicyActionExtension,
@@ -13,9 +15,18 @@ import {
   ilmBannerExtension,
   ilmFilterExtension,
   ilmSummaryExtension,
-} from '../public/extend_index_management';
+} from '../public/np_ready/extend_index_management';
+import { init as initHttp } from '../public/np_ready/application/services/http';
+import { init as initUiMetric } from '../public/np_ready/application/services/ui_metric';
+
+// We need to init the http with a mock for any tests that depend upon the http service.
+// For example, add_lifecycle_confirm_modal makes an API request in its componentDidMount
+// lifecycle method. If we don't mock this, CI will fail with "Call retries were exceeded".
+initHttp(axios.create({ adapter: axiosXhrAdapter }), path => path);
+initUiMetric(() => () => {});
 
 jest.mock('ui/new_platform');
+
 const indexWithoutLifecyclePolicy = {
   health: 'yellow',
   status: 'open',
@@ -33,6 +44,7 @@ const indexWithoutLifecyclePolicy = {
     managed: false,
   },
 };
+
 const indexWithLifecyclePolicy = {
   health: 'yellow',
   status: 'open',
@@ -58,6 +70,7 @@ const indexWithLifecyclePolicy = {
     step_time_millis: 1544187775867,
   },
 };
+
 const indexWithLifecycleError = {
   health: 'yellow',
   status: 'open',
@@ -95,132 +108,151 @@ const indexWithLifecycleError = {
     },
   },
 };
+
 moment.tz.setDefault('utc');
-describe('retry lifecycle action extension', () => {
-  test('should return null when no indices have index lifecycle policy', () => {
-    const extension = retryLifecycleActionExtension([indexWithoutLifecyclePolicy]);
-    expect(extension).toBeNull();
-  });
-  test('should return null when no index has lifecycle errors', () => {
-    const extension = retryLifecycleActionExtension([
-      indexWithLifecyclePolicy,
-      indexWithLifecyclePolicy,
-    ]);
-    expect(extension).toBeNull();
-  });
-  test('should return null when not all indices have lifecycle errors', () => {
-    const extension = retryLifecycleActionExtension([
-      indexWithLifecyclePolicy,
-      indexWithLifecycleError,
-    ]);
-    expect(extension).toBeNull();
-  });
-  test('should return extension when all indices have lifecycle errors', () => {
-    const extension = retryLifecycleActionExtension([
-      indexWithLifecycleError,
-      indexWithLifecycleError,
-    ]);
-    expect(extension).toBeDefined();
-    expect(extension).toMatchSnapshot();
-  });
-});
-describe('remove lifecycle action extension', () => {
-  test('should return null when no indices have index lifecycle policy', () => {
-    const extension = removeLifecyclePolicyActionExtension([indexWithoutLifecyclePolicy]);
-    expect(extension).toBeNull();
-  });
-  test('should return null when some indices have index lifecycle policy', () => {
-    const extension = removeLifecyclePolicyActionExtension([
-      indexWithoutLifecyclePolicy,
-      indexWithLifecyclePolicy,
-    ]);
-    expect(extension).toBeNull();
-  });
-  test('should return extension when all indices have lifecycle policy', () => {
-    const extension = removeLifecyclePolicyActionExtension([
-      indexWithLifecycleError,
-      indexWithLifecycleError,
-    ]);
-    expect(extension).toBeDefined();
-    expect(extension).toMatchSnapshot();
-  });
-});
-describe('add lifecycle policy action extension', () => {
-  test('should return null when index has index lifecycle policy', () => {
-    const extension = addLifecyclePolicyActionExtension([indexWithLifecyclePolicy]);
-    expect(extension).toBeNull();
-  });
-  test('should return null when more than one index is passed', () => {
-    const extension = addLifecyclePolicyActionExtension([
-      indexWithoutLifecyclePolicy,
-      indexWithoutLifecyclePolicy,
-    ]);
-    expect(extension).toBeNull();
-  });
-  test('should return extension when one index is passed and it does not have lifecycle policy', () => {
-    const extension = addLifecyclePolicyActionExtension([indexWithoutLifecyclePolicy]);
-    expect(extension.renderConfirmModal).toBeDefined;
-    const component = extension.renderConfirmModal(jest.fn());
-    const rendered = mountWithIntl(component);
-    expect(rendered.exists('.euiModal--confirmation'));
-  });
-});
-describe('ilm banner extension', () => {
-  test('should return null when no index has index lifecycle policy', () => {
-    const extension = ilmBannerExtension([
-      indexWithoutLifecyclePolicy,
-      indexWithoutLifecyclePolicy,
-    ]);
-    expect(extension).toBeNull();
-  });
-  test('should return null no index has lifecycle error', () => {
-    const extension = ilmBannerExtension([indexWithoutLifecyclePolicy, indexWithLifecyclePolicy]);
-    expect(extension).toBeNull();
-  });
-  test('should return extension when any index has lifecycle error', () => {
-    const extension = ilmBannerExtension([
-      indexWithoutLifecyclePolicy,
-      indexWithLifecyclePolicy,
-      indexWithLifecycleError,
-    ]);
-    expect(extension).toBeDefined();
-    expect(extension).toMatchSnapshot();
+
+describe('extend index management', () => {
+  describe('retry lifecycle action extension', () => {
+    test('should return null when no indices have index lifecycle policy', () => {
+      const extension = retryLifecycleActionExtension({ indices: [indexWithoutLifecyclePolicy] });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when no index has lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecyclePolicy, indexWithLifecyclePolicy],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when not all indices have lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecyclePolicy, indexWithLifecycleError],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when all indices have lifecycle errors', () => {
+      const extension = retryLifecycleActionExtension({
+        indices: [indexWithLifecycleError, indexWithLifecycleError],
+      });
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
   });
-});
-describe('ilm summary extension', () => {
-  test('should render null when index has no index lifecycle policy', () => {
-    const extension = ilmSummaryExtension(indexWithoutLifecyclePolicy);
-    const rendered = mountWithIntl(extension);
-    expect(rendered.isEmptyRender()).toBeTruthy();
+
+  describe('remove lifecycle action extension', () => {
+    test('should return null when no indices have index lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when some indices have index lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy, indexWithLifecyclePolicy],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when all indices have lifecycle policy', () => {
+      const extension = removeLifecyclePolicyActionExtension({
+        indices: [indexWithLifecycleError, indexWithLifecycleError],
+      });
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
   });
-  test('should return extension when index has lifecycle policy', () => {
-    const extension = ilmSummaryExtension(indexWithLifecyclePolicy);
-    expect(extension).toBeDefined();
-    const rendered = mountWithIntl(extension);
-    expect(rendered).toMatchSnapshot();
+
+  describe('add lifecycle policy action extension', () => {
+    test('should return null when index has index lifecycle policy', () => {
+      const extension = addLifecyclePolicyActionExtension({ indices: [indexWithLifecyclePolicy] });
+      expect(extension).toBeNull();
+    });
+
+    test('should return null when more than one index is passed', () => {
+      const extension = addLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy, indexWithoutLifecyclePolicy],
+      });
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when one index is passed and it does not have lifecycle policy', () => {
+      const extension = addLifecyclePolicyActionExtension({
+        indices: [indexWithoutLifecyclePolicy],
+      });
+      expect(extension.renderConfirmModal).toBeDefined;
+      const component = extension.renderConfirmModal(jest.fn());
+      const rendered = mountWithIntl(component);
+      expect(rendered.exists('.euiModal--confirmation'));
+    });
   });
-  test('should return extension when index has lifecycle error', () => {
-    const extension = ilmSummaryExtension(indexWithLifecycleError);
-    expect(extension).toBeDefined();
-    const rendered = mountWithIntl(extension);
-    expect(rendered).toMatchSnapshot();
+
+  describe('ilm banner extension', () => {
+    test('should return null when no index has index lifecycle policy', () => {
+      const extension = ilmBannerExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension).toBeNull();
+    });
+
+    test('should return null no index has lifecycle error', () => {
+      const extension = ilmBannerExtension([indexWithoutLifecyclePolicy, indexWithLifecyclePolicy]);
+      expect(extension).toBeNull();
+    });
+
+    test('should return extension when any index has lifecycle error', () => {
+      const extension = ilmBannerExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithLifecyclePolicy,
+        indexWithLifecycleError,
+      ]);
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
   });
-});
-describe('ilm filter extension', () => {
-  test('should return empty array when no indices have index lifecycle policy', () => {
-    const extension = ilmFilterExtension([
-      indexWithoutLifecyclePolicy,
-      indexWithoutLifecyclePolicy,
-    ]);
-    expect(extension.length).toBe(0);
+
+  describe('ilm summary extension', () => {
+    test('should render null when index has no index lifecycle policy', () => {
+      const extension = ilmSummaryExtension(indexWithoutLifecyclePolicy);
+      const rendered = mountWithIntl(extension);
+      expect(rendered.isEmptyRender()).toBeTruthy();
+    });
+
+    test('should return extension when index has lifecycle policy', () => {
+      const extension = ilmSummaryExtension(indexWithLifecyclePolicy);
+      expect(extension).toBeDefined();
+      const rendered = mountWithIntl(extension);
+      expect(rendered).toMatchSnapshot();
+    });
+
+    test('should return extension when index has lifecycle error', () => {
+      const extension = ilmSummaryExtension(indexWithLifecycleError);
+      expect(extension).toBeDefined();
+      const rendered = mountWithIntl(extension);
+      expect(rendered).toMatchSnapshot();
+    });
   });
-  test('should return extension when any index has lifecycle policy', () => {
-    const extension = ilmFilterExtension([
-      indexWithLifecyclePolicy,
-      indexWithoutLifecyclePolicy,
-      indexWithoutLifecyclePolicy,
-    ]);
-    expect(extension).toBeDefined();
-    expect(extension).toMatchSnapshot();
+
+  describe('ilm filter extension', () => {
+    test('should return empty array when no indices have index lifecycle policy', () => {
+      const extension = ilmFilterExtension([
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension.length).toBe(0);
+    });
+
+    test('should return extension when any index has lifecycle policy', () => {
+      const extension = ilmFilterExtension([
+        indexWithLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+        indexWithoutLifecyclePolicy,
+      ]);
+      expect(extension).toBeDefined();
+      expect(extension).toMatchSnapshot();
+    });
   });
 });
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.js b/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.js
deleted file mode 100644
index d01df3c6beeec..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const BASE_PATH = '/management/elasticsearch/index_lifecycle_management/';
-export const PLUGIN_ID = 'index_lifecycle_management';
-export {
-  UIM_APP_NAME,
-  UIM_APP_LOAD,
-  UIM_POLICY_CREATE,
-  UIM_POLICY_UPDATE,
-  UIM_POLICY_DELETE,
-  UIM_POLICY_ATTACH_INDEX,
-  UIM_POLICY_ATTACH_INDEX_TEMPLATE,
-  UIM_POLICY_DETACH_INDEX,
-  UIM_CONFIG_COLD_PHASE,
-  UIM_CONFIG_WARM_PHASE,
-  UIM_CONFIG_SET_PRIORITY,
-  UIM_CONFIG_FREEZE_INDEX,
-  UIM_INDEX_RETRY_STEP,
-  UIM_EDIT_CLICK,
-} from './ui_metric';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.ts
new file mode 100644
index 0000000000000..9193efb561a0f
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/common/constants/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const PLUGIN = {
+  ID: 'index_lifecycle_management',
+  TITLE: i18n.translate('xpack.indexLifecycleMgmt.appTitle', {
+    defaultMessage: 'Index Lifecycle Policies',
+  }),
+};
+
+export const BASE_PATH = '/management/elasticsearch/index_lifecycle_management/';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/common/constants/ui_metric.js b/x-pack/legacy/plugins/index_lifecycle_management/common/constants/ui_metric.js
deleted file mode 100644
index bc673b5b7a5e5..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/common/constants/ui_metric.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const UIM_APP_NAME = 'index_lifecycle_management';
-
-export const UIM_APP_LOAD = 'app_load';
-export const UIM_POLICY_CREATE = 'policy_create';
-export const UIM_POLICY_UPDATE = 'policy_update';
-export const UIM_POLICY_DELETE = 'policy_delete';
-export const UIM_POLICY_ATTACH_INDEX = 'policy_attach_index';
-export const UIM_POLICY_ATTACH_INDEX_TEMPLATE = 'policy_attach_index_template';
-export const UIM_POLICY_DETACH_INDEX = 'policy_detach_index';
-export const UIM_CONFIG_COLD_PHASE = 'config_cold_phase';
-export const UIM_CONFIG_WARM_PHASE = 'config_warm_phase';
-export const UIM_CONFIG_SET_PRIORITY = 'config_set_priority';
-export const UIM_CONFIG_FREEZE_INDEX = 'config_freeze_index';
-export const UIM_INDEX_RETRY_STEP = 'index_retry_step';
-export const UIM_EDIT_CLICK = 'edit_click';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/index.js b/x-pack/legacy/plugins/index_lifecycle_management/index.js
deleted file mode 100644
index 5a8f6548af97f..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/index.js
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { resolve } from 'path';
-import { registerTemplatesRoutes } from './server/routes/api/templates';
-import { registerNodesRoutes } from './server/routes/api/nodes';
-import { registerPoliciesRoutes } from './server/routes/api/policies';
-import { registerIndexRoutes } from './server/routes/api/index';
-import { registerLicenseChecker } from './server/lib/register_license_checker';
-import { PLUGIN_ID } from './common/constants';
-import { indexLifecycleDataEnricher } from './index_lifecycle_data';
-
-export function indexLifecycleManagement(kibana) {
-  return new kibana.Plugin({
-    config: Joi => {
-      return Joi.object({
-        enabled: Joi.boolean().default(true),
-        ui: Joi.object({
-          enabled: Joi.boolean().default(true),
-        }).default(),
-        filteredNodeAttributes: Joi.array()
-          .items(Joi.string())
-          .default([]),
-      }).default();
-    },
-    id: PLUGIN_ID,
-    publicDir: resolve(__dirname, 'public'),
-    configPrefix: 'xpack.ilm',
-    require: ['kibana', 'elasticsearch', 'xpack_main', 'index_management'],
-    uiExports: {
-      styleSheetPaths: resolve(__dirname, 'public/index.scss'),
-      managementSections: ['plugins/index_lifecycle_management'],
-      injectDefaultVars(server) {
-        const config = server.config();
-        return {
-          ilmUiEnabled: config.get('xpack.ilm.ui.enabled'),
-        };
-      },
-    },
-    isEnabled(config) {
-      return (
-        config.get('xpack.ilm.enabled') &&
-        config.has('xpack.index_management.enabled') &&
-        config.get('xpack.index_management.enabled')
-      );
-    },
-    init: function(server) {
-      registerLicenseChecker(server);
-      registerTemplatesRoutes(server);
-      registerNodesRoutes(server);
-      registerPoliciesRoutes(server);
-      registerIndexRoutes(server);
-
-      if (
-        server.config().get('xpack.ilm.ui.enabled') &&
-        server.plugins.index_management &&
-        server.plugins.index_management.addIndexManagementDataEnricher
-      ) {
-        server.plugins.index_management.addIndexManagementDataEnricher(indexLifecycleDataEnricher);
-      }
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/index.ts
new file mode 100644
index 0000000000000..9b14b7143bf44
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/index.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Legacy } from 'kibana';
+import { resolve } from 'path';
+import { PLUGIN } from './common/constants';
+import { Plugin as IndexLifecycleManagementPlugin } from './plugin';
+import { createShim } from './shim';
+
+export function indexLifecycleManagement(kibana: any) {
+  return new kibana.Plugin({
+    id: PLUGIN.ID,
+    configPrefix: 'xpack.ilm',
+    publicDir: resolve(__dirname, 'public'),
+    require: ['kibana', 'elasticsearch', 'xpack_main', 'index_management'],
+    uiExports: {
+      styleSheetPaths: resolve(__dirname, 'public/np_ready/application/index.scss'),
+      managementSections: ['plugins/index_lifecycle_management/legacy'],
+      injectDefaultVars(server: Legacy.Server) {
+        const config = server.config();
+        return {
+          ilmUiEnabled: config.get('xpack.ilm.ui.enabled'),
+        };
+      },
+    },
+    config: (Joi: any) => {
+      return Joi.object({
+        // display menu item
+        ui: Joi.object({
+          enabled: Joi.boolean().default(true),
+        }).default(),
+
+        // enable plugin
+        enabled: Joi.boolean().default(true),
+
+        filteredNodeAttributes: Joi.array()
+          .items(Joi.string())
+          .default([]),
+      }).default();
+    },
+    isEnabled(config: any) {
+      return (
+        config.get('xpack.ilm.enabled') &&
+        config.has('xpack.index_management.enabled') &&
+        config.get('xpack.index_management.enabled')
+      );
+    },
+    init(server: Legacy.Server) {
+      const core = server.newPlatform.setup.core;
+      const plugins = {};
+      const __LEGACY = createShim(server);
+
+      const indexLifecycleManagementPlugin = new IndexLifecycleManagementPlugin();
+
+      // Set up plugin.
+      indexLifecycleManagementPlugin.setup(core, plugins, __LEGACY);
+    },
+  });
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/index_lifecycle_data.js b/x-pack/legacy/plugins/index_lifecycle_management/index_lifecycle_data.js
deleted file mode 100644
index 57b90204ce224..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/index_lifecycle_data.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const indexLifecycleDataEnricher = async (indicesList, callWithRequest) => {
-  if (!indicesList || !indicesList.length) {
-    return;
-  }
-  const params = {
-    path: '/*/_ilm/explain',
-    method: 'GET',
-  };
-  const { indices: ilmIndicesData } = await callWithRequest('transport.request', params);
-  return indicesList.map(index => {
-    return {
-      ...index,
-      ilm: { ...(ilmIndicesData[index.name] || {}) },
-    };
-  });
-};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/plugin.ts b/x-pack/legacy/plugins/index_lifecycle_management/plugin.ts
new file mode 100644
index 0000000000000..8d7f937039203
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/plugin.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup } from 'kibana/server';
+import { LegacySetup } from './shim';
+import { registerLicenseChecker } from './server/lib/register_license_checker';
+import { registerIndexRoutes } from './server/routes/api/index';
+import { registerNodesRoutes } from './server/routes/api/nodes';
+import { registerPoliciesRoutes } from './server/routes/api/policies';
+import { registerTemplatesRoutes } from './server/routes/api/templates';
+
+const indexLifecycleDataEnricher = async (indicesList: any, callWithRequest: any) => {
+  if (!indicesList || !indicesList.length) {
+    return;
+  }
+  const params = {
+    path: '/*/_ilm/explain',
+    method: 'GET',
+  };
+  const { indices: ilmIndicesData } = await callWithRequest('transport.request', params);
+  return indicesList.map((index: any): any => {
+    return {
+      ...index,
+      ilm: { ...(ilmIndicesData[index.name] || {}) },
+    };
+  });
+};
+
+export class Plugin {
+  public setup(core: CoreSetup, plugins: any, __LEGACY: LegacySetup): void {
+    const { server } = __LEGACY;
+
+    registerLicenseChecker(server);
+
+    // Register routes.
+    registerIndexRoutes(server);
+    registerNodesRoutes(server);
+    registerPoliciesRoutes(server);
+    registerTemplatesRoutes(server);
+
+    const serverPlugins = server.plugins as any;
+
+    if (
+      server.config().get('xpack.ilm.ui.enabled') &&
+      serverPlugins.index_management &&
+      serverPlugins.index_management.addIndexManagementDataEnricher
+    ) {
+      serverPlugins.index_management.addIndexManagementDataEnricher(indexLifecycleDataEnricher);
+    }
+  }
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/constants/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/constants/index.js
deleted file mode 100644
index bc1244dc7b281..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/constants/index.js
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const SET_PHASE_DATA = 'SET_PHASE_DATA';
-export const SET_SELECTED_NODE_ATTRS = 'SET_SELECTED_NODE_ATTRS';
-export const PHASE_HOT = 'hot';
-export const PHASE_WARM = 'warm';
-export const PHASE_COLD = 'cold';
-export const PHASE_DELETE = 'delete';
-
-export const PHASE_ENABLED = 'phaseEnabled';
-
-export const PHASE_ROLLOVER_ENABLED = 'rolloverEnabled';
-export const WARM_PHASE_ON_ROLLOVER = 'warmPhaseOnRollover';
-export const PHASE_ROLLOVER_ALIAS = 'selectedAlias';
-export const PHASE_ROLLOVER_MAX_AGE = 'selectedMaxAge';
-export const PHASE_ROLLOVER_MAX_AGE_UNITS = 'selectedMaxAgeUnits';
-export const PHASE_ROLLOVER_MAX_SIZE_STORED = 'selectedMaxSizeStored';
-export const PHASE_ROLLOVER_MAX_DOCUMENTS = 'selectedMaxDocuments';
-export const PHASE_ROLLOVER_MAX_SIZE_STORED_UNITS = 'selectedMaxSizeStoredUnits';
-export const PHASE_ROLLOVER_MINIMUM_AGE = 'selectedMinimumAge';
-export const PHASE_ROLLOVER_MINIMUM_AGE_UNITS = 'selectedMinimumAgeUnits';
-
-export const PHASE_FORCE_MERGE_SEGMENTS = 'selectedForceMergeSegments';
-export const PHASE_FORCE_MERGE_ENABLED = 'forceMergeEnabled';
-export const PHASE_FREEZE_ENABLED = 'freezeEnabled';
-
-export const PHASE_SHRINK_ENABLED = 'shrinkEnabled';
-
-export const PHASE_NODE_ATTRS = 'selectedNodeAttrs';
-export const PHASE_PRIMARY_SHARD_COUNT = 'selectedPrimaryShardCount';
-export const PHASE_REPLICA_COUNT = 'selectedReplicaCount';
-export const PHASE_INDEX_PRIORITY = 'phaseIndexPriority';
-
-export const PHASE_ATTRIBUTES_THAT_ARE_NUMBERS_VALIDATE = [
-  PHASE_ROLLOVER_MINIMUM_AGE,
-  PHASE_FORCE_MERGE_SEGMENTS,
-  PHASE_PRIMARY_SHARD_COUNT,
-  PHASE_REPLICA_COUNT,
-  PHASE_INDEX_PRIORITY,
-];
-export const PHASE_ATTRIBUTES_THAT_ARE_NUMBERS = [
-  ...PHASE_ATTRIBUTES_THAT_ARE_NUMBERS_VALIDATE,
-  PHASE_ROLLOVER_MAX_AGE,
-  PHASE_ROLLOVER_MAX_SIZE_STORED,
-  PHASE_ROLLOVER_MAX_DOCUMENTS,
-];
-
-export const STRUCTURE_INDEX_TEMPLATE = 'indexTemplate';
-export const STRUCTURE_TEMPLATE_SELECTION = 'templateSelection';
-export const STRUCTURE_TEMPLATE_NAME = 'templateName';
-export const STRUCTURE_CONFIGURATION = 'configuration';
-export const STRUCTURE_NODE_ATTRS = 'node_attrs';
-export const STRUCTURE_PRIMARY_NODES = 'primary_nodes';
-export const STRUCTURE_REPLICAS = 'replicas';
-
-export const STRUCTURE_POLICY_CONFIGURATION = 'policyConfiguration';
-
-export const STRUCTURE_REVIEW = 'review';
-export const STRUCTURE_POLICY_NAME = 'policyName';
-export const STRUCTURE_INDEX_NAME = 'indexName';
-export const STRUCTURE_ALIAS_NAME = 'aliasName';
-
-export const ERROR_STRUCTURE = {
-  [PHASE_HOT]: {
-    [PHASE_ROLLOVER_ALIAS]: [],
-    [PHASE_ROLLOVER_MAX_AGE]: [],
-    [PHASE_ROLLOVER_MAX_AGE_UNITS]: [],
-    [PHASE_ROLLOVER_MAX_SIZE_STORED]: [],
-    [PHASE_ROLLOVER_MAX_DOCUMENTS]: [],
-    [PHASE_ROLLOVER_MAX_SIZE_STORED_UNITS]: [],
-    [PHASE_INDEX_PRIORITY]: [],
-  },
-  [PHASE_WARM]: {
-    [PHASE_ROLLOVER_ALIAS]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
-    [PHASE_NODE_ATTRS]: [],
-    [PHASE_PRIMARY_SHARD_COUNT]: [],
-    [PHASE_REPLICA_COUNT]: [],
-    [PHASE_FORCE_MERGE_SEGMENTS]: [],
-    [PHASE_INDEX_PRIORITY]: [],
-  },
-  [PHASE_COLD]: {
-    [PHASE_ROLLOVER_ALIAS]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
-    [PHASE_NODE_ATTRS]: [],
-    [PHASE_REPLICA_COUNT]: [],
-    [PHASE_INDEX_PRIORITY]: [],
-  },
-  [PHASE_DELETE]: {
-    [PHASE_ROLLOVER_ALIAS]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
-    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
-  },
-  [STRUCTURE_POLICY_NAME]: [],
-};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/index.js
deleted file mode 100644
index ef44f5dbfeca4..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/index.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import './register_management_section';
-import './register_routes';
-
-import chrome from 'ui/chrome';
-import { addAllExtensions } from './extend_index_management';
-
-// Only add extensions if ILM UI is enabled
-if (chrome.getInjected('ilmUiEnabled')) {
-  addAllExtensions();
-}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/legacy.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/legacy.ts
new file mode 100644
index 0000000000000..3c21a644c0f78
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/legacy.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { App } from 'src/core/public';
+
+/* Legacy Imports */
+import { npSetup, npStart } from 'ui/new_platform';
+import chrome from 'ui/chrome';
+import routes from 'ui/routes';
+import { management } from 'ui/management';
+import { createUiStatsReporter } from '../../../../../src/legacy/core_plugins/ui_metric/public';
+
+import { PLUGIN, BASE_PATH } from '../common/constants';
+import { createPlugin } from './np_ready';
+import { addAllExtensions } from './np_ready/extend_index_management';
+
+if (chrome.getInjected('ilmUiEnabled')) {
+  // We have to initialize this outside of the NP lifecycle, otherwise these extensions won't
+  // be available in Index Management unless the user visits ILM first.
+  addAllExtensions();
+
+  // This method handles the cleanup needed when route is scope is destroyed.  It also prevents Angular
+  // from destroying scope when route changes and both old route and new route are this same route.
+  const manageAngularLifecycle = ($scope: any, $route: any, unmount: () => void) => {
+    const lastRoute = $route.current;
+    const deregister = $scope.$on('$locationChangeSuccess', () => {
+      const currentRoute = $route.current;
+      // if templates are the same we are on the same route
+      if (lastRoute.$$route.template === currentRoute.$$route.template) {
+        // this prevents angular from destroying scope
+        $route.current = lastRoute;
+      }
+    });
+    $scope.$on('$destroy', () => {
+      if (deregister) {
+        deregister();
+      }
+      unmount();
+    });
+  };
+
+  // Once this app no longer depends upon Angular's routing (e.g. for the "redirect" service), we can
+  // use the Management plugin's API to register this app within the Elasticsearch section.
+  const esSection = management.getSection('elasticsearch');
+  esSection.register('index_lifecycle_policies', {
+    visible: true,
+    display: PLUGIN.TITLE,
+    order: 2,
+    url: `#${BASE_PATH}policies`,
+  });
+
+  const REACT_ROOT_ID = 'indexLifecycleManagementReactRoot';
+
+  const template = `<kbn-management-app section="elasticsearch/index_lifecycle_policies">
+    <div id="${REACT_ROOT_ID}" class="policyTable__horizontalScrollContainer"/>
+  </kbn-management-app>
+  `;
+
+  routes.when(`${BASE_PATH}:view?/:action?/:id?`, {
+    template,
+    controllerAs: 'indexLifecycleManagement',
+    controller: class IndexLifecycleManagementController {
+      constructor($scope: any, $route: any, kbnUrl: any, $rootScope: any) {
+        $scope.$$postDigest(() => {
+          const element = document.getElementById(REACT_ROOT_ID)!;
+          const { core } = npSetup;
+
+          const coreDependencies = {
+            ...core,
+            application: {
+              ...core.application,
+              async register(app: App) {
+                const unmountApp = await app.mount({ ...npStart } as any, {
+                  element,
+                  appBasePath: '',
+                  onAppLeave: () => undefined,
+                });
+                manageAngularLifecycle($scope, $route, unmountApp as any);
+              },
+            },
+          };
+
+          // The Plugin interface won't allow us to pass __LEGACY as a third argument, so we'll just
+          // sneak it inside of the plugins argument for now.
+          const pluginDependencies = {
+            __LEGACY: {
+              redirect: (path: string) => {
+                $scope.$evalAsync(() => {
+                  kbnUrl.redirect(path);
+                });
+              },
+              createUiStatsReporter,
+            },
+          };
+
+          const plugin = createPlugin({} as any);
+          plugin.setup(coreDependencies, pluginDependencies);
+        });
+      }
+    } as any,
+  } as any);
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/main.html b/x-pack/legacy/plugins/index_lifecycle_management/public/main.html
deleted file mode 100644
index d54cba0632cdf..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/main.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<kbn-management-app section="elasticsearch/index_lifecycle_policies">
-  <div id="indexLifecycleManagementReactRoot" class="policyTable__horizontalScrollContainer"/>
-</kbn-management-app>
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/_index_lifecycle_management.scss b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/_index_lifecycle_management.scss
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/_index_lifecycle_management.scss
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/_index_lifecycle_management.scss
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/app.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/app.tsx
similarity index 75%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/app.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/app.tsx
index 87a2b45c7fedd..6738d7caa4444 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/app.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/app.tsx
@@ -6,13 +6,16 @@
 
 import React, { useEffect } from 'react';
 import { HashRouter, Switch, Route, Redirect } from 'react-router-dom';
-import { BASE_PATH, UIM_APP_LOAD } from '../common/constants';
+import { METRIC_TYPE } from '@kbn/analytics';
+
+import { BASE_PATH } from '../../../common/constants';
+import { UIM_APP_LOAD } from './constants';
 import { EditPolicy } from './sections/edit_policy';
 import { PolicyTable } from './sections/policy_table';
-import { trackUiMetric } from './services';
+import { trackUiMetric } from './services/ui_metric';
 
 export const App = () => {
-  useEffect(() => trackUiMetric('loaded', UIM_APP_LOAD), []);
+  useEffect(() => trackUiMetric(METRIC_TYPE.LOADED, UIM_APP_LOAD), []);
 
   return (
     <HashRouter>
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/index.ts
new file mode 100644
index 0000000000000..a631a38fbcb7e
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/index.ts
@@ -0,0 +1,103 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './ui_metric';
+
+export const SET_PHASE_DATA: string = 'SET_PHASE_DATA';
+export const SET_SELECTED_NODE_ATTRS: string = 'SET_SELECTED_NODE_ATTRS';
+export const PHASE_HOT: string = 'hot';
+export const PHASE_WARM: string = 'warm';
+export const PHASE_COLD: string = 'cold';
+export const PHASE_DELETE: string = 'delete';
+
+export const PHASE_ENABLED: string = 'phaseEnabled';
+
+export const PHASE_ROLLOVER_ENABLED: string = 'rolloverEnabled';
+export const WARM_PHASE_ON_ROLLOVER: string = 'warmPhaseOnRollover';
+export const PHASE_ROLLOVER_ALIAS: string = 'selectedAlias';
+export const PHASE_ROLLOVER_MAX_AGE: string = 'selectedMaxAge';
+export const PHASE_ROLLOVER_MAX_AGE_UNITS: string = 'selectedMaxAgeUnits';
+export const PHASE_ROLLOVER_MAX_SIZE_STORED: string = 'selectedMaxSizeStored';
+export const PHASE_ROLLOVER_MAX_DOCUMENTS: string = 'selectedMaxDocuments';
+export const PHASE_ROLLOVER_MAX_SIZE_STORED_UNITS: string = 'selectedMaxSizeStoredUnits';
+export const PHASE_ROLLOVER_MINIMUM_AGE: string = 'selectedMinimumAge';
+export const PHASE_ROLLOVER_MINIMUM_AGE_UNITS: string = 'selectedMinimumAgeUnits';
+
+export const PHASE_FORCE_MERGE_SEGMENTS: string = 'selectedForceMergeSegments';
+export const PHASE_FORCE_MERGE_ENABLED: string = 'forceMergeEnabled';
+export const PHASE_FREEZE_ENABLED: string = 'freezeEnabled';
+
+export const PHASE_SHRINK_ENABLED: string = 'shrinkEnabled';
+
+export const PHASE_NODE_ATTRS: string = 'selectedNodeAttrs';
+export const PHASE_PRIMARY_SHARD_COUNT: string = 'selectedPrimaryShardCount';
+export const PHASE_REPLICA_COUNT: string = 'selectedReplicaCount';
+export const PHASE_INDEX_PRIORITY: string = 'phaseIndexPriority';
+
+export const PHASE_ATTRIBUTES_THAT_ARE_NUMBERS_VALIDATE: string[] = [
+  PHASE_ROLLOVER_MINIMUM_AGE,
+  PHASE_FORCE_MERGE_SEGMENTS,
+  PHASE_PRIMARY_SHARD_COUNT,
+  PHASE_REPLICA_COUNT,
+  PHASE_INDEX_PRIORITY,
+];
+export const PHASE_ATTRIBUTES_THAT_ARE_NUMBERS: string[] = [
+  ...PHASE_ATTRIBUTES_THAT_ARE_NUMBERS_VALIDATE,
+  PHASE_ROLLOVER_MAX_AGE,
+  PHASE_ROLLOVER_MAX_SIZE_STORED,
+  PHASE_ROLLOVER_MAX_DOCUMENTS,
+];
+
+export const STRUCTURE_INDEX_TEMPLATE: string = 'indexTemplate';
+export const STRUCTURE_TEMPLATE_SELECTION: string = 'templateSelection';
+export const STRUCTURE_TEMPLATE_NAME: string = 'templateName';
+export const STRUCTURE_CONFIGURATION: string = 'configuration';
+export const STRUCTURE_NODE_ATTRS: string = 'node_attrs';
+export const STRUCTURE_PRIMARY_NODES: string = 'primary_nodes';
+export const STRUCTURE_REPLICAS: string = 'replicas';
+
+export const STRUCTURE_POLICY_CONFIGURATION: string = 'policyConfiguration';
+
+export const STRUCTURE_REVIEW: string = 'review';
+export const STRUCTURE_POLICY_NAME: string = 'policyName';
+export const STRUCTURE_INDEX_NAME: string = 'indexName';
+export const STRUCTURE_ALIAS_NAME: string = 'aliasName';
+
+export const ERROR_STRUCTURE: any = {
+  [PHASE_HOT]: {
+    [PHASE_ROLLOVER_ALIAS]: [],
+    [PHASE_ROLLOVER_MAX_AGE]: [],
+    [PHASE_ROLLOVER_MAX_AGE_UNITS]: [],
+    [PHASE_ROLLOVER_MAX_SIZE_STORED]: [],
+    [PHASE_ROLLOVER_MAX_DOCUMENTS]: [],
+    [PHASE_ROLLOVER_MAX_SIZE_STORED_UNITS]: [],
+    [PHASE_INDEX_PRIORITY]: [],
+  },
+  [PHASE_WARM]: {
+    [PHASE_ROLLOVER_ALIAS]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
+    [PHASE_NODE_ATTRS]: [],
+    [PHASE_PRIMARY_SHARD_COUNT]: [],
+    [PHASE_REPLICA_COUNT]: [],
+    [PHASE_FORCE_MERGE_SEGMENTS]: [],
+    [PHASE_INDEX_PRIORITY]: [],
+  },
+  [PHASE_COLD]: {
+    [PHASE_ROLLOVER_ALIAS]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
+    [PHASE_NODE_ATTRS]: [],
+    [PHASE_REPLICA_COUNT]: [],
+    [PHASE_INDEX_PRIORITY]: [],
+  },
+  [PHASE_DELETE]: {
+    [PHASE_ROLLOVER_ALIAS]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE]: [],
+    [PHASE_ROLLOVER_MINIMUM_AGE_UNITS]: [],
+  },
+  [STRUCTURE_POLICY_NAME]: [],
+};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/ui_metric.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/ui_metric.ts
new file mode 100644
index 0000000000000..ee4dbb8582cef
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/constants/ui_metric.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const UIM_APP_NAME: string = 'index_lifecycle_management';
+
+export const UIM_APP_LOAD: string = 'app_load';
+export const UIM_POLICY_CREATE: string = 'policy_create';
+export const UIM_POLICY_UPDATE: string = 'policy_update';
+export const UIM_POLICY_DELETE: string = 'policy_delete';
+export const UIM_POLICY_ATTACH_INDEX: string = 'policy_attach_index';
+export const UIM_POLICY_ATTACH_INDEX_TEMPLATE: string = 'policy_attach_index_template';
+export const UIM_POLICY_DETACH_INDEX: string = 'policy_detach_index';
+export const UIM_CONFIG_COLD_PHASE: string = 'config_cold_phase';
+export const UIM_CONFIG_WARM_PHASE: string = 'config_warm_phase';
+export const UIM_CONFIG_SET_PRIORITY: string = 'config_set_priority';
+export const UIM_CONFIG_FREEZE_INDEX: string = 'config_freeze_index';
+export const UIM_INDEX_RETRY_STEP: string = 'index_retry_step';
+export const UIM_EDIT_CLICK: string = 'edit_click';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/index.scss b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/index.scss
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/index.scss
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/index.scss
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/index.tsx b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/index.tsx
new file mode 100644
index 0000000000000..b87a633d65c9c
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/index.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { render, unmountComponentAtNode } from 'react-dom';
+import { Provider } from 'react-redux';
+import { DocLinksStart, ToastsSetup, HttpSetup, FatalErrorsSetup } from 'src/core/public';
+
+import { App } from './app';
+import { indexLifecycleManagementStore } from './store';
+import { init as initHttp } from './services/http';
+import { init as initNavigation } from './services/navigation';
+import { init as initDocumentation } from './services/documentation';
+import { init as initUiMetric } from './services/ui_metric';
+import { init as initNotification } from './services/notification';
+
+export interface LegacySetup {
+  redirect: any;
+  createUiStatsReporter: any;
+}
+
+interface AppDependencies {
+  legacy: LegacySetup;
+  I18nContext: any;
+  http: HttpSetup;
+  toasts: ToastsSetup;
+  fatalErrors: FatalErrorsSetup;
+  docLinks: DocLinksStart;
+  element: HTMLElement;
+}
+
+export const renderApp = (appDependencies: AppDependencies) => {
+  const {
+    legacy: { redirect, createUiStatsReporter },
+    I18nContext,
+    http,
+    toasts,
+    fatalErrors,
+    docLinks: { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION },
+    element,
+  } = appDependencies;
+
+  // Initialize services
+  initHttp(http);
+  initNavigation(redirect);
+  initDocumentation(`${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/reference/${DOC_LINK_VERSION}/`);
+  initUiMetric(createUiStatsReporter);
+  initNotification(toasts, fatalErrors);
+
+  render(
+    <I18nContext>
+      <Provider store={indexLifecycleManagementStore()}>
+        <App />
+      </Provider>
+    </I18nContext>,
+    element
+  );
+
+  return () => unmountComponentAtNode(element);
+};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/active_badge.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/active_badge.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/active_badge.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/active_badge.js
index df0236b63e41f..f39e103cffd25 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/active_badge.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/active_badge.js
@@ -6,6 +6,7 @@
 import React from 'react';
 import { EuiBadge } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+
 export const ActiveBadge = () => {
   return (
     <EuiBadge className="eui-alignMiddle">
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/learn_more_link.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/learn_more_link.js
similarity index 79%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/learn_more_link.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/learn_more_link.js
index afa26cf6389a6..2284b9e39835c 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/learn_more_link.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/learn_more_link.js
@@ -6,17 +6,16 @@
 
 import React from 'react';
 import { EuiLink } from '@elastic/eui';
-import { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } from 'ui/documentation_links';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-const esBase = `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/reference/${DOC_LINK_VERSION}/`;
+import { createDocLink } from '../../services/documentation';
 
 export class LearnMoreLink extends React.PureComponent {
   render() {
     const { href, docPath, text } = this.props;
     let url;
     if (docPath) {
-      url = `${esBase}${docPath}`;
+      url = createDocLink(docPath);
     } else {
       url = href;
     }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/optional_label.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/optional_label.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/optional_label.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/optional_label.js
index dc9909941e67e..8b464070386f2 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/optional_label.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/optional_label.js
@@ -5,6 +5,7 @@
  */
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
+
 export const OptionalLabel = () => {
   return (
     <FormattedMessage id="xpack.indexLifecycleMgmt.optionalMessage" defaultMessage=" (optional)" />
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/phase_error_message.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/phase_error_message.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/phase_error_message.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/phase_error_message.js
index c5fd0984ca6f3..904ac7c25f2f9 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/components/phase_error_message.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/components/phase_error_message.js
@@ -6,6 +6,7 @@
 import React from 'react';
 import { EuiBadge } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+
 export const PhaseErrorMessage = ({ isShowingErrors }) => {
   return isShowingErrors ? (
     <EuiBadge className="eui-alignMiddle" color="danger">
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/cold_phase.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/cold_phase.container.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/cold_phase.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/cold_phase.container.js
index 8e73f4b9ede3c..1f2468e79ebd3 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/cold_phase.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/cold_phase.container.js
@@ -5,10 +5,11 @@
  */
 
 import { connect } from 'react-redux';
-import { ColdPhase as PresentationComponent } from './cold_phase';
+
 import { getPhase } from '../../../../store/selectors';
 import { setPhaseData } from '../../../../store/actions';
 import { PHASE_COLD, PHASE_HOT, PHASE_ROLLOVER_ENABLED } from '../../../../constants';
+import { ColdPhase as PresentationComponent } from './cold_phase';
 
 export const ColdPhase = connect(
   state => ({
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/cold_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/cold_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/cold_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/cold_phase.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/cold_phase/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/cold_phase/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.container.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.container.js
index 64a5d4ad651d7..74ec9b2c98ed9 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.container.js
@@ -5,10 +5,10 @@
  */
 
 import { connect } from 'react-redux';
-import { DeletePhase as PresentationComponent } from './delete_phase';
 import { getPhase } from '../../../../store/selectors';
 import { setPhaseData } from '../../../../store/actions';
 import { PHASE_DELETE, PHASE_HOT, PHASE_ROLLOVER_ENABLED } from '../../../../constants';
+import { DeletePhase as PresentationComponent } from './delete_phase';
 
 export const DeletePhase = connect(
   state => ({
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.js
index cec8ba5ac8167..146b5c36847db 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/delete_phase.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/delete_phase.js
@@ -5,13 +5,13 @@
  */
 
 import React, { PureComponent, Fragment } from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
 import PropTypes from 'prop-types';
-import { MinAgeInput } from '../min_age_input';
-
+import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiDescribedFormGroup, EuiSwitch } from '@elastic/eui';
+
 import { PHASE_DELETE, PHASE_ENABLED } from '../../../../constants';
 import { ActiveBadge, PhaseErrorMessage } from '../../../components';
+import { MinAgeInput } from '../min_age_input';
 
 export class DeletePhase extends PureComponent {
   static propTypes = {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/delete_phase/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/delete_phase/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/hot_phase.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/hot_phase.container.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/hot_phase.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/hot_phase.container.js
index cf4960e4e21f1..818af79466f6b 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/hot_phase.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/hot_phase.container.js
@@ -5,10 +5,11 @@
  */
 
 import { connect } from 'react-redux';
-import { HotPhase as PresentationComponent } from './hot_phase';
+
 import { getPhase } from '../../../../store/selectors';
 import { setPhaseData } from '../../../../store/actions';
 import { PHASE_HOT, PHASE_WARM, WARM_PHASE_ON_ROLLOVER } from '../../../../constants';
+import { HotPhase as PresentationComponent } from './hot_phase';
 
 export const HotPhase = connect(
   state => ({
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/hot_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/hot_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/hot_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/hot_phase.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/hot_phase/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/hot_phase/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/min_age_input.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/min_age_input.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/min_age_input.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/min_age_input.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/node_allocation.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/node_allocation.container.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/node_allocation.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/node_allocation.container.js
index 178c2071fdff5..a92959a5b31cf 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/node_allocation.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/node_allocation.container.js
@@ -5,9 +5,10 @@
  */
 
 import { connect } from 'react-redux';
-import { NodeAllocation as PresentationComponent } from './node_allocation';
+
 import { getNodeOptions } from '../../../../store/selectors';
 import { fetchNodes } from '../../../../store/actions';
+import { NodeAllocation as PresentationComponent } from './node_allocation';
 
 export const NodeAllocation = connect(
   state => ({
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/node_allocation.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/node_allocation.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_allocation/node_allocation.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_allocation/node_allocation.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js
index 8887b13740e04..ca7c310723b62 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/node_attrs_details.container.js
@@ -5,9 +5,10 @@
  */
 
 import { connect } from 'react-redux';
-import { NodeAttrsDetails as PresentationComponent } from './node_attrs_details';
+
 import { getNodeDetails } from '../../../../store/selectors';
 import { fetchNodeDetails } from '../../../../store/actions';
+import { NodeAttrsDetails as PresentationComponent } from './node_attrs_details';
 
 export const NodeAttrsDetails = connect(
   (state, ownProps) => ({
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/node_attrs_details.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/node_attrs_details.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/node_attrs_details/node_attrs_details.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/node_attrs_details/node_attrs_details.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/policy_json_flyout.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/policy_json_flyout.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/policy_json_flyout.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/policy_json_flyout.js
index 3f8296a7b0525..b40f3763d8e01 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/policy_json_flyout.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/policy_json_flyout.js
@@ -5,8 +5,8 @@
  */
 
 import React, { PureComponent } from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
 import PropTypes from 'prop-types';
+import { FormattedMessage } from '@kbn/i18n/react';
 
 import {
   EuiButtonEmpty,
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/set_priority_input.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/set_priority_input.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/set_priority_input.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/set_priority_input.js
index fe65cc2d91455..09db792b689da 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/set_priority_input.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/set_priority_input.js
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import React, { Fragment } from 'react';
-import { LearnMoreLink, OptionalLabel } from '../../components';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiFieldNumber, EuiTextColor, EuiDescribedFormGroup } from '@elastic/eui';
+
 import { PHASE_INDEX_PRIORITY } from '../../../constants';
+import { LearnMoreLink, OptionalLabel } from '../../components';
 import { ErrableFormRow } from '../form_errors';
-import { FormattedMessage } from '@kbn/i18n/react';
+
 export const SetPriorityInput = props => {
   const { errors, phaseData, phase, setPhaseData, isShowingErrors } = props;
 
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/warm_phase.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/warm_phase.container.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/warm_phase.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/warm_phase.container.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/warm_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/warm_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/warm_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/warm_phase.js
index 77afd4f7051dc..133e6b617c71e 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/components/warm_phase/warm_phase.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/components/warm_phase/warm_phase.js
@@ -5,9 +5,9 @@
  */
 
 import React, { Fragment, PureComponent } from 'react';
+import PropTypes from 'prop-types';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import PropTypes from 'prop-types';
 import {
   EuiTextColor,
   EuiFlexGroup,
@@ -29,10 +29,10 @@ import {
   PHASE_REPLICA_COUNT,
   PHASE_SHRINK_ENABLED,
 } from '../../../../constants';
+import { LearnMoreLink, ActiveBadge, PhaseErrorMessage, OptionalLabel } from '../../../components';
+import { ErrableFormRow } from '../../form_errors';
 import { SetPriorityInput } from '../set_priority_input';
 import { NodeAllocation } from '../node_allocation';
-import { ErrableFormRow } from '../../form_errors';
-import { LearnMoreLink, ActiveBadge, PhaseErrorMessage, OptionalLabel } from '../../../components';
 import { MinAgeInput } from '../min_age_input';
 
 export class WarmPhase extends PureComponent {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/edit_policy.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/edit_policy.container.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/edit_policy.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/edit_policy.container.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/edit_policy.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/edit_policy.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/edit_policy.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/edit_policy.js
index 6e08ce6be0fa7..040ce189ba2e6 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/edit_policy.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/edit_policy.js
@@ -6,7 +6,6 @@
 
 import React, { Component, Fragment } from 'react';
 import PropTypes from 'prop-types';
-import { toastNotifications } from 'ui/notify';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 
@@ -36,6 +35,7 @@ import {
   STRUCTURE_POLICY_NAME,
 } from '../../constants';
 
+import { toasts } from '../../services/notification';
 import { goToPolicyList } from '../../services/navigation';
 import { findFirstError } from '../../services/find_errors';
 import { LearnMoreLink } from '../components';
@@ -107,7 +107,7 @@ export class EditPolicy extends Component {
     this.setState({ isShowingErrors: true });
     const { saveLifecyclePolicy, lifecycle, saveAsNewPolicy, firstError } = this.props;
     if (firstError) {
-      toastNotifications.addDanger(
+      toasts.addDanger(
         i18n.translate('xpack.indexLifecycleMgmt.editPolicy.formErrorsMessage', {
           defaultMessage: 'Please fix the errors on this page.',
         })
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/form_errors.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/form_errors.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/form_errors.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/form_errors.js
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/index.d.ts
similarity index 73%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/index.ts
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/index.d.ts
index 4ef6e3fa8a6bd..5f15d929a4916 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/index.ts
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/index.d.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { StubIndexPatternAdapter, stubIndexPatternAdapter } from './stub_index_pattern';
+export declare const EditPolicy: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/edit_policy/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/edit_policy/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/components/no_match/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/components/no_match/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/components/no_match/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/components/no_match/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/components/no_match/no_match.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/components/no_match/no_match.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/components/no_match/no_match.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/components/no_match/no_match.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/no_match/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/no_match/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
similarity index 98%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
index 7aae114c3bffe..6129678edf3b7 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/add_policy_to_template_confirm_modal.js
@@ -19,8 +19,8 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
-import { toastNotifications } from 'ui/notify';
 
+import { toasts } from '../../../../services/notification';
 import { addLifecyclePolicyToTemplate, loadIndexTemplates } from '../../../../services/api';
 import { showApiError } from '../../../../services/api_errors';
 import { LearnMoreLink } from '../../../components/learn_more_link';
@@ -59,7 +59,7 @@ export class AddPolicyToTemplateConfirmModal extends Component {
           values: { policyName, templateName },
         }
       );
-      toastNotifications.addSuccess(message);
+      toasts.addSuccess(message);
       onCancel();
     } catch (e) {
       const title = i18n.translate(
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/confirm_delete.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/confirm_delete.js
similarity index 96%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/confirm_delete.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/confirm_delete.js
index c1e47c733545c..0ecc9cc13ecd0 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/confirm_delete.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/confirm_delete.js
@@ -8,7 +8,8 @@ import React, { Component } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiOverlayMask, EuiConfirmModal } from '@elastic/eui';
-import { toastNotifications } from 'ui/notify';
+
+import { toasts } from '../../../../services/notification';
 import { deletePolicy } from '../../../../services/api';
 import { showApiError } from '../../../../services/api_errors';
 
@@ -23,7 +24,7 @@ export class ConfirmDelete extends Component {
         defaultMessage: 'Deleted policy {policyName}',
         values: { policyName },
       });
-      toastNotifications.addSuccess(message);
+      toasts.addSuccess(message);
     } catch (e) {
       const title = i18n.translate('xpack.indexLifecycleMgmt.confirmDelete.errorMessage', {
         defaultMessage: 'Error deleting policy {policyName}',
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.container.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.container.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.container.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.container.js
index 0688284606b1f..7db980abeba8a 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.container.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.container.js
@@ -5,7 +5,7 @@
  */
 
 import { connect } from 'react-redux';
-import { PolicyTable as PresentationComponent } from './policy_table';
+
 import {
   fetchPolicies,
   policyFilterChanged,
@@ -13,6 +13,7 @@ import {
   policyPageSizeChanged,
   policySortChanged,
 } from '../../../../store/actions';
+
 import {
   getPolicies,
   getPageOfPolicies,
@@ -22,6 +23,8 @@ import {
   isPolicyListLoaded,
 } from '../../../../store/selectors';
 
+import { PolicyTable as PresentationComponent } from './policy_table';
+
 const mapDispatchToProps = dispatch => {
   return {
     policyFilterChanged: filter => {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.js
similarity index 98%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.js
index ed3cb5d9d3cd2..eba7f75aa9baf 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/components/policy_table/policy_table.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/components/policy_table/policy_table.js
@@ -34,13 +34,15 @@ import {
   EuiPageContent,
   EuiScreenReaderOnly,
 } from '@elastic/eui';
+
 import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
 
-import { getIndexListUri } from '../../../../../../index_management/public/app/services/navigation';
-import { BASE_PATH, UIM_EDIT_CLICK } from '../../../../../common/constants';
+import { getIndexListUri } from '../../../../../../../../index_management/public/app/services/navigation';
+import { BASE_PATH } from '../../../../../../../common/constants';
+import { UIM_EDIT_CLICK } from '../../../../constants';
 import { getPolicyPath } from '../../../../services/navigation';
 import { flattenPanelTree } from '../../../../services/flatten_panel_tree';
-import { trackUiMetric } from '../../../../services';
+import { trackUiMetric } from '../../../../services/ui_metric';
 import { NoMatch } from '../no_match';
 import { ConfirmDelete } from './confirm_delete';
 import { AddPolicyToTemplateConfirmModal } from './add_policy_to_template_confirm_modal';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/index.d.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/index.d.ts
new file mode 100644
index 0000000000000..fa1b1129523eb
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/index.d.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export declare const PolicyTable: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/sections/policy_table/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/sections/policy_table/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api.js
new file mode 100644
index 0000000000000..f13bbcb6162b8
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api.js
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  UIM_POLICY_DELETE,
+  UIM_POLICY_ATTACH_INDEX,
+  UIM_POLICY_ATTACH_INDEX_TEMPLATE,
+  UIM_POLICY_DETACH_INDEX,
+  UIM_INDEX_RETRY_STEP,
+} from '../constants';
+
+import { trackUiMetric } from './ui_metric';
+import { sendGet, sendPost, sendDelete } from './http';
+
+// The extend_index_management module that we support an injected httpClient here.
+
+export async function loadNodes(httpClient) {
+  return await sendGet(`nodes/list`, httpClient);
+}
+
+export async function loadNodeDetails(selectedNodeAttrs, httpClient) {
+  return await sendGet(`nodes/${selectedNodeAttrs}/details`, httpClient);
+}
+
+export async function loadIndexTemplates(httpClient) {
+  return await sendGet(`templates`, httpClient);
+}
+
+export async function loadIndexTemplate(templateName, httpClient) {
+  if (!templateName) {
+    return {};
+  }
+  return await sendGet(`templates/${templateName}`, httpClient);
+}
+
+export async function loadPolicies(withIndices, httpClient) {
+  const query = withIndices ? '?withIndices=true' : '';
+  return await sendGet('policies', query, httpClient);
+}
+
+export async function savePolicy(policy, httpClient) {
+  return await sendPost(`policies`, policy, httpClient);
+}
+
+export async function deletePolicy(policyName, httpClient) {
+  const response = await sendDelete(`policies/${encodeURIComponent(policyName)}`, httpClient);
+  // Only track successful actions.
+  trackUiMetric('count', UIM_POLICY_DELETE);
+  return response;
+}
+
+export const retryLifecycleForIndex = async (indexNames, httpClient) => {
+  const response = await sendPost(`index/retry`, { indexNames }, httpClient);
+  // Only track successful actions.
+  trackUiMetric('count', UIM_INDEX_RETRY_STEP);
+  return response;
+};
+
+export const removeLifecycleForIndex = async (indexNames, httpClient) => {
+  const response = await sendPost(`index/remove`, { indexNames }, httpClient);
+  // Only track successful actions.
+  trackUiMetric('count', UIM_POLICY_DETACH_INDEX);
+  return response;
+};
+
+export const addLifecyclePolicyToIndex = async (body, httpClient) => {
+  const response = await sendPost(`index/add`, body, httpClient);
+  // Only track successful actions.
+  trackUiMetric('count', UIM_POLICY_ATTACH_INDEX);
+  return response;
+};
+
+export const addLifecyclePolicyToTemplate = async (body, httpClient) => {
+  const response = await sendPost(`template`, body, httpClient);
+  // Only track successful actions.
+  trackUiMetric('count', UIM_POLICY_ATTACH_INDEX_TEMPLATE);
+  return response;
+};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/api_errors.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api_errors.js
similarity index 69%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/api_errors.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api_errors.js
index bacaf13405898..af107b5cff4b1 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/api_errors.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/api_errors.js
@@ -4,12 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { fatalError, toastNotifications } from 'ui/notify';
+import { fatalErrors, toasts } from './notification';
 
 function createToastConfig(error, errorTitle) {
-  // Expect an error in the shape provided by Angular's $http service.
-  if (error && error.data) {
-    const { error: errorString, statusCode, message } = error.data;
+  if (error && error.body) {
+    const { error: errorString, statusCode, message } = error.body;
+
     return {
       title: errorTitle,
       text: `${statusCode}: ${errorString}. ${message}`,
@@ -21,22 +21,22 @@ export function showApiWarning(error, errorTitle) {
   const toastConfig = createToastConfig(error, errorTitle);
 
   if (toastConfig) {
-    return toastNotifications.addWarning(toastConfig);
+    return toasts.addWarning(toastConfig);
   }
 
   // This error isn't an HTTP error, so let the fatal error screen tell the user something
   // unexpected happened.
-  return fatalError(error, errorTitle);
+  return fatalErrors(error, errorTitle);
 }
 
 export function showApiError(error, errorTitle) {
   const toastConfig = createToastConfig(error, errorTitle);
 
   if (toastConfig) {
-    return toastNotifications.addDanger(toastConfig);
+    return toasts.addDanger(toastConfig);
   }
 
   // This error isn't an HTTP error, so let the fatal error screen tell the user something
   // unexpected happened.
-  fatalError(error, errorTitle);
+  fatalErrors.add(error, errorTitle);
 }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/documentation.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/documentation.ts
new file mode 100644
index 0000000000000..d459d304d5c71
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/documentation.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export let skippingDisconnectedClustersUrl: string;
+export let remoteClustersUrl: string;
+export let transportPortUrl: string;
+
+let _esDocBasePath: string;
+
+export function init(esDocBasePath: string): void {
+  _esDocBasePath = esDocBasePath;
+}
+
+export const createDocLink = (docPath: string): string => `${_esDocBasePath}${docPath}`;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/filter_items.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/filter_items.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/filter_items.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/filter_items.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/find_errors.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/find_errors.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/find_errors.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/find_errors.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/flatten_panel_tree.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/flatten_panel_tree.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/flatten_panel_tree.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/flatten_panel_tree.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/http.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/http.ts
new file mode 100644
index 0000000000000..bbda1ebd2e0e5
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/http.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+let _httpClient: any;
+
+export function init(httpClient: any): void {
+  _httpClient = httpClient;
+}
+
+function getFullPath(path: string): string {
+  const apiPrefix = '/api/index_lifecycle_management';
+
+  if (path) {
+    return `${apiPrefix}/${path}`;
+  }
+
+  return apiPrefix;
+}
+
+// The extend_index_management module requires that we support an injected httpClient here.
+
+export function sendPost(path: string, payload: any, httpClient = _httpClient): any {
+  return httpClient.post(getFullPath(path), { body: JSON.stringify(payload) });
+}
+
+export function sendGet(path: string, query: any, httpClient = _httpClient): any {
+  return httpClient.get(getFullPath(path), { query });
+}
+
+export function sendDelete(path: string, httpClient = _httpClient): any {
+  return httpClient.delete(getFullPath(path));
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/index.js
similarity index 82%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/index.js
index 9d8eeb9b9a808..a82b581309d29 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/index.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/index.js
@@ -6,4 +6,3 @@
 
 export { filterItems } from './filter_items';
 export { sortTable } from './sort_table';
-export { trackUiMetric, getUiMetricsForPhases } from './ui_metric';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/navigation.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/navigation.ts
similarity index 51%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/navigation.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/navigation.ts
index 177b30dc37e0a..943f9a49d0ab6 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/navigation.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/navigation.ts
@@ -4,19 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-let urlService;
-import { BASE_PATH } from '../../common/constants';
-export const setUrlService = aUrlService => {
-  urlService = aUrlService;
-};
-export const getUrlService = () => {
-  return urlService;
-};
+import { BASE_PATH } from '../../../../common/constants';
+
+// This depends upon Angular, which is why we use this provider pattern to access it within
+// our React app.
+let _redirect: any;
+
+export function init(redirect: any) {
+  _redirect = redirect;
+}
 
 export const goToPolicyList = () => {
-  urlService.change(`${BASE_PATH}policies`);
+  _redirect(`${BASE_PATH}policies`);
 };
 
-export const getPolicyPath = policyName => {
+export const getPolicyPath = (policyName: string): string => {
   return encodeURI(`#${BASE_PATH}policies/edit/${encodeURIComponent(policyName)}`);
 };
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/notification.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/notification.ts
new file mode 100644
index 0000000000000..7d24bc31006b4
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/notification.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export let toasts: any;
+export let fatalErrors: any;
+
+export function init(_toasts: any, _fatalErrors: any): void {
+  toasts = _toasts;
+  fatalErrors = _fatalErrors;
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/sort_table.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/sort_table.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/sort_table.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/sort_table.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.test.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.test.js
similarity index 95%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.test.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.test.js
index 85e3365d064f2..99e6bfb99472c 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.test.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.test.js
@@ -5,16 +5,15 @@
  */
 
 import {
+  PHASE_INDEX_PRIORITY,
   UIM_CONFIG_COLD_PHASE,
   UIM_CONFIG_WARM_PHASE,
   UIM_CONFIG_SET_PRIORITY,
   UIM_CONFIG_FREEZE_INDEX,
-} from '../../common/constants';
+} from '../constants';
 
 import { defaultColdPhase, defaultWarmPhase } from '../store/defaults';
 
-import { PHASE_INDEX_PRIORITY } from '../constants';
-
 import { getUiMetricsForPhases } from './ui_metric';
 jest.mock('ui/new_platform');
 
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.ts
similarity index 76%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.ts
index f54924b85ab55..d9f2c26048317 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/ui_metric.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/services/ui_metric.ts
@@ -5,7 +5,8 @@
  */
 
 import { get } from 'lodash';
-import { createUiStatsReporter } from '../../../../../../src/legacy/core_plugins/ui_metric/public';
+
+import { createUiStatsReporter } from '../../../../../../../../src/legacy/core_plugins/ui_metric/public';
 
 import {
   UIM_APP_NAME,
@@ -13,15 +14,23 @@ import {
   UIM_CONFIG_WARM_PHASE,
   UIM_CONFIG_SET_PRIORITY,
   UIM_CONFIG_FREEZE_INDEX,
-} from '../../common/constants';
-
-import { PHASE_HOT, PHASE_WARM, PHASE_COLD, PHASE_INDEX_PRIORITY } from '../constants';
+  PHASE_HOT,
+  PHASE_WARM,
+  PHASE_COLD,
+  PHASE_INDEX_PRIORITY,
+} from '../constants';
 
 import { defaultColdPhase, defaultWarmPhase, defaultHotPhase } from '../store/defaults';
 
-export const trackUiMetric = createUiStatsReporter(UIM_APP_NAME);
+export let trackUiMetric: ReturnType<typeof createUiStatsReporter>;
+
+export function init(getReporter: typeof createUiStatsReporter): void {
+  if (getReporter) {
+    trackUiMetric = getReporter(UIM_APP_NAME);
+  }
+}
 
-export function getUiMetricsForPhases(phases) {
+export function getUiMetricsForPhases(phases: any): any {
   const phaseUiMetrics = [
     {
       metric: UIM_CONFIG_COLD_PHASE,
@@ -58,7 +67,7 @@ export function getUiMetricsForPhases(phases) {
     },
   ];
 
-  const trackedUiMetrics = phaseUiMetrics.reduce((tracked, { metric, isTracked }) => {
+  const trackedUiMetrics = phaseUiMetrics.reduce((tracked: any, { metric, isTracked }) => {
     if (isTracked()) {
       tracked.push(metric);
     }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/general.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/general.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/general.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/general.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/lifecycle.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/lifecycle.js
similarity index 89%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/lifecycle.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/lifecycle.js
index 8379a03b1e68b..0bb6543482bd6 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/lifecycle.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/lifecycle.js
@@ -3,14 +3,14 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { i18n } from '@kbn/i18n';
-import { toastNotifications } from 'ui/notify';
 
-import { UIM_POLICY_CREATE, UIM_POLICY_UPDATE } from '../../../common/constants';
+import { i18n } from '@kbn/i18n';
 
+import { UIM_POLICY_CREATE, UIM_POLICY_UPDATE } from '../../constants';
 import { showApiError } from '../../services/api_errors';
+import { toasts } from '../../services/notification';
 import { savePolicy as savePolicyApi } from '../../services/api';
-import { trackUiMetric, getUiMetricsForPhases } from '../../services';
+import { trackUiMetric, getUiMetricsForPhases } from '../../services/ui_metric';
 
 export const saveLifecyclePolicy = (lifecycle, isNew) => async () => {
   try {
@@ -41,6 +41,6 @@ export const saveLifecyclePolicy = (lifecycle, isNew) => async () => {
       lifecycleName: lifecycle.name,
     },
   });
-  toastNotifications.addSuccess(message);
+  toasts.addSuccess(message);
   return true;
 };
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/nodes.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/nodes.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/nodes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/nodes.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/policies.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/policies.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/policies.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/policies.js
index c048a315deab7..b6064af6e38b2 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/store/actions/policies.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/actions/policies.js
@@ -5,10 +5,12 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { showApiError } from '../../services/api_errors';
 import { createAction } from 'redux-actions';
+
+import { showApiError } from '../../services/api_errors';
 import { loadPolicies } from '../../services/api';
 import { SET_PHASE_DATA } from '../../constants';
+
 export const fetchedPolicies = createAction('FETCHED_POLICIES');
 export const setSelectedPolicy = createAction('SET_SELECTED_POLICY');
 export const unsetSelectedPolicy = createAction('UNSET_SELECTED_POLICY');
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/cold_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/cold_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/cold_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/cold_phase.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/delete_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/delete_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/delete_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/delete_phase.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/hot_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/hot_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/hot_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/hot_phase.js
diff --git a/x-pack/legacy/plugins/lens/server/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/index.d.ts
similarity index 64%
rename from x-pack/legacy/plugins/lens/server/index.ts
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/index.d.ts
index ae14d1c5a0052..889e038f9e2c4 100644
--- a/x-pack/legacy/plugins/lens/server/index.ts
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/index.d.ts
@@ -4,8 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { LensServer } from './plugin';
-
-export * from './plugin';
-
-export const lensServerPlugin = () => new LensServer();
+export declare const defaultColdPhase: any;
+export declare const defaultWarmPhase: any;
+export declare const defaultHotPhase: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/warm_phase.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/warm_phase.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/defaults/warm_phase.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/defaults/warm_phase.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/index.d.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/index.d.ts
new file mode 100644
index 0000000000000..8617a7045a5c3
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/index.d.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export declare const indexLifecycleManagementStore: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/general.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/general.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/general.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/general.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/nodes.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/nodes.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/nodes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/nodes.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/policies.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/policies.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/reducers/policies.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/reducers/policies.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/general.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/general.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/general.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/general.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/index.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/index.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/lifecycle.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/lifecycle.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/lifecycle.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/lifecycle.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/nodes.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/nodes.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/nodes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/nodes.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/policies.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/policies.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/selectors/policies.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/selectors/policies.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/store/store.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/store.js
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/store/store.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/application/store/store.js
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/add_lifecycle_confirm_modal.js
similarity index 96%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/add_lifecycle_confirm_modal.js
index 940cdf2357993..5b8f2d197daf4 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/add_lifecycle_confirm_modal.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/add_lifecycle_confirm_modal.js
@@ -7,6 +7,7 @@
 import React, { Component, Fragment } from 'react';
 import { get } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiLink,
   EuiSelect,
@@ -21,11 +22,12 @@ import {
   EuiSpacer,
   EuiModalHeaderTitle,
 } from '@elastic/eui';
-import { BASE_PATH } from '../../../common/constants';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { toastNotifications } from 'ui/notify';
-import { loadPolicies, addLifecyclePolicyToIndex } from '../../services/api';
-import { showApiError } from '../../services/api_errors';
+
+import { BASE_PATH } from '../../../../common/constants';
+import { loadPolicies, addLifecyclePolicyToIndex } from '../../application/services/api';
+import { showApiError } from '../../application/services/api_errors';
+import { toasts } from '../../application/services/notification';
+
 export class AddLifecyclePolicyConfirmModal extends Component {
   constructor(props) {
     super(props);
@@ -55,7 +57,7 @@ export class AddLifecyclePolicyConfirmModal extends Component {
       };
       await addLifecyclePolicyToIndex(body, httpClient);
       closeModal();
-      toastNotifications.addSuccess(
+      toasts.addSuccess(
         i18n.translate(
           'xpack.indexLifecycleMgmt.indexManagementTable.addLifecyclePolicyConfirmModal.addPolicyToIndexSuccess',
           {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/index_lifecycle_summary.js
similarity index 99%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/index_lifecycle_summary.js
index d6bbfa3d4d270..7e15e9861dd75 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/index_lifecycle_summary.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/index_lifecycle_summary.js
@@ -6,6 +6,8 @@
 
 import React, { Component, Fragment } from 'react';
 import moment from 'moment-timezone';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiButtonEmpty,
   EuiCallOut,
@@ -21,9 +23,9 @@ import {
   EuiPopover,
   EuiPopoverTitle,
 } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { getPolicyPath } from '../../services/navigation';
+
+import { getPolicyPath } from '../../application/services/navigation';
+
 const getHeaders = () => {
   return {
     policy: i18n.translate(
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/remove_lifecycle_confirm_modal.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/remove_lifecycle_confirm_modal.js
similarity index 93%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/remove_lifecycle_confirm_modal.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/remove_lifecycle_confirm_modal.js
index 97373f046047c..0ba5ed1720084 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/components/remove_lifecycle_confirm_modal.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/components/remove_lifecycle_confirm_modal.js
@@ -6,12 +6,12 @@
 
 import React, { Component, Fragment } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiOverlayMask, EuiConfirmModal } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { toastNotifications } from 'ui/notify';
+import { EuiOverlayMask, EuiConfirmModal } from '@elastic/eui';
 
-import { removeLifecycleForIndex } from '../../services/api';
-import { showApiError } from '../../services/api_errors';
+import { removeLifecycleForIndex } from '../../application/services/api';
+import { showApiError } from '../../application/services/api_errors';
+import { toasts } from '../../application/services/notification';
 
 export class RemoveLifecyclePolicyConfirmModal extends Component {
   constructor(props) {
@@ -29,7 +29,7 @@ export class RemoveLifecyclePolicyConfirmModal extends Component {
     try {
       await removeLifecycleForIndex(indexNames, httpClient);
       closeModal();
-      toastNotifications.addSuccess(
+      toasts.addSuccess(
         i18n.translate(
           'xpack.indexLifecycleMgmt.indexManagementTable.removeLifecyclePolicyConfirmModal.removePolicySuccess',
           {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.d.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.d.ts
new file mode 100644
index 0000000000000..086ba67703122
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.d.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export declare const addAllExtensions: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/index.js b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.js
similarity index 76%
rename from x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.js
index b6e7d92f4251d..422a7986aa057 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/extend_index_management/index.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/extend_index_management/index.js
@@ -3,23 +3,39 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import React from 'react';
-import { IndexLifecycleSummary } from './components/index_lifecycle_summary';
-import { AddLifecyclePolicyConfirmModal } from './components/add_lifecycle_confirm_modal';
-import { RemoveLifecyclePolicyConfirmModal } from './components/remove_lifecycle_confirm_modal';
 import { get, every, any } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import { EuiSearchBar } from '@elastic/eui';
+
 import {
   addSummaryExtension,
   addBannerExtension,
   addActionExtension,
   addFilterExtension,
-} from '../../../index_management/public/index_management_extensions';
-import { retryLifecycleForIndex } from '../services/api';
-import { EuiSearchBar } from '@elastic/eui';
+} from '../../../../index_management/public/index_management_extensions';
+
+import { init as initUiMetric } from '../application/services/ui_metric';
+import { init as initNotification } from '../application/services/notification';
+import { retryLifecycleForIndex } from '../application/services/api';
+import { IndexLifecycleSummary } from './components/index_lifecycle_summary';
+import { AddLifecyclePolicyConfirmModal } from './components/add_lifecycle_confirm_modal';
+import { RemoveLifecyclePolicyConfirmModal } from './components/remove_lifecycle_confirm_modal';
 
 const stepPath = 'ilm.step';
-export const retryLifecycleActionExtension = indices => {
+
+export const retryLifecycleActionExtension = ({
+  indices,
+  createUiStatsReporter,
+  toasts,
+  fatalErrors,
+}) => {
+  // These are hacks that we can remove once the New Platform migration is done. They're needed here
+  // because API requests and API errors require them.
+  initUiMetric(createUiStatsReporter);
+  initNotification(toasts, fatalErrors);
+
   const allHaveErrors = every(indices, index => {
     return index.ilm && index.ilm.failed_step;
   });
@@ -44,7 +60,19 @@ export const retryLifecycleActionExtension = indices => {
   };
 };
 
-export const removeLifecyclePolicyActionExtension = (indices, reloadIndices) => {
+export const removeLifecyclePolicyActionExtension = ({
+  indices,
+  reloadIndices,
+  createUiStatsReporter,
+  toasts,
+  fatalErrors,
+  httpClient,
+}) => {
+  // These are hacks that we can remove once the New Platform migration is done. They're needed here
+  // because API requests and API errors require them.
+  initUiMetric(createUiStatsReporter);
+  initNotification(toasts, fatalErrors);
+
   const allHaveIlm = every(indices, index => {
     return index.ilm && index.ilm.managed;
   });
@@ -53,12 +81,13 @@ export const removeLifecyclePolicyActionExtension = (indices, reloadIndices) =>
   }
   const indexNames = indices.map(({ name }) => name);
   return {
-    renderConfirmModal: (closeModal, httpClient) => {
+    renderConfirmModal: closeModal => {
       return (
         <RemoveLifecyclePolicyConfirmModal
           indexNames={indexNames}
           closeModal={closeModal}
           httpClient={httpClient}
+          toasts={toasts}
           reloadIndices={reloadIndices}
         />
       );
@@ -71,7 +100,19 @@ export const removeLifecyclePolicyActionExtension = (indices, reloadIndices) =>
   };
 };
 
-export const addLifecyclePolicyActionExtension = (indices, reloadIndices) => {
+export const addLifecyclePolicyActionExtension = ({
+  indices,
+  reloadIndices,
+  createUiStatsReporter,
+  toasts,
+  fatalErrors,
+  httpClient,
+}) => {
+  // These are hacks that we can remove once the New Platform migration is done. They're needed here
+  // because API requests and API errors require them.
+  initUiMetric(createUiStatsReporter);
+  initNotification(toasts, fatalErrors);
+
   if (indices.length !== 1) {
     return null;
   }
@@ -83,12 +124,13 @@ export const addLifecyclePolicyActionExtension = (indices, reloadIndices) => {
   }
   const indexName = index.name;
   return {
-    renderConfirmModal: (closeModal, httpClient) => {
+    renderConfirmModal: closeModal => {
       return (
         <AddLifecyclePolicyConfirmModal
           indexName={indexName}
           closeModal={closeModal}
           httpClient={httpClient}
+          toasts={toasts}
           index={index}
           reloadIndices={reloadIndices}
         />
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/index.ts
similarity index 63%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/index.ts
rename to x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/index.ts
index c2241f424511f..1af0b697a9283 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/index.ts
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/index.ts
@@ -5,8 +5,6 @@
  */
 
 import { PluginInitializerContext } from 'src/core/public';
-import { KueryAutocompletePlugin as Plugin } from './plugin';
+import { IndexLifecycleManagementPlugin } from './plugin';
 
-export function plugin(initializerContext: PluginInitializerContext) {
-  return new Plugin(initializerContext);
-}
+export const createPlugin = (ctx: PluginInitializerContext) => new IndexLifecycleManagementPlugin();
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/plugin.tsx b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/plugin.tsx
new file mode 100644
index 0000000000000..e2897f09fa892
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/public/np_ready/plugin.tsx
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup, CoreStart, Plugin } from 'src/core/public';
+import { PLUGIN } from '../../common/constants';
+import { LegacySetup } from './application';
+
+interface PluginsSetup {
+  __LEGACY: LegacySetup;
+}
+
+export class IndexLifecycleManagementPlugin implements Plugin<void, void, any, any> {
+  setup(core: CoreSetup, plugins: PluginsSetup) {
+    // Extract individual core dependencies.
+    const {
+      application,
+      notifications: { toasts },
+      fatalErrors,
+      http,
+    } = core;
+
+    // The Plugin interface won't allow us to pass __LEGACY as a third argument, so we'll just
+    // sneak it inside of the plugins parameter for now.
+    const { __LEGACY } = plugins;
+
+    application.register({
+      id: PLUGIN.ID,
+      title: PLUGIN.TITLE,
+      async mount(config, mountPoint) {
+        const {
+          core: {
+            docLinks,
+            i18n: { Context: I18nContext },
+          },
+        } = config;
+
+        const { element } = mountPoint;
+        const { renderApp } = await import('./application');
+
+        // Inject all dependencies into our app.
+        return renderApp({
+          legacy: { ...__LEGACY },
+          I18nContext,
+          http,
+          toasts,
+          fatalErrors,
+          docLinks,
+          element,
+        });
+      },
+    });
+  }
+  start(core: CoreStart, plugins: any) {}
+  stop() {}
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/register_management_section.js b/x-pack/legacy/plugins/index_lifecycle_management/public/register_management_section.js
deleted file mode 100644
index aeb2f04220444..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/register_management_section.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import chrome from 'ui/chrome';
-import { management } from 'ui/management';
-import { i18n } from '@kbn/i18n';
-import { BASE_PATH } from '../common/constants';
-const esSection = management.getSection('elasticsearch');
-if (chrome.getInjected('ilmUiEnabled')) {
-  esSection.register('index_lifecycle_policies', {
-    visible: true,
-    display: i18n.translate('xpack.indexLifecycleMgmt.appTitle', {
-      defaultMessage: 'Index Lifecycle Policies',
-    }),
-    order: 2,
-    url: `#${BASE_PATH}policies`,
-  });
-}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/register_routes.js b/x-pack/legacy/plugins/index_lifecycle_management/public/register_routes.js
deleted file mode 100644
index ae28b72c4d5ea..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/register_routes.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { render, unmountComponentAtNode } from 'react-dom';
-import { Provider } from 'react-redux';
-import { setHttpClient } from './services/api';
-import chrome from 'ui/chrome';
-import { App } from './app';
-import { BASE_PATH } from '../common/constants';
-import { indexLifecycleManagementStore } from './store';
-import { I18nContext } from 'ui/i18n';
-import { setUrlService } from './services/navigation';
-
-import routes from 'ui/routes';
-
-import template from './main.html';
-import { manageAngularLifecycle } from './services/manage_angular_lifecycle';
-let elem;
-const renderReact = async elem => {
-  render(
-    <I18nContext>
-      <Provider store={indexLifecycleManagementStore()}>
-        <App />
-      </Provider>
-    </I18nContext>,
-    elem
-  );
-};
-if (chrome.getInjected('ilmUiEnabled')) {
-  routes.when(`${BASE_PATH}:view?/:action?/:id?`, {
-    template: template,
-    controllerAs: 'indexLifecycleManagement',
-    controller: class IndexLifecycleManagementController {
-      constructor($scope, $route, $http, kbnUrl, $rootScope) {
-        // clean up previously rendered React app if one exists
-        // this happens because of React Router redirects
-        elem && unmountComponentAtNode(elem);
-        setHttpClient($http);
-        setUrlService({
-          change(url) {
-            kbnUrl.change(url);
-            $rootScope.$digest();
-          },
-        });
-        $scope.$$postDigest(() => {
-          elem = document.getElementById('indexLifecycleManagementReactRoot');
-          renderReact(elem);
-          manageAngularLifecycle($scope, $route, elem);
-        });
-      }
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/api.js b/x-pack/legacy/plugins/index_lifecycle_management/public/services/api.js
deleted file mode 100644
index 758402a115c68..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/api.js
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import chrome from 'ui/chrome';
-import {
-  UIM_POLICY_DELETE,
-  UIM_POLICY_ATTACH_INDEX,
-  UIM_POLICY_ATTACH_INDEX_TEMPLATE,
-  UIM_POLICY_DETACH_INDEX,
-  UIM_INDEX_RETRY_STEP,
-} from '../../common/constants';
-import { trackUiMetric } from './ui_metric';
-
-let httpClient;
-export const setHttpClient = client => {
-  httpClient = client;
-};
-export const getHttpClient = () => {
-  return httpClient;
-};
-const apiPrefix = chrome.addBasePath('/api/index_lifecycle_management');
-
-export async function loadNodes(httpClient = getHttpClient()) {
-  const response = await httpClient.get(`${apiPrefix}/nodes/list`);
-  return response.data;
-}
-
-export async function loadNodeDetails(selectedNodeAttrs, httpClient = getHttpClient()) {
-  const response = await httpClient.get(`${apiPrefix}/nodes/${selectedNodeAttrs}/details`);
-  return response.data;
-}
-
-export async function loadIndexTemplates(httpClient = getHttpClient()) {
-  const response = await httpClient.get(`${apiPrefix}/templates`);
-  return response.data;
-}
-
-export async function loadIndexTemplate(templateName, httpClient = getHttpClient()) {
-  if (!templateName) {
-    return {};
-  }
-  const response = await httpClient.get(`${apiPrefix}/templates/${templateName}`);
-  return response.data;
-}
-
-export async function loadPolicies(withIndices, httpClient = getHttpClient()) {
-  const response = await httpClient.get(
-    `${apiPrefix}/policies${withIndices ? '?withIndices=true' : ''}`
-  );
-  return response.data;
-}
-
-export async function savePolicy(policy, httpClient = getHttpClient()) {
-  const response = await httpClient.post(`${apiPrefix}/policies`, policy);
-  return response.data;
-}
-
-export async function deletePolicy(policyName, httpClient = getHttpClient()) {
-  const response = await httpClient.delete(
-    `${apiPrefix}/policies/${encodeURIComponent(policyName)}`
-  );
-  // Only track successful actions.
-  trackUiMetric('count', UIM_POLICY_DELETE);
-  return response.data;
-}
-
-export const retryLifecycleForIndex = async (indexNames, httpClient = getHttpClient()) => {
-  const response = await httpClient.post(`${apiPrefix}/index/retry`, { indexNames });
-  // Only track successful actions.
-  trackUiMetric('count', UIM_INDEX_RETRY_STEP);
-  return response.data;
-};
-
-export const removeLifecycleForIndex = async (indexNames, httpClient = getHttpClient()) => {
-  const response = await httpClient.post(`${apiPrefix}/index/remove`, { indexNames });
-  // Only track successful actions.
-  trackUiMetric('count', UIM_POLICY_DETACH_INDEX);
-  return response.data;
-};
-
-export const addLifecyclePolicyToIndex = async (body, httpClient = getHttpClient()) => {
-  const response = await httpClient.post(`${apiPrefix}/index/add`, body);
-  // Only track successful actions.
-  trackUiMetric('count', UIM_POLICY_ATTACH_INDEX);
-  return response.data;
-};
-
-export const addLifecyclePolicyToTemplate = async (body, httpClient = getHttpClient()) => {
-  const response = await httpClient.post(`${apiPrefix}/template`, body);
-  // Only track successful actions.
-  trackUiMetric('count', UIM_POLICY_ATTACH_INDEX_TEMPLATE);
-  return response.data;
-};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/public/services/manage_angular_lifecycle.js b/x-pack/legacy/plugins/index_lifecycle_management/public/services/manage_angular_lifecycle.js
deleted file mode 100644
index 3813e632a0a73..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/public/services/manage_angular_lifecycle.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { unmountComponentAtNode } from 'react-dom';
-
-export const manageAngularLifecycle = ($scope, $route, elem) => {
-  const lastRoute = $route.current;
-
-  const deregister = $scope.$on('$locationChangeSuccess', () => {
-    const currentRoute = $route.current;
-    if (lastRoute.$$route.template === currentRoute.$$route.template) {
-      $route.current = lastRoute;
-    }
-  });
-
-  $scope.$on('$destroy', () => {
-    deregister && deregister();
-    elem && unmountComponentAtNode(elem);
-  });
-};
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.ts
similarity index 68%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.ts
index 7359a831994f9..1b28dc4fde4f7 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/call_with_request_factory.ts
@@ -5,14 +5,15 @@
  */
 
 import { once } from 'lodash';
+import { Legacy } from 'kibana';
 
-const callWithRequest = once(server => {
+const callWithRequest = once((server: Legacy.Server): any => {
   const cluster = server.plugins.elasticsearch.getCluster('data');
   return cluster.callWithRequest;
 });
 
-export const callWithRequestFactory = (server, request) => {
-  return (...args) => {
+export const callWithRequestFactory = (server: Legacy.Server, request: any) => {
+  return (...args: any[]) => {
     return callWithRequest(server)(request, ...args);
   };
 };
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/call_with_request_factory/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.ts
similarity index 97%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.ts
index 7534f3cd0934e..b35ab14964d55 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/check_license.ts
@@ -3,8 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 import { i18n } from '@kbn/i18n';
-export function checkLicense(xpackLicenseInfo) {
+
+export function checkLicense(xpackLicenseInfo: any): any {
   const pluginName = 'Index Lifecycle Policies';
 
   // If, for some reason, we cannot get the license information
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/check_license/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.ts
similarity index 88%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.ts
index 3295113d38ee5..c5780e7c83fb5 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_custom_error.ts
@@ -13,6 +13,6 @@ import Boom from 'boom';
  * @param statusCode Error status code
  * @return Object Boom error response
  */
-export function wrapCustomError(err, statusCode) {
+export function wrapCustomError(err: any, statusCode: any): any {
   return Boom.boomify(err, { statusCode });
 }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.ts
similarity index 92%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.ts
index 183a7ff25cb9a..6980a5afa5eac 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_es_error.ts
@@ -13,7 +13,7 @@ import Boom from 'boom';
  * @param statusCodeToMessageMap Object Optional map of HTTP status codes => error messages
  * @return Object Boom error response
  */
-export function wrapEsError(err, statusCodeToMessageMap = {}) {
+export function wrapEsError(err: any, statusCodeToMessageMap: any = {}): any {
   const statusCode = err.statusCode;
 
   // If no custom message if specified for the error's status code, just
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.ts
similarity index 90%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.ts
index ffd915c513362..ede1baec286f3 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/error_wrappers/wrap_unknown_error.ts
@@ -12,6 +12,6 @@ import Boom from 'boom';
  * @param err Object Unknown error
  * @return Object Boom error response
  */
-export function wrapUnknownError(err) {
+export function wrapUnknownError(err: any): any {
   return Boom.boomify(err);
 }
diff --git a/x-pack/legacy/plugins/siem/public/hooks/index.ts b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/index.ts
similarity index 79%
rename from x-pack/legacy/plugins/siem/public/hooks/index.ts
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/index.ts
index 5049e4587d383..a9a3c61472d8c 100644
--- a/x-pack/legacy/plugins/siem/public/hooks/index.ts
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { useDateFormat, useTimeZone } from './use_ui_settings';
+export { isEsError } from './is_es_error';
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/is_es_error.ts b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/is_es_error.ts
new file mode 100644
index 0000000000000..2f514b93e5016
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error/is_es_error.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as legacyElasticsearch from 'elasticsearch';
+
+const esErrorsParent = legacyElasticsearch.errors._Abstract;
+
+export function isEsError(err: Error): boolean {
+  return err instanceof esErrorsParent;
+}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js
deleted file mode 100644
index 5f2141cce9395..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { isEsErrorFactory } from '../is_es_error_factory';
-import { set } from 'lodash';
-
-class MockAbstractEsError {}
-
-describe('is_es_error_factory', () => {
-  let mockServer;
-  let isEsError;
-
-  beforeEach(() => {
-    const mockEsErrors = {
-      _Abstract: MockAbstractEsError,
-    };
-    mockServer = {};
-    set(mockServer, 'plugins.elasticsearch.getCluster', () => ({ errors: mockEsErrors }));
-
-    isEsError = isEsErrorFactory(mockServer);
-  });
-
-  describe('#isEsErrorFactory', () => {
-    it('should return a function', () => {
-      expect(isEsError).to.be.a(Function);
-    });
-
-    describe('returned function', () => {
-      it('should return true if passed-in err is a known esError', () => {
-        const knownEsError = new MockAbstractEsError();
-        expect(isEsError(knownEsError)).to.be(true);
-      });
-
-      it('should return false if passed-in err is not a known esError', () => {
-        const unknownEsError = {};
-        expect(isEsError(unknownEsError)).to.be(false);
-      });
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/is_es_error_factory.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/is_es_error_factory.js
deleted file mode 100644
index 6c17554385ef8..0000000000000
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/is_es_error_factory.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { memoize } from 'lodash';
-
-const esErrorsFactory = memoize(server => {
-  return server.plugins.elasticsearch.getCluster('admin').errors;
-});
-
-export function isEsErrorFactory(server) {
-  const esErrors = esErrorsFactory(server);
-  return function isEsError(err) {
-    return err instanceof esErrors._Abstract;
-  };
-}
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.ts
similarity index 79%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.ts
index 8c1a080484a30..e348125967c14 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/license_pre_routing_factory/license_pre_routing_factory.ts
@@ -5,15 +5,17 @@
  */
 
 import { once } from 'lodash';
+import { Legacy } from 'kibana';
+
+import { PLUGIN } from '../../../common/constants';
 import { wrapCustomError } from '../error_wrappers';
-import { PLUGIN_ID } from '../../../common/constants';
 
-export const licensePreRoutingFactory = once(server => {
+export const licensePreRoutingFactory = once((server: Legacy.Server) => {
   const xpackMainPlugin = server.plugins.xpack_main;
 
   // License checking and enable/disable logic
   function licensePreRouting() {
-    const licenseCheckResults = xpackMainPlugin.info.feature(PLUGIN_ID).getLicenseCheckResults();
+    const licenseCheckResults = xpackMainPlugin.info.feature(PLUGIN.ID).getLicenseCheckResults();
     if (!licenseCheckResults.isAvailable) {
       const error = new Error(licenseCheckResults.message);
       const statusCode = 403;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.js b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.ts
similarity index 64%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.ts
index 260fc15c7a83f..8e3b89fa20e33 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/lib/register_license_checker/register_license_checker.ts
@@ -4,18 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Legacy } from 'kibana';
+// @ts-ignore
 import { mirrorPluginStatus } from '../../../../../server/lib/mirror_plugin_status';
+import { PLUGIN } from '../../../common/constants';
 import { checkLicense } from '../check_license';
-import { PLUGIN_ID } from '../../../common/constants';
 
-export function registerLicenseChecker(server) {
-  const xpackMainPlugin = server.plugins.xpack_main;
-  const ilmPlugin = server.plugins.index_lifecycle_management;
+export function registerLicenseChecker(server: Legacy.Server) {
+  const xpackMainPlugin = server.plugins.xpack_main as any;
+  const ilmPlugin = (server.plugins as any).index_lifecycle_management;
 
   mirrorPluginStatus(xpackMainPlugin, ilmPlugin);
   xpackMainPlugin.status.once('green', () => {
     // Register a function that is called whenever the xpack info changes,
     // to re-compute the license check results for this plugin
-    xpackMainPlugin.info.feature(PLUGIN_ID).registerLicenseCheckResultsGenerator(checkLicense);
+    xpackMainPlugin.info.feature(PLUGIN.ID).registerLicenseCheckResultsGenerator(checkLicense);
   });
 }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.ts
similarity index 79%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.ts
index 632864b3d9767..c3e235220931c 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_add_policy_route.ts
@@ -5,11 +5,16 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function addLifecyclePolicy(callWithRequest, indexName, policyName, alias) {
+async function addLifecyclePolicy(
+  callWithRequest: any,
+  indexName: string,
+  policyName: string,
+  alias: string
+) {
   const body = {
     lifecycle: {
       name: policyName,
@@ -26,16 +31,15 @@ async function addLifecyclePolicy(callWithRequest, indexName, policyName, alias)
   return callWithRequest('transport.request', params);
 }
 
-export function registerAddPolicyRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerAddPolicyRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/index/add',
     method: 'POST',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
-      const { indexName, policyName, alias } = request.payload;
+      const { indexName, policyName, alias } = request.payload as any;
       try {
         const response = await addLifecyclePolicy(callWithRequest, indexName, policyName, alias);
         return response;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.ts
similarity index 91%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.ts
index ac8d024a51b03..74eb1a86a93ba 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_index_routes.ts
@@ -8,7 +8,7 @@ import { registerRetryRoute } from './register_retry_route';
 import { registerRemoveRoute } from './register_remove_route';
 import { registerAddPolicyRoute } from './register_add_policy_route';
 
-export function registerIndexRoutes(server) {
+export function registerIndexRoutes(server: any) {
   registerRetryRoute(server);
   registerRemoveRoute(server);
   registerAddPolicyRoute(server);
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.ts
similarity index 84%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.ts
index df056064ebc1f..ed3b5a97a3b42 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_remove_route.ts
@@ -5,11 +5,11 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function removeLifecycle(callWithRequest, indexNames) {
+async function removeLifecycle(callWithRequest: any, indexNames: string[]) {
   const responses = [];
   for (let i = 0; i < indexNames.length; i++) {
     const indexName = indexNames[i];
@@ -24,14 +24,13 @@ async function removeLifecycle(callWithRequest, indexNames) {
   return Promise.all(responses);
 }
 
-export function registerRemoveRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerRemoveRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/index/remove',
     method: 'POST',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.ts
similarity index 84%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.ts
index 4e3bd42dcbe6a..89278edbecea2 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/index/register_retry_route.ts
@@ -5,11 +5,11 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function retryLifecycle(callWithRequest, indexNames) {
+async function retryLifecycle(callWithRequest: any, indexNames: string[]) {
   const responses = [];
   for (let i = 0; i < indexNames.length; i++) {
     const indexName = indexNames[i];
@@ -24,14 +24,13 @@ async function retryLifecycle(callWithRequest, indexNames) {
   return Promise.all(responses);
 }
 
-export function registerRetryRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerRetryRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/index/retry',
     method: 'POST',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.ts
similarity index 86%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.ts
index 2e2b84a76002e..7a85c5e7c02d4 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/constants.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const NODE_ATTRS_KEYS_TO_IGNORE = [
+export const NODE_ATTRS_KEYS_TO_IGNORE: string[] = [
   'ml.enabled',
   'ml.machine_memory',
   'ml.max_open_jobs',
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.ts
similarity index 75%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.ts
index 6c4e5b58da757..c2c3f8bf07028 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_details_route.ts
@@ -5,18 +5,18 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-function findMatchingNodes(stats, nodeAttrs) {
-  return Object.entries(stats.nodes).reduce((accum, [nodeId, stats]) => {
-    const attributes = stats.attributes || {};
+function findMatchingNodes(stats: any, nodeAttrs: string): any {
+  return Object.entries(stats.nodes).reduce((accum: any[], [nodeId, nodeStats]: [any, any]) => {
+    const attributes = nodeStats.attributes || {};
     for (const [key, value] of Object.entries(attributes)) {
       if (`${key}:${value}` === nodeAttrs) {
         accum.push({
           nodeId,
-          stats,
+          stats: nodeStats,
         });
         break;
       }
@@ -25,7 +25,7 @@ function findMatchingNodes(stats, nodeAttrs) {
   }, []);
 }
 
-async function fetchNodeStats(callWithRequest) {
+async function fetchNodeStats(callWithRequest: any): Promise<any> {
   const params = {
     format: 'json',
   };
@@ -33,14 +33,13 @@ async function fetchNodeStats(callWithRequest) {
   return await callWithRequest('nodes.stats', params);
 }
 
-export function registerDetailsRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerDetailsRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/nodes/{nodeAttrs}/details',
     method: 'GET',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
similarity index 80%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
index d12b5454c1442..edbe4289ed83c 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_list_route.ts
@@ -5,14 +5,14 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 import { NODE_ATTRS_KEYS_TO_IGNORE } from './constants';
 
-function convertStatsIntoList(stats, attributesToBeFiltered) {
-  return Object.entries(stats.nodes).reduce((accum, [nodeId, stats]) => {
-    const attributes = stats.attributes || {};
+function convertStatsIntoList(stats: any, attributesToBeFiltered: string[]): any {
+  return Object.entries(stats.nodes).reduce((accum: any, [nodeId, nodeStats]: [any, any]) => {
+    const attributes = nodeStats.attributes || {};
     for (const [key, value] of Object.entries(attributes)) {
       if (!attributesToBeFiltered.includes(key)) {
         const attributeString = `${key}:${value}`;
@@ -24,7 +24,7 @@ function convertStatsIntoList(stats, attributesToBeFiltered) {
   }, {});
 }
 
-async function fetchNodeStats(callWithRequest) {
+async function fetchNodeStats(callWithRequest: any): Promise<any> {
   const params = {
     format: 'json',
   };
@@ -32,17 +32,16 @@ async function fetchNodeStats(callWithRequest) {
   return await callWithRequest('nodes.stats', params);
 }
 
-export function registerListRoute(server) {
+export function registerListRoute(server: any) {
   const config = server.config();
   const filteredNodeAttributes = config.get('xpack.ilm.filteredNodeAttributes');
   const attributesToBeFiltered = [...NODE_ATTRS_KEYS_TO_IGNORE, ...filteredNodeAttributes];
-  const isEsError = isEsErrorFactory(server);
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/nodes/list',
     method: 'GET',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.ts
similarity index 89%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.ts
index 341f1d4f1ebf3..4486d97038657 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/nodes/register_nodes_routes.ts
@@ -7,7 +7,7 @@
 import { registerListRoute } from './register_list_route';
 import { registerDetailsRoute } from './register_details_route';
 
-export function registerNodesRoutes(server) {
+export function registerNodesRoutes(server: any) {
   registerListRoute(server);
   registerDetailsRoute(server);
 }
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
similarity index 84%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
index d1716472029d5..f6bc96dd498a4 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_create_route.ts
@@ -5,11 +5,11 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function createPolicy(callWithRequest, policy) {
+async function createPolicy(callWithRequest: any, policy: any): Promise<any> {
   const body = {
     policy: {
       phases: policy.phases,
@@ -25,14 +25,13 @@ async function createPolicy(callWithRequest, policy) {
   return await callWithRequest('transport.request', params);
 }
 
-export function registerCreateRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerCreateRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/policies',
     method: 'POST',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.ts
similarity index 83%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.ts
index ea8d7ae7e0436..c84f2efd92d8f 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_delete_route.ts
@@ -5,11 +5,11 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function deletePolicies(policyNames, callWithRequest) {
+async function deletePolicies(policyNames: string, callWithRequest: any): Promise<any> {
   const params = {
     method: 'DELETE',
     path: `/_ilm/policy/${encodeURIComponent(policyNames)}`,
@@ -20,14 +20,13 @@ async function deletePolicies(policyNames, callWithRequest) {
   return await callWithRequest('transport.request', params);
 }
 
-export function registerDeleteRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerDeleteRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/policies/{policyNames}',
     method: 'DELETE',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
       const { policyNames } = request.params;
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
similarity index 79%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
index df2053ed2f8c4..c65f849a47d87 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_fetch_route.ts
@@ -5,15 +5,16 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-function formatPolicies(policiesMap) {
+function formatPolicies(policiesMap: any): any {
   if (policiesMap.status === 404) {
     return [];
   }
-  return Object.keys(policiesMap).reduce((accum, lifecycleName) => {
+
+  return Object.keys(policiesMap).reduce((accum: any[], lifecycleName: string) => {
     const policyEntry = policiesMap[lifecycleName];
     accum.push({
       ...policyEntry,
@@ -23,7 +24,7 @@ function formatPolicies(policiesMap) {
   }, []);
 }
 
-async function fetchPolicies(callWithRequest) {
+async function fetchPolicies(callWithRequest: any): Promise<any> {
   const params = {
     method: 'GET',
     path: '/_ilm/policy',
@@ -33,7 +34,7 @@ async function fetchPolicies(callWithRequest) {
 
   return await callWithRequest('transport.request', params);
 }
-async function addLinkedIndices(policiesMap, callWithRequest) {
+async function addLinkedIndices(policiesMap: any, callWithRequest: any) {
   if (policiesMap.status === 404) {
     return policiesMap;
   }
@@ -44,8 +45,8 @@ async function addLinkedIndices(policiesMap, callWithRequest) {
     ignore: [404],
   };
 
-  const policyExplanation = await callWithRequest('transport.request', params);
-  Object.entries(policyExplanation.indices).forEach(([indexName, { policy }]) => {
+  const policyExplanation: any = await callWithRequest('transport.request', params);
+  Object.entries(policyExplanation.indices).forEach(([indexName, { policy }]: [string, any]) => {
     if (policy && policiesMap[policy]) {
       policiesMap[policy].linkedIndices = policiesMap[policy].linkedIndices || [];
       policiesMap[policy].linkedIndices.push(indexName);
@@ -53,14 +54,13 @@ async function addLinkedIndices(policiesMap, callWithRequest) {
   });
 }
 
-export function registerFetchRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerFetchRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/policies',
     method: 'GET',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
       const { withIndices } = request.query;
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.ts
similarity index 90%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.ts
index bcb5971a1c34f..279b016da178f 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/policies/register_policies_routes.ts
@@ -8,7 +8,7 @@ import { registerFetchRoute } from './register_fetch_route';
 import { registerCreateRoute } from './register_create_route';
 import { registerDeleteRoute } from './register_delete_route';
 
-export function registerPoliciesRoutes(server) {
+export function registerPoliciesRoutes(server: any) {
   registerFetchRoute(server);
   registerCreateRoute(server);
   registerDeleteRoute(server);
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/index.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/index.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/index.ts
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
similarity index 83%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
index e21f4615aaeb9..57e5a91f60f5b 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_add_policy_route.ts
@@ -4,18 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { merge } from 'lodash';
+
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
-import { merge } from 'lodash';
 
-async function getIndexTemplate(callWithRequest, templateName) {
+async function getIndexTemplate(callWithRequest: any, templateName: string): Promise<any> {
   const response = await callWithRequest('indices.getTemplate', { name: templateName });
   return response[templateName];
 }
 
-async function updateIndexTemplate(callWithRequest, indexTemplatePatch) {
+async function updateIndexTemplate(callWithRequest: any, indexTemplatePatch: any): Promise<any> {
   // Fetch existing template
   const template = await getIndexTemplate(callWithRequest, indexTemplatePatch.templateName);
   merge(template, {
@@ -39,14 +40,13 @@ async function updateIndexTemplate(callWithRequest, indexTemplatePatch) {
   return await callWithRequest('transport.request', params);
 }
 
-export function registerAddPolicyRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerAddPolicyRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/template',
     method: 'POST',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
similarity index 87%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
index c27bf393526e8..fd58f471d69bb 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_fetch_route.ts
@@ -5,7 +5,7 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
@@ -17,7 +17,7 @@ import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_facto
  * @param {String} templateName The index template
  * @param {Array} indexPatterns Index patterns
  */
-function isReservedSystemTemplate(templateName, indexPatterns) {
+function isReservedSystemTemplate(templateName: string, indexPatterns: string[]): boolean {
   return (
     templateName.startsWith('kibana_index_template') ||
     (templateName.startsWith('.') &&
@@ -27,7 +27,7 @@ function isReservedSystemTemplate(templateName, indexPatterns) {
   );
 }
 
-function filterAndFormatTemplates(templates) {
+function filterAndFormatTemplates(templates: any): any {
   const formattedTemplates = [];
   const templateNames = Object.keys(templates);
   for (const templateName of templateNames) {
@@ -49,7 +49,7 @@ function filterAndFormatTemplates(templates) {
   return formattedTemplates;
 }
 
-async function fetchTemplates(callWithRequest) {
+async function fetchTemplates(callWithRequest: any): Promise<any> {
   const params = {
     method: 'GET',
     path: '/_template',
@@ -59,14 +59,13 @@ async function fetchTemplates(callWithRequest) {
 
   return await callWithRequest('transport.request', params);
 }
-export function registerFetchRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerFetchRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/templates',
     method: 'GET',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
 
       try {
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.ts
similarity index 84%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.ts
index 102ffb12a698d..3edaea6e15818 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_get_route.ts
@@ -5,11 +5,11 @@
  */
 
 import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
+import { isEsError } from '../../../lib/is_es_error';
 import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
 import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
 
-async function fetchTemplate(callWithRequest, templateName) {
+async function fetchTemplate(callWithRequest: any, templateName: string): Promise<any> {
   const params = {
     method: 'GET',
     path: `/_template/${encodeURIComponent(templateName)}`,
@@ -20,14 +20,13 @@ async function fetchTemplate(callWithRequest, templateName) {
   return await callWithRequest('transport.request', params);
 }
 
-export function registerGetRoute(server) {
-  const isEsError = isEsErrorFactory(server);
+export function registerGetRoute(server: any) {
   const licensePreRouting = licensePreRoutingFactory(server);
 
   server.route({
     path: '/api/index_lifecycle_management/templates/{templateName}',
     method: 'GET',
-    handler: async request => {
+    handler: async (request: any) => {
       const callWithRequest = callWithRequestFactory(server, request);
       const templateName = request.params.templateName;
 
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.js b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.ts
similarity index 90%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.js
rename to x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.ts
index f70590a0d99ca..424b2d36b1ba2 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.js
+++ b/x-pack/legacy/plugins/index_lifecycle_management/server/routes/api/templates/register_templates_routes.ts
@@ -8,7 +8,7 @@ import { registerFetchRoute } from './register_fetch_route';
 import { registerGetRoute } from './register_get_route';
 import { registerAddPolicyRoute } from './register_add_policy_route';
 
-export function registerTemplatesRoutes(server) {
+export function registerTemplatesRoutes(server: any) {
   registerFetchRoute(server);
   registerGetRoute(server);
   registerAddPolicyRoute(server);
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/shim.ts b/x-pack/legacy/plugins/index_lifecycle_management/shim.ts
new file mode 100644
index 0000000000000..18b3d9ef28b6a
--- /dev/null
+++ b/x-pack/legacy/plugins/index_lifecycle_management/shim.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Legacy } from 'kibana';
+
+export interface LegacySetup {
+  server: Legacy.Server;
+}
+
+export function createShim(server: Legacy.Server): LegacySetup {
+  return {
+    server,
+  };
+}
diff --git a/x-pack/legacy/plugins/index_management/public/app/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js b/x-pack/legacy/plugins/index_management/public/app/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
index ea1fcdc51fc4d..5ed651e3125cf 100644
--- a/x-pack/legacy/plugins/index_management/public/app/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
+++ b/x-pack/legacy/plugins/index_management/public/app/sections/home/index_list/index_actions_context_menu/index_actions_context_menu.js
@@ -22,10 +22,22 @@ import {
   EuiOverlayMask,
   EuiCheckbox,
 } from '@elastic/eui';
+
+// We will be able to remove these after the NP migration is complete.
+import { fatalError } from 'ui/notify';
+import { createUiStatsReporter } from '../../../../../../../../../../src/legacy/core_plugins/ui_metric/public';
+import { httpService } from '../../../../services/http';
+import { notificationService } from '../../../../services/notification';
+
 import { flattenPanelTree } from '../../../../lib/flatten_panel_tree';
 import { INDEX_OPEN } from '../../../../../../common/constants';
 import { getActionExtensions } from '../../../../../index_management_extensions';
-import { getHttpClient } from '../../../../services/api';
+
+// We will be able to remove this after the NP migration is complete and we can just inject the
+// NP fatalErrors service..
+const getNewPlatformCompatibleFatalErrorService = () => ({
+  add: fatalError.bind(fatalError),
+});
 
 export class IndexActionsContextMenu extends Component {
   constructor(props) {
@@ -211,7 +223,20 @@ export class IndexActionsContextMenu extends Component {
       },
     });
     getActionExtensions().forEach(actionExtension => {
-      const actionExtensionDefinition = actionExtension(indices, reloadIndices);
+      const actionExtensionDefinition = actionExtension({
+        indices,
+        reloadIndices,
+        // These config options can be removed once the NP migration out of legacy is complete.
+        // They're needed for now because ILM's extensions make API calls which require these
+        // dependencies, but they're not available unless the app's "setup" lifecycle stage occurs.
+        // Within the old platform, "setup" only occurs once the user actually visits the app.
+        // Once ILM and IM have been moved out of legacy this hack won't be necessary.
+        createUiStatsReporter,
+        toasts: notificationService.toasts,
+        fatalErrors: getNewPlatformCompatibleFatalErrorService(),
+        httpClient: httpService.httpClient,
+      });
+
       if (actionExtensionDefinition) {
         const {
           buttonLabel,
@@ -727,7 +752,7 @@ export class IndexActionsContextMenu extends Component {
     return (
       <div>
         {this.state.renderConfirmModal
-          ? this.state.renderConfirmModal(this.closeConfirmModal, getHttpClient())
+          ? this.state.renderConfirmModal(this.closeConfirmModal)
           : null}
         <EuiPopover
           id="contextMenuIndices"
diff --git a/x-pack/legacy/plugins/index_management/public/app/services/api.ts b/x-pack/legacy/plugins/index_management/public/app/services/api.ts
index bdd5c39919646..8030a7f29d4ee 100644
--- a/x-pack/legacy/plugins/index_management/public/app/services/api.ts
+++ b/x-pack/legacy/plugins/index_management/public/app/services/api.ts
@@ -39,16 +39,6 @@ import { useRequest, sendRequest } from './use_request';
 import { httpService } from './http';
 import { Template } from '../../../common/types';
 
-let httpClient: ng.IHttpService;
-
-export const setHttpClient = (client: ng.IHttpService) => {
-  httpClient = client;
-};
-
-export const getHttpClient = () => {
-  return httpClient;
-};
-
 export async function loadIndices() {
   const response = await httpService.httpClient.get(`${API_BASE_PATH}/indices`);
   return response.data ? response.data : response;
diff --git a/x-pack/legacy/plugins/index_management/public/app/services/notification.ts b/x-pack/legacy/plugins/index_management/public/app/services/notification.ts
index 2e63253ccae67..85558a7023491 100644
--- a/x-pack/legacy/plugins/index_management/public/app/services/notification.ts
+++ b/x-pack/legacy/plugins/index_management/public/app/services/notification.ts
@@ -7,14 +7,18 @@
 import { NotificationsStart } from '../../../../../../../src/core/public';
 
 class NotificationService {
-  private toasts: any;
+  private _toasts: any;
 
   public init(notifications: NotificationsStart): void {
-    this.toasts = notifications.toasts;
+    this._toasts = notifications.toasts;
+  }
+
+  public get toasts() {
+    return this._toasts;
   }
 
   private addToasts = (title: string, type: 'danger' | 'warning' | 'success', text?: string) => {
-    this.toasts.add({
+    this._toasts.add({
       title,
       color: type,
       text,
diff --git a/x-pack/legacy/plugins/index_management/public/app/store/actions/extension_action.js b/x-pack/legacy/plugins/index_management/public/app/store/actions/extension_action.js
index dc2d2e346f803..277a71999492f 100644
--- a/x-pack/legacy/plugins/index_management/public/app/store/actions/extension_action.js
+++ b/x-pack/legacy/plugins/index_management/public/app/store/actions/extension_action.js
@@ -6,7 +6,7 @@
 
 import { reloadIndices } from '../actions';
 import { notificationService } from '../../services/notification';
-import { getHttpClient } from '../../services/api';
+import { httpService } from '../../services/http';
 
 export const performExtensionAction = ({
   requestMethod,
@@ -14,7 +14,7 @@ export const performExtensionAction = ({
   successMessage,
 }) => async dispatch => {
   try {
-    await requestMethod(indexNames, getHttpClient());
+    await requestMethod(indexNames, httpService.httpClient);
   } catch (error) {
     notificationService.showDangerToast(error.message);
     return;
diff --git a/x-pack/legacy/plugins/index_management/public/register_routes.ts b/x-pack/legacy/plugins/index_management/public/register_routes.ts
index 778d0733d04c0..378a53cf65555 100644
--- a/x-pack/legacy/plugins/index_management/public/register_routes.ts
+++ b/x-pack/legacy/plugins/index_management/public/register_routes.ts
@@ -10,7 +10,6 @@ import { CoreStart } from '../../../../../src/core/public';
 import { mountReactApp, unmountReactApp } from './app';
 import { REACT_ROOT_ID } from './app/constants';
 import { BASE_PATH } from '../common/constants';
-import { setHttpClient } from './app/services/api';
 
 import template from './index.html';
 import { manageAngularLifecycle } from './app/lib/manage_angular_lifecycle';
@@ -20,15 +19,11 @@ let elem: HTMLElement | null;
 export const registerRoutes = (core: CoreStart) => {
   routes.when(`${BASE_PATH}:view?/:action?/:id?`, {
     template,
-    controller: ($scope: any, $route: any, $http: ng.IHttpService) => {
+    controller: ($scope: any, $route: any) => {
       // clean up previously rendered React app if one exists
       // this happens because of React Router redirects
       unmountReactApp(elem);
 
-      // TODO $http is still needed for the ILM actions
-      // Once ILM is migrated to NP, it should be able to be removed
-      setHttpClient($http);
-
       $scope.$$postDigest(() => {
         elem = document.getElementById(REACT_ROOT_ID);
         mountReactApp(elem, { core });
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/index.ts b/x-pack/legacy/plugins/kuery_autocomplete/index.ts
deleted file mode 100644
index 5f9d74ed799e6..0000000000000
--- a/x-pack/legacy/plugins/kuery_autocomplete/index.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { resolve } from 'path';
-import { Legacy } from 'kibana';
-
-import { LegacyPluginApi, LegacyPluginInitializer } from '../../../../src/legacy/types';
-
-export const kueryAutocompleteInitializer: LegacyPluginInitializer = ({
-  Plugin,
-}: LegacyPluginApi) =>
-  new Plugin({
-    id: 'kuery_autocomplete',
-    publicDir: resolve(__dirname, 'public'),
-    uiExports: {
-      hacks: [resolve(__dirname, 'public/legacy')],
-    },
-    init: (server: Legacy.Server) => ({}),
-  } as Legacy.PluginSpecOptions);
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/legacy.ts b/x-pack/legacy/plugins/kuery_autocomplete/public/legacy.ts
deleted file mode 100644
index 303fe8c557fbd..0000000000000
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/legacy.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { PluginInitializerContext } from 'src/core/public';
-import { npSetup, npStart } from 'ui/new_platform';
-
-import { plugin } from './index';
-import {
-  KueryAutocompletePluginSetupDependencies,
-  KueryAutocompletePluginStartDependencies,
-} from './plugin';
-
-const pluginsSetup: Readonly<KueryAutocompletePluginSetupDependencies> = {
-  data: npSetup.plugins.data,
-};
-
-const pluginsStart: Readonly<KueryAutocompletePluginStartDependencies> = {
-  data: npStart.plugins.data,
-};
-
-const pluginInstance = plugin({} as PluginInitializerContext);
-
-export const setup = pluginInstance.setup(npSetup.core, pluginsSetup);
-export const start = pluginInstance.start(npStart.core, pluginsStart);
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/plugin.ts b/x-pack/legacy/plugins/kuery_autocomplete/public/plugin.ts
deleted file mode 100644
index 81737c4636532..0000000000000
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/plugin.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from 'src/core/public';
-import { Plugin as DataPublicPlugin } from '../../../../../src/plugins/data/public';
-import { setAutocompleteService } from './services';
-import { setupKqlQuerySuggestionProvider } from './kql_query_suggestion';
-
-/** @internal */
-export interface KueryAutocompletePluginSetupDependencies {
-  data: ReturnType<DataPublicPlugin['setup']>;
-}
-
-/** @internal */
-export interface KueryAutocompletePluginStartDependencies {
-  data: ReturnType<DataPublicPlugin['start']>;
-}
-
-const KUERY_LANGUAGE_NAME = 'kuery';
-
-/** @internal */
-export class KueryAutocompletePlugin implements Plugin<Promise<void>, void> {
-  initializerContext: PluginInitializerContext;
-
-  constructor(initializerContext: PluginInitializerContext) {
-    this.initializerContext = initializerContext;
-  }
-
-  public async setup(core: CoreSetup, plugins: KueryAutocompletePluginSetupDependencies) {
-    const kueryProvider = setupKqlQuerySuggestionProvider(core);
-
-    plugins.data.autocomplete.addQuerySuggestionProvider(KUERY_LANGUAGE_NAME, kueryProvider);
-  }
-
-  public start(core: CoreStart, plugins: KueryAutocompletePluginStartDependencies) {
-    setAutocompleteService(plugins.data.autocomplete);
-  }
-}
diff --git a/x-pack/legacy/plugins/lens/index.ts b/x-pack/legacy/plugins/lens/index.ts
index a4eb24d4a4de4..bb0bf9b67ee2c 100644
--- a/x-pack/legacy/plugins/lens/index.ts
+++ b/x-pack/legacy/plugins/lens/index.ts
@@ -7,11 +7,12 @@
 import * as Joi from 'joi';
 import { resolve } from 'path';
 import { LegacyPluginInitializer } from 'src/legacy/types';
-import KbnServer, { Server } from 'src/legacy/server/kbn_server';
 import mappings from './mappings.json';
-import { PLUGIN_ID, getEditPath, NOT_INTERNATIONALIZED_PRODUCT_NAME } from './common';
-import { lensServerPlugin } from './server';
-import { getTaskManagerSetup, getTaskManagerStart } from '../task_manager/server';
+import {
+  PLUGIN_ID,
+  getEditPath,
+  NOT_INTERNATIONALIZED_PRODUCT_NAME,
+} from '../../../plugins/lens/common';
 
 export const lens: LegacyPluginInitializer = kibana => {
   return new kibana.Plugin({
@@ -51,31 +52,5 @@ export const lens: LegacyPluginInitializer = kibana => {
         enabled: Joi.boolean().default(true),
       }).default();
     },
-
-    init(server: Server) {
-      const kbnServer = (server as unknown) as KbnServer;
-
-      // Set up with the new platform plugin lifecycle API.
-      const plugin = lensServerPlugin();
-      const { usageCollection } = server.newPlatform.setup.plugins;
-
-      plugin.setup(kbnServer.newPlatform.setup.core, {
-        usageCollection,
-        // Legacy APIs
-        savedObjects: server.savedObjects,
-        config: server.config(),
-        server,
-        taskManager: getTaskManagerSetup(server)!,
-      });
-
-      plugin.start(kbnServer.newPlatform.start.core, {
-        server,
-        taskManager: getTaskManagerStart(server)!,
-      });
-
-      server.events.on('stop', () => {
-        plugin.stop();
-      });
-    },
   });
 };
diff --git a/x-pack/legacy/plugins/lens/public/app_plugin/app.tsx b/x-pack/legacy/plugins/lens/public/app_plugin/app.tsx
index 6d2ebee1d88db..23c595bf770d2 100644
--- a/x-pack/legacy/plugins/lens/public/app_plugin/app.tsx
+++ b/x-pack/legacy/plugins/lens/public/app_plugin/app.tsx
@@ -9,12 +9,12 @@ import React, { useState, useEffect, useCallback } from 'react';
 import { I18nProvider } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { Query, DataPublicPluginStart } from 'src/plugins/data/public';
-import { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
 import { AppMountContext, NotificationsStart } from 'src/core/public';
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { npStart } from 'ui/new_platform';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
+import { SavedObjectSaveModal } from '../../../../../../src/plugins/saved_objects/public';
 import { Document, SavedObjectStore } from '../persistence';
 import { EditorFrameInstance } from '../types';
 import { NativeRenderer } from '../native_renderer';
diff --git a/x-pack/legacy/plugins/lens/public/app_plugin/plugin.tsx b/x-pack/legacy/plugins/lens/public/app_plugin/plugin.tsx
index f7d9ae5741afb..283f4d2a0689d 100644
--- a/x-pack/legacy/plugins/lens/public/app_plugin/plugin.tsx
+++ b/x-pack/legacy/plugins/lens/public/app_plugin/plugin.tsx
@@ -40,7 +40,7 @@ import {
   stopReportManager,
   trackUiEvent,
 } from '../lens_ui_telemetry';
-import { NOT_INTERNATIONALIZED_PRODUCT_NAME } from '../../common';
+import { NOT_INTERNATIONALIZED_PRODUCT_NAME } from '../../../../../plugins/lens/common';
 import { KibanaLegacySetup } from '../../../../../../src/plugins/kibana_legacy/public';
 import { EditorFrameStart } from '../types';
 import {
@@ -50,7 +50,7 @@ import {
 } from '../../../../../../src/legacy/core_plugins/kibana/public/dashboard/np_ready/url_helper';
 
 export interface LensPluginSetupDependencies {
-  kibana_legacy: KibanaLegacySetup;
+  kibanaLegacy: KibanaLegacySetup;
 }
 
 export interface LensPluginStartDependencies {
@@ -71,7 +71,7 @@ export class AppPlugin {
 
   constructor() {}
 
-  setup(core: CoreSetup, { kibana_legacy }: LensPluginSetupDependencies) {
+  setup(core: CoreSetup, { kibanaLegacy }: LensPluginSetupDependencies) {
     // TODO: These plugins should not be called from the top level, but since this is the
     // entry point to the app we have no choice until the new platform is ready
     const indexPattern = indexPatternDatasourceSetup();
@@ -85,7 +85,7 @@ export class AppPlugin {
     editorFrameSetupInterface.registerVisualization(metricVisualization);
     editorFrameSetupInterface.registerDatasource(indexPattern);
 
-    kibana_legacy.registerLegacyApp({
+    kibanaLegacy.registerLegacyApp({
       id: 'lens',
       title: NOT_INTERNATIONALIZED_PRODUCT_NAME,
       mount: async (context, params) => {
diff --git a/x-pack/legacy/plugins/lens/public/editor_frame_plugin/embeddable/embeddable_factory.ts b/x-pack/legacy/plugins/lens/public/editor_frame_plugin/embeddable/embeddable_factory.ts
index 03a21a9b364c1..629efdbdb460b 100644
--- a/x-pack/legacy/plugins/lens/public/editor_frame_plugin/embeddable/embeddable_factory.ts
+++ b/x-pack/legacy/plugins/lens/public/editor_frame_plugin/embeddable/embeddable_factory.ts
@@ -19,7 +19,7 @@ import {
 } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public';
 import { Embeddable } from './embeddable';
 import { SavedObjectIndexStore, DOC_TYPE } from '../../persistence';
-import { getEditPath } from '../../../common';
+import { getEditPath } from '../../../../../../plugins/lens/common';
 
 export class EmbeddableFactory extends AbstractEmbeddableFactory {
   type = DOC_TYPE;
diff --git a/x-pack/legacy/plugins/lens/public/editor_frame_plugin/plugin.test.tsx b/x-pack/legacy/plugins/lens/public/editor_frame_plugin/plugin.test.tsx
index da9fdd7927d60..7a6067dd5f23c 100644
--- a/x-pack/legacy/plugins/lens/public/editor_frame_plugin/plugin.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/editor_frame_plugin/plugin.test.tsx
@@ -14,9 +14,6 @@ import {
 } from './mocks';
 
 jest.mock('ui/new_platform');
-jest.mock('ui/chrome', () => ({
-  getSavedObjectsClient: jest.fn(),
-}));
 
 // mock away actual dependencies to prevent all of it being loaded
 jest.mock('../../../../../../src/legacy/core_plugins/interpreter/public/registries', () => {});
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/auto_date.ts b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/auto_date.ts
index b62585f5da09a..7720af8ee9001 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/auto_date.ts
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/auto_date.ts
@@ -10,7 +10,7 @@ import {
   ExpressionFunction,
   KibanaContext,
 } from '../../../../../../src/plugins/expressions/public';
-import { DateRange } from '../../common';
+import { DateRange } from '../../../../../plugins/lens/common';
 
 interface LensAutoDateProps {
   aggConfigs: string;
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/dimension_panel/dimension_panel.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/dimension_panel/dimension_panel.tsx
index dfeb8632d096e..972c396f93b43 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/dimension_panel/dimension_panel.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/dimension_panel/dimension_panel.tsx
@@ -19,7 +19,7 @@ import { changeColumn, deleteColumn } from '../state_helpers';
 import { isDraggedField, hasField } from '../utils';
 import { IndexPatternPrivateState, IndexPatternField } from '../types';
 import { trackUiEvent } from '../../lens_ui_telemetry';
-import { DateRange } from '../../../common';
+import { DateRange } from '../../../../../../plugins/lens/common';
 
 export type IndexPatternDimensionPanelProps = DatasourceDimensionPanelProps & {
   state: IndexPatternPrivateState;
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.test.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.test.tsx
index 1b49eb6bca7fa..62e2e628c254f 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.test.tsx
@@ -90,6 +90,24 @@ describe('IndexPattern Field Item', () => {
     } as unknown) as FieldFormatsStart;
   });
 
+  it('should request field stats without a time field, if the index pattern has none', async () => {
+    indexPattern.timeFieldName = undefined;
+    core.http.post.mockImplementationOnce(() => {
+      return Promise.resolve({});
+    });
+    const wrapper = mountWithIntl(<FieldItem {...defaultProps} />);
+    wrapper.find('[data-test-subj="lnsFieldListPanelField-bytes"]').simulate('click');
+
+    expect(core.http.post).toHaveBeenCalledWith(
+      '/api/lens/index_stats/my-fake-index-pattern/field',
+      expect.anything()
+    );
+    // Function argument types not detected correctly (https://github.com/microsoft/TypeScript/issues/26591)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const { body } = (core.http.post.mock.calls[0] as any)[1];
+    expect(JSON.parse(body)).not.toHaveProperty('timeFieldName');
+  });
+
   it('should request field stats every time the button is clicked', async () => {
     let resolveFunction: (arg: unknown) => void;
 
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.tsx
index 4a58f0354882a..2aec28181f02b 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/field_item.tsx
@@ -44,7 +44,7 @@ import {
 import { DraggedField } from './indexpattern';
 import { DragDrop } from '../drag_drop';
 import { DatasourceDataPanelProps, DataType } from '../types';
-import { BucketedAggregation, FieldStatsResponse } from '../../common';
+import { BucketedAggregation, FieldStatsResponse } from '../../../../../plugins/lens/common';
 import { IndexPattern, IndexPatternField } from './types';
 import { getColorForDataType, LensFieldIcon } from './lens_field_icon';
 import { trackUiEvent } from '../lens_ui_telemetry';
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/loader.ts b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/loader.ts
index c9473c1869868..e37c5db09ca74 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/loader.ts
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/loader.ts
@@ -15,13 +15,12 @@ import {
   IndexPatternPersistedState,
   IndexPatternPrivateState,
   IndexPatternField,
-  AggregationRestrictions,
 } from './types';
 import { updateLayerIndexPattern } from './state_helpers';
-import { DateRange, ExistingFields } from '../../common/types';
-import { BASE_API_URL } from '../../common';
+import { DateRange, ExistingFields } from '../../../../../plugins/lens/common/types';
+import { BASE_API_URL } from '../../../../../plugins/lens/common';
 import { documentField } from './document_field';
-import { isNestedField, IFieldType } from '../../../../../../src/plugins/data/public';
+import { isNestedField, IFieldType, TypeMeta } from '../../../../../../src/plugins/data/public';
 
 interface SavedIndexPatternAttributes extends SavedObjectAttributes {
   title: string;
@@ -31,12 +30,7 @@ interface SavedIndexPatternAttributes extends SavedObjectAttributes {
   typeMeta: string;
 }
 
-interface SavedRestrictionsObject {
-  aggs: Record<string, AggregationRestrictions>;
-}
-
 type SetState = StateSetter<IndexPatternPrivateState>;
-type SavedRestrictionsInfo = SavedRestrictionsObject | undefined;
 type SavedObjectsClient = Pick<SavedObjectsClientContract, 'find' | 'bulkGet'>;
 type ErrorHandler = (err: Error) => void;
 
@@ -275,9 +269,7 @@ function fromSavedObject(
     fields: (JSON.parse(attributes.fields) as IFieldType[])
       .filter(field => !isNestedField(field) && (!!field.aggregatable || !!field.scripted))
       .concat(documentField) as IndexPatternField[],
-    typeMeta: attributes.typeMeta
-      ? (JSON.parse(attributes.typeMeta) as SavedRestrictionsInfo)
-      : undefined,
+    typeMeta: attributes.typeMeta ? (JSON.parse(attributes.typeMeta) as TypeMeta) : undefined,
     fieldFormatMap: attributes.fieldFormatMap ? JSON.parse(attributes.fieldFormatMap) : undefined,
   };
 
@@ -286,21 +278,23 @@ function fromSavedObject(
     return indexPattern;
   }
 
-  const aggs = Object.keys(typeMeta.aggs);
-
   const newFields = [...(indexPattern.fields as IndexPatternField[])];
-  newFields.forEach((field, index) => {
-    const restrictionsObj: IndexPatternField['aggregationRestrictions'] = {};
-    aggs.forEach(agg => {
-      const restriction = typeMeta.aggs[agg] && typeMeta.aggs[agg][field.name];
-      if (restriction) {
-        restrictionsObj[agg] = restriction;
+
+  if (typeMeta.aggs) {
+    const aggs = Object.keys(typeMeta.aggs);
+    newFields.forEach((field, index) => {
+      const restrictionsObj: IndexPatternField['aggregationRestrictions'] = {};
+      aggs.forEach(agg => {
+        const restriction = typeMeta.aggs && typeMeta.aggs[agg] && typeMeta.aggs[agg][field.name];
+        if (restriction) {
+          restrictionsObj[agg] = restriction;
+        }
+      });
+      if (Object.keys(restrictionsObj).length) {
+        newFields[index] = { ...field, aggregationRestrictions: restrictionsObj };
       }
     });
-    if (Object.keys(restrictionsObj).length) {
-      newFields[index] = { ...field, aggregationRestrictions: restrictionsObj };
-    }
-  });
+  }
 
   return {
     id: indexPattern.id,
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.test.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.test.tsx
index 2bd6c7106a952..5be92e31f4934 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.test.tsx
@@ -14,33 +14,31 @@ import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
 import { createMockedIndexPattern } from '../../mocks';
 import { IndexPatternPrivateState } from '../../types';
 
-jest.mock('ui/new_platform', () => {
+jest.mock(`ui/new_platform`, () => {
   // Due to the way we are handling shims in the NP migration, we need
   // to mock core here so that upstream services don't cause these
   // tests to fail. Ordinarly `jest.mock('ui/new_platform')` would be
   // sufficient, however we need to mock one of the `uiSettings` return
   // values for this suite, so we must manually assemble the mock.
   // Because babel hoists `jest` we must use an inline `require`
-  // to ensure the core mocks are available (`jest.doMock` doesn't
+  // to ensure the mocks are available (`jest.doMock` doesn't
   // work in this case). This mock should be able to be replaced
   // altogether once Lens has migrated to the new platform.
-  const { coreMock } = require('src/core/public/mocks'); // eslint-disable-line @typescript-eslint/no-var-requires
+  const {
+    createUiNewPlatformMock,
+  } = require('../../../../../../../../src/legacy/ui/public/new_platform/__mocks__/helpers'); // eslint-disable-line @typescript-eslint/no-var-requires
+  // This is basically duplicating what would ordinarily happen in
+  // `ui/new_platform/__mocks__`
+  const { npSetup, npStart } = createUiNewPlatformMock();
+  // Override the core mock provided by `ui/new_platform`
+  npStart.core.uiSettings.get = (path: string) => {
+    if (path === 'histogram:maxBars') {
+      return 10;
+    }
+  };
   return {
-    npSetup: {
-      core: coreMock.createSetup(),
-    },
-    npStart: {
-      core: {
-        ...coreMock.createStart(),
-        uiSettings: {
-          get: (path: string) => {
-            if (path === 'histogram:maxBars') {
-              return 10;
-            }
-          },
-        },
-      },
-    },
+    npSetup,
+    npStart,
   };
 });
 
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.tsx
index dbb6278352f09..4cfd7195d1fc0 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/date_histogram.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 // TODO: make this new-platform compatible
-import { isValidInterval } from 'ui/agg_types/utils';
+import { isValidInterval } from 'ui/agg_types';
 
 import {
   EuiForm,
@@ -27,7 +27,7 @@ import { updateColumnParam } from '../../state_helpers';
 import { OperationDefinition } from '.';
 import { FieldBasedIndexPatternColumn } from './column_types';
 import { autoIntervalFromDateRange } from '../../auto_date';
-import { AggregationRestrictions } from '../../types';
+import { AggregationRestrictions } from '../../../../../../../../src/plugins/data/public';
 
 const autoInterval = 'auto';
 const calendarOnlyIntervals = new Set(['w', 'M', 'q', 'y']);
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/index.ts b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/index.ts
index 63e4564878e31..f357038be41a4 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/index.ts
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/operations/definitions/index.ts
@@ -14,7 +14,7 @@ import { countOperation } from './count';
 import { DimensionPriority, StateSetter, OperationMetadata } from '../../../types';
 import { BaseIndexPatternColumn } from './column_types';
 import { IndexPatternPrivateState, IndexPattern, IndexPatternField } from '../../types';
-import { DateRange } from '../../../../common';
+import { DateRange } from '../../../../../../../plugins/lens/common';
 
 // List of all operation definitions registered to this data source.
 // If you want to implement a new operation, add it to this array and
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/types.ts b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/types.ts
index e556ddda10679..546d148be1e29 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_plugin/types.ts
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_plugin/types.ts
@@ -5,6 +5,7 @@
  */
 
 import { IndexPatternColumn } from './operations';
+import { AggregationRestrictions } from '../../../../../../src/plugins/data/public';
 
 export interface IndexPattern {
   id: string;
@@ -20,18 +21,6 @@ export interface IndexPattern {
   >;
 }
 
-export type AggregationRestrictions = Record<
-  string,
-  {
-    agg?: string;
-    interval?: number;
-    fixed_interval?: string;
-    calendar_interval?: string;
-    delay?: string;
-    time_zone?: string;
-  }
->;
-
 export interface IndexPatternField {
   name: string;
   type: string;
diff --git a/x-pack/legacy/plugins/lens/public/lens_ui_telemetry/factory.ts b/x-pack/legacy/plugins/lens/public/lens_ui_telemetry/factory.ts
index babc65969afb5..73750a65c50b8 100644
--- a/x-pack/legacy/plugins/lens/public/lens_ui_telemetry/factory.ts
+++ b/x-pack/legacy/plugins/lens/public/lens_ui_telemetry/factory.ts
@@ -8,7 +8,7 @@ import moment from 'moment';
 import { HttpSetup } from 'src/core/public';
 
 import { IStorageWrapper } from 'src/plugins/kibana_utils/public';
-import { BASE_API_URL } from '../../common';
+import { BASE_API_URL } from '../../../../../plugins/lens/common';
 
 const STORAGE_KEY = 'lens-ui-telemetry';
 
diff --git a/x-pack/legacy/plugins/lens/public/register_vis_type_alias.ts b/x-pack/legacy/plugins/lens/public/register_vis_type_alias.ts
index 0c4e6d9f7cb10..f71796268065b 100644
--- a/x-pack/legacy/plugins/lens/public/register_vis_type_alias.ts
+++ b/x-pack/legacy/plugins/lens/public/register_vis_type_alias.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { setup as visualizations } from '../../../../../src/legacy/core_plugins/visualizations/public/np_ready/public/legacy';
-import { getBasePath, getEditPath } from '../common';
+import { getBasePath, getEditPath } from '../../../../plugins/lens/common';
 
 visualizations.types.registerAlias({
   aliasUrl: getBasePath(),
diff --git a/x-pack/legacy/plugins/lens/public/types.ts b/x-pack/legacy/plugins/lens/public/types.ts
index 923e0aff5ae0e..e2157deb43e49 100644
--- a/x-pack/legacy/plugins/lens/public/types.ts
+++ b/x-pack/legacy/plugins/lens/public/types.ts
@@ -11,7 +11,7 @@ import { SavedQuery } from 'src/legacy/core_plugins/data/public';
 import { KibanaDatatable } from '../../../../../src/plugins/expressions/public';
 import { DragContextState } from './drag_drop';
 import { Document } from './persistence';
-import { DateRange } from '../common';
+import { DateRange } from '../../../../plugins/lens/common';
 import { Query, esFilters } from '../../../../../src/plugins/data/public';
 
 // eslint-disable-next-line
diff --git a/x-pack/legacy/plugins/lens/server/plugin.tsx b/x-pack/legacy/plugins/lens/server/plugin.tsx
deleted file mode 100644
index f80d52248b484..0000000000000
--- a/x-pack/legacy/plugins/lens/server/plugin.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { Server, KibanaConfig } from 'src/legacy/server/kbn_server';
-import { Plugin, CoreSetup, CoreStart, SavedObjectsLegacyService } from 'src/core/server';
-import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { Subject } from 'rxjs';
-import { first } from 'rxjs/operators';
-import {
-  TaskManagerSetupContract,
-  TaskManagerStartContract,
-} from '../../../../plugins/task_manager/server';
-import { setupRoutes } from './routes';
-import {
-  registerLensUsageCollector,
-  initializeLensTelemetry,
-  scheduleLensTelemetry,
-} from './usage';
-
-export interface PluginSetupContract {
-  savedObjects: SavedObjectsLegacyService;
-  usageCollection: UsageCollectionSetup;
-  config: KibanaConfig;
-  server: Server;
-  taskManager: TaskManagerSetupContract;
-}
-
-export interface PluginStartContract {
-  server: Server;
-  taskManager: TaskManagerStartContract;
-}
-
-const taskManagerStartContract$ = new Subject<TaskManagerStartContract>();
-
-export class LensServer implements Plugin<{}, {}, {}, {}> {
-  setup(core: CoreSetup, plugins: PluginSetupContract) {
-    setupRoutes(core, plugins);
-    registerLensUsageCollector(
-      plugins.usageCollection,
-      taskManagerStartContract$.pipe(first()).toPromise()
-    );
-    initializeLensTelemetry(plugins.server, plugins.taskManager);
-    return {};
-  }
-
-  start(core: CoreStart, plugins: PluginStartContract) {
-    scheduleLensTelemetry(plugins.server, plugins.taskManager);
-    taskManagerStartContract$.next(plugins.taskManager);
-    taskManagerStartContract$.complete();
-    return {};
-  }
-
-  stop() {}
-}
diff --git a/x-pack/legacy/plugins/maps/public/angular/map_controller.js b/x-pack/legacy/plugins/maps/public/angular/map_controller.js
index 5f058e2ba7806..c90560a4fcfdf 100644
--- a/x-pack/legacy/plugins/maps/public/angular/map_controller.js
+++ b/x-pack/legacy/plugins/maps/public/angular/map_controller.js
@@ -45,8 +45,6 @@ import {
 import { getInspectorAdapters } from '../reducers/non_serializable_instances';
 import { docTitle } from 'ui/doc_title';
 import { indexPatternService, getInspector } from '../kibana_services';
-import { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
-import { showSaveModal } from 'ui/saved_objects/show_saved_object_save_modal';
 import { toastNotifications } from 'ui/notify';
 import { getInitialLayers } from './get_initial_layers';
 import { getInitialQuery } from './get_initial_query';
@@ -55,6 +53,10 @@ import { getInitialRefreshConfig } from './get_initial_refresh_config';
 import { MAP_SAVED_OBJECT_TYPE, MAP_APP_PATH } from '../../common/constants';
 import { npStart } from 'ui/new_platform';
 import { esFilters } from '../../../../../../src/plugins/data/public';
+import {
+  SavedObjectSaveModal,
+  showSaveModal,
+} from '../../../../../../src/plugins/saved_objects/public';
 
 const savedQueryService = npStart.plugins.data.query.savedQueries;
 
@@ -566,7 +568,7 @@ app.controller(
                     objectType={MAP_SAVED_OBJECT_TYPE}
                   />
                 );
-                showSaveModal(saveModal);
+                showSaveModal(saveModal, npStart.core.i18n.Context);
               },
             },
           ]
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
index ad55a279f9cd7..da6248099c9c1 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
@@ -227,7 +227,7 @@ export class CreateSourceEditor extends Component {
             label={i18n.translate('xpack.maps.source.esSearch.extentFilterLabel', {
               defaultMessage: `Dynamically filter for data in the visible map area`,
             })}
-            checked={this.props.filterByMapBounds}
+            checked={this.state.filterByMapBounds}
             onChange={this.onFilterByMapBoundsChange}
           />
         </EuiFormRow>
diff --git a/x-pack/legacy/plugins/ml/common/util/job_utils.d.ts b/x-pack/legacy/plugins/ml/common/util/job_utils.d.ts
index df62d19b6d27b..cfff15bb97be2 100644
--- a/x-pack/legacy/plugins/ml/common/util/job_utils.d.ts
+++ b/x-pack/legacy/plugins/ml/common/util/job_utils.d.ts
@@ -43,3 +43,5 @@ export function processCreatedBy(customSettings: { created_by?: string }): void;
 export function mlFunctionToESAggregation(functionName: string): string | null;
 
 export function isModelPlotEnabled(job: Job, detectorIndex: number, entityFields: any[]): boolean;
+
+export function getSafeAggregationName(fieldName: string, index: number): string;
diff --git a/x-pack/legacy/plugins/ml/public/application/components/create_job_link_card/create_job_link_card.tsx b/x-pack/legacy/plugins/ml/public/application/components/create_job_link_card/create_job_link_card.tsx
index 07a924caae772..7538a7c05b7fe 100644
--- a/x-pack/legacy/plugins/ml/public/application/components/create_job_link_card/create_job_link_card.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/components/create_job_link_card/create_job_link_card.tsx
@@ -67,7 +67,7 @@ export const CreateJobLinkCard: FC<Props> = ({
           </EuiFlexItem>
           <EuiFlexItem>
             <EuiTitle size="s">
-              <h4>{title}</h4>
+              <h3>{title}</h3>
             </EuiTitle>
             <EuiText color="subdued">
               <p>{description}</p>
diff --git a/x-pack/legacy/plugins/ml/public/application/components/influencers_list/_influencers_list.scss b/x-pack/legacy/plugins/ml/public/application/components/influencers_list/_influencers_list.scss
index efaff421cdf6a..e4bb9c22fda82 100644
--- a/x-pack/legacy/plugins/ml/public/application/components/influencers_list/_influencers_list.scss
+++ b/x-pack/legacy/plugins/ml/public/application/components/influencers_list/_influencers_list.scss
@@ -15,23 +15,23 @@
   }
 
   .progress {
-    display:inline-block;
-    width: calc(100% - 34px); // SASSTODO: Calc porper value
+    display: inline-block;
+    width: calc(100% - 34px); // SASSTODO: Calc proper value
     height: 22px;
     min-width: 70px;
     margin-bottom: 0px;
     color: $euiColorDarkShade;
-    background-color : transparent;
+    background-color: transparent;
 
     .progress-bar-holder {
-      width: calc(100% - 28px); // SASSTODO: Calc porper value
+      width: calc(100% - 28px); // SASSTODO: Calc proper value
     }
 
     .progress-bar {
       height: $euiSizeXS / 2;
       margin-top: $euiSizeM;
       text-align: right;
-      line-height: 18px; // SASSTODO: Calc porper value
+      line-height: 18px; // SASSTODO: Calc proper value
       display: inline-block;
       transition: none;
     }
@@ -42,6 +42,7 @@
     .progress-bar {
       background-color: $mlColorCritical;
     }
+
     .score-label {
       border-color: $mlColorCritical;
     }
@@ -51,6 +52,7 @@
     .progress-bar {
       background-color: $mlColorMajor;
     }
+
     .score-label {
       border-color: $mlColorMajor;
     }
@@ -60,6 +62,7 @@
     .progress-bar {
       background-color: $mlColorMinor;
     }
+
     .score-label {
       border-color: $mlColorMinor;
     }
@@ -69,6 +72,7 @@
     .progress-bar {
       background-color: $mlColorWarning;
     }
+
     .score-label {
       border-color: $mlColorWarning;
     }
@@ -99,8 +103,7 @@
   }
 }
 
-  // SASSTODO: Can .eui-textBreakAll
+// SASSTODO: Can .eui-textBreakAll
 .ml-influencers-list-tooltip {
   word-break: break-all;
 }
-
diff --git a/x-pack/legacy/plugins/ml/public/application/components/influencers_list/influencers_list.js b/x-pack/legacy/plugins/ml/public/application/components/influencers_list/influencers_list.js
index ae61e65f91799..5a31dcef51676 100644
--- a/x-pack/legacy/plugins/ml/public/application/components/influencers_list/influencers_list.js
+++ b/x-pack/legacy/plugins/ml/public/application/components/influencers_list/influencers_list.js
@@ -11,7 +11,7 @@
 import PropTypes from 'prop-types';
 import React from 'react';
 
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText, EuiTitle, EuiToolTip } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle, EuiToolTip } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import { abbreviateWholeNumber } from '../../formatters/abbreviate_whole_number';
@@ -115,7 +115,7 @@ function InfluencersByName({ influencerFieldName, influencerFilter, fieldValues
   return (
     <React.Fragment key={influencerFieldName}>
       <EuiTitle size="xs" data-test-subj={`mlInfluencerFieldName ${influencerFieldName}`}>
-        <h4>{influencerFieldName}</h4>
+        <h3>{influencerFieldName}</h3>
       </EuiTitle>
       <EuiSpacer size="xs" />
       {influencerValues}
@@ -131,17 +131,17 @@ InfluencersByName.propTypes = {
 export function InfluencersList({ influencers, influencerFilter }) {
   if (influencers === undefined || Object.keys(influencers).length === 0) {
     return (
-      <EuiFlexGroup justifyContent="spaceAround">
+      <EuiFlexGroup justifyContent="spaceAround" className="ml-influencers-list">
         <EuiFlexItem grow={false}>
           <EuiSpacer size="xxl" />
-          <EuiText>
-            <h4>
+          <EuiTitle size="xs" className="influencer-title">
+            <h3>
               <FormattedMessage
                 id="xpack.ml.influencersList.noInfluencersFoundTitle"
                 defaultMessage="No influencers found"
               />
-            </h4>
-          </EuiText>
+            </h3>
+          </EuiTitle>
         </EuiFlexItem>
       </EuiFlexGroup>
     );
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx b/x-pack/legacy/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
index 1727b1652c55d..7c0bcac039164 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/datavisualizer_selector.tsx
@@ -62,12 +62,12 @@ export const DatavisualizerSelector: FC = () => {
           <EuiFlexGroup gutterSize="xl">
             <EuiFlexItem grow={false}>
               <EuiTitle size="l">
-                <h2>
+                <h1>
                   <FormattedMessage
                     id="xpack.ml.datavisualizer.selector.dataVisualizerTitle"
                     defaultMessage="Data Visualizer"
                   />
-                </h2>
+                </h1>
               </EuiTitle>
             </EuiFlexItem>
           </EuiFlexGroup>
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_file_datavisualizer.scss b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_file_datavisualizer.scss
deleted file mode 100644
index 9a0bc2d5c04e8..0000000000000
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_file_datavisualizer.scss
+++ /dev/null
@@ -1,3 +0,0 @@
-.file-datavisualizer__content {
-  padding: $euiSize;
-}
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_index.scss b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_index.scss
index b08d81b0dfe4b..841415620d691 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_index.scss
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/_index.scss
@@ -1,2 +1 @@
-@import 'file_datavisualizer';
 @import 'components/index';
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/about_panel.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/about_panel.js
index 33aaea6970a17..4fe4933261985 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/about_panel.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/about_panel.js
@@ -60,12 +60,12 @@ export function LoadingPanel() {
         <EuiPageContent className="file-datavisualizer-about-panel__content" paddingSize="l">
           <div style={{ textAlign: 'center' }}>
             <EuiTitle size="s">
-              <h3 role="alert">
+              <h1 role="alert">
                 <FormattedMessage
                   id="xpack.ml.fileDatavisualizer.aboutPanel.analyzingDataTitle"
                   defaultMessage="Analyzing data"
                 />
-              </h3>
+              </h1>
             </EuiTitle>
 
             <EuiSpacer size="l" />
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/welcome_content.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/welcome_content.js
index 0b438ea584b28..73d12122879f8 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/welcome_content.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/about_panel/welcome_content.js
@@ -27,7 +27,7 @@ export function WelcomeContent() {
       </EuiFlexItem>
       <EuiFlexItem>
         <EuiTitle size="m">
-          <h3>
+          <h1>
             <FormattedMessage
               id="xpack.ml.fileDatavisualizer.welcomeContent.visualizeDataFromLogFileTitle"
               defaultMessage="Visualize data from a log file&nbsp;{experimentalBadge}"
@@ -44,7 +44,7 @@ export function WelcomeContent() {
                 ),
               }}
             />
-          </h3>
+          </h1>
         </EuiTitle>
         <EuiSpacer size="s" />
         <EuiText>
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/analysis_summary/analysis_summary.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/analysis_summary/analysis_summary.js
index 02d50b34f68a2..b3bf4ea4daf83 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/analysis_summary/analysis_summary.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/analysis_summary/analysis_summary.js
@@ -15,12 +15,12 @@ export function AnalysisSummary({ results }) {
   return (
     <React.Fragment>
       <EuiTitle size="s">
-        <h3>
+        <h2>
           <FormattedMessage
             id="xpack.ml.fileDatavisualizer.analysisSummary.summaryTitle"
             defaultMessage="Summary"
           />
-        </h3>
+        </h2>
       </EuiTitle>
 
       <EuiSpacer size="m" />
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_contents/file_contents.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_contents/file_contents.js
index 97ee1e9c5e98a..99bac9cc27d6f 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_contents/file_contents.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_contents/file_contents.js
@@ -22,12 +22,12 @@ export function FileContents({ data, format, numberOfLines }) {
   return (
     <React.Fragment>
       <EuiTitle size="s">
-        <h3>
+        <h2>
           <FormattedMessage
             id="xpack.ml.fileDatavisualizer.fileContents.fileContentsTitle"
             defaultMessage="File contents"
           />
-        </h3>
+        </h2>
       </EuiTitle>
 
       <div>
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_datavisualizer_view/file_datavisualizer_view.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_datavisualizer_view/file_datavisualizer_view.js
index 134a1f85e8346..a4300de5abbbb 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_datavisualizer_view/file_datavisualizer_view.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/file_datavisualizer_view/file_datavisualizer_view.js
@@ -36,6 +36,7 @@ export class FileDataVisualizerView extends Component {
 
     this.state = {
       files: {},
+      fileName: '',
       fileContents: '',
       fileSize: 0,
       fileTooLarge: false,
@@ -71,6 +72,7 @@ export class FileDataVisualizerView extends Component {
         loading: files.length > 0,
         bottomBarVisible: files.length > 0,
         loaded: false,
+        fileName: '',
         fileContents: '',
         fileSize: 0,
         fileTooLarge: false,
@@ -93,6 +95,7 @@ export class FileDataVisualizerView extends Component {
         const data = fileContents.data;
         this.setState({
           fileContents: data,
+          fileName: file.name,
           fileSize: file.size,
         });
 
@@ -110,6 +113,7 @@ export class FileDataVisualizerView extends Component {
         loaded: false,
         loading: false,
         fileTooLarge: true,
+        fileName: file.name,
         fileSize: file.size,
       });
     }
@@ -240,6 +244,7 @@ export class FileDataVisualizerView extends Component {
       loaded,
       results,
       fileContents,
+      fileName,
       fileSize,
       fileTooLarge,
       fileCouldNotBeRead,
@@ -256,7 +261,7 @@ export class FileDataVisualizerView extends Component {
         : [];
 
     return (
-      <div className="file-datavisualizer__content">
+      <div>
         {mode === MODE.READ && (
           <React.Fragment>
             {!loading && !loaded && <AboutPanel onFilePickerChange={this.onFilePickerChange} />}
@@ -275,6 +280,7 @@ export class FileDataVisualizerView extends Component {
             {loaded && (
               <ResultsView
                 results={results}
+                fileName={fileName}
                 data={fileContents}
                 showEditFlyout={() => this.showEditFlyout()}
               />
@@ -304,8 +310,8 @@ export class FileDataVisualizerView extends Component {
           <React.Fragment>
             <ImportView
               results={results}
+              fileName={fileName}
               fileContents={fileContents}
-              fileSize={fileSize}
               indexPatterns={this.props.indexPatterns}
               kibanaConfig={this.props.kibanaConfig}
               showBottomBar={this.showBottomBar}
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/import_view/import_view.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/import_view/import_view.js
index 7031308b337b4..bb95d3e420d2a 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/import_view/import_view.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/import_view/import_view.js
@@ -7,7 +7,15 @@
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { Component } from 'react';
 
-import { EuiButton, EuiSpacer, EuiPanel, EuiTitle } from '@elastic/eui';
+import {
+  EuiButton,
+  EuiPage,
+  EuiPageBody,
+  EuiPageContentHeader,
+  EuiPanel,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
 
 import { i18n } from '@kbn/i18n';
 import { importerFactory } from './importer';
@@ -433,113 +441,121 @@ export class ImportView extends Component {
       initialized === true;
 
     return (
-      <React.Fragment>
-        <EuiPanel>
-          <EuiTitle size="s">
-            <h3>
-              <FormattedMessage
-                id="xpack.ml.fileDatavisualizer.importView.importDataTitle"
-                defaultMessage="Import data"
-              />
-              &nbsp;
-              <ExperimentalBadge
-                tooltipContent={
-                  <FormattedMessage
-                    id="xpack.ml.fileDatavisualizer.importView.experimentalFeatureTooltip"
-                    defaultMessage="Experimental feature. We'd love to hear your feedback."
-                  />
-                }
-              />
-            </h3>
-          </EuiTitle>
-
-          <ImportSettings
-            index={index}
-            indexPattern={indexPattern}
-            initialized={initialized}
-            onIndexChange={this.onIndexChange}
-            createIndexPattern={createIndexPattern}
-            onCreateIndexPatternChange={this.onCreateIndexPatternChange}
-            onIndexPatternChange={this.onIndexPatternChange}
-            indexSettingsString={indexSettingsString}
-            mappingsString={mappingsString}
-            pipelineString={pipelineString}
-            onIndexSettingsStringChange={this.onIndexSettingsStringChange}
-            onMappingsStringChange={this.onMappingsStringChange}
-            onPipelineStringChange={this.onPipelineStringChange}
-            indexNameError={indexNameError}
-            indexPatternNameError={indexPatternNameError}
-          />
-
+      <EuiPage>
+        <EuiPageBody>
+          <EuiPageContentHeader>
+            <EuiTitle>
+              <h1>{this.props.fileName}</h1>
+            </EuiTitle>
+          </EuiPageContentHeader>
           <EuiSpacer size="m" />
+          <EuiPanel>
+            <EuiTitle size="s">
+              <h2>
+                <FormattedMessage
+                  id="xpack.ml.fileDatavisualizer.importView.importDataTitle"
+                  defaultMessage="Import data"
+                />
+                &nbsp;
+                <ExperimentalBadge
+                  tooltipContent={
+                    <FormattedMessage
+                      id="xpack.ml.fileDatavisualizer.importView.experimentalFeatureTooltip"
+                      defaultMessage="Experimental feature. We'd love to hear your feedback."
+                    />
+                  }
+                />
+              </h2>
+            </EuiTitle>
+
+            <ImportSettings
+              index={index}
+              indexPattern={indexPattern}
+              initialized={initialized}
+              onIndexChange={this.onIndexChange}
+              createIndexPattern={createIndexPattern}
+              onCreateIndexPatternChange={this.onCreateIndexPatternChange}
+              onIndexPatternChange={this.onIndexPatternChange}
+              indexSettingsString={indexSettingsString}
+              mappingsString={mappingsString}
+              pipelineString={pipelineString}
+              onIndexSettingsStringChange={this.onIndexSettingsStringChange}
+              onMappingsStringChange={this.onMappingsStringChange}
+              onPipelineStringChange={this.onPipelineStringChange}
+              indexNameError={indexNameError}
+              indexPatternNameError={indexPatternNameError}
+            />
 
-          {(initialized === false || importing === true) && (
-            <EuiButton
-              isDisabled={disableImport}
-              onClick={this.clickImport}
-              isLoading={importing}
-              iconSide="right"
-              fill
-            >
-              <FormattedMessage
-                id="xpack.ml.fileDatavisualizer.importView.importButtonLabel"
-                defaultMessage="Import"
-              />
-            </EuiButton>
-          )}
-
-          {initialized === true && importing === false && (
-            <EuiButton onClick={this.clickReset}>
-              <FormattedMessage
-                id="xpack.ml.fileDatavisualizer.importView.resetButtonLabel"
-                defaultMessage="Reset"
-              />
-            </EuiButton>
-          )}
-        </EuiPanel>
-
-        {initialized === true && (
-          <React.Fragment>
             <EuiSpacer size="m" />
 
-            <EuiPanel>
-              <ImportProgress statuses={statuses} />
-
-              {imported === true && (
-                <React.Fragment>
-                  <EuiSpacer size="m" />
-
-                  <ImportSummary
-                    index={index}
-                    indexPattern={indexPattern === '' ? index : indexPattern}
-                    ingestPipelineId={ingestPipelineId}
-                    docCount={docCount}
-                    importFailures={importFailures}
-                    createIndexPattern={createIndexPattern}
-                    createPipeline={createPipeline}
-                  />
-
-                  <EuiSpacer size="l" />
-
-                  <ResultsLinks
-                    index={index}
-                    indexPatternId={indexPatternId}
-                    timeFieldName={timeFieldName}
-                    createIndexPattern={createIndexPattern}
-                  />
-                </React.Fragment>
-              )}
-            </EuiPanel>
-          </React.Fragment>
-        )}
-        {errors.length > 0 && (
-          <React.Fragment>
-            <EuiSpacer size="m" />
+            {(initialized === false || importing === true) && (
+              <EuiButton
+                isDisabled={disableImport}
+                onClick={this.clickImport}
+                isLoading={importing}
+                iconSide="right"
+                fill
+              >
+                <FormattedMessage
+                  id="xpack.ml.fileDatavisualizer.importView.importButtonLabel"
+                  defaultMessage="Import"
+                />
+              </EuiButton>
+            )}
+
+            {initialized === true && importing === false && (
+              <EuiButton onClick={this.clickReset}>
+                <FormattedMessage
+                  id="xpack.ml.fileDatavisualizer.importView.resetButtonLabel"
+                  defaultMessage="Reset"
+                />
+              </EuiButton>
+            )}
+          </EuiPanel>
+
+          {initialized === true && (
+            <React.Fragment>
+              <EuiSpacer size="m" />
+
+              <EuiPanel>
+                <ImportProgress statuses={statuses} />
+
+                {imported === true && (
+                  <React.Fragment>
+                    <EuiSpacer size="m" />
+
+                    <ImportSummary
+                      index={index}
+                      indexPattern={indexPattern === '' ? index : indexPattern}
+                      ingestPipelineId={ingestPipelineId}
+                      docCount={docCount}
+                      importFailures={importFailures}
+                      createIndexPattern={createIndexPattern}
+                      createPipeline={createPipeline}
+                    />
+
+                    <EuiSpacer size="l" />
+
+                    <ResultsLinks
+                      index={index}
+                      indexPatternId={indexPatternId}
+                      timeFieldName={timeFieldName}
+                      createIndexPattern={createIndexPattern}
+                    />
+                  </React.Fragment>
+                )}
+              </EuiPanel>
+            </React.Fragment>
+          )}
+          {errors.length > 0 && (
+            <React.Fragment>
+              <EuiSpacer size="m" />
 
-            <ImportErrors errors={errors} statuses={statuses} />
-          </React.Fragment>
-        )}
-      </React.Fragment>
+              <ImportErrors errors={errors} statuses={statuses} />
+            </React.Fragment>
+          )}
+        </EuiPageBody>
+      </EuiPage>
     );
   }
 }
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/results_view/results_view.js b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/results_view/results_view.js
index bd0e1cb1eb79f..6ff0eb86f2c55 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/results_view/results_view.js
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/file_based/components/results_view/results_view.js
@@ -7,13 +7,22 @@
 import { injectI18n, FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
 
-import { EuiTabbedContent, EuiButton, EuiSpacer, EuiPanel } from '@elastic/eui';
+import {
+  EuiButton,
+  EuiPage,
+  EuiPageBody,
+  EuiPageContentHeader,
+  EuiPanel,
+  EuiTabbedContent,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
 
 import { FileContents } from '../file_contents';
 import { AnalysisSummary } from '../analysis_summary';
 import { FieldsStats } from '../fields_stats';
 
-export const ResultsView = injectI18n(function({ data, results, showEditFlyout, intl }) {
+export const ResultsView = injectI18n(function({ data, fileName, results, showEditFlyout, intl }) {
   console.log(results);
 
   const tabs = [
@@ -28,35 +37,45 @@ export const ResultsView = injectI18n(function({ data, results, showEditFlyout,
   ];
 
   return (
-    <div className="results">
-      <EuiPanel>
-        <FileContents
-          data={data}
-          format={results.format}
-          numberOfLines={results.num_lines_analyzed}
-        />
-      </EuiPanel>
+    <EuiPage>
+      <EuiPageBody>
+        <EuiPageContentHeader>
+          <EuiTitle>
+            <h1>{fileName}</h1>
+          </EuiTitle>
+        </EuiPageContentHeader>
+        <EuiSpacer size="m" />
+        <div className="results">
+          <EuiPanel>
+            <FileContents
+              data={data}
+              format={results.format}
+              numberOfLines={results.num_lines_analyzed}
+            />
+          </EuiPanel>
 
-      <EuiSpacer size="m" />
+          <EuiSpacer size="m" />
 
-      <EuiPanel>
-        <AnalysisSummary results={results} />
+          <EuiPanel>
+            <AnalysisSummary results={results} />
 
-        <EuiSpacer size="m" />
+            <EuiSpacer size="m" />
 
-        <EuiButton onClick={() => showEditFlyout()}>
-          <FormattedMessage
-            id="xpack.ml.fileDatavisualizer.resultsView.overrideSettingsButtonLabel"
-            defaultMessage="Override settings"
-          />
-        </EuiButton>
-      </EuiPanel>
+            <EuiButton onClick={() => showEditFlyout()}>
+              <FormattedMessage
+                id="xpack.ml.fileDatavisualizer.resultsView.overrideSettingsButtonLabel"
+                defaultMessage="Override settings"
+              />
+            </EuiButton>
+          </EuiPanel>
 
-      <EuiSpacer size="m" />
+          <EuiSpacer size="m" />
 
-      <EuiPanel>
-        <EuiTabbedContent tabs={tabs} initialSelectedTab={tabs[0]} onTabClick={() => {}} />
-      </EuiPanel>
-    </div>
+          <EuiPanel>
+            <EuiTabbedContent tabs={tabs} initialSelectedTab={tabs[0]} onTabClick={() => {}} />
+          </EuiPanel>
+        </div>
+      </EuiPageBody>
+    </EuiPage>
   );
 });
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/_field_data_card.scss b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/_field_data_card.scss
index 6790b947f6f59..09c85b1d26953 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/_field_data_card.scss
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/_field_data_card.scss
@@ -100,4 +100,8 @@
     padding: $euiSizeS $euiSizeS 0px $euiSizeS;
     text-align: center;
   }
+
+  .mlFieldDataCard__valuesTitle {
+    text-transform: uppercase;
+  }
 }
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/boolean_content.tsx b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/boolean_content.tsx
index a85419015fa9b..c7277295b4c4f 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/boolean_content.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/boolean_content.tsx
@@ -5,7 +5,7 @@
  */
 
 import React, { FC } from 'react';
-import { EuiIcon, EuiSpacer, EuiText } from '@elastic/eui';
+import { EuiIcon, EuiSpacer, EuiText, EuiTitle } from '@elastic/eui';
 import { Axis, BarSeries, Chart, Settings } from '@elastic/charts';
 
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -50,15 +50,15 @@ export const BooleanContent: FC<FieldDataCardProps> = ({ config }) => {
       <EuiSpacer size="m" />
 
       <div>
-        <EuiText size="s">
-          <h6>
+        <EuiTitle size="xxxs" className="mlFieldDataCard__valuesTitle">
+          <span>
             <FormattedMessage
               id="xpack.ml.fieldDataCard.cardBoolean.valuesLabel"
               defaultMessage="Values"
             />
-          </h6>
-        </EuiText>
-        <EuiSpacer size="s" />
+          </span>
+        </EuiTitle>
+        <EuiSpacer size="xs" />
         <Chart renderer="canvas" className="story-chart" size={{ height: 200 }}>
           <Axis id="bottom" position="bottom" showOverlappingTicks />
           <Settings
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/keyword_content.tsx b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/keyword_content.tsx
index 1d679df05d5af..21fb087ff24ad 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/keyword_content.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/content_types/keyword_content.tsx
@@ -5,7 +5,7 @@
  */
 
 import React, { FC } from 'react';
-import { EuiIcon, EuiSpacer, EuiText } from '@elastic/eui';
+import { EuiIcon, EuiSpacer, EuiText, EuiTitle } from '@elastic/eui';
 // @ts-ignore
 import { formatDate } from '@elastic/eui/lib/services/format';
 
@@ -57,16 +57,15 @@ export const KeywordContent: FC<FieldDataCardProps> = ({ config }) => {
       <EuiSpacer size="m" />
 
       <div>
-        <EuiText size="s">
-          <h6>
+        <EuiTitle size="xxxs" className="mlFieldDataCard__valuesTitle">
+          <span>
             <FormattedMessage
               id="xpack.ml.fieldDataCard.cardKeyword.topValuesLabel"
               defaultMessage="Top values"
             />
-          </h6>
-        </EuiText>
-
-        <EuiSpacer size="s" />
+          </span>
+        </EuiTitle>
+        <EuiSpacer size="xs" />
         <TopValues stats={stats} fieldFormat={fieldFormat} barColor="secondary" />
       </div>
     </div>
diff --git a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/examples_list/examples_list.tsx b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/examples_list/examples_list.tsx
index c8eb810115401..e8d6bb985bec8 100644
--- a/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/examples_list/examples_list.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/datavisualizer/index_based/components/field_data_card/examples_list/examples_list.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC } from 'react';
 
-import { EuiListGroup, EuiListGroupItem, EuiSpacer, EuiText } from '@elastic/eui';
+import { EuiListGroup, EuiListGroupItem, EuiSpacer, EuiTitle } from '@elastic/eui';
 
 import { FormattedMessage } from '@kbn/i18n/react';
 
@@ -32,8 +32,8 @@ export const ExamplesList: FC<Props> = ({ examples }) => {
 
   return (
     <div>
-      <EuiText size="s">
-        <h6>
+      <EuiTitle size="xxxs" className="mlFieldDataCard__valuesTitle">
+        <span>
           <FormattedMessage
             id="xpack.ml.fieldDataCard.cardText.examplesTitle"
             defaultMessage="{numExamples, plural, one {value} other {examples}}"
@@ -41,8 +41,8 @@ export const ExamplesList: FC<Props> = ({ examples }) => {
               numExamples: examples.length,
             }}
           />
-        </h6>
-      </EuiText>
+        </span>
+      </EuiTitle>
       <EuiSpacer size="s" />
       <EuiListGroup flush={true} showToolTips={true}>
         {examplesContent}
diff --git a/x-pack/legacy/plugins/ml/public/application/explorer/_explorer.scss b/x-pack/legacy/plugins/ml/public/application/explorer/_explorer.scss
index f6e3dd2b79b00..9fb2f0c3bed94 100644
--- a/x-pack/legacy/plugins/ml/public/application/explorer/_explorer.scss
+++ b/x-pack/legacy/plugins/ml/public/application/explorer/_explorer.scss
@@ -22,7 +22,7 @@
       border-radius: $euiBorderRadius;
       display: inline-block;
 
-    // SASSTODO: Make a proper selector
+      // SASSTODO: Make a proper selector
       i {
         color: $euiColorPrimary;
         margin-right: $euiSizeXS;
@@ -46,7 +46,7 @@
   .results-container {
     padding: 0px 0px $euiSize 0px;
 
-      // SASSTODO: Overwrite of bootstrap
+    // SASSTODO: Overwrite of bootstrap
     .col-xs-12 {
       width: calc(100% - #{$euiSizeXL});
       padding-left: $euiSize;
@@ -61,6 +61,8 @@
     }
 
     .panel-title {
+      font-size: $euiFontSizeM;
+      font-weight: 400;
       color: $euiColorDarkShade;
       display: inline-block;
       padding-bottom: $euiSizeXS;
@@ -75,7 +77,7 @@
   .ml-controls {
     padding-bottom: $euiSizeS;
 
-      // SASSTODO: Make a proper selector
+    // SASSTODO: Make a proper selector
     label {
       font-size: $euiFontSizeXS;
       padding: $euiSizeXS;
@@ -111,6 +113,7 @@
         margin-left: 176px;
         height: 22px;
         white-space: nowrap;
+
         // background-color: #CCC;
         .sl-cell {
           height: 10px;
@@ -125,15 +128,19 @@
             color: $euiColorDarkShade;
           }
         }
+
         .sl-cell-hover {
           visibility: visible;
+
           i {
             display: block;
             margin-top: -6px;
           }
         }
+
         .sl-cell-active-hover {
           visibility: visible;
+
           .floating-time-label {
             display: inline-block;
           }
@@ -160,6 +167,7 @@
           overflow: hidden;
           text-overflow: ellipsis;
         }
+
         div.lane-label.lane-label-masked {
           opacity: 0.3;
         }
@@ -180,15 +188,19 @@
             border-right: $euiBorderThin;
             vertical-align: top;
             position: relative;
-            .sl-cell-inner, .sl-cell-inner-dragselect {
+
+            .sl-cell-inner,
+            .sl-cell-inner-dragselect {
               height: 26px;
               margin: 1px;
               border-radius: 2px;
               text-align: center;
             }
+
             .sl-cell-inner.sl-cell-inner-masked {
               opacity: 0.2;
             }
+
             .sl-cell-inner.sl-cell-inner-selected,
             .sl-cell-inner-dragselect.sl-cell-inner-selected {
               border: 2px solid $euiColorDarkShade;
@@ -200,13 +212,16 @@
               opacity: 0.4;
             }
           }
+
           .sl-cell:hover {
             .sl-cell-inner {
               opacity: 0.8;
               cursor: pointer;
             }
           }
+
           .sl-cell.ds-selected {
+
             .sl-cell-inner,
             .sl-cell-inner-dragselect {
               border: 2px solid $euiColorDarkShade;
@@ -230,14 +245,17 @@
         height: 25px;
         margin-top: $euiSizeXS / 2;
         margin-left: 175px;
+
         /* hide d3's domain line */
         path.domain {
           display: none;
         }
+
         /* hide d3's tick line */
         g.tick line {
           display: none;
         }
+
         /* override d3's default tick styles */
         g.tick text {
           font-size: 11px;
@@ -249,12 +267,12 @@
     line.gridLine {
       stroke: $euiBorderColor;
       fill: none;
-      shape-rendering : crispEdges;
-      stroke-width : 1px;
+      shape-rendering: crispEdges;
+      stroke-width: 1px;
     }
 
     rect.gridCell {
-      shape-rendering : crispEdges;
+      shape-rendering: crispEdges;
     }
 
     rect.hovered {
@@ -278,6 +296,7 @@
 
 /* using !important in the following rule because other related legacy rules have more specifity. */
 .mlDragselectDragging {
+
   .sl-cell-inner,
   .sl-cell-inner-dragselect {
     opacity: 0.6 !important;
@@ -290,14 +309,17 @@
     div.lane {
       div.cells-container {
         .sl-cell.ds-selected {
+
           .sl-cell-inner,
           .sl-cell-inner-dragselect {
             border-width: 0px !important;
             opacity: 1 !important;
           }
+
           .sl-cell-inner.sl-cell-inner-selected {
             border-width: $euiSizeXS / 2 !important;
           }
+
           .sl-cell-inner.sl-cell-inner-masked {
             opacity: 0.6 !important;
           }
diff --git a/x-pack/legacy/plugins/ml/public/application/explorer/explorer.js b/x-pack/legacy/plugins/ml/public/application/explorer/explorer.js
index 8d26fafe8057c..3b3a431c07e62 100644
--- a/x-pack/legacy/plugins/ml/public/application/explorer/explorer.js
+++ b/x-pack/legacy/plugins/ml/public/application/explorer/explorer.js
@@ -21,8 +21,12 @@ import {
   EuiFlexItem,
   EuiFormRow,
   EuiIconTip,
+  EuiPage,
+  EuiPageBody,
+  EuiScreenReaderOnly,
   EuiSelect,
   EuiSpacer,
+  EuiTitle,
 } from '@elastic/eui';
 
 import { AnnotationFlyout } from '../components/annotations/annotation_flyout';
@@ -87,8 +91,17 @@ function mapSwimlaneOptionsToEuiOptions(options) {
 const ExplorerPage = ({ children, jobSelectorProps, resizeRef }) => (
   <div ref={resizeRef} data-test-subj="mlPageAnomalyExplorer">
     <NavigationMenu tabId="explorer" />
-    <JobSelector {...jobSelectorProps} />
-    {children}
+    <EuiPage style={{ padding: '0px', background: 'none' }}>
+      <EuiPageBody>
+        <EuiScreenReaderOnly>
+          <h1>
+            <FormattedMessage id="xpack.ml.explorer.pageTitle" defaultMessage="Anomaly Explorer" />
+          </h1>
+        </EuiScreenReaderOnly>
+        <JobSelector {...jobSelectorProps} />
+        {children}
+      </EuiPageBody>
+    </EuiPage>
   </div>
 );
 
@@ -343,7 +356,7 @@ export class Explorer extends React.Component {
     return (
       <ExplorerPage jobSelectorProps={jobSelectorProps} resizeRef={this.resizeRef}>
         <div className="results-container">
-          {/* Make sure ChartTooltip is inside this plain wrapping div so positioning can be infered correctly. */}
+          {/* Make sure ChartTooltip is inside wrapping div with 0px left/right padding so positioning can be inferred correctly. */}
           <ChartTooltip />
 
           {noInfluencersConfigured === false && influencers !== undefined && (
@@ -372,27 +385,28 @@ export class Explorer extends React.Component {
           )}
 
           {noInfluencersConfigured === false && (
-            <div
-              className="column col-xs-2 euiText"
-              data-test-subj="mlAnomalyExplorerInfluencerList"
-            >
-              <span className="panel-title">
-                <FormattedMessage
-                  id="xpack.ml.explorer.topInfuencersTitle"
-                  defaultMessage="Top Influencers"
-                />
-              </span>
+            <div className="column col-xs-2" data-test-subj="mlAnomalyExplorerInfluencerList">
+              <EuiTitle className="panel-title">
+                <h2>
+                  <FormattedMessage
+                    id="xpack.ml.explorer.topInfuencersTitle"
+                    defaultMessage="Top influencers"
+                  />
+                </h2>
+              </EuiTitle>
               <InfluencersList influencers={influencers} influencerFilter={this.applyFilter} />
             </div>
           )}
 
           <div className={mainColumnClasses}>
-            <span className="panel-title euiText">
-              <FormattedMessage
-                id="xpack.ml.explorer.anomalyTimelineTitle"
-                defaultMessage="Anomaly timeline"
-              />
-            </span>
+            <EuiTitle className="panel-title">
+              <h2>
+                <FormattedMessage
+                  id="xpack.ml.explorer.anomalyTimelineTitle"
+                  defaultMessage="Anomaly timeline"
+                />
+              </h2>
+            </EuiTitle>
 
             <div
               className="ml-explorer-swimlane euiText"
@@ -507,12 +521,14 @@ export class Explorer extends React.Component {
 
             {annotationsData.length > 0 && (
               <>
-                <span className="panel-title euiText">
-                  <FormattedMessage
-                    id="xpack.ml.explorer.annotationsTitle"
-                    defaultMessage="Annotations"
-                  />
-                </span>
+                <EuiTitle className="panel-title">
+                  <h2>
+                    <FormattedMessage
+                      id="xpack.ml.explorer.annotationsTitle"
+                      defaultMessage="Annotations"
+                    />
+                  </h2>
+                </EuiTitle>
                 <AnnotationsTable
                   annotations={annotationsData}
                   drillDown={true}
@@ -523,9 +539,14 @@ export class Explorer extends React.Component {
               </>
             )}
 
-            <span className="panel-title euiText">
-              <FormattedMessage id="xpack.ml.explorer.anomaliesTitle" defaultMessage="Anomalies" />
-            </span>
+            <EuiTitle className="panel-title">
+              <h2>
+                <FormattedMessage
+                  id="xpack.ml.explorer.anomaliesTitle"
+                  defaultMessage="Anomalies"
+                />
+              </h2>
+            </EuiTitle>
 
             <EuiFlexGroup
               direction="row"
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/jobs_list/components/jobs_list_view/jobs_list_view.js b/x-pack/legacy/plugins/ml/public/application/jobs/jobs_list/components/jobs_list_view/jobs_list_view.js
index effc54c228130..28f95b3c1ba21 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/jobs_list/components/jobs_list_view/jobs_list_view.js
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/jobs_list/components/jobs_list_view/jobs_list_view.js
@@ -7,7 +7,16 @@
 import React, { Component } from 'react';
 import { timefilter } from 'ui/timefilter';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPage,
+  EuiPageBody,
+  EuiPageHeader,
+  EuiPageHeaderSection,
+  EuiSpacer,
+  EuiTitle,
+} from '@elastic/eui';
 
 import { ml } from '../../../../services/ml_api_service';
 import { checkForAutoStartDatafeed, filterJobs, loadFullJob } from '../utils';
@@ -348,109 +357,18 @@ export class JobsListView extends Component {
 
   renderManagementJobsListComponents() {
     const {
+      isRefreshing,
       loading,
       itemIdToExpandedRowMap,
+      jobsSummaryList,
       filteredJobsSummaryList,
       fullJobsList,
       selectedJobs,
     } = this.state;
-    return (
-      <div className="managementJobsList">
-        <div>
-          <JobFilterBar setFilters={this.setFilters} />
-        </div>
-        <JobsList
-          jobsSummaryList={filteredJobsSummaryList}
-          fullJobsList={fullJobsList}
-          itemIdToExpandedRowMap={itemIdToExpandedRowMap}
-          toggleRow={this.toggleRow}
-          selectJobChange={this.selectJobChange}
-          selectedJobsCount={selectedJobs.length}
-          loading={loading}
-          isManagementTable={true}
-          isMlEnabledInSpace={this.props.isMlEnabledInSpace}
-        />
-      </div>
-    );
-  }
-
-  renderJobsListComponents() {
-    const { loading, jobsSummaryList } = this.state;
-    const jobIds = jobsSummaryList.map(j => j.id);
-    return (
-      <div>
-        <div className="actions-bar">
-          <MultiJobActions
-            selectedJobs={this.state.selectedJobs}
-            allJobIds={jobIds}
-            showStartDatafeedModal={this.showStartDatafeedModal}
-            showDeleteJobModal={this.showDeleteJobModal}
-            refreshJobs={() => this.refreshJobSummaryList(true)}
-          />
-          <JobFilterBar setFilters={this.setFilters} />
-        </div>
-        <JobsList
-          jobsSummaryList={this.state.filteredJobsSummaryList}
-          fullJobsList={this.state.fullJobsList}
-          itemIdToExpandedRowMap={this.state.itemIdToExpandedRowMap}
-          toggleRow={this.toggleRow}
-          selectJobChange={this.selectJobChange}
-          showEditJobFlyout={this.showEditJobFlyout}
-          showDeleteJobModal={this.showDeleteJobModal}
-          showStartDatafeedModal={this.showStartDatafeedModal}
-          refreshJobs={() => this.refreshJobSummaryList(true)}
-          selectedJobsCount={this.state.selectedJobs.length}
-          loading={loading}
-        />
-        <EditJobFlyout
-          setShowFunction={this.setShowEditJobFlyoutFunction}
-          unsetShowFunction={this.unsetShowEditJobFlyoutFunction}
-          refreshJobs={() => this.refreshJobSummaryList(true)}
-          allJobIds={jobIds}
-        />
-        <DeleteJobModal
-          setShowFunction={this.setShowDeleteJobModalFunction}
-          unsetShowFunction={this.unsetShowDeleteJobModalFunction}
-          refreshJobs={() => this.refreshJobSummaryList(true)}
-        />
-        <StartDatafeedModal
-          setShowFunction={this.setShowStartDatafeedModalFunction}
-          unsetShowFunction={this.unsetShowDeleteJobModalFunction}
-          getShowCreateWatchFlyoutFunction={this.getShowCreateWatchFlyoutFunction}
-          refreshJobs={() => this.refreshJobSummaryList(true)}
-        />
-        <CreateWatchFlyout
-          setShowFunction={this.setShowCreateWatchFlyoutFunction}
-          unsetShowFunction={this.unsetShowCreateWatchFlyoutFunction}
-        />
-      </div>
-    );
-  }
-
-  render() {
-    const { isRefreshing, jobsSummaryList } = this.state;
-    const { isManagementTable } = this.props;
-
     return (
       <div className="job-management" data-test-subj="ml-jobs-list">
-        {!isManagementTable && (
-          <>
-            <EuiTitle>
-              <h1>
-                <FormattedMessage
-                  id="xpack.ml.jobsList.title"
-                  defaultMessage="Anomaly detection jobs"
-                />
-              </h1>
-            </EuiTitle>
-            <EuiSpacer size="m" />
-          </>
-        )}
-
         <NodeAvailableWarning />
-
         <UpgradeWarning />
-
         <EuiFlexGroup justifyContent="spaceBetween">
           <EuiFlexItem grow={false}>
             <JobStatsBar jobsSummaryList={jobsSummaryList} />
@@ -463,19 +381,133 @@ export class JobsListView extends Component {
                   isRefreshing={isRefreshing}
                 />
               </EuiFlexItem>
-              {!isManagementTable && (
-                <EuiFlexItem grow={false}>
-                  <NewJobButton />
-                </EuiFlexItem>
-              )}
             </EuiFlexGroup>
           </EuiFlexItem>
         </EuiFlexGroup>
-
         <EuiSpacer size="s" />
+        <div className="managementJobsList">
+          <div>
+            <JobFilterBar setFilters={this.setFilters} />
+          </div>
+          <JobsList
+            jobsSummaryList={filteredJobsSummaryList}
+            fullJobsList={fullJobsList}
+            itemIdToExpandedRowMap={itemIdToExpandedRowMap}
+            toggleRow={this.toggleRow}
+            selectJobChange={this.selectJobChange}
+            selectedJobsCount={selectedJobs.length}
+            loading={loading}
+            isManagementTable={true}
+            isMlEnabledInSpace={this.props.isMlEnabledInSpace}
+          />
+        </div>
+      </div>
+    );
+  }
+
+  renderJobsListComponents() {
+    const { isRefreshing, loading, jobsSummaryList } = this.state;
+    const jobIds = jobsSummaryList.map(j => j.id);
+    return (
+      <EuiPage data-test-subj="ml-jobs-list">
+        <EuiPageBody>
+          <EuiPageHeader>
+            <EuiPageHeaderSection>
+              <EuiTitle>
+                <h1>
+                  <FormattedMessage
+                    id="xpack.ml.jobsList.title"
+                    defaultMessage="Anomaly detection jobs"
+                  />
+                </h1>
+              </EuiTitle>
+            </EuiPageHeaderSection>
+          </EuiPageHeader>
 
-        {!isManagementTable && this.renderJobsListComponents()}
-        {isManagementTable && this.renderManagementJobsListComponents()}
+          <NodeAvailableWarning />
+
+          <UpgradeWarning />
+
+          <EuiFlexGroup justifyContent="spaceBetween">
+            <EuiFlexItem grow={false}>
+              <JobStatsBar jobsSummaryList={jobsSummaryList} />
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiFlexGroup alignItems="center" gutterSize="s">
+                <EuiFlexItem grow={false}>
+                  <RefreshJobsListButton
+                    onRefreshClick={this.onRefreshClick}
+                    isRefreshing={isRefreshing}
+                  />
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <NewJobButton />
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+
+          <EuiSpacer size="s" />
+
+          <div>
+            <div className="actions-bar">
+              <MultiJobActions
+                selectedJobs={this.state.selectedJobs}
+                allJobIds={jobIds}
+                showStartDatafeedModal={this.showStartDatafeedModal}
+                showDeleteJobModal={this.showDeleteJobModal}
+                refreshJobs={() => this.refreshJobSummaryList(true)}
+              />
+              <JobFilterBar setFilters={this.setFilters} />
+            </div>
+            <JobsList
+              jobsSummaryList={this.state.filteredJobsSummaryList}
+              fullJobsList={this.state.fullJobsList}
+              itemIdToExpandedRowMap={this.state.itemIdToExpandedRowMap}
+              toggleRow={this.toggleRow}
+              selectJobChange={this.selectJobChange}
+              showEditJobFlyout={this.showEditJobFlyout}
+              showDeleteJobModal={this.showDeleteJobModal}
+              showStartDatafeedModal={this.showStartDatafeedModal}
+              refreshJobs={() => this.refreshJobSummaryList(true)}
+              selectedJobsCount={this.state.selectedJobs.length}
+              loading={loading}
+            />
+            <EditJobFlyout
+              setShowFunction={this.setShowEditJobFlyoutFunction}
+              unsetShowFunction={this.unsetShowEditJobFlyoutFunction}
+              refreshJobs={() => this.refreshJobSummaryList(true)}
+              allJobIds={jobIds}
+            />
+            <DeleteJobModal
+              setShowFunction={this.setShowDeleteJobModalFunction}
+              unsetShowFunction={this.unsetShowDeleteJobModalFunction}
+              refreshJobs={() => this.refreshJobSummaryList(true)}
+            />
+            <StartDatafeedModal
+              setShowFunction={this.setShowStartDatafeedModalFunction}
+              unsetShowFunction={this.unsetShowDeleteJobModalFunction}
+              getShowCreateWatchFlyoutFunction={this.getShowCreateWatchFlyoutFunction}
+              refreshJobs={() => this.refreshJobSummaryList(true)}
+            />
+            <CreateWatchFlyout
+              setShowFunction={this.setShowCreateWatchFlyoutFunction}
+              unsetShowFunction={this.unsetShowCreateWatchFlyoutFunction}
+            />
+          </div>
+        </EuiPageBody>
+      </EuiPage>
+    );
+  }
+
+  render() {
+    const { isManagementTable } = this.props;
+
+    return (
+      <div>
+        {!isManagementTable
+          ? this.renderJobsListComponents()
+          : this.renderManagementJobsListComponents()}
       </div>
     );
   }
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
index cb311f04dd1d7..2fbedc1cd39bb 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
@@ -16,7 +16,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { npStart } from 'ui/new_platform';
-import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/kibana_react/public';
+import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/saved_objects/public';
 
 export interface PageProps {
   nextStepPath: string;
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
index 1b57dd341a046..b1382aef86d30 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx
@@ -174,13 +174,13 @@ export const Page: FC = () => {
     <EuiPage data-test-subj="mlPageJobTypeSelection">
       <EuiPageBody restrictWidth={1200}>
         <EuiTitle size="l">
-          <h2>
+          <h1>
             <FormattedMessage
               id="xpack.ml.newJob.wizard.jobType.createJobFromTitle"
               defaultMessage="Create a job from the {pageTitleLabel}"
               values={{ pageTitleLabel }}
             />
-          </h2>
+          </h1>
         </EuiTitle>
         <EuiSpacer />
 
@@ -204,16 +204,16 @@ export const Page: FC = () => {
         )}
 
         <div hidden={recognizerResultsCount === 0}>
+          <EuiTitle size="s">
+            <h2>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.jobType.useSuppliedConfigurationTitle"
+                defaultMessage="Use a supplied configuration"
+              />
+            </h2>
+          </EuiTitle>
+          <EuiSpacer size="s" />
           <EuiText>
-            <EuiTitle size="s">
-              <h3>
-                <FormattedMessage
-                  id="xpack.ml.newJob.wizard.jobType.useSuppliedConfigurationTitle"
-                  defaultMessage="Use a supplied configuration"
-                />
-              </h3>
-            </EuiTitle>
-
             <p>
               <FormattedMessage
                 id="xpack.ml.newJob.wizard.jobType.useSuppliedConfigurationDescription"
@@ -236,16 +236,16 @@ export const Page: FC = () => {
           <EuiSpacer size="xxl" />
         </div>
 
+        <EuiTitle size="s">
+          <h2>
+            <FormattedMessage
+              id="xpack.ml.newJob.wizard.jobType.useWizardTitle"
+              defaultMessage="Use a wizard"
+            />
+          </h2>
+        </EuiTitle>
+        <EuiSpacer size="s" />
         <EuiText>
-          <EuiTitle size="s">
-            <h3>
-              <FormattedMessage
-                id="xpack.ml.newJob.wizard.jobType.useWizardTitle"
-                defaultMessage="Use a wizard"
-              />
-            </h3>
-          </EuiTitle>
-
           <p>
             <FormattedMessage
               id="xpack.ml.newJob.wizard.jobType.useWizardDescription"
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
index ece43e00f2eb1..bc269b22df880 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/page.tsx
@@ -200,13 +200,13 @@ export const Page: FC<PageProps> = ({ existingJobsAndGroups, jobType }) => {
             <EuiPageContentHeader>
               <EuiPageContentHeaderSection>
                 <EuiTitle>
-                  <h2>
+                  <h1>
                     <FormattedMessage
                       id="xpack.ml.newJob.page.createJob"
                       defaultMessage="Create job"
                     />
                     : {jobCreatorTitle}
-                  </h2>
+                  </h1>
                 </EuiTitle>
               </EuiPageContentHeaderSection>
             </EuiPageContentHeader>
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
index df21e70a68ed9..cd3d887c906af 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
@@ -144,7 +144,7 @@ const Title: FC<{ 'data-test-subj': string }> = ({ 'data-test-subj': dataTestSub
   return (
     <Fragment>
       <EuiTitle size="s">
-        <h3 data-test-subj={dataTestSubj}>{children}</h3>
+        <h2 data-test-subj={dataTestSubj}>{children}</h2>
       </EuiTitle>
       <EuiSpacer />
     </Fragment>
diff --git a/x-pack/legacy/plugins/ml/public/application/overview/components/sidebar.tsx b/x-pack/legacy/plugins/ml/public/application/overview/components/sidebar.tsx
index 82caadd4d58ea..8648bd211715e 100644
--- a/x-pack/legacy/plugins/ml/public/application/overview/components/sidebar.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/overview/components/sidebar.tsx
@@ -5,7 +5,7 @@
  */
 
 import React, { FC } from 'react';
-import { EuiFlexItem, EuiLink, EuiText } from '@elastic/eui';
+import { EuiFlexItem, EuiLink, EuiSpacer, EuiText, EuiTitle } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import chrome from 'ui/chrome';
 import { metadata } from 'ui/metadata';
@@ -39,13 +39,16 @@ function getCreateJobLink(createAnomalyDetectionJobDisabled: boolean) {
 
 export const OverviewSideBar: FC<Props> = ({ createAnomalyDetectionJobDisabled }) => (
   <EuiFlexItem grow={1}>
-    <EuiText className="mlOverview__sidebar">
-      <h2>
+    <EuiTitle size="m">
+      <h1>
         <FormattedMessage
           id="xpack.ml.overview.gettingStartedSectionTitle"
           defaultMessage="Getting started"
         />
-      </h2>
+      </h1>
+    </EuiTitle>
+    <EuiSpacer size="s" />
+    <EuiText className="mlOverview__sidebar">
       <p>
         <FormattedMessage
           id="xpack.ml.overview.gettingStartedSectionText"
diff --git a/x-pack/legacy/plugins/ml/public/application/services/job_service.js b/x-pack/legacy/plugins/ml/public/application/services/job_service.js
index 54e0dd1f535f2..fe3663d6a3ddb 100644
--- a/x-pack/legacy/plugins/ml/public/application/services/job_service.js
+++ b/x-pack/legacy/plugins/ml/public/application/services/job_service.js
@@ -5,7 +5,6 @@
  */
 
 import _ from 'lodash';
-import angular from 'angular';
 import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 
@@ -116,8 +115,7 @@ class JobService {
 
       ml.getJobs()
         .then(resp => {
-          // make deep copy of jobs
-          angular.copy(resp.jobs, jobs);
+          jobs = resp.jobs;
 
           // load jobs stats
           ml.getJobStats()
@@ -131,14 +129,13 @@ class JobService {
                 job.datafeed_config = {};
 
                 for (let j = 0; j < statsResp.jobs.length; j++) {
-                  if (job.job_id === statsResp.jobs[j].job_id) {
-                    const jobStats = angular.copy(statsResp.jobs[j]);
-
+                  const jobStats = statsResp.jobs[j];
+                  if (job.job_id === jobStats.job_id) {
                     job.state = jobStats.state;
-                    job.data_counts = jobStats.data_counts;
-                    job.model_size_stats = jobStats.model_size_stats;
+                    job.data_counts = _.cloneDeep(jobStats.data_counts);
+                    job.model_size_stats = _.cloneDeep(jobStats.model_size_stats);
                     if (jobStats.node) {
-                      job.node = jobStats.node;
+                      job.node = _.cloneDeep(jobStats.node);
                     }
                     if (jobStats.open_time) {
                       job.open_time = jobStats.open_time;
@@ -199,9 +196,8 @@ class JobService {
     return new Promise((resolve, reject) => {
       ml.getJobs({ jobId })
         .then(resp => {
-          const newJob = {};
           if (resp.jobs && resp.jobs.length) {
-            angular.copy(resp.jobs[0], newJob);
+            const newJob = resp.jobs[0];
 
             // load jobs stats
             ml.getJobStats({ jobId })
@@ -213,10 +209,10 @@ class JobService {
                     newJob.state = statsJob.state;
                     newJob.data_counts = {};
                     newJob.model_size_stats = {};
-                    angular.copy(statsJob.data_counts, newJob.data_counts);
-                    angular.copy(statsJob.model_size_stats, newJob.model_size_stats);
+                    newJob.data_counts = _.cloneDeep(statsJob.data_counts);
+                    newJob.model_size_stats = _.cloneDeep(statsJob.model_size_stats);
                     if (newJob.node) {
-                      angular.copy(statsJob.node, newJob.node);
+                      newJob.node = _.cloneDeep(statsJob.node);
                     }
 
                     if (statsJob.open_time) {
@@ -273,7 +269,6 @@ class JobService {
 
   loadDatafeeds(datafeedId) {
     return new Promise((resolve, reject) => {
-      const datafeeds = [];
       const sId = datafeedId !== undefined ? { datafeed_id: datafeedId } : undefined;
 
       ml.getDatafeeds(sId)
@@ -281,7 +276,7 @@ class JobService {
           // console.log('loadDatafeeds query response:', resp);
 
           // make deep copy of datafeeds
-          angular.copy(resp.datafeeds, datafeeds);
+          const datafeeds = resp.datafeeds;
 
           // load datafeeds stats
           ml.getDatafeedStats()
@@ -357,7 +352,7 @@ class JobService {
     // create a deep copy of a job object
     // also remove items from the job which are set by the server and not needed
     // in the future this formatting could be optional
-    const tempJob = angular.copy(job);
+    const tempJob = _.cloneDeep(job);
 
     // remove all of the items which should not be copied
     // such as counts, state and times
@@ -421,7 +416,7 @@ class JobService {
         return { success: true };
       })
       .catch(err => {
-        msgs.error(
+        msgs.notify.error(
           i18n.translate('xpack.ml.jobService.couldNotUpdateJobErrorMessage', {
             defaultMessage: 'Could not update job: {jobId}',
             values: { jobId },
@@ -440,7 +435,7 @@ class JobService {
         return { success: true, messages };
       })
       .catch(err => {
-        msgs.error(
+        msgs.notify.error(
           i18n.translate('xpack.ml.jobService.jobValidationErrorMessage', {
             defaultMessage: 'Job Validation Error: {errorMessage}',
             values: { errorMessage: err.message },
@@ -633,7 +628,7 @@ class JobService {
         return { success: true };
       })
       .catch(err => {
-        msgs.error(
+        msgs.notify.error(
           i18n.translate('xpack.ml.jobService.couldNotUpdateDatafeedErrorMessage', {
             defaultMessage: 'Could not update datafeed: {datafeedId}',
             values: { datafeedId },
@@ -664,7 +659,7 @@ class JobService {
         })
         .catch(err => {
           console.log('jobService error starting datafeed:', err);
-          msgs.error(
+          msgs.notify.error(
             i18n.translate('xpack.ml.jobService.couldNotStartDatafeedErrorMessage', {
               defaultMessage: 'Could not start datafeed for {jobId}',
               values: { jobId },
@@ -697,15 +692,15 @@ class JobService {
           );
 
           if (err.statusCode === 500) {
-            msgs.error(couldNotStopDatafeedErrorMessage);
-            msgs.error(
+            msgs.notify.error(couldNotStopDatafeedErrorMessage);
+            msgs.notify.error(
               i18n.translate('xpack.ml.jobService.requestMayHaveTimedOutErrorMessage', {
                 defaultMessage:
                   'Request may have timed out and may still be running in the background.',
               })
             );
           } else {
-            msgs.error(couldNotStopDatafeedErrorMessage, err);
+            msgs.notify.error(couldNotStopDatafeedErrorMessage, err);
           }
           reject(err);
         });
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap b/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
index e8219f5fa6f94..e8f7050f20875 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
+++ b/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/__snapshots__/new_calendar.test.js.snap
@@ -8,36 +8,38 @@ exports[`NewCalendar Renders new calendar form 1`] = `
   <EuiPage
     className="mlCalendarEditForm"
   >
-    <EuiPageContent
-      className="mlCalendarEditForm__content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <InjectIntl(CalendarForm)
-        calendarId=""
-        canCreateCalendar={true}
-        canDeleteCalendar={true}
-        description=""
-        eventsList={Array []}
-        groupIds={Array []}
-        isEdit={false}
-        isNewCalendarIdValid={true}
-        jobIds={Array []}
-        onCalendarIdChange={[Function]}
-        onCreate={[Function]}
-        onCreateGroupOption={[Function]}
-        onDescriptionChange={[Function]}
-        onEdit={[Function]}
-        onEventDelete={[Function]}
-        onGroupSelection={[Function]}
-        onJobSelection={[Function]}
-        saving={false}
-        selectedGroupOptions={Array []}
-        selectedJobOptions={Array []}
-        showImportModal={[Function]}
-        showNewEventModal={[Function]}
-      />
-    </EuiPageContent>
+    <EuiPageBody>
+      <EuiPageContent
+        className="mlCalendarEditForm__content"
+        horizontalPosition="center"
+        verticalPosition="center"
+      >
+        <InjectIntl(CalendarForm)
+          calendarId=""
+          canCreateCalendar={true}
+          canDeleteCalendar={true}
+          description=""
+          eventsList={Array []}
+          groupIds={Array []}
+          isEdit={false}
+          isNewCalendarIdValid={true}
+          jobIds={Array []}
+          onCalendarIdChange={[Function]}
+          onCreate={[Function]}
+          onCreateGroupOption={[Function]}
+          onDescriptionChange={[Function]}
+          onEdit={[Function]}
+          onEventDelete={[Function]}
+          onGroupSelection={[Function]}
+          onJobSelection={[Function]}
+          saving={false}
+          selectedGroupOptions={Array []}
+          selectedJobOptions={Array []}
+          showImportModal={[Function]}
+          showNewEventModal={[Function]}
+        />
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/new_calendar.js b/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
index 5ed98d7dc846b..bc60e9e5df24e 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
+++ b/x-pack/legacy/plugins/ml/public/application/settings/calendars/edit/new_calendar.js
@@ -10,7 +10,7 @@ import { timefilter } from 'ui/timefilter';
 
 import { injectI18n } from '@kbn/i18n/react';
 
-import { EuiPage, EuiPageContent, EuiOverlayMask } from '@elastic/eui';
+import { EuiPage, EuiPageBody, EuiPageContent, EuiOverlayMask } from '@elastic/eui';
 
 import { toastNotifications } from 'ui/notify';
 
@@ -334,39 +334,41 @@ export const NewCalendar = injectI18n(
         <Fragment>
           <NavigationMenu tabId="settings" />
           <EuiPage className="mlCalendarEditForm">
-            <EuiPageContent
-              className="mlCalendarEditForm__content"
-              verticalPosition="center"
-              horizontalPosition="center"
-            >
-              <CalendarForm
-                calendarId={selectedCalendar ? selectedCalendar.calendar_id : formCalendarId}
-                canCreateCalendar={this.props.canCreateCalendar}
-                canDeleteCalendar={this.props.canDeleteCalendar}
-                description={selectedCalendar ? selectedCalendar.description : description}
-                eventsList={events}
-                groupIds={groupIdOptions}
-                isEdit={selectedCalendar !== undefined}
-                isNewCalendarIdValid={
-                  selectedCalendar || isNewCalendarIdValid === null ? true : isNewCalendarIdValid
-                }
-                jobIds={jobIdOptions}
-                onCalendarIdChange={this.onCalendarIdChange}
-                onCreate={this.onCreate}
-                onDescriptionChange={this.onDescriptionChange}
-                onEdit={this.onEdit}
-                onEventDelete={this.onEventDelete}
-                onGroupSelection={this.onGroupSelection}
-                showImportModal={this.showImportModal}
-                onJobSelection={this.onJobSelection}
-                saving={saving}
-                selectedGroupOptions={selectedGroupOptions}
-                selectedJobOptions={selectedJobOptions}
-                onCreateGroupOption={this.onCreateGroupOption}
-                showNewEventModal={this.showNewEventModal}
-              />
-            </EuiPageContent>
-            {modal}
+            <EuiPageBody>
+              <EuiPageContent
+                className="mlCalendarEditForm__content"
+                verticalPosition="center"
+                horizontalPosition="center"
+              >
+                <CalendarForm
+                  calendarId={selectedCalendar ? selectedCalendar.calendar_id : formCalendarId}
+                  canCreateCalendar={this.props.canCreateCalendar}
+                  canDeleteCalendar={this.props.canDeleteCalendar}
+                  description={selectedCalendar ? selectedCalendar.description : description}
+                  eventsList={events}
+                  groupIds={groupIdOptions}
+                  isEdit={selectedCalendar !== undefined}
+                  isNewCalendarIdValid={
+                    selectedCalendar || isNewCalendarIdValid === null ? true : isNewCalendarIdValid
+                  }
+                  jobIds={jobIdOptions}
+                  onCalendarIdChange={this.onCalendarIdChange}
+                  onCreate={this.onCreate}
+                  onDescriptionChange={this.onDescriptionChange}
+                  onEdit={this.onEdit}
+                  onEventDelete={this.onEventDelete}
+                  onGroupSelection={this.onGroupSelection}
+                  showImportModal={this.showImportModal}
+                  onJobSelection={this.onJobSelection}
+                  saving={saving}
+                  selectedGroupOptions={selectedGroupOptions}
+                  selectedJobOptions={selectedJobOptions}
+                  onCreateGroupOption={this.onCreateGroupOption}
+                  showNewEventModal={this.showNewEventModal}
+                />
+              </EuiPageContent>
+              {modal}
+            </EuiPageBody>
           </EuiPage>
         </Fragment>
       );
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap b/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
index fc011a77bb082..867fd16932627 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
+++ b/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/__snapshots__/calendars_list.test.js.snap
@@ -8,65 +8,67 @@ exports[`CalendarsList Renders calendar list with calendars 1`] = `
   <EuiPage
     className="mlCalendarList"
   >
-    <EuiPageContent
-      className="mlCalendarList__content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <CalendarsListHeader
-        refreshCalendars={[Function]}
-        totalCount={2}
-      />
-      <InjectIntl(CalendarsListTable)
-        calendarsList={
-          Array [
-            Object {
-              "calendar_id": "farequote-calendar",
-              "description": "test ",
-              "events": Array [
-                Object {
-                  "calendar_id": "farequote-calendar",
-                  "description": "Downtime feb 9 2017 10:10 to 10:30",
-                  "end_time": 1486657800000,
-                  "event_id": "Ee-YgGcBxHgQWEhCO_xj",
-                  "start_time": 1486656600000,
-                },
-              ],
-              "events_length": 1,
-              "job_ids": Array [
-                "farequote",
-              ],
-              "job_ids_string": "farequote",
-            },
-            Object {
-              "calendar_id": "this-is-a-new-calendar",
-              "description": "new calendar",
-              "events": Array [
-                Object {
-                  "calendar_id": "this-is-a-new-calendar",
-                  "description": "New event!",
-                  "end_time": 1544162400000,
-                  "event_id": "ehWKhGcBqHkXuWNrIrSV",
-                  "start_time": 1544076000000,
-                },
-              ],
-              "events_length": 1,
-              "job_ids": Array [
-                "test",
-              ],
-              "job_ids_string": "test",
-            },
-          ]
-        }
-        canCreateCalendar={true}
-        canDeleteCalendar={true}
-        itemsSelected={false}
-        loading={false}
-        mlNodesAvailable={true}
-        onDeleteClick={[Function]}
-        setSelectedCalendarList={[Function]}
-      />
-    </EuiPageContent>
+    <EuiPageBody>
+      <EuiPageContent
+        className="mlCalendarList__content"
+        horizontalPosition="center"
+        verticalPosition="center"
+      >
+        <CalendarsListHeader
+          refreshCalendars={[Function]}
+          totalCount={2}
+        />
+        <InjectIntl(CalendarsListTable)
+          calendarsList={
+            Array [
+              Object {
+                "calendar_id": "farequote-calendar",
+                "description": "test ",
+                "events": Array [
+                  Object {
+                    "calendar_id": "farequote-calendar",
+                    "description": "Downtime feb 9 2017 10:10 to 10:30",
+                    "end_time": 1486657800000,
+                    "event_id": "Ee-YgGcBxHgQWEhCO_xj",
+                    "start_time": 1486656600000,
+                  },
+                ],
+                "events_length": 1,
+                "job_ids": Array [
+                  "farequote",
+                ],
+                "job_ids_string": "farequote",
+              },
+              Object {
+                "calendar_id": "this-is-a-new-calendar",
+                "description": "new calendar",
+                "events": Array [
+                  Object {
+                    "calendar_id": "this-is-a-new-calendar",
+                    "description": "New event!",
+                    "end_time": 1544162400000,
+                    "event_id": "ehWKhGcBqHkXuWNrIrSV",
+                    "start_time": 1544076000000,
+                  },
+                ],
+                "events_length": 1,
+                "job_ids": Array [
+                  "test",
+                ],
+                "job_ids_string": "test",
+              },
+            ]
+          }
+          canCreateCalendar={true}
+          canDeleteCalendar={true}
+          itemsSelected={false}
+          loading={false}
+          mlNodesAvailable={true}
+          onDeleteClick={[Function]}
+          setSelectedCalendarList={[Function]}
+        />
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/calendars_list.js b/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/calendars_list.js
index aec7336f3da14..3f5802583f542 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/calendars_list.js
+++ b/x-pack/legacy/plugins/ml/public/application/settings/calendars/list/calendars_list.js
@@ -11,6 +11,7 @@ import {
   EuiConfirmModal,
   EuiOverlayMask,
   EuiPage,
+  EuiPageBody,
   EuiPageContent,
   EUI_MODAL_CONFIRM_BUTTON,
 } from '@elastic/eui';
@@ -149,27 +150,29 @@ export const CalendarsList = injectI18n(
         <Fragment>
           <NavigationMenu tabId="settings" />
           <EuiPage className="mlCalendarList">
-            <EuiPageContent
-              className="mlCalendarList__content"
-              verticalPosition="center"
-              horizontalPosition="center"
-            >
-              <CalendarsListHeader
-                totalCount={calendars.length}
-                refreshCalendars={this.loadCalendars}
-              />
-              <CalendarsListTable
-                loading={loading}
-                calendarsList={this.addRequiredFieldsToList(calendars)}
-                onDeleteClick={this.showDestroyModal}
-                canCreateCalendar={canCreateCalendar}
-                canDeleteCalendar={canDeleteCalendar}
-                mlNodesAvailable={nodesAvailable}
-                setSelectedCalendarList={this.setSelectedCalendarList}
-                itemsSelected={selectedForDeletion.length > 0}
-              />
-            </EuiPageContent>
-            {destroyModal}
+            <EuiPageBody>
+              <EuiPageContent
+                className="mlCalendarList__content"
+                verticalPosition="center"
+                horizontalPosition="center"
+              >
+                <CalendarsListHeader
+                  totalCount={calendars.length}
+                  refreshCalendars={this.loadCalendars}
+                />
+                <CalendarsListTable
+                  loading={loading}
+                  calendarsList={this.addRequiredFieldsToList(calendars)}
+                  onDeleteClick={this.showDestroyModal}
+                  canCreateCalendar={canCreateCalendar}
+                  canDeleteCalendar={canDeleteCalendar}
+                  mlNodesAvailable={nodesAvailable}
+                  setSelectedCalendarList={this.setSelectedCalendarList}
+                  itemsSelected={selectedForDeletion.length > 0}
+                />
+              </EuiPageContent>
+              {destroyModal}
+            </EuiPageBody>
           </EuiPage>
         </Fragment>
       );
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
index 17986d838ec5e..447d79ffff32a 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
+++ b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/__snapshots__/edit_filter_list.test.js.snap
@@ -8,102 +8,104 @@ exports[`EditFilterList adds new items to filter list 1`] = `
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="List of known safe domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={6}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "amazon.com",
-            "elastic.co",
-            "google.co.uk",
-            "google.com",
-            "spotify.com",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={6}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="List of known safe domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={6}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "amazon.com",
+              "elastic.co",
+              "google.co.uk",
+              "google.com",
+              "spotify.com",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={6}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -116,104 +118,106 @@ exports[`EditFilterList renders after selecting an item and deleting it 1`] = `
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="List of known safe domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={4}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={1}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "google.com",
-            "google.co.uk",
-            "elastic.co",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={
-          Array [
-            "google.co.uk",
-          ]
-        }
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={4}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="List of known safe domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={4}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={1}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "google.com",
+              "google.co.uk",
+              "elastic.co",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={
+            Array [
+              "google.co.uk",
+            ]
+          }
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={4}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -226,99 +230,101 @@ exports[`EditFilterList renders after selecting an item and deleting it 2`] = `
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="List of known safe domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={3}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "google.com",
-            "elastic.co",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={3}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="List of known safe domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={3}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "google.com",
+              "elastic.co",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={3}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -331,83 +337,85 @@ exports[`EditFilterList renders the edit page for a new filter list and updates
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description=""
-        isNewFilterIdInvalid={true}
-        newFilterId=""
-        totalItemCount={0}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={Array []}
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={0}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description=""
+          isNewFilterIdInvalid={true}
+          newFilterId=""
+          totalItemCount={0}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={Array []}
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={0}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={true}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={true}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -420,83 +428,85 @@ exports[`EditFilterList renders the edit page for a new filter list and updates
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description=""
-        isNewFilterIdInvalid={false}
-        newFilterId="new_filter_list"
-        totalItemCount={0}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={Array []}
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={0}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description=""
+          isNewFilterIdInvalid={false}
+          newFilterId="new_filter_list"
+          totalItemCount={0}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={Array []}
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={0}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -509,100 +519,102 @@ exports[`EditFilterList renders the edit page for an existing filter list and up
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="List of known safe domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={4}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "google.com",
-            "google.co.uk",
-            "elastic.co",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={4}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="List of known safe domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={4}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "google.com",
+              "google.co.uk",
+              "elastic.co",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={4}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -615,100 +627,102 @@ exports[`EditFilterList renders the edit page for an existing filter list and up
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="Known safe web domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={4}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "google.com",
-            "google.co.uk",
-            "elastic.co",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={50}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={4}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="Known safe web domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={4}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "google.com",
+              "google.co.uk",
+              "elastic.co",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={50}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={4}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
@@ -721,100 +735,102 @@ exports[`EditFilterList updates the items per page 1`] = `
   <EuiPage
     className="ml-edit-filter-lists"
   >
-    <EuiPageContent
-      className="ml-edit-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <EditFilterListHeader
-        canCreateFilter={true}
-        description="List of known safe domains"
-        isNewFilterIdInvalid={false}
-        newFilterId=""
-        totalItemCount={4}
-        updateDescription={[Function]}
-        updateNewFilterId={[Function]}
-        usedBy={
-          Object {
-            "detectors": Array [
-              "high info content",
-            ],
-            "jobs": Array [
-              "dns_exfiltration",
-            ],
-          }
-        }
-      />
-      <EditFilterListToolbar
-        addItems={[Function]}
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        deleteSelectedItems={[Function]}
-        onSearchChange={[Function]}
-        selectedItemCount={0}
-      />
-      <EuiSpacer
-        size="xl"
-      />
-      <ItemsGrid
-        activePage={0}
-        items={
-          Array [
-            "google.com",
-            "google.co.uk",
-            "elastic.co",
-            "youtube.com",
-          ]
-        }
-        itemsPerPage={500}
-        itemsPerPageOptions={
-          Array [
-            50,
-            100,
-            500,
-            1000,
-          ]
-        }
-        numberColumns={4}
-        selectedItems={Array []}
-        setActivePage={[Function]}
-        setItemSelected={[Function]}
-        setItemsPerPage={[Function]}
-        totalItemCount={4}
-      />
-      <EuiFlexGroup
-        justifyContent="flexEnd"
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-edit-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
       >
-        <EuiFlexItem
-          grow={false}
+        <EditFilterListHeader
+          canCreateFilter={true}
+          description="List of known safe domains"
+          isNewFilterIdInvalid={false}
+          newFilterId=""
+          totalItemCount={4}
+          updateDescription={[Function]}
+          updateNewFilterId={[Function]}
+          usedBy={
+            Object {
+              "detectors": Array [
+                "high info content",
+              ],
+              "jobs": Array [
+                "dns_exfiltration",
+              ],
+            }
+          }
+        />
+        <EditFilterListToolbar
+          addItems={[Function]}
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          deleteSelectedItems={[Function]}
+          onSearchChange={[Function]}
+          selectedItemCount={0}
+        />
+        <EuiSpacer
+          size="xl"
+        />
+        <ItemsGrid
+          activePage={0}
+          items={
+            Array [
+              "google.com",
+              "google.co.uk",
+              "elastic.co",
+              "youtube.com",
+            ]
+          }
+          itemsPerPage={500}
+          itemsPerPageOptions={
+            Array [
+              50,
+              100,
+              500,
+              1000,
+            ]
+          }
+          numberColumns={4}
+          selectedItems={Array []}
+          setActivePage={[Function]}
+          setItemSelected={[Function]}
+          setItemsPerPage={[Function]}
+          totalItemCount={4}
+        />
+        <EuiFlexGroup
+          justifyContent="flexEnd"
         >
-          <EuiButtonEmpty
-            onClick={[Function]}
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            disabled={false}
-            fill={true}
-            onClick={[Function]}
+            <EuiButtonEmpty
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Cancel"
+                id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                values={Object {}}
+              />
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
           >
-            <FormattedMessage
-              defaultMessage="Save"
-              id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiPageContent>
+            <EuiButton
+              disabled={false}
+              fill={true}
+              onClick={[Function]}
+            >
+              <FormattedMessage
+                defaultMessage="Save"
+                id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                values={Object {}}
+              />
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
index c5e439b20db2f..819fbe7ba788f 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
+++ b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/edit/edit_filter_list.js
@@ -18,6 +18,7 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiPage,
+  EuiPageBody,
   EuiPageContent,
   EuiSearchBar,
   EuiSpacer,
@@ -324,68 +325,70 @@ export const EditFilterList = injectI18n(
         <Fragment>
           <NavigationMenu tabId="settings" />
           <EuiPage className="ml-edit-filter-lists">
-            <EuiPageContent
-              className="ml-edit-filter-lists-content"
-              verticalPosition="center"
-              horizontalPosition="center"
-            >
-              <EditFilterListHeader
-                canCreateFilter={canCreateFilter}
-                filterId={this.props.filterId}
-                newFilterId={newFilterId}
-                isNewFilterIdInvalid={isNewFilterIdInvalid}
-                updateNewFilterId={this.updateNewFilterId}
-                description={description}
-                updateDescription={this.updateDescription}
-                totalItemCount={totalItemCount}
-                usedBy={loadedFilter.used_by}
-              />
-              <EditFilterListToolbar
-                canCreateFilter={canCreateFilter}
-                canDeleteFilter={canDeleteFilter}
-                onSearchChange={this.onSearchChange}
-                addItems={this.addItems}
-                deleteSelectedItems={this.deleteSelectedItems}
-                selectedItemCount={selectedItems.length}
-              />
-              <EuiSpacer size="xl" />
-              <ItemsGrid
-                totalItemCount={totalItemCount}
-                items={matchingItems}
-                selectedItems={selectedItems}
-                itemsPerPage={itemsPerPage}
-                setItemsPerPage={this.setItemsPerPage}
-                setItemSelected={this.setItemSelected}
-                activePage={activePage}
-                setActivePage={this.setActivePage}
-              />
-              <EuiFlexGroup justifyContent="flexEnd">
-                <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty onClick={returnToFiltersList}>
-                    <FormattedMessage
-                      id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
-                      defaultMessage="Cancel"
-                    />
-                  </EuiButtonEmpty>
-                </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiButton
-                    onClick={this.save}
-                    disabled={
-                      saveInProgress === true ||
-                      isNewFilterIdInvalid === true ||
-                      canCreateFilter === false
-                    }
-                    fill
-                  >
-                    <FormattedMessage
-                      id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
-                      defaultMessage="Save"
-                    />
-                  </EuiButton>
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            </EuiPageContent>
+            <EuiPageBody>
+              <EuiPageContent
+                className="ml-edit-filter-lists-content"
+                verticalPosition="center"
+                horizontalPosition="center"
+              >
+                <EditFilterListHeader
+                  canCreateFilter={canCreateFilter}
+                  filterId={this.props.filterId}
+                  newFilterId={newFilterId}
+                  isNewFilterIdInvalid={isNewFilterIdInvalid}
+                  updateNewFilterId={this.updateNewFilterId}
+                  description={description}
+                  updateDescription={this.updateDescription}
+                  totalItemCount={totalItemCount}
+                  usedBy={loadedFilter.used_by}
+                />
+                <EditFilterListToolbar
+                  canCreateFilter={canCreateFilter}
+                  canDeleteFilter={canDeleteFilter}
+                  onSearchChange={this.onSearchChange}
+                  addItems={this.addItems}
+                  deleteSelectedItems={this.deleteSelectedItems}
+                  selectedItemCount={selectedItems.length}
+                />
+                <EuiSpacer size="xl" />
+                <ItemsGrid
+                  totalItemCount={totalItemCount}
+                  items={matchingItems}
+                  selectedItems={selectedItems}
+                  itemsPerPage={itemsPerPage}
+                  setItemsPerPage={this.setItemsPerPage}
+                  setItemSelected={this.setItemSelected}
+                  activePage={activePage}
+                  setActivePage={this.setActivePage}
+                />
+                <EuiFlexGroup justifyContent="flexEnd">
+                  <EuiFlexItem grow={false}>
+                    <EuiButtonEmpty onClick={returnToFiltersList}>
+                      <FormattedMessage
+                        id="xpack.ml.settings.filterLists.editFilterList.cancelButtonLabel"
+                        defaultMessage="Cancel"
+                      />
+                    </EuiButtonEmpty>
+                  </EuiFlexItem>
+                  <EuiFlexItem grow={false}>
+                    <EuiButton
+                      onClick={this.save}
+                      disabled={
+                        saveInProgress === true ||
+                        isNewFilterIdInvalid === true ||
+                        canCreateFilter === false
+                      }
+                      fill
+                    >
+                      <FormattedMessage
+                        id="xpack.ml.settings.filterLists.editFilterList.saveButtonLabel"
+                        defaultMessage="Save"
+                      />
+                    </EuiButton>
+                  </EuiFlexItem>
+                </EuiFlexGroup>
+              </EuiPageContent>
+            </EuiPageBody>
           </EuiPage>
         </Fragment>
       );
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
index b58dcfe7d8f1f..52971bfe49cd9 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
+++ b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/__snapshots__/filter_lists.test.js.snap
@@ -8,37 +8,39 @@ exports[`Filter Lists renders a list of filters 1`] = `
   <EuiPage
     className="ml-list-filter-lists"
   >
-    <EuiPageContent
-      className="ml-list-filter-lists-content"
-      horizontalPosition="center"
-      verticalPosition="center"
-    >
-      <FilterListsHeader
-        refreshFilterLists={[Function]}
-        totalCount={1}
-      />
-      <FilterListsTable
-        canCreateFilter={true}
-        canDeleteFilter={true}
-        filterLists={
-          Array [
-            Object {
-              "description": "List of known safe domains",
-              "filter_id": "safe_domains",
-              "item_count": 500,
-              "used_by": Object {
-                "jobs": Array [
-                  "dns_exfiltration",
-                ],
+    <EuiPageBody>
+      <EuiPageContent
+        className="ml-list-filter-lists-content"
+        horizontalPosition="center"
+        verticalPosition="center"
+      >
+        <FilterListsHeader
+          refreshFilterLists={[Function]}
+          totalCount={1}
+        />
+        <FilterListsTable
+          canCreateFilter={true}
+          canDeleteFilter={true}
+          filterLists={
+            Array [
+              Object {
+                "description": "List of known safe domains",
+                "filter_id": "safe_domains",
+                "item_count": 500,
+                "used_by": Object {
+                  "jobs": Array [
+                    "dns_exfiltration",
+                  ],
+                },
               },
-            },
-          ]
-        }
-        refreshFilterLists={[Function]}
-        selectedFilterLists={Array []}
-        setSelectedFilterLists={[Function]}
-      />
-    </EuiPageContent>
+            ]
+          }
+          refreshFilterLists={[Function]}
+          selectedFilterLists={Array []}
+          setSelectedFilterLists={[Function]}
+        />
+      </EuiPageContent>
+    </EuiPageBody>
   </EuiPage>
 </Fragment>
 `;
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
index 9a467bcfd25a9..949dfe82d9f54 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
+++ b/x-pack/legacy/plugins/ml/public/application/settings/filter_lists/list/filter_lists.js
@@ -11,7 +11,7 @@
 import React, { Component, Fragment } from 'react';
 import { PropTypes } from 'prop-types';
 
-import { EuiPage, EuiPageContent } from '@elastic/eui';
+import { EuiPage, EuiPageBody, EuiPageContent } from '@elastic/eui';
 
 import { injectI18n } from '@kbn/i18n/react';
 
@@ -90,24 +90,26 @@ export const FilterLists = injectI18n(
         <Fragment>
           <NavigationMenu tabId="settings" />
           <EuiPage className="ml-list-filter-lists">
-            <EuiPageContent
-              className="ml-list-filter-lists-content"
-              verticalPosition="center"
-              horizontalPosition="center"
-            >
-              <FilterListsHeader
-                totalCount={filterLists.length}
-                refreshFilterLists={this.refreshFilterLists}
-              />
-              <FilterListsTable
-                canCreateFilter={canCreateFilter}
-                canDeleteFilter={canDeleteFilter}
-                filterLists={filterLists}
-                selectedFilterLists={selectedFilterLists}
-                setSelectedFilterLists={this.setSelectedFilterLists}
-                refreshFilterLists={this.refreshFilterLists}
-              />
-            </EuiPageContent>
+            <EuiPageBody>
+              <EuiPageContent
+                className="ml-list-filter-lists-content"
+                verticalPosition="center"
+                horizontalPosition="center"
+              >
+                <FilterListsHeader
+                  totalCount={filterLists.length}
+                  refreshFilterLists={this.refreshFilterLists}
+                />
+                <FilterListsTable
+                  canCreateFilter={canCreateFilter}
+                  canDeleteFilter={canDeleteFilter}
+                  filterLists={filterLists}
+                  selectedFilterLists={selectedFilterLists}
+                  setSelectedFilterLists={this.setSelectedFilterLists}
+                  refreshFilterLists={this.refreshFilterLists}
+                />
+              </EuiPageContent>
+            </EuiPageBody>
           </EuiPage>
         </Fragment>
       );
diff --git a/x-pack/legacy/plugins/ml/public/application/settings/settings.tsx b/x-pack/legacy/plugins/ml/public/application/settings/settings.tsx
index 225f39fc6f419..e2e7a4030f04f 100644
--- a/x-pack/legacy/plugins/ml/public/application/settings/settings.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/settings/settings.tsx
@@ -35,12 +35,12 @@ export const Settings: FC<Props> = ({ canGetFilters, canGetCalendars }) => {
           <EuiPageContent className="mlSettingsPage__content" horizontalPosition="center">
             <EuiPageContentHeader>
               <EuiTitle>
-                <h2>
+                <h1>
                   <FormattedMessage
                     id="xpack.ml.settings.jobManagementTitle"
                     defaultMessage="Job Management"
                   />
-                </h2>
+                </h1>
               </EuiTitle>
             </EuiPageContentHeader>
 
diff --git a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/_timeseriesexplorer.scss b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/_timeseriesexplorer.scss
index 0dd32ceabdb05..06f93ff7b158e 100644
--- a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/_timeseriesexplorer.scss
+++ b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/_timeseriesexplorer.scss
@@ -34,7 +34,9 @@
     padding: $euiSize;
 
     .panel-title {
-      color: $euiTitleColor;
+      font-size: $euiFontSizeM;
+      font-weight: 400;
+      color: $euiColorDarkShade;
     }
 
     .entity-count-text {
@@ -78,7 +80,8 @@
       font-family: $euiFontFamily;
     }
 
-    .axis path, .axis line {
+    .axis path,
+    .axis line {
       fill: none;
       stroke: $euiBorderColor;
       shape-rendering: crispEdges;
@@ -104,6 +107,7 @@
       stroke: $euiColorDarkShade;
       stroke-width: 2;
     }
+
     .chart-border-highlight:hover {
       opacity: 1;
     }
@@ -191,6 +195,7 @@
     }
 
     .forecast {
+
       .metric-value,
       .metric-value:hover {
         stroke: #cca300;
@@ -220,7 +225,9 @@
           }
         }
 
-        a:hover, a:active, a:focus {
+        a:hover,
+        a:active,
+        a:focus {
           text-decoration: underline;
         }
 
@@ -321,6 +328,7 @@
     div.brush-handle-inner-left {
       border-radius: $euiBorderRadius 0px 0px $euiBorderRadius;
     }
+
     div.brush-handle-inner-right {
       border-radius: 0px $euiBorderRadius $euiBorderRadius 0px;
     }
@@ -342,7 +350,9 @@
    of the horizontal bar below the tab menu elements in its inactive state. */
 .mlTimeSeriesExplorerProgress {
   background-color: $euiColorEmptyShade;
-  &::-moz-progress-bar, &::-webkit-progress-bar {
+
+  &::-moz-progress-bar,
+  &::-webkit-progress-bar {
     background-color: $euiColorEmptyShade;
   }
 }
diff --git a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/components/timeseries_chart/timeseries_chart.js b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/components/timeseries_chart/timeseries_chart.js
index 474b4f2470bde..2eaa4a907af66 100644
--- a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/components/timeseries_chart/timeseries_chart.js
+++ b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/components/timeseries_chart/timeseries_chart.js
@@ -61,7 +61,7 @@ const contextChartHeight = 60;
 const contextChartLineTopMargin = 3;
 const chartSpacing = 25;
 const swimlaneHeight = 30;
-const margin = { top: 20, right: 10, bottom: 15, left: 40 };
+const margin = { top: 10, right: 10, bottom: 15, left: 40 };
 const mlAnnotationsEnabled = chrome.getInjected('mlAnnotationsEnabled', false);
 
 const ZOOM_INTERVAL_OPTIONS = [
diff --git a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
index a864808276166..6d9dbef64b009 100644
--- a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
+++ b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer.js
@@ -20,14 +20,14 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
 import {
+  EuiCallOut,
   EuiCheckbox,
   EuiFlexGroup,
   EuiFlexItem,
   EuiFormRow,
   EuiSelect,
   EuiSpacer,
-  EuiText,
-  EuiCallOut,
+  EuiTitle,
 } from '@elastic/eui';
 
 import chrome from 'ui/chrome';
@@ -1209,54 +1209,60 @@ export class TimeSeriesExplorer extends React.Component {
             <div>
               {/* Make sure ChartTooltip is inside this plain wrapping element without padding so positioning can be inferred correctly. */}
               <ChartTooltip />
-              <EuiText className="results-container">
-                <span className="panel-title">
-                  {i18n.translate('xpack.ml.timeSeriesExplorer.singleTimeSeriesAnalysisTitle', {
-                    defaultMessage: 'Single time series analysis of {functionLabel}',
-                    values: { functionLabel: chartDetails.functionLabel },
-                  })}
-                </span>
-                &nbsp;
-                {chartDetails.entityData.count === 1 && (
-                  <span className="entity-count-text">
-                    {chartDetails.entityData.entities.length > 0 && '('}
-                    {chartDetails.entityData.entities
-                      .map(entity => {
-                        return `${entity.fieldName}: ${entity.fieldValue}`;
-                      })
-                      .join(', ')}
-                    {chartDetails.entityData.entities.length > 0 && ')'}
-                  </span>
-                )}
-                {chartDetails.entityData.count !== 1 && (
-                  <span className="entity-count-text">
-                    {chartDetails.entityData.entities.map((countData, i) => {
-                      return (
-                        <Fragment key={countData.fieldName}>
-                          {i18n.translate(
-                            'xpack.ml.timeSeriesExplorer.countDataInChartDetailsDescription',
-                            {
-                              defaultMessage:
-                                '{openBrace}{cardinalityValue} distinct {fieldName} {cardinality, plural, one {} other { values}}{closeBrace}',
-                              values: {
-                                openBrace: i === 0 ? '(' : '',
-                                closeBrace:
-                                  i === chartDetails.entityData.entities.length - 1 ? ')' : '',
-                                cardinalityValue:
-                                  countData.cardinality === 0
-                                    ? allValuesLabel
-                                    : countData.cardinality,
-                                cardinality: countData.cardinality,
-                                fieldName: countData.fieldName,
-                              },
-                            }
-                          )}
-                          {i !== chartDetails.entityData.entities.length - 1 ? ', ' : ''}
-                        </Fragment>
-                      );
-                    })}
-                  </span>
-                )}
+
+              <div className="results-container">
+                <EuiTitle className="panel-title">
+                  <h2 style={{ display: 'inline' }}>
+                    <span>
+                      {i18n.translate('xpack.ml.timeSeriesExplorer.singleTimeSeriesAnalysisTitle', {
+                        defaultMessage: 'Single time series analysis of {functionLabel}',
+                        values: { functionLabel: chartDetails.functionLabel },
+                      })}
+                    </span>
+                    &nbsp;
+                    {chartDetails.entityData.count === 1 && (
+                      <span className="entity-count-text">
+                        {chartDetails.entityData.entities.length > 0 && '('}
+                        {chartDetails.entityData.entities
+                          .map(entity => {
+                            return `${entity.fieldName}: ${entity.fieldValue}`;
+                          })
+                          .join(', ')}
+                        {chartDetails.entityData.entities.length > 0 && ')'}
+                      </span>
+                    )}
+                    {chartDetails.entityData.count !== 1 && (
+                      <span className="entity-count-text">
+                        {chartDetails.entityData.entities.map((countData, i) => {
+                          return (
+                            <Fragment key={countData.fieldName}>
+                              {i18n.translate(
+                                'xpack.ml.timeSeriesExplorer.countDataInChartDetailsDescription',
+                                {
+                                  defaultMessage:
+                                    '{openBrace}{cardinalityValue} distinct {fieldName} {cardinality, plural, one {} other { values}}{closeBrace}',
+                                  values: {
+                                    openBrace: i === 0 ? '(' : '',
+                                    closeBrace:
+                                      i === chartDetails.entityData.entities.length - 1 ? ')' : '',
+                                    cardinalityValue:
+                                      countData.cardinality === 0
+                                        ? allValuesLabel
+                                        : countData.cardinality,
+                                    cardinality: countData.cardinality,
+                                    fieldName: countData.fieldName,
+                                  },
+                                }
+                              )}
+                              {i !== chartDetails.entityData.entities.length - 1 ? ', ' : ''}
+                            </Fragment>
+                          );
+                        })}
+                      </span>
+                    )}
+                  </h2>
+                </EuiTitle>
+
                 <EuiFlexGroup style={{ float: 'right' }}>
                   {showModelBoundsCheckbox && (
                     <EuiFlexItem grow={false}>
@@ -1311,11 +1317,14 @@ export class TimeSeriesExplorer extends React.Component {
                 </div>
                 {showAnnotations && focusAnnotationData.length > 0 && (
                   <div>
-                    <span className="panel-title">
-                      {i18n.translate('xpack.ml.timeSeriesExplorer.annotationsTitle', {
-                        defaultMessage: 'Annotations',
-                      })}
-                    </span>
+                    <EuiTitle className="panel-title">
+                      <h2>
+                        <FormattedMessage
+                          id="xpack.ml.timeSeriesExplorer.annotationsTitle"
+                          defaultMessage="Annotations"
+                        />
+                      </h2>
+                    </EuiTitle>
                     <AnnotationsTable
                       annotations={focusAnnotationData}
                       isSingleMetricViewerLinkVisible={false}
@@ -1325,11 +1334,14 @@ export class TimeSeriesExplorer extends React.Component {
                   </div>
                 )}
                 <AnnotationFlyout />
-                <span className="panel-title">
-                  {i18n.translate('xpack.ml.timeSeriesExplorer.anomaliesTitle', {
-                    defaultMessage: 'Anomalies',
-                  })}
-                </span>
+                <EuiTitle className="panel-title">
+                  <h2>
+                    <FormattedMessage
+                      id="xpack.ml.timeSeriesExplorer.anomaliesTitle"
+                      defaultMessage="Anomalies"
+                    />
+                  </h2>
+                </EuiTitle>
                 <EuiFlexGroup
                   direction="row"
                   gutterSize="l"
@@ -1356,7 +1368,7 @@ export class TimeSeriesExplorer extends React.Component {
                   </EuiFlexItem>
                 </EuiFlexGroup>
                 <EuiSpacer size="m" />
-              </EuiText>
+              </div>
             </div>
           )}
         {arePartitioningFieldsProvided && jobs.length > 0 && hasResults === true && (
diff --git a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer_page.tsx b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer_page.tsx
index 9da1a79232fce..a44171167cb67 100644
--- a/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer_page.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/timeseriesexplorer/timeseriesexplorer_page.tsx
@@ -6,7 +6,9 @@
 
 import React, { FC } from 'react';
 
-import { EuiProgress } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { EuiPage, EuiPageBody, EuiProgress, EuiScreenReaderOnly } from '@elastic/eui';
 
 import { JobSelector } from '../components/job_selector';
 import { NavigationMenu } from '../components/navigation_menu';
@@ -47,7 +49,19 @@ export const TimeSeriesExplorerPage: FC<TimeSeriesExplorerPageProps> = ({
         ref={resizeRef}
         data-test-subj="mlPageSingleMetricViewer"
       >
-        {children}
+        <EuiPage style={{ padding: '0px', background: 'none' }}>
+          <EuiPageBody>
+            <EuiScreenReaderOnly>
+              <h1>
+                <FormattedMessage
+                  id="xpack.ml.timeSeriesExplorer.pageTitle"
+                  defaultMessage="Single Metric Viewer"
+                />
+              </h1>
+            </EuiScreenReaderOnly>
+            {children}
+          </EuiPageBody>
+        </EuiPage>
       </div>
     </>
   );
diff --git a/x-pack/legacy/plugins/ml/server/lib/query_utils.js b/x-pack/legacy/plugins/ml/server/lib/query_utils.ts
similarity index 86%
rename from x-pack/legacy/plugins/ml/server/lib/query_utils.js
rename to x-pack/legacy/plugins/ml/server/lib/query_utils.ts
index 806ce324d26d1..5eff726d6c5c8 100644
--- a/x-pack/legacy/plugins/ml/server/lib/query_utils.js
+++ b/x-pack/legacy/plugins/ml/server/lib/query_utils.ts
@@ -10,7 +10,12 @@
 
 // Builds the base filter criteria used in queries,
 // adding criteria for the time range and an optional query.
-export function buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query) {
+export function buildBaseFilterCriteria(
+  timeFieldName?: string,
+  earliestMs?: number,
+  latestMs?: number,
+  query?: object
+) {
   const filterCriteria = [];
   if (timeFieldName && earliestMs && latestMs) {
     filterCriteria.push({
@@ -34,7 +39,7 @@ export function buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, que
 // Wraps the supplied aggregations in a sampler aggregation.
 // A supplied samplerShardSize (the shard_size parameter of the sampler aggregation)
 // of less than 1 indicates no sampling, and the aggs are returned as-is.
-export function buildSamplerAggregation(aggs, samplerShardSize) {
+export function buildSamplerAggregation(aggs: object, samplerShardSize: number) {
   if (samplerShardSize < 1) {
     return aggs;
   }
@@ -53,6 +58,6 @@ export function buildSamplerAggregation(aggs, samplerShardSize) {
 // depending on whether sampling is being used.
 // A supplied samplerShardSize (the shard_size parameter of the sampler aggregation)
 // of less than 1 indicates no sampling, and an empty array is returned.
-export function getSamplerAggregationsResponsePath(samplerShardSize) {
+export function getSamplerAggregationsResponsePath(samplerShardSize: number): string[] {
   return samplerShardSize > 0 ? ['sample'] : [];
 }
diff --git a/x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.js b/x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.ts
similarity index 75%
rename from x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.js
rename to x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.ts
index f4ee032ee2dbb..6186a61c5075f 100644
--- a/x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.js
+++ b/x-pack/legacy/plugins/ml/server/models/data_visualizer/data_visualizer.ts
@@ -4,23 +4,118 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { CallAPIOptions, RequestHandlerContext } from 'kibana/server';
 import _ from 'lodash';
+import { ML_JOB_FIELD_TYPES } from '../../../common/constants/field_types';
+import { getSafeAggregationName } from '../../../common/util/job_utils';
 import {
   buildBaseFilterCriteria,
   buildSamplerAggregation,
   getSamplerAggregationsResponsePath,
 } from '../../lib/query_utils';
-import { ML_JOB_FIELD_TYPES } from '../../../common/constants/field_types';
-import { getSafeAggregationName } from '../../../common/util/job_utils';
 
 const SAMPLER_TOP_TERMS_THRESHOLD = 100000;
 const SAMPLER_TOP_TERMS_SHARD_SIZE = 5000;
 const AGGREGATABLE_EXISTS_REQUEST_BATCH_SIZE = 200;
 const FIELDS_REQUEST_BATCH_SIZE = 10;
 
+interface FieldData {
+  fieldName: string;
+  existsInDocs: boolean;
+  stats?: {
+    sampleCount?: number;
+    count?: number;
+    cardinality?: number;
+  };
+}
+
+export interface Field {
+  fieldName: string;
+  type: string;
+  cardinality: number;
+}
+
+interface Distribution {
+  percentiles: any[];
+  minPercentile: number;
+  maxPercentile: number;
+}
+
+interface Aggs {
+  [key: string]: any;
+}
+
+interface Bucket {
+  doc_count: number;
+}
+
+interface NumericFieldStats {
+  fieldName: string;
+  count: number;
+  min: number;
+  max: number;
+  avg: number;
+  isTopValuesSampled: boolean;
+  topValues: Bucket[];
+  topValuesSampleSize: number;
+  topValuesSamplerShardSize: number;
+  median?: number;
+  distribution?: Distribution;
+}
+
+interface StringFieldStats {
+  fieldName: string;
+  isTopValuesSampled: boolean;
+  topValues: Bucket[];
+  topValuesSampleSize: number;
+  topValuesSamplerShardSize: number;
+}
+
+interface DateFieldStats {
+  fieldName: string;
+  count: number;
+  earliest: number;
+  latest: number;
+}
+
+interface BooleanFieldStats {
+  fieldName: string;
+  count: number;
+  trueCount: number;
+  falseCount: number;
+  [key: string]: number | string;
+}
+
+interface DocumentCountStats {
+  documentCounts: {
+    interval: number;
+    buckets: { [key: string]: number };
+  };
+}
+
+interface FieldExamples {
+  fieldName: string;
+  examples: any[];
+}
+
+type BatchStats =
+  | NumericFieldStats
+  | StringFieldStats
+  | BooleanFieldStats
+  | DateFieldStats
+  | DocumentCountStats
+  | FieldExamples;
+
 export class DataVisualizer {
-  constructor(callWithRequest) {
-    this.callWithRequest = callWithRequest;
+  callAsCurrentUser: (
+    endpoint: string,
+    clientParams: Record<string, any>,
+    options?: CallAPIOptions
+  ) => Promise<any>;
+
+  constructor(client: RequestHandlerContext | (() => any)) {
+    this.callAsCurrentUser =
+      typeof client === 'object' ? client.ml!.mlClient.callAsCurrentUser : client;
   }
 
   // Obtains overall stats on the fields in the supplied index pattern, returning an object
@@ -28,28 +123,28 @@ export class DataVisualizer {
   // aggregatable and non-aggregatable fields do or do not exist in documents.
   // Sampling will be used if supplied samplerShardSize > 0.
   async getOverallStats(
-    indexPatternTitle,
-    query,
-    aggregatableFields,
-    nonAggregatableFields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: object,
+    aggregatableFields: string[],
+    nonAggregatableFields: string[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const stats = {
       totalCount: 0,
-      aggregatableExistsFields: [],
-      aggregatableNotExistsFields: [],
-      nonAggregatableExistsFields: [],
-      nonAggregatableNotExistsFields: [],
+      aggregatableExistsFields: [] as FieldData[],
+      aggregatableNotExistsFields: [] as FieldData[],
+      nonAggregatableExistsFields: [] as FieldData[],
+      nonAggregatableNotExistsFields: [] as FieldData[],
     };
 
     // To avoid checking for the existence of too many aggregatable fields in one request,
     // split the check into multiple batches (max 200 fields per request).
-    const batches = [[]];
+    const batches: string[][] = [[]];
     _.each(aggregatableFields, field => {
-      let lastArray = _.last(batches);
+      let lastArray: string[] = _.last(batches);
       if (lastArray.length === AGGREGATABLE_EXISTS_REQUEST_BATCH_SIZE) {
         lastArray = [];
         batches.push(lastArray);
@@ -89,7 +184,7 @@ export class DataVisualizer {
           latestMs
         );
 
-        const fieldData = {
+        const fieldData: FieldData = {
           fieldName: field,
           existsInDocs,
           stats: {},
@@ -110,19 +205,19 @@ export class DataVisualizer {
   // returned array depend on the type of the field (keyword, number, date etc).
   // Sampling will be used if supplied samplerShardSize > 0.
   async getStatsForFields(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-    interval,
-    maxExamples
-  ) {
+    indexPatternTitle: string,
+    query: any,
+    fields: Field[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number,
+    interval: number,
+    maxExamples: number
+  ): Promise<BatchStats[]> {
     // Batch up fields by type, getting stats for multiple fields at a time.
-    const batches = [];
-    const batchedFields = {};
+    const batches: Field[][] = [];
+    const batchedFields: { [key: string]: Field[][] } = {};
     _.each(fields, field => {
       if (field.fieldName === undefined) {
         // undefined fieldName is used for a document count request.
@@ -135,7 +230,7 @@ export class DataVisualizer {
         if (batchedFields[fieldType] === undefined) {
           batchedFields[fieldType] = [[]];
         }
-        let lastArray = _.last(batchedFields[fieldType]);
+        let lastArray: Field[] = _.last(batchedFields[fieldType]);
         if (lastArray.length === FIELDS_REQUEST_BATCH_SIZE) {
           lastArray = [];
           batchedFields[fieldType].push(lastArray);
@@ -148,10 +243,10 @@ export class DataVisualizer {
       batches.push(...lists);
     });
 
-    let results = [];
+    let results: BatchStats[] = [];
     await Promise.all(
       batches.map(async batch => {
-        let batchStats = [];
+        let batchStats: BatchStats[] = [];
         const first = batch[0];
         switch (first.type) {
           case ML_JOB_FIELD_TYPES.NUMBER:
@@ -243,13 +338,13 @@ export class DataVisualizer {
   }
 
   async checkAggregatableFieldsExist(
-    indexPatternTitle,
-    query,
-    aggregatableFields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: any,
+    aggregatableFields: string[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
@@ -257,7 +352,7 @@ export class DataVisualizer {
 
     // Value count aggregation faster way of checking if field exists than using
     // filter aggregation with exists query.
-    const aggs = {};
+    const aggs: Aggs = {};
     aggregatableFields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field, i);
       aggs[`${safeFieldName}_count`] = {
@@ -277,7 +372,7 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this.callWithRequest('search', {
+    const resp = await this.callAsCurrentUser('search', {
       index,
       rest_total_hits_as_int: true,
       size,
@@ -287,8 +382,8 @@ export class DataVisualizer {
     const totalCount = _.get(resp, ['hits', 'total'], 0);
     const stats = {
       totalCount,
-      aggregatableExistsFields: [],
-      aggregatableNotExistsFields: [],
+      aggregatableExistsFields: [] as FieldData[],
+      aggregatableNotExistsFields: [] as FieldData[],
     };
 
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
@@ -324,12 +419,12 @@ export class DataVisualizer {
   }
 
   async checkNonAggregatableFieldExists(
-    indexPatternTitle,
-    query,
-    field,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: any,
+    field: string,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
@@ -344,7 +439,7 @@ export class DataVisualizer {
     };
     filterCriteria.push({ exists: { field } });
 
-    const resp = await this.callWithRequest('search', {
+    const resp = await this.callAsCurrentUser('search', {
       index,
       rest_total_hits_as_int: true,
       size,
@@ -354,13 +449,13 @@ export class DataVisualizer {
   }
 
   async getDocumentCountStats(
-    indexPatternTitle,
-    query,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-    interval
-  ) {
+    indexPatternTitle: string,
+    query: any,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number,
+    interval: number
+  ): Promise<DocumentCountStats> {
     const index = indexPatternTitle;
     const size = 0;
     const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
@@ -371,7 +466,7 @@ export class DataVisualizer {
       eventRate: {
         date_histogram: {
           field: timeFieldName,
-          interval: interval,
+          interval,
           min_doc_count: 1,
         },
       },
@@ -383,36 +478,42 @@ export class DataVisualizer {
           filter: filterCriteria,
         },
       },
-      aggs: aggs,
+      aggs,
     };
 
-    const resp = await this.callWithRequest('search', { index, size, body });
+    const resp = await this.callAsCurrentUser('search', {
+      index,
+      size,
+      body,
+    });
 
-    const buckets = {};
-    const dataByTimeBucket = _.get(resp, ['aggregations', 'eventRate', 'buckets'], []);
+    const buckets: { [key: string]: number } = {};
+    const dataByTimeBucket: Array<{ key: string; doc_count: number }> = _.get(
+      resp,
+      ['aggregations', 'eventRate', 'buckets'],
+      []
+    );
     _.each(dataByTimeBucket, dataForTime => {
       const time = dataForTime.key;
       buckets[time] = dataForTime.doc_count;
     });
 
-    const stats = {
+    return {
       documentCounts: {
         interval,
         buckets,
       },
     };
-
-    return stats;
   }
 
   async getNumericFieldsStats(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: object,
+    fields: Field[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
@@ -429,7 +530,7 @@ export class DataVisualizer {
       () => (count += PERCENTILE_SPACING)
     );
 
-    const aggs = {};
+    const aggs: { [key: string]: any } = {};
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       aggs[`${safeFieldName}_field_stats`] = {
@@ -443,7 +544,7 @@ export class DataVisualizer {
       aggs[`${safeFieldName}_percentiles`] = {
         percentiles: {
           field: field.fieldName,
-          percents: percents,
+          percents,
           keyed: false,
         },
       };
@@ -483,10 +584,14 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this.callWithRequest('search', { index, size, body });
+    const resp = await this.callAsCurrentUser('search', {
+      index,
+      size,
+      body,
+    });
     const aggregations = resp.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-    const batchStats = [];
+    const batchStats: NumericFieldStats[] = [];
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       const docCount = _.get(
@@ -499,7 +604,15 @@ export class DataVisualizer {
         [...aggsPath, `${safeFieldName}_field_stats`, 'actual_stats'],
         {}
       );
-      const stats = {
+
+      const topAggsPath = [...aggsPath, `${safeFieldName}_top`];
+      if (samplerShardSize < 1 && field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD) {
+        topAggsPath.push('top');
+      }
+
+      const topValues: Bucket[] = _.get(aggregations, [...topAggsPath, 'buckets'], []);
+
+      const stats: NumericFieldStats = {
         fieldName: field.fieldName,
         count: docCount,
         min: _.get(fieldStatsResp, 'min', 0),
@@ -507,31 +620,27 @@ export class DataVisualizer {
         avg: _.get(fieldStatsResp, 'avg', 0),
         isTopValuesSampled:
           field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD || samplerShardSize > 0,
+        topValues,
+        topValuesSampleSize: topValues.reduce(
+          (acc, curr) => acc + curr.doc_count,
+          _.get(aggregations, [...topAggsPath, 'sum_other_doc_count'], 0)
+        ),
+        topValuesSamplerShardSize:
+          field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD
+            ? SAMPLER_TOP_TERMS_SHARD_SIZE
+            : samplerShardSize,
       };
 
-      const topAggsPath = [...aggsPath, `${safeFieldName}_top`];
-      if (samplerShardSize < 1 && field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD) {
-        topAggsPath.push('top');
-      }
-
-      stats.topValues = _.get(aggregations, [...topAggsPath, 'buckets'], []);
-      stats.topValuesSampleSize = _.get(aggregations, [...topAggsPath, 'sum_other_doc_count'], 0);
-      stats.topValuesSamplerShardSize =
-        field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD
-          ? SAMPLER_TOP_TERMS_SHARD_SIZE
-          : samplerShardSize;
-      stats.topValues.forEach(bucket => {
-        stats.topValuesSampleSize += bucket.doc_count;
-      });
-
       if (stats.count > 0) {
         const percentiles = _.get(
           aggregations,
           [...aggsPath, `${safeFieldName}_percentiles`, 'values'],
           []
         );
-        const medianPercentile = _.find(percentiles, { key: 50 });
-        stats.median = medianPercentile !== undefined ? medianPercentile.value : 0;
+        const medianPercentile: { value: number; key: number } | undefined = _.find(percentiles, {
+          key: 50,
+        });
+        stats.median = medianPercentile !== undefined ? medianPercentile!.value : 0;
         stats.distribution = this.processDistributionData(
           percentiles,
           PERCENTILE_SPACING,
@@ -546,19 +655,19 @@ export class DataVisualizer {
   }
 
   async getStringFieldsStats(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: object,
+    fields: Field[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
     const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
 
-    const aggs = {};
+    const aggs: Aggs = {};
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       const top = {
@@ -596,32 +705,38 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this.callWithRequest('search', { index, size, body });
+    const resp = await this.callAsCurrentUser('search', {
+      index,
+      size,
+      body,
+    });
     const aggregations = resp.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-    const batchStats = [];
+    const batchStats: StringFieldStats[] = [];
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
-      const stats = {
-        fieldName: field.fieldName,
-        isTopValuesSampled:
-          field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD || samplerShardSize > 0,
-      };
 
       const topAggsPath = [...aggsPath, `${safeFieldName}_top`];
       if (samplerShardSize < 1 && field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD) {
         topAggsPath.push('top');
       }
 
-      stats.topValues = _.get(aggregations, [...topAggsPath, 'buckets'], []);
-      stats.topValuesSampleSize = _.get(aggregations, [...topAggsPath, 'sum_other_doc_count'], 0);
-      stats.topValuesSamplerShardSize =
-        field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD
-          ? SAMPLER_TOP_TERMS_SHARD_SIZE
-          : samplerShardSize;
-      stats.topValues.forEach(bucket => {
-        stats.topValuesSampleSize += bucket.doc_count;
-      });
+      const topValues: Bucket[] = _.get(aggregations, [...topAggsPath, 'buckets'], []);
+
+      const stats = {
+        fieldName: field.fieldName,
+        isTopValuesSampled:
+          field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD || samplerShardSize > 0,
+        topValues,
+        topValuesSampleSize: topValues.reduce(
+          (acc, curr) => acc + curr.doc_count,
+          _.get(aggregations, [...topAggsPath, 'sum_other_doc_count'], 0)
+        ),
+        topValuesSamplerShardSize:
+          field.cardinality >= SAMPLER_TOP_TERMS_THRESHOLD
+            ? SAMPLER_TOP_TERMS_SHARD_SIZE
+            : samplerShardSize,
+      };
 
       batchStats.push(stats);
     });
@@ -630,19 +745,19 @@ export class DataVisualizer {
   }
 
   async getDateFieldsStats(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: object,
+    fields: Field[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
     const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
 
-    const aggs = {};
+    const aggs: Aggs = {};
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       aggs[`${safeFieldName}_field_stats`] = {
@@ -664,10 +779,14 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this.callWithRequest('search', { index, size, body });
+    const resp = await this.callAsCurrentUser('search', {
+      index,
+      size,
+      body,
+    });
     const aggregations = resp.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-    const batchStats = [];
+    const batchStats: DateFieldStats[] = [];
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       const docCount = _.get(
@@ -692,19 +811,19 @@ export class DataVisualizer {
   }
 
   async getBooleanFieldsStats(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
+    indexPatternTitle: string,
+    query: object,
+    fields: Field[],
+    samplerShardSize: number,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
   ) {
     const index = indexPatternTitle;
     const size = 0;
     const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
 
-    const aggs = {};
+    const aggs: Aggs = {};
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
       aggs[`${safeFieldName}_value_count`] = {
@@ -727,20 +846,24 @@ export class DataVisualizer {
       aggs: buildSamplerAggregation(aggs, samplerShardSize),
     };
 
-    const resp = await this.callWithRequest('search', { index, size, body });
+    const resp = await this.callAsCurrentUser('search', {
+      index,
+      size,
+      body,
+    });
     const aggregations = resp.aggregations;
     const aggsPath = getSamplerAggregationsResponsePath(samplerShardSize);
-    const batchStats = [];
+    const batchStats: BooleanFieldStats[] = [];
     fields.forEach((field, i) => {
       const safeFieldName = getSafeAggregationName(field.fieldName, i);
-      const stats = {
+      const stats: BooleanFieldStats = {
         fieldName: field.fieldName,
         count: _.get(aggregations, [...aggsPath, `${safeFieldName}_value_count`, 'doc_count'], 0),
         trueCount: 0,
         falseCount: 0,
       };
 
-      const valueBuckets = _.get(
+      const valueBuckets: Array<{ [key: string]: number }> = _.get(
         aggregations,
         [...aggsPath, `${safeFieldName}_values`, 'buckets'],
         []
@@ -756,14 +879,14 @@ export class DataVisualizer {
   }
 
   async getFieldExamples(
-    indexPatternTitle,
-    query,
-    field,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-    maxExamples
-  ) {
+    indexPatternTitle: string,
+    query: any,
+    field: string,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number,
+    maxExamples: number
+  ): Promise<FieldExamples> {
     const index = indexPatternTitle;
 
     // Request at least 100 docs so that we have a chance of obtaining
@@ -785,7 +908,7 @@ export class DataVisualizer {
       },
     };
 
-    const resp = await this.callWithRequest('search', {
+    const resp = await this.callAsCurrentUser('search', {
       index,
       rest_total_hits_as_int: true,
       size,
@@ -793,7 +916,7 @@ export class DataVisualizer {
     });
     const stats = {
       fieldName: field,
-      examples: [],
+      examples: [] as any[],
     };
     if (resp.hits.total !== 0) {
       const hits = resp.hits.hits;
@@ -803,7 +926,7 @@ export class DataVisualizer {
         // field is populated using copy_to in the index mapping),
         // there will be no example to add.
         // Use lodash _.get() to support field names containing dots.
-        const example = _.get(hits[i]._source, field);
+        const example: any = _.get(hits[i]._source, field);
         if (example !== undefined && stats.examples.indexOf(example) === -1) {
           stats.examples.push(example);
           if (stats.examples.length === maxExamples) {
@@ -816,13 +939,17 @@ export class DataVisualizer {
     return stats;
   }
 
-  processDistributionData(percentiles, percentileSpacing, minValue) {
-    const distribution = { percentiles: [], minPercentile: 0, maxPercentile: 100 };
+  processDistributionData(
+    percentiles: Array<{ value: number }>,
+    percentileSpacing: number,
+    minValue: number
+  ): Distribution {
+    const distribution: Distribution = { percentiles: [], minPercentile: 0, maxPercentile: 100 };
     if (percentiles.length === 0) {
       return distribution;
     }
 
-    let percentileBuckets = [];
+    let percentileBuckets: Array<{ value: number }> = [];
     let lowerBound = minValue;
     if (lowerBound >= 0) {
       // By default return results for 0 - 90% percentiles.
@@ -853,7 +980,7 @@ export class DataVisualizer {
 
       // Add in 0-5 and 95-100% if they don't add more
       // than 25% to the value range at either end.
-      const lastValue = _.last(percentileBuckets).value;
+      const lastValue: number = _.last(percentileBuckets).value;
       const maxDiff = 0.25 * (lastValue - lowerBound);
       if (lowerBound - dataMin < maxDiff) {
         percentileBuckets.splice(0, 0, percentiles[0]);
diff --git a/x-pack/legacy/plugins/ml/server/models/data_visualizer/index.js b/x-pack/legacy/plugins/ml/server/models/data_visualizer/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/ml/server/models/data_visualizer/index.js
rename to x-pack/legacy/plugins/ml/server/models/data_visualizer/index.ts
diff --git a/x-pack/legacy/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts b/x-pack/legacy/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts
new file mode 100644
index 0000000000000..2bd19985c8518
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AnomalyRecordDoc } from '../../../common/types/anomalies';
+
+export interface AnomaliesTableRecord {
+  time: number;
+  source: AnomalyRecordDoc;
+  rowId: string;
+  jobId: string;
+  detectorIndex: number;
+  severity: number;
+  entityName?: string;
+  entityValue?: any;
+  influencers?: Array<{ [key: string]: any }>;
+  actual?: number[];
+  actualSort?: any;
+  typical?: number[];
+  typicalSort?: any;
+  metricDescriptionSort?: number;
+}
+
+export function buildAnomalyTableItems(
+  anomalyRecords: any,
+  aggregationInterval: any,
+  dateFormatTz: string
+): AnomaliesTableRecord[];
diff --git a/x-pack/legacy/plugins/ml/server/models/results_service/get_partition_fields_values.ts b/x-pack/legacy/plugins/ml/server/models/results_service/get_partition_fields_values.ts
index 00e3002a7fc71..99eeaacc8de9c 100644
--- a/x-pack/legacy/plugins/ml/server/models/results_service/get_partition_fields_values.ts
+++ b/x-pack/legacy/plugins/ml/server/models/results_service/get_partition_fields_values.ts
@@ -7,11 +7,7 @@
 import Boom from 'boom';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
 import { callWithRequestType } from '../../../common/types/kibana';
-
-interface CriteriaField {
-  fieldName: string;
-  fieldValue: any;
-}
+import { CriteriaField } from './results_service';
 
 const PARTITION_FIELDS = ['partition_field', 'over_field', 'by_field'] as const;
 
diff --git a/x-pack/legacy/plugins/ml/server/models/results_service/index.js b/x-pack/legacy/plugins/ml/server/models/results_service/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/ml/server/models/results_service/index.js
rename to x-pack/legacy/plugins/ml/server/models/results_service/index.ts
diff --git a/x-pack/legacy/plugins/ml/server/models/results_service/results_service.js b/x-pack/legacy/plugins/ml/server/models/results_service/results_service.ts
similarity index 81%
rename from x-pack/legacy/plugins/ml/server/models/results_service/results_service.js
rename to x-pack/legacy/plugins/ml/server/models/results_service/results_service.ts
index 3ee5d04186ff1..5b154991f7cf0 100644
--- a/x-pack/legacy/plugins/ml/server/models/results_service/results_service.js
+++ b/x-pack/legacy/plugins/ml/server/models/results_service/results_service.ts
@@ -6,18 +6,33 @@
 
 import _ from 'lodash';
 import moment from 'moment';
-
-import { buildAnomalyTableItems } from './build_anomaly_table_items';
+import { SearchResponse } from 'elasticsearch';
+import { RequestHandlerContext } from 'kibana/server';
+import { buildAnomalyTableItems, AnomaliesTableRecord } from './build_anomaly_table_items';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
 import { ANOMALIES_TABLE_DEFAULT_QUERY_SIZE } from '../../../common/constants/search';
 import { getPartitionFieldsValuesFactory } from './get_partition_fields_values';
+import { AnomalyRecordDoc } from '../../../common/types/anomalies';
 
 // Service for carrying out Elasticsearch queries to obtain data for the
 // ML Results dashboards.
 
 const DEFAULT_MAX_EXAMPLES = 500;
 
-export function resultsServiceProvider(callWithRequest) {
+export interface CriteriaField {
+  fieldType?: string;
+  fieldName: string;
+  fieldValue: any;
+}
+
+interface Influencer {
+  fieldName: string;
+  fieldValue: any;
+}
+
+export function resultsServiceProvider(client: RequestHandlerContext | (() => any)) {
+  const callAsCurrentUser =
+    typeof client === 'object' ? client.ml!.mlClient.callAsCurrentUser : client;
   // Obtains data for the anomalies table, aggregating anomalies by day or hour as requested.
   // Return an Object with properties 'anomalies' and 'interval' (interval used to aggregate anomalies,
   // one of day, hour or second. Note 'auto' can be provided as the aggregationInterval in the request,
@@ -25,21 +40,21 @@ export function resultsServiceProvider(callWithRequest) {
   // last anomalies),  plus an examplesByJobId property if any of the
   // anomalies are categorization anomalies in mlcategory.
   async function getAnomaliesTableData(
-    jobIds,
-    criteriaFields,
-    influencers,
-    aggregationInterval,
-    threshold,
-    earliestMs,
-    latestMs,
-    dateFormatTz,
-    maxRecords = ANOMALIES_TABLE_DEFAULT_QUERY_SIZE,
-    maxExamples = DEFAULT_MAX_EXAMPLES,
-    influencersFilterQuery
+    jobIds: string[],
+    criteriaFields: CriteriaField[],
+    influencers: Influencer[],
+    aggregationInterval: string,
+    threshold: number,
+    earliestMs: number,
+    latestMs: number,
+    dateFormatTz: string,
+    maxRecords: number = ANOMALIES_TABLE_DEFAULT_QUERY_SIZE,
+    maxExamples: number = DEFAULT_MAX_EXAMPLES,
+    influencersFilterQuery: any
   ) {
     // Build the query to return the matching anomaly record results.
     // Add criteria for the time range, record score, plus any specified job IDs.
-    const boolCriteria = [
+    const boolCriteria: object[] = [
       {
         range: {
           timestamp: {
@@ -120,7 +135,7 @@ export function resultsServiceProvider(callWithRequest) {
       });
     }
 
-    const resp = await callWithRequest('search', {
+    const resp: SearchResponse<any> = await callAsCurrentUser('search', {
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: maxRecords,
@@ -146,9 +161,16 @@ export function resultsServiceProvider(callWithRequest) {
       },
     });
 
-    const tableData = { anomalies: [], interval: 'second' };
+    const tableData: {
+      anomalies: AnomaliesTableRecord[];
+      interval: string;
+      examplesByJobId?: { [key: string]: any };
+    } = {
+      anomalies: [],
+      interval: 'second',
+    };
     if (resp.hits.total !== 0) {
-      let records = [];
+      let records: AnomalyRecordDoc[] = [];
       resp.hits.hits.forEach(hit => {
         records.push(hit._source);
       });
@@ -169,12 +191,12 @@ export function resultsServiceProvider(callWithRequest) {
 
       // Load examples for any categorization anomalies.
       const categoryAnomalies = tableData.anomalies.filter(
-        item => item.entityName === 'mlcategory'
+        (item: any) => item.entityName === 'mlcategory'
       );
       if (categoryAnomalies.length > 0) {
         tableData.examplesByJobId = {};
 
-        const categoryIdsByJobId = {};
+        const categoryIdsByJobId: { [key: string]: any } = {};
         categoryAnomalies.forEach(anomaly => {
           if (!_.has(categoryIdsByJobId, anomaly.jobId)) {
             categoryIdsByJobId[anomaly.jobId] = [];
@@ -192,7 +214,9 @@ export function resultsServiceProvider(callWithRequest) {
               categoryIdsByJobId[jobId],
               maxExamples
             );
-            tableData.examplesByJobId[jobId] = examplesByCategoryId;
+            if (tableData.examplesByJobId !== undefined) {
+              tableData.examplesByJobId[jobId] = examplesByCategoryId;
+            }
           })
         );
       }
@@ -202,10 +226,10 @@ export function resultsServiceProvider(callWithRequest) {
   }
 
   // Returns the maximum anomaly_score for result_type:bucket over jobIds for the interval passed in
-  async function getMaxAnomalyScore(jobIds = [], earliestMs, latestMs) {
+  async function getMaxAnomalyScore(jobIds: string[] = [], earliestMs: number, latestMs: number) {
     // Build the criteria to use in the bool filter part of the request.
     // Adds criteria for the time range plus any specified job IDs.
-    const boolCriteria = [
+    const boolCriteria: object[] = [
       {
         range: {
           timestamp: {
@@ -265,7 +289,7 @@ export function resultsServiceProvider(callWithRequest) {
       },
     };
 
-    const resp = await callWithRequest('search', query);
+    const resp = await callAsCurrentUser('search', query);
     const maxScore = _.get(resp, ['aggregations', 'max_score', 'value'], null);
 
     return { maxScore };
@@ -275,7 +299,7 @@ export function resultsServiceProvider(callWithRequest) {
   // Returns data over all jobs unless an optional list of job IDs of interest is supplied.
   // Returned response consists of latest bucket timestamps (ms since Jan 1 1970) against job ID
   async function getLatestBucketTimestampByJob(jobIds = []) {
-    const filter = [
+    const filter: object[] = [
       {
         term: {
           result_type: 'bucket',
@@ -303,7 +327,7 @@ export function resultsServiceProvider(callWithRequest) {
     // Size of job terms agg, consistent with maximum number of jobs supported by Java endpoints.
     const maxJobs = 10000;
 
-    const resp = await callWithRequest('search', {
+    const resp = await callAsCurrentUser('search', {
       index: ML_RESULTS_INDEX_PATTERN,
       size: 0,
       body: {
@@ -330,8 +354,12 @@ export function resultsServiceProvider(callWithRequest) {
       },
     });
 
-    const bucketsByJobId = _.get(resp, ['aggregations', 'byJobId', 'buckets'], []);
-    const timestampByJobId = {};
+    const bucketsByJobId: Array<{ key: string; maxTimestamp: { value?: number } }> = _.get(
+      resp,
+      ['aggregations', 'byJobId', 'buckets'],
+      []
+    );
+    const timestampByJobId: { [key: string]: number | undefined } = {};
     bucketsByJobId.forEach(bucket => {
       timestampByJobId[bucket.key] = bucket.maxTimestamp.value;
     });
@@ -342,8 +370,8 @@ export function resultsServiceProvider(callWithRequest) {
   // Obtains the categorization examples for the categories with the specified IDs
   // from the given index and job ID.
   // Returned response consists of a list of examples against category ID.
-  async function getCategoryExamples(jobId, categoryIds, maxExamples) {
-    const resp = await callWithRequest('search', {
+  async function getCategoryExamples(jobId: string, categoryIds: any, maxExamples: number) {
+    const resp = await callAsCurrentUser('search', {
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: ANOMALIES_TABLE_DEFAULT_QUERY_SIZE, // Matches size of records in anomaly summary table.
@@ -356,9 +384,9 @@ export function resultsServiceProvider(callWithRequest) {
       },
     });
 
-    const examplesByCategoryId = {};
+    const examplesByCategoryId: { [key: string]: any } = {};
     if (resp.hits.total !== 0) {
-      resp.hits.hits.forEach(hit => {
+      resp.hits.hits.forEach((hit: any) => {
         if (maxExamples) {
           examplesByCategoryId[hit._source.category_id] = _.slice(
             hit._source.examples,
@@ -377,8 +405,8 @@ export function resultsServiceProvider(callWithRequest) {
   // Obtains the definition of the category with the specified ID and job ID.
   // Returned response contains four properties - categoryId, regex, examples
   // and terms (space delimited String of the common tokens matched in values of the category).
-  async function getCategoryDefinition(jobId, categoryId) {
-    const resp = await callWithRequest('search', {
+  async function getCategoryDefinition(jobId: string, categoryId: string) {
+    const resp = await callAsCurrentUser('search', {
       index: ML_RESULTS_INDEX_PATTERN,
       rest_total_hits_as_int: true,
       size: 1,
@@ -409,6 +437,6 @@ export function resultsServiceProvider(callWithRequest) {
     getCategoryExamples,
     getLatestBucketTimestampByJob,
     getMaxAnomalyScore,
-    getPartitionFieldsValues: getPartitionFieldsValuesFactory(callWithRequest),
+    getPartitionFieldsValues: getPartitionFieldsValuesFactory(callAsCurrentUser),
   };
 }
diff --git a/x-pack/legacy/plugins/ml/server/new_platform/anomaly_detectors_schema.ts b/x-pack/legacy/plugins/ml/server/new_platform/anomaly_detectors_schema.ts
new file mode 100644
index 0000000000000..392d3bfd84768
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/new_platform/anomaly_detectors_schema.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+const detectorSchema = schema.object({
+  identifier: schema.maybe(schema.string()),
+  function: schema.string(),
+  field_name: schema.maybe(schema.string()),
+  by_field_name: schema.maybe(schema.string()),
+  over_field_name: schema.maybe(schema.string()),
+  partition_field_name: schema.maybe(schema.string()),
+  detector_description: schema.maybe(schema.string()),
+});
+
+const customUrlSchema = {
+  url_name: schema.string(),
+  url_value: schema.string(),
+  time_range: schema.maybe(schema.any()),
+};
+
+const customSettingsSchema = schema.object({
+  created_by: schema.maybe(schema.string()),
+  custom_urls: schema.maybe(schema.arrayOf(schema.maybe(schema.object({ ...customUrlSchema })))),
+});
+
+export const anomalyDetectionUpdateJobSchema = {
+  description: schema.maybe(schema.string()),
+  detectors: schema.maybe(
+    schema.arrayOf(
+      schema.maybe(
+        schema.object({
+          detector_index: schema.number(),
+          custom_rules: schema.arrayOf(
+            schema.maybe(
+              schema.object({
+                actions: schema.arrayOf(schema.string()),
+                conditions: schema.arrayOf(schema.any()),
+                scope: schema.maybe(schema.any()),
+              })
+            )
+          ),
+        })
+      )
+    )
+  ),
+  custom_settings: schema.maybe(customSettingsSchema),
+  analysis_limits: schema.object({
+    categorization_examples_limit: schema.maybe(schema.number()),
+    model_memory_limit: schema.maybe(schema.string()),
+  }),
+  groups: schema.maybe(schema.arrayOf(schema.maybe(schema.string()))),
+};
+
+export const anomalyDetectionJobSchema = {
+  analysis_config: schema.object({
+    bucket_span: schema.maybe(schema.string()),
+    summary_count_field_name: schema.maybe(schema.string()),
+    detectors: schema.arrayOf(detectorSchema),
+    influencers: schema.arrayOf(schema.maybe(schema.string())),
+    categorization_field_name: schema.maybe(schema.string()),
+  }),
+  analysis_limits: schema.object({
+    categorization_examples_limit: schema.maybe(schema.number()),
+    model_memory_limit: schema.maybe(schema.string()),
+  }),
+  create_time: schema.maybe(schema.number()),
+  custom_settings: schema.maybe(customSettingsSchema),
+  allow_lazy_open: schema.maybe(schema.any()),
+  data_counts: schema.maybe(schema.any()),
+  data_description: schema.object({
+    time_field: schema.string(),
+    time_format: schema.maybe(schema.string()),
+  }),
+  datafeed_config: schema.maybe(schema.any()),
+  description: schema.maybe(schema.string()),
+  established_model_memory: schema.maybe(schema.number()),
+  finished_time: schema.maybe(schema.number()),
+  job_id: schema.string(),
+  job_type: schema.maybe(schema.string()),
+  job_version: schema.maybe(schema.string()),
+  groups: schema.arrayOf(schema.maybe(schema.string())),
+  model_plot_config: schema.maybe(schema.any()),
+  model_size_stats: schema.maybe(schema.any()),
+  model_snapshot_id: schema.maybe(schema.string()),
+  model_snapshot_min_version: schema.maybe(schema.string()),
+  model_snapshot_retention_days: schema.maybe(schema.number()),
+  results_index_name: schema.maybe(schema.string()),
+  state: schema.maybe(schema.string()),
+};
diff --git a/x-pack/legacy/plugins/ml/server/new_platform/data_visualizer_schema.ts b/x-pack/legacy/plugins/ml/server/new_platform/data_visualizer_schema.ts
new file mode 100644
index 0000000000000..0c10b2d5b4f16
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/new_platform/data_visualizer_schema.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+export const dataVisualizerFieldStatsSchema = {
+  params: schema.object({
+    indexPatternTitle: schema.string(),
+  }),
+  body: schema.object({
+    query: schema.any(),
+    fields: schema.arrayOf(schema.any()),
+    samplerShardSize: schema.number(),
+    timeFieldName: schema.maybe(schema.string()),
+    earliest: schema.maybe(schema.number()),
+    latest: schema.maybe(schema.number()),
+    interval: schema.maybe(schema.string()),
+    maxExamples: schema.number(),
+  }),
+};
+
+export const dataVisualizerOverallStatsSchema = {
+  params: schema.object({
+    indexPatternTitle: schema.string(),
+  }),
+  body: schema.object({
+    query: schema.any(),
+    aggregatableFields: schema.arrayOf(schema.string()),
+    nonAggregatableFields: schema.arrayOf(schema.string()),
+    samplerShardSize: schema.number(),
+    timeFieldName: schema.maybe(schema.string()),
+    earliest: schema.maybe(schema.number()),
+    latest: schema.maybe(schema.number()),
+  }),
+};
diff --git a/x-pack/legacy/plugins/ml/server/new_platform/results_service_schema.ts b/x-pack/legacy/plugins/ml/server/new_platform/results_service_schema.ts
new file mode 100644
index 0000000000000..b9a70b8e14197
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/new_platform/results_service_schema.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+const criteriaFieldSchema = schema.object({
+  fieldType: schema.maybe(schema.string()),
+  fieldName: schema.string(),
+  fieldValue: schema.any(),
+});
+
+export const anomaliesTableDataSchema = {
+  jobIds: schema.arrayOf(schema.string()),
+  criteriaFields: schema.arrayOf(criteriaFieldSchema),
+  influencers: schema.arrayOf(schema.maybe(schema.string())),
+  aggregationInterval: schema.string(),
+  threshold: schema.number(),
+  earliestMs: schema.number(),
+  latestMs: schema.number(),
+  dateFormatTz: schema.string(),
+  maxRecords: schema.number(),
+  maxExamples: schema.maybe(schema.number()),
+  influencersFilterQuery: schema.maybe(schema.any()),
+};
+
+export const partitionFieldValuesSchema = {
+  jobId: schema.string(),
+  searchTerm: schema.maybe(schema.any()),
+  criteriaFields: schema.arrayOf(criteriaFieldSchema),
+  earliestMs: schema.number(),
+  latestMs: schema.number(),
+};
diff --git a/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.js b/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.js
deleted file mode 100644
index 54d447c288151..0000000000000
--- a/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.js
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../client/call_with_request_factory';
-import { wrapError } from '../client/errors';
-
-export function jobRoutes({ commonRouteConfig, elasticsearchPlugin, route }) {
-  route({
-    method: 'GET',
-    path: '/api/ml/anomaly_detectors',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return callWithRequest('ml.jobs').catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'GET',
-    path: '/api/ml/anomaly_detectors/{jobId}',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      return callWithRequest('ml.jobs', { jobId }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'GET',
-    path: '/api/ml/anomaly_detectors/_stats',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return callWithRequest('ml.jobStats').catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'GET',
-    path: '/api/ml/anomaly_detectors/{jobId}/_stats',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      return callWithRequest('ml.jobStats', { jobId }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'PUT',
-    path: '/api/ml/anomaly_detectors/{jobId}',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      const body = request.payload;
-      return callWithRequest('ml.addJob', { jobId, body }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/{jobId}/_update',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      const body = request.payload;
-      return callWithRequest('ml.updateJob', { jobId, body }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/{jobId}/_open',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      return callWithRequest('ml.openJob', { jobId }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/{jobId}/_close',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const options = {
-        jobId: request.params.jobId,
-      };
-      const force = request.query.force;
-      if (force !== undefined) {
-        options.force = force;
-      }
-      return callWithRequest('ml.closeJob', options).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'DELETE',
-    path: '/api/ml/anomaly_detectors/{jobId}',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const options = {
-        jobId: request.params.jobId,
-      };
-      const force = request.query.force;
-      if (force !== undefined) {
-        options.force = force;
-      }
-      return callWithRequest('ml.deleteJob', options).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/_validate/detector',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const body = request.payload;
-      return callWithRequest('ml.validateDetector', { body }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/{jobId}/_forecast',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const jobId = request.params.jobId;
-      const duration = request.payload.duration;
-      return callWithRequest('ml.forecast', { jobId, duration }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/anomaly_detectors/{jobId}/results/overall_buckets',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return callWithRequest('ml.overallBuckets', {
-        jobId: request.params.jobId,
-        top_n: request.payload.topN,
-        bucket_span: request.payload.bucketSpan,
-        start: request.payload.start,
-        end: request.payload.end,
-      }).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'GET',
-    path: '/api/ml/anomaly_detectors/{jobId}/results/categories/{categoryId}',
-    handler(request, reply) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const options = {
-        jobId: request.params.jobId,
-        categoryId: request.params.categoryId,
-      };
-      return callWithRequest('ml.categories', options)
-        .then(resp => reply(resp))
-        .catch(resp => reply(wrapError(resp)));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.ts b/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.ts
new file mode 100644
index 0000000000000..64af1f67bce29
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/routes/anomaly_detectors.ts
@@ -0,0 +1,459 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { wrapError } from '../client/error_wrapper';
+import { licensePreRoutingFactory } from '../new_platform/licence_check_pre_routing_factory';
+import { RouteInitialization } from '../new_platform/plugin';
+import {
+  anomalyDetectionJobSchema,
+  anomalyDetectionUpdateJobSchema,
+} from '../new_platform/anomaly_detectors_schema';
+
+/**
+ * Routes for the anomaly detectors
+ */
+export function jobRoutes({ xpackMainPlugin, router }: RouteInitialization) {
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {get} /api/ml/anomaly_detectors Get anomaly detectors data
+   * @apiName GetAnomalyDetectors
+   * @apiDescription Returns the list of anomaly detection jobs.
+   *
+   * @apiSuccess {Number} count
+   * @apiSuccess {Object[]} jobs
+   */
+  router.get(
+    {
+      path: '/api/ml/anomaly_detectors',
+      validate: false,
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.jobs');
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {get} /api/ml/anomaly_detectors/:jobId Get anomaly detection data by id
+   * @apiName GetAnomalyDetectorsById
+   * @apiDescription Returns the anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.get(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const { jobId } = request.params;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.jobs', { jobId });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {get} /api/ml/anomaly_detectors/_stats Get anomaly detection stats
+   * @apiName GetAnomalyDetectorsStats
+   * @apiDescription Returns anomaly detection jobs statistics.
+   *
+   * @apiSuccess {Number} count
+   * @apiSuccess {Object[]} jobs
+   */
+  router.get(
+    {
+      path: '/api/ml/anomaly_detectors/_stats',
+      validate: false,
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.jobStats');
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {get} /api/ml/anomaly_detectors/:jobId/_stats Get stats for requested anomaly detection job
+   * @apiName GetAnomalyDetectorsStatsById
+   * @apiDescription Returns anomaly detection job statistics.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.get(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/_stats',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const { jobId } = request.params;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.jobStats', { jobId });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {put} /api/ml/anomaly_detectors/:jobId Instantiate an anomaly detection job
+   * @apiName CreateAnomalyDetectors
+   * @apiDescription Creates an anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.put(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+        body: schema.object({ ...anomalyDetectionJobSchema }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const { jobId } = request.params;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.addJob', {
+          jobId,
+          body: request.body,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/:jobId/_update Update an anomaly detection job
+   * @apiName UpdateAnomalyDetectors
+   * @apiDescription Updates certain properties of an anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/_update',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+        body: schema.object({ ...anomalyDetectionUpdateJobSchema }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const { jobId } = request.params;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.updateJob', {
+          jobId,
+          body: request.body,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/:jobId/_open Open specified job
+   * @apiName OpenAnomalyDetectorsJob
+   * @apiDescription Opens an anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/_open',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const { jobId } = request.params;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.openJob', {
+          jobId,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/:jobId/_close Close specified job
+   * @apiName CloseAnomalyDetectorsJob
+   * @apiDescription Closes an anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/_close',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const options: { jobId: string; force?: boolean } = {
+          jobId: request.params.jobId,
+        };
+        const force = request.query.force;
+        if (force !== undefined) {
+          options.force = force;
+        }
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.closeJob', options);
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {delete} /api/ml/anomaly_detectors/:jobId Delete specified job
+   * @apiName DeleteAnomalyDetectorsJob
+   * @apiDescription Deletes specified anomaly detection job.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.delete(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const options: { jobId: string; force?: boolean } = {
+          jobId: request.params.jobId,
+        };
+        const force = request.query.force;
+        if (force !== undefined) {
+          options.force = force;
+        }
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.deleteJob', options);
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/_validate/detector Validate detector
+   * @apiName ValidateAnomalyDetector
+   * @apiDescription Validates specified detector.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/_validate/detector',
+      validate: {
+        body: schema.any(),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.validateDetector', {
+          body: request.body,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/:jobId/_forecast Create forecast for specified job
+   * @apiName ForecastAnomalyDetector
+   * @apiDescription Creates a forecast for the specified anomaly detection job, predicting the future behavior of a time series by using its historical behavior.
+   *
+   * @apiParam {String} jobId Job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/_forecast',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+        body: schema.object({ duration: schema.any() }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const jobId = request.params.jobId;
+        const duration = request.body.duration;
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.forecast', {
+          jobId,
+          duration,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {post} /api/ml/anomaly_detectors/:jobId/results/overall_buckets  Obtain overall bucket scores for the specified job ID
+   * @apiName GetOverallBuckets
+   * @apiDescription Retrieves overall bucket results that summarize the bucket results of multiple anomaly detection jobs.
+   *
+   * @apiParam {String} jobId Job ID.
+   *
+   * @apiSuccess {Number} count
+   * @apiSuccess {Object[]} overall_buckets
+   */
+  router.post(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/results/overall_buckets',
+      validate: {
+        params: schema.object({
+          jobId: schema.string(),
+        }),
+        body: schema.object({
+          topN: schema.number(),
+          bucketSpan: schema.string(),
+          start: schema.number(),
+          end: schema.number(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.overallBuckets', {
+          jobId: request.params.jobId,
+          top_n: request.body.topN,
+          bucket_span: request.body.bucketSpan,
+          start: request.body.start,
+          end: request.body.end,
+        });
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup AnomalyDetectors
+   *
+   * @api {get} /api/ml/anomaly_detectors/:jobId/results/categories/:categoryId Get results category data by job id and category id
+   * @apiName GetCategories
+   * @apiDescription Returns the categories results for the specified job ID and category ID.
+   *
+   * @apiParam {String} jobId Job ID.
+   * @apiParam {String} categoryId Category ID.
+   */
+  router.get(
+    {
+      path: '/api/ml/anomaly_detectors/{jobId}/results/categories/{categoryId}',
+      validate: {
+        params: schema.object({
+          categoryId: schema.string(),
+          jobId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const options = {
+          jobId: request.params.jobId,
+          categoryId: request.params.categoryId,
+        };
+        const results = await context.ml!.mlClient.callAsCurrentUser('ml.categories', options);
+        return response.ok({
+          body: { ...results },
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+}
diff --git a/x-pack/legacy/plugins/ml/server/routes/apidoc.json b/x-pack/legacy/plugins/ml/server/routes/apidoc.json
index 8292e946cd344..574065446827d 100644
--- a/x-pack/legacy/plugins/ml/server/routes/apidoc.json
+++ b/x-pack/legacy/plugins/ml/server/routes/apidoc.json
@@ -16,6 +16,29 @@
     "DeleteDataFrameAnalytics",
     "StartDataFrameAnalyticsJob",
     "StopsDataFrameAnalyticsJob",
-    "GetDataFrameAnalyticsMessages"
+    "GetDataFrameAnalyticsMessages",
+    "DataVisualizer",
+    "GetOverallStats",
+    "GetStatsForFields",
+    "AnomalyDetectors",
+    "GetAnomalyDetectors",
+    "GetAnomalyDetectorsById",
+    "GetAnomalyDetectorsStats",
+    "GetAnomalyDetectorsStatsById",
+    "CreateAnomalyDetectors",
+    "UpdateAnomalyDetectors",
+    "OpenAnomalyDetectorsJob",
+    "CloseAnomalyDetectorsJob",
+    "DeleteAnomalyDetectorsJob",
+    "ValidateAnomalyDetector",
+    "ForecastAnomalyDetector",
+    "GetOverallBuckets",
+    "GetCategories",
+    "ResultsService",
+    "GetAnomaliesTableData",
+    "GetCategoryDefinition",
+    "GetMaxAnomalyScore",
+    "GetCategoryExamples",
+    "GetPartitionFieldsValues"
   ]
 }
diff --git a/x-pack/legacy/plugins/ml/server/routes/data_visualizer.js b/x-pack/legacy/plugins/ml/server/routes/data_visualizer.js
deleted file mode 100644
index fe11f7f4fd5b2..0000000000000
--- a/x-pack/legacy/plugins/ml/server/routes/data_visualizer.js
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../client/call_with_request_factory';
-import { wrapError } from '../client/errors';
-import { DataVisualizer } from '../models/data_visualizer';
-
-function getOverallStats(
-  callWithRequest,
-  indexPatternTitle,
-  query,
-  aggregatableFields,
-  nonAggregatableFields,
-  samplerShardSize,
-  timeFieldName,
-  earliestMs,
-  latestMs
-) {
-  const dv = new DataVisualizer(callWithRequest);
-  return dv.getOverallStats(
-    indexPatternTitle,
-    query,
-    aggregatableFields,
-    nonAggregatableFields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs
-  );
-}
-
-function getStatsForFields(
-  callWithRequest,
-  indexPatternTitle,
-  query,
-  fields,
-  samplerShardSize,
-  timeFieldName,
-  earliestMs,
-  latestMs,
-  interval,
-  maxExamples
-) {
-  const dv = new DataVisualizer(callWithRequest);
-  return dv.getStatsForFields(
-    indexPatternTitle,
-    query,
-    fields,
-    samplerShardSize,
-    timeFieldName,
-    earliestMs,
-    latestMs,
-    interval,
-    maxExamples
-  );
-}
-
-export function dataVisualizerRoutes({ commonRouteConfig, elasticsearchPlugin, route }) {
-  route({
-    method: 'POST',
-    path: '/api/ml/data_visualizer/get_field_stats/{indexPatternTitle}',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const indexPatternTitle = request.params.indexPatternTitle;
-      const payload = request.payload;
-      return getStatsForFields(
-        callWithRequest,
-        indexPatternTitle,
-        payload.query,
-        payload.fields,
-        payload.samplerShardSize,
-        payload.timeFieldName,
-        payload.earliest,
-        payload.latest,
-        payload.interval,
-        payload.maxExamples
-      ).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/data_visualizer/get_overall_stats/{indexPatternTitle}',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      const indexPatternTitle = request.params.indexPatternTitle;
-      const payload = request.payload;
-      return getOverallStats(
-        callWithRequest,
-        indexPatternTitle,
-        payload.query,
-        payload.aggregatableFields,
-        payload.nonAggregatableFields,
-        payload.samplerShardSize,
-        payload.timeFieldName,
-        payload.earliest,
-        payload.latest
-      ).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/ml/server/routes/data_visualizer.ts b/x-pack/legacy/plugins/ml/server/routes/data_visualizer.ts
new file mode 100644
index 0000000000000..235fc26d78441
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/routes/data_visualizer.ts
@@ -0,0 +1,173 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RequestHandlerContext } from 'kibana/server';
+import { wrapError } from '../client/error_wrapper';
+import { DataVisualizer } from '../models/data_visualizer';
+import { Field } from '../models/data_visualizer/data_visualizer';
+import {
+  dataVisualizerFieldStatsSchema,
+  dataVisualizerOverallStatsSchema,
+} from '../new_platform/data_visualizer_schema';
+import { licensePreRoutingFactory } from '../new_platform/licence_check_pre_routing_factory';
+import { RouteInitialization } from '../new_platform/plugin';
+
+function getOverallStats(
+  context: RequestHandlerContext,
+  indexPatternTitle: string,
+  query: object,
+  aggregatableFields: string[],
+  nonAggregatableFields: string[],
+  samplerShardSize: number,
+  timeFieldName: string,
+  earliestMs: number,
+  latestMs: number
+) {
+  const dv = new DataVisualizer(context);
+  return dv.getOverallStats(
+    indexPatternTitle,
+    query,
+    aggregatableFields,
+    nonAggregatableFields,
+    samplerShardSize,
+    timeFieldName,
+    earliestMs,
+    latestMs
+  );
+}
+
+function getStatsForFields(
+  context: RequestHandlerContext,
+  indexPatternTitle: string,
+  query: any,
+  fields: Field[],
+  samplerShardSize: number,
+  timeFieldName: string,
+  earliestMs: number,
+  latestMs: number,
+  interval: number,
+  maxExamples: number
+) {
+  const dv = new DataVisualizer(context);
+  return dv.getStatsForFields(
+    indexPatternTitle,
+    query,
+    fields,
+    samplerShardSize,
+    timeFieldName,
+    earliestMs,
+    latestMs,
+    interval,
+    maxExamples
+  );
+}
+
+/**
+ * Routes for the index data visualizer.
+ */
+export function dataVisualizerRoutes({ xpackMainPlugin, router }: RouteInitialization) {
+  /**
+   * @apiGroup DataVisualizer
+   *
+   * @api {post} /api/ml/data_visualizer/get_field_stats/:indexPatternTitle Get stats for fields
+   * @apiName GetStatsForFields
+   * @apiDescription Returns fields stats of the index pattern.
+   *
+   * @apiParam {String} indexPatternTitle Index pattern title.
+   */
+  router.post(
+    {
+      path: '/api/ml/data_visualizer/get_field_stats/{indexPatternTitle}',
+      validate: dataVisualizerFieldStatsSchema,
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const {
+          params: { indexPatternTitle },
+          body: {
+            query,
+            fields,
+            samplerShardSize,
+            timeFieldName,
+            earliest,
+            latest,
+            interval,
+            maxExamples,
+          },
+        } = request;
+
+        const results = await getStatsForFields(
+          context,
+          indexPatternTitle,
+          query,
+          fields,
+          samplerShardSize,
+          timeFieldName,
+          earliest,
+          latest,
+          interval,
+          maxExamples
+        );
+
+        return response.ok({
+          body: results,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup DataVisualizer
+   *
+   * @api {post} /api/ml/data_visualizer/get_overall_stats/:indexPatternTitle Get overall stats
+   * @apiName GetOverallStats
+   * @apiDescription Returns overall stats of the index pattern.
+   *
+   * @apiParam {String} indexPatternTitle Index pattern title.
+   */
+  router.post(
+    {
+      path: '/api/ml/data_visualizer/get_overall_stats/{indexPatternTitle}',
+      validate: dataVisualizerOverallStatsSchema,
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const {
+          params: { indexPatternTitle },
+          body: {
+            query,
+            aggregatableFields,
+            nonAggregatableFields,
+            samplerShardSize,
+            timeFieldName,
+            earliest,
+            latest,
+          },
+        } = request;
+
+        const results = await getOverallStats(
+          context,
+          indexPatternTitle,
+          query,
+          aggregatableFields,
+          nonAggregatableFields,
+          samplerShardSize,
+          timeFieldName,
+          earliest,
+          latest
+        );
+
+        return response.ok({
+          body: results,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+}
diff --git a/x-pack/legacy/plugins/ml/server/routes/results_service.js b/x-pack/legacy/plugins/ml/server/routes/results_service.js
deleted file mode 100644
index a658729e85083..0000000000000
--- a/x-pack/legacy/plugins/ml/server/routes/results_service.js
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../client/call_with_request_factory';
-import { wrapError } from '../client/errors';
-import { resultsServiceProvider } from '../models/results_service';
-
-function getAnomaliesTableData(callWithRequest, payload) {
-  const rs = resultsServiceProvider(callWithRequest);
-  const {
-    jobIds,
-    criteriaFields,
-    influencers,
-    aggregationInterval,
-    threshold,
-    earliestMs,
-    latestMs,
-    dateFormatTz,
-    maxRecords,
-    maxExamples,
-    influencersFilterQuery,
-  } = payload;
-  return rs.getAnomaliesTableData(
-    jobIds,
-    criteriaFields,
-    influencers,
-    aggregationInterval,
-    threshold,
-    earliestMs,
-    latestMs,
-    dateFormatTz,
-    maxRecords,
-    maxExamples,
-    influencersFilterQuery
-  );
-}
-
-function getCategoryDefinition(callWithRequest, payload) {
-  const rs = resultsServiceProvider(callWithRequest);
-  return rs.getCategoryDefinition(payload.jobId, payload.categoryId);
-}
-
-function getCategoryExamples(callWithRequest, payload) {
-  const rs = resultsServiceProvider(callWithRequest);
-  const { jobId, categoryIds, maxExamples } = payload;
-  return rs.getCategoryExamples(jobId, categoryIds, maxExamples);
-}
-
-function getMaxAnomalyScore(callWithRequest, payload) {
-  const rs = resultsServiceProvider(callWithRequest);
-  const { jobIds, earliestMs, latestMs } = payload;
-  return rs.getMaxAnomalyScore(jobIds, earliestMs, latestMs);
-}
-
-function getPartitionFieldsValues(callWithRequest, payload) {
-  const rs = resultsServiceProvider(callWithRequest);
-  const { jobId, searchTerm, criteriaFields, earliestMs, latestMs } = payload;
-  return rs.getPartitionFieldsValues(jobId, searchTerm, criteriaFields, earliestMs, latestMs);
-}
-
-export function resultsServiceRoutes({ commonRouteConfig, elasticsearchPlugin, route }) {
-  route({
-    method: 'POST',
-    path: '/api/ml/results/anomalies_table_data',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return getAnomaliesTableData(callWithRequest, request.payload).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/results/category_definition',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return getCategoryDefinition(callWithRequest, request.payload).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/results/max_anomaly_score',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return getMaxAnomalyScore(callWithRequest, request.payload).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/results/category_examples',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return getCategoryExamples(callWithRequest, request.payload).catch(resp => wrapError(resp));
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-
-  route({
-    method: 'POST',
-    path: '/api/ml/results/partition_fields_values',
-    handler(request) {
-      const callWithRequest = callWithRequestFactory(elasticsearchPlugin, request);
-      return getPartitionFieldsValues(callWithRequest, request.payload).catch(resp =>
-        wrapError(resp)
-      );
-    },
-    config: {
-      ...commonRouteConfig,
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/ml/server/routes/results_service.ts b/x-pack/legacy/plugins/ml/server/routes/results_service.ts
new file mode 100644
index 0000000000000..b44b82ec486d7
--- /dev/null
+++ b/x-pack/legacy/plugins/ml/server/routes/results_service.ts
@@ -0,0 +1,220 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RequestHandlerContext } from 'src/core/server';
+import { schema } from '@kbn/config-schema';
+import { licensePreRoutingFactory } from '../new_platform/licence_check_pre_routing_factory';
+import { wrapError } from '../client/error_wrapper';
+import { RouteInitialization } from '../new_platform/plugin';
+import {
+  anomaliesTableDataSchema,
+  partitionFieldValuesSchema,
+} from '../new_platform/results_service_schema';
+import { resultsServiceProvider } from '../models/results_service';
+
+function getAnomaliesTableData(context: RequestHandlerContext, payload: any) {
+  const rs = resultsServiceProvider(context);
+  const {
+    jobIds,
+    criteriaFields,
+    influencers,
+    aggregationInterval,
+    threshold,
+    earliestMs,
+    latestMs,
+    dateFormatTz,
+    maxRecords,
+    maxExamples,
+    influencersFilterQuery,
+  } = payload;
+  return rs.getAnomaliesTableData(
+    jobIds,
+    criteriaFields,
+    influencers,
+    aggregationInterval,
+    threshold,
+    earliestMs,
+    latestMs,
+    dateFormatTz,
+    maxRecords,
+    maxExamples,
+    influencersFilterQuery
+  );
+}
+
+function getCategoryDefinition(context: RequestHandlerContext, payload: any) {
+  const rs = resultsServiceProvider(context);
+  return rs.getCategoryDefinition(payload.jobId, payload.categoryId);
+}
+
+function getCategoryExamples(context: RequestHandlerContext, payload: any) {
+  const rs = resultsServiceProvider(context);
+  const { jobId, categoryIds, maxExamples } = payload;
+  return rs.getCategoryExamples(jobId, categoryIds, maxExamples);
+}
+
+function getMaxAnomalyScore(context: RequestHandlerContext, payload: any) {
+  const rs = resultsServiceProvider(context);
+  const { jobIds, earliestMs, latestMs } = payload;
+  return rs.getMaxAnomalyScore(jobIds, earliestMs, latestMs);
+}
+
+function getPartitionFieldsValues(context: RequestHandlerContext, payload: any) {
+  const rs = resultsServiceProvider(context);
+  const { jobId, searchTerm, criteriaFields, earliestMs, latestMs } = payload;
+  return rs.getPartitionFieldsValues(jobId, searchTerm, criteriaFields, earliestMs, latestMs);
+}
+
+/**
+ * Routes for results service
+ */
+export function resultsServiceRoutes({ xpackMainPlugin, router }: RouteInitialization) {
+  /**
+   * @apiGroup ResultsService
+   *
+   * @api {post} /api/ml/results/anomalies_table_data Prepare anomalies records for table display
+   * @apiName GetAnomaliesTableData
+   * @apiDescription Retrieves anomaly records for an anomaly detection job and formats them for anomalies table display
+   */
+  router.post(
+    {
+      path: '/api/ml/results/anomalies_table_data',
+      validate: {
+        body: schema.object({ ...anomaliesTableDataSchema }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const resp = await getAnomaliesTableData(context, request.body);
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup ResultsService
+   *
+   * @api {post} /api/ml/results/category_definition Returns category definition
+   * @apiName GetCategoryDefinition
+   * @apiDescription Returns the definition of the category with the specified ID and job ID
+   */
+  router.post(
+    {
+      path: '/api/ml/results/category_definition',
+      validate: {
+        body: schema.object({
+          jobId: schema.maybe(schema.string()),
+          categoryId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const resp = await getCategoryDefinition(context, request.body);
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup ResultsService
+   *
+   * @api {post} /api/ml/results/max_anomaly_score Returns the maximum anomaly_score
+   * @apiName GetMaxAnomalyScore
+   * @apiDescription Returns the maximum anomaly score of the bucket results for the request job ID(s) and time range
+   */
+  router.post(
+    {
+      path: '/api/ml/results/max_anomaly_score',
+      validate: {
+        body: schema.object({
+          jobIds: schema.arrayOf(schema.string()),
+          earliestMs: schema.number(),
+          latestMs: schema.number(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const resp = await getMaxAnomalyScore(context, request.body);
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup ResultsService
+   *
+   * @api {post} /api/ml/results/category_examples Returns category examples
+   * @apiName GetCategoryExamples
+   * @apiDescription Returns examples for the categories with the specified IDs from the job with the supplied ID
+   */
+  router.post(
+    {
+      path: '/api/ml/results/category_examples',
+      validate: {
+        body: schema.object({
+          jobId: schema.string(),
+          categoryIds: schema.arrayOf(schema.string()),
+          maxExamples: schema.number(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const resp = await getCategoryExamples(context, request.body);
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+
+  /**
+   * @apiGroup ResultsService
+   *
+   * @api {post} /api/ml/results/partition_fields_values Returns partition fields values
+   * @apiName GetPartitionFieldsValues
+   * @apiDescription Returns the partition fields with values that match the provided criteria for the specified job ID.
+   */
+  router.post(
+    {
+      path: '/api/ml/results/partition_fields_values',
+      validate: {
+        body: schema.object({ ...partitionFieldValuesSchema }),
+      },
+    },
+    licensePreRoutingFactory(xpackMainPlugin, async (context, request, response) => {
+      try {
+        const resp = await getPartitionFieldsValues(context, request.body);
+
+        return response.ok({
+          body: resp,
+        });
+      } catch (e) {
+        return response.customError(wrapError(e));
+      }
+    })
+  );
+}
diff --git a/x-pack/legacy/plugins/monitoring/public/lib/ajax_error_handler.tsx b/x-pack/legacy/plugins/monitoring/public/lib/ajax_error_handler.tsx
index 22ce32103c208..c09014b9a9627 100644
--- a/x-pack/legacy/plugins/monitoring/public/lib/ajax_error_handler.tsx
+++ b/x-pack/legacy/plugins/monitoring/public/lib/ajax_error_handler.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { contains } from 'lodash';
 import { toastNotifications } from 'ui/notify';
 // @ts-ignore
-import { formatMsg } from 'ui/notify/lib';
+import { formatMsg } from '../../../../../../src/plugins/kibana_legacy/public'; // eslint-disable-line import/order
 import { EuiButton, EuiSpacer, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { toMountPoint } from '../../../../../../src/plugins/kibana_react/public';
diff --git a/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_cluster_search.js b/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_cluster_search.js
index 1e5615cc907ba..f6dafb5bb8c7e 100644
--- a/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_cluster_search.js
+++ b/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_cluster_search.js
@@ -55,7 +55,7 @@ describe('Alerts Cluster Search', () => {
       const { mockReq, callWithRequestStub } = createStubs(mockQueryResult, featureStub);
       return alertsClusterSearch(
         mockReq,
-        '.monitoring-alerts,monitoring-alerts',
+        '.monitoring-alerts',
         { cluster_uuid: 'cluster-1234' },
         checkLicense
       ).then(alerts => {
@@ -68,7 +68,7 @@ describe('Alerts Cluster Search', () => {
       const { mockReq, callWithRequestStub } = createStubs(mockQueryResult, featureStub);
       return alertsClusterSearch(
         mockReq,
-        '.monitoring-alerts,monitoring-alerts',
+        '.monitoring-alerts',
         { cluster_uuid: 'cluster-1234' },
         checkLicense,
         { size: 3 }
@@ -89,15 +89,9 @@ describe('Alerts Cluster Search', () => {
           issue_date: 'fake-issue_date',
         },
       };
-      return alertsClusterSearch(
-        mockReq,
-        '.monitoring-alerts,monitoring-alerts',
-        cluster,
-        checkLicense,
-        {
-          size: 3,
-        }
-      ).then(alerts => {
+      return alertsClusterSearch(mockReq, '.monitoring-alerts', cluster, checkLicense, {
+        size: 3,
+      }).then(alerts => {
         expect(alerts).to.have.length(3);
         expect(alerts[0]).to.eql(mockAlerts[0]);
         expect(alerts[1]).to.eql({
@@ -128,15 +122,9 @@ describe('Alerts Cluster Search', () => {
           issue_date: 'fake-issue_date',
         },
       };
-      return alertsClusterSearch(
-        mockReq,
-        '.monitoring-alerts,monitoring-alerts',
-        cluster,
-        checkLicense,
-        {
-          size: 3,
-        }
-      ).then(alerts => {
+      return alertsClusterSearch(mockReq, '.monitoring-alerts', cluster, checkLicense, {
+        size: 3,
+      }).then(alerts => {
         expect(alerts).to.have.length(1);
         expect(alerts[0]).to.eql({
           metadata: {
@@ -167,7 +155,7 @@ describe('Alerts Cluster Search', () => {
       const { mockReq, callWithRequestStub } = createStubs({}, featureStub);
       return alertsClusterSearch(
         mockReq,
-        '.monitoring-alerts,monitoring-alerts',
+        '.monitoring-alerts',
         { cluster_uuid: 'cluster-1234' },
         checkLicense
       ).then(alerts => {
@@ -189,7 +177,7 @@ describe('Alerts Cluster Search', () => {
       const { mockReq, callWithRequestStub } = createStubs({}, featureStub);
       return alertsClusterSearch(
         mockReq,
-        '.monitoring-alerts,monitoring-alerts',
+        '.monitoring-alerts',
         { cluster_uuid: 'cluster-1234' },
         checkLicense
       ).then(alerts => {
diff --git a/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_clusters_aggregation.js b/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_clusters_aggregation.js
index 9ee0d512a3c1c..efd9a933e1f81 100644
--- a/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_clusters_aggregation.js
+++ b/x-pack/legacy/plugins/monitoring/server/cluster_alerts/__tests__/alerts_clusters_aggregation.js
@@ -73,37 +73,34 @@ describe('Alerts Clusters Aggregation', () => {
 
     it('aggregates alert count summary by cluster', () => {
       const { mockReq } = createStubs(mockQueryResult, featureStub);
-      return alertsClustersAggregation(
-        mockReq,
-        '.monitoring-alerts,monitoring-alerts',
-        clusters,
-        checkLicense
-      ).then(result => {
-        expect(result).to.eql({
-          alertsMeta: { enabled: true },
-          'cluster-abc0': undefined,
-          'cluster-abc1': {
-            count: 1,
-            high: 0,
-            low: 1,
-            medium: 0,
-          },
-          'cluster-abc2': {
-            count: 2,
-            high: 0,
-            low: 0,
-            medium: 2,
-          },
-          'cluster-abc3': {
-            count: 3,
-            high: 3,
-            low: 0,
-            medium: 0,
-          },
-          'cluster-no-license': undefined,
-          'cluster-invalid': undefined,
-        });
-      });
+      return alertsClustersAggregation(mockReq, '.monitoring-alerts', clusters, checkLicense).then(
+        result => {
+          expect(result).to.eql({
+            alertsMeta: { enabled: true },
+            'cluster-abc0': undefined,
+            'cluster-abc1': {
+              count: 1,
+              high: 0,
+              low: 1,
+              medium: 0,
+            },
+            'cluster-abc2': {
+              count: 2,
+              high: 0,
+              low: 0,
+              medium: 2,
+            },
+            'cluster-abc3': {
+              count: 3,
+              high: 3,
+              low: 0,
+              medium: 0,
+            },
+            'cluster-no-license': undefined,
+            'cluster-invalid': undefined,
+          });
+        }
+      );
     });
 
     it('aggregates alert count summary by cluster include static alert', () => {
@@ -116,7 +113,7 @@ describe('Alerts Clusters Aggregation', () => {
 
       return alertsClustersAggregation(
         mockReq,
-        '.monitoring-alerts,monitoring-alerts',
+        '.monitoring-alerts',
         newClusters,
         checkLicense
       ).then(result => {
@@ -166,16 +163,13 @@ describe('Alerts Clusters Aggregation', () => {
       const checkLicense = () => ({ clusterAlerts: { enabled: true } });
       const { mockReq } = createStubs(mockQueryResult, featureStub);
 
-      return alertsClustersAggregation(
-        mockReq,
-        '.monitoring-alerts,monitoring-alerts',
-        clusters,
-        checkLicense
-      ).then(result => {
-        expect(result).to.eql({
-          alertsMeta: { enabled: false, message: 'monitoring cluster license is fail' },
-        });
-      });
+      return alertsClustersAggregation(mockReq, '.monitoring-alerts', clusters, checkLicense).then(
+        result => {
+          expect(result).to.eql({
+            alertsMeta: { enabled: false, message: 'monitoring cluster license is fail' },
+          });
+        }
+      );
     });
 
     it('returns the input set if disabled because production cluster checks', () => {
@@ -187,56 +181,53 @@ describe('Alerts Clusters Aggregation', () => {
       const checkLicense = () => ({ clusterAlerts: { enabled: false } });
       const { mockReq } = createStubs(mockQueryResult, featureStub);
 
-      return alertsClustersAggregation(
-        mockReq,
-        '.monitoring-alerts,monitoring-alerts',
-        clusters,
-        checkLicense
-      ).then(result => {
-        expect(result).to.eql({
-          alertsMeta: { enabled: true },
-          'cluster-abc0': {
-            clusterMeta: {
-              enabled: false,
-              message:
-                'Cluster [cluster-abc0-name] license type [test_license] does not support Cluster Alerts',
+      return alertsClustersAggregation(mockReq, '.monitoring-alerts', clusters, checkLicense).then(
+        result => {
+          expect(result).to.eql({
+            alertsMeta: { enabled: true },
+            'cluster-abc0': {
+              clusterMeta: {
+                enabled: false,
+                message:
+                  'Cluster [cluster-abc0-name] license type [test_license] does not support Cluster Alerts',
+              },
             },
-          },
-          'cluster-abc1': {
-            clusterMeta: {
-              enabled: false,
-              message:
-                'Cluster [cluster-abc1-name] license type [test_license] does not support Cluster Alerts',
+            'cluster-abc1': {
+              clusterMeta: {
+                enabled: false,
+                message:
+                  'Cluster [cluster-abc1-name] license type [test_license] does not support Cluster Alerts',
+              },
             },
-          },
-          'cluster-abc2': {
-            clusterMeta: {
-              enabled: false,
-              message:
-                'Cluster [cluster-abc2-name] license type [test_license] does not support Cluster Alerts',
+            'cluster-abc2': {
+              clusterMeta: {
+                enabled: false,
+                message:
+                  'Cluster [cluster-abc2-name] license type [test_license] does not support Cluster Alerts',
+              },
             },
-          },
-          'cluster-abc3': {
-            clusterMeta: {
-              enabled: false,
-              message:
-                'Cluster [cluster-abc3-name] license type [test_license] does not support Cluster Alerts',
+            'cluster-abc3': {
+              clusterMeta: {
+                enabled: false,
+                message:
+                  'Cluster [cluster-abc3-name] license type [test_license] does not support Cluster Alerts',
+              },
             },
-          },
-          'cluster-no-license': {
-            clusterMeta: {
-              enabled: false,
-              message: `Cluster [cluster-no-license-name] license type [undefined] does not support Cluster Alerts`,
+            'cluster-no-license': {
+              clusterMeta: {
+                enabled: false,
+                message: `Cluster [cluster-no-license-name] license type [undefined] does not support Cluster Alerts`,
+              },
             },
-          },
-          'cluster-invalid': {
-            clusterMeta: {
-              enabled: false,
-              message: `Cluster [cluster-invalid-name] license type [undefined] does not support Cluster Alerts`,
+            'cluster-invalid': {
+              clusterMeta: {
+                enabled: false,
+                message: `Cluster [cluster-invalid-name] license type [undefined] does not support Cluster Alerts`,
+              },
             },
-          },
-        });
-      });
+          });
+        }
+      );
     });
   });
 });
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/__tests__/ccs_utils.js b/x-pack/legacy/plugins/monitoring/server/lib/__tests__/ccs_utils.js
index 2d310962238fd..ad02807b5585e 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/__tests__/ccs_utils.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/__tests__/ccs_utils.js
@@ -10,8 +10,7 @@ import { parseCrossClusterPrefix, prefixIndexPattern } from '../ccs_utils';
 
 describe('ccs_utils', () => {
   describe('prefixIndexPattern', () => {
-    const indexPattern =
-      '.monitoring-xyz-1-*,.monitoring-xyz-2-*,monitoring-xyz-1-*,monitoring-xyz-2-*';
+    const indexPattern = '.monitoring-xyz-1-*,.monitoring-xyz-2-*';
 
     it('returns the index pattern if ccs is not enabled', () => {
       const get = sinon.stub();
@@ -54,11 +53,9 @@ describe('ccs_utils', () => {
       const abcPattern = prefixIndexPattern(config, indexPattern, 'aBc');
       const underscorePattern = prefixIndexPattern(config, indexPattern, 'cluster_one');
 
-      expect(abcPattern).to.eql(
-        'aBc:.monitoring-xyz-1-*,aBc:.monitoring-xyz-2-*,aBc:monitoring-xyz-1-*,aBc:monitoring-xyz-2-*'
-      );
+      expect(abcPattern).to.eql('aBc:.monitoring-xyz-1-*,aBc:.monitoring-xyz-2-*');
       expect(underscorePattern).to.eql(
-        'cluster_one:.monitoring-xyz-1-*,cluster_one:.monitoring-xyz-2-*,cluster_one:monitoring-xyz-1-*,cluster_one:monitoring-xyz-2-*'
+        'cluster_one:.monitoring-xyz-1-*,cluster_one:.monitoring-xyz-2-*'
       );
       expect(get.callCount).to.eql(2);
     });
@@ -72,11 +69,7 @@ describe('ccs_utils', () => {
       const pattern = prefixIndexPattern(config, indexPattern, '*');
 
       // it should have BOTH patterns so that it searches all CCS clusters and the local cluster
-      expect(pattern).to.eql(
-        '*:.monitoring-xyz-1-*,*:.monitoring-xyz-2-*,*:monitoring-xyz-1-*,*:monitoring-xyz-2-*' +
-          ',' +
-          indexPattern
-      );
+      expect(pattern).to.eql('*:.monitoring-xyz-1-*,*:.monitoring-xyz-2-*' + ',' + indexPattern);
       expect(get.callCount).to.eql(1);
     });
   });
@@ -84,25 +77,18 @@ describe('ccs_utils', () => {
   describe('parseCrossClusterPrefix', () => {
     it('returns ccs prefix for index with one', () => {
       expect(parseCrossClusterPrefix('abc:.monitoring-es-6-2017.07.28')).to.eql('abc');
-      expect(parseCrossClusterPrefix('abc:monitoring-es-6-2017.07.28')).to.eql('abc');
       expect(parseCrossClusterPrefix('abc_123:.monitoring-es-6-2017.07.28')).to.eql('abc_123');
-      expect(parseCrossClusterPrefix('abc_123:monitoring-es-6-2017.07.28')).to.eql('abc_123');
       expect(parseCrossClusterPrefix('broken:example:.monitoring-es-6-2017.07.28')).to.eql(
         'broken'
       );
-      expect(parseCrossClusterPrefix('broken:example:monitoring-es-6-2017.07.28')).to.eql('broken');
       expect(parseCrossClusterPrefix('with-a-dash:.monitoring-es-6-2017.07.28')).to.eql(
         'with-a-dash'
       );
-      expect(parseCrossClusterPrefix('with-a-dash:monitoring-es-6-2017.07.28')).to.eql(
-        'with-a-dash'
-      );
       expect(parseCrossClusterPrefix('something:not-monitoring')).to.eql('something');
     });
 
     it('returns null when no prefix exists', () => {
       expect(parseCrossClusterPrefix('.monitoring-es-6-2017.07.28')).to.be(null);
-      expect(parseCrossClusterPrefix('monitoring-es-6-2017.07.28')).to.be(null);
       expect(parseCrossClusterPrefix('random')).to.be(null);
     });
   });
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_node_ids.test.js b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_node_ids.test.js
index a7827c7474a15..19fa99a783302 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_node_ids.test.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_node_ids.test.js
@@ -47,7 +47,7 @@ describe('getNodeIds', () => {
     };
     const clusterUuid = '1cb';
 
-    const result = await getNodeIds(req, '.monitoring-es-*,monitoring-es-*', { clusterUuid }, 10);
+    const result = await getNodeIds(req, '.monitoring-es-*', { clusterUuid }, 10);
     expect(result).toEqual([
       { name: 'foobar', uuid: 1 },
       { name: 'barfoo', uuid: 2 },
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_paginated_nodes.test.js b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_paginated_nodes.test.js
index d1126e79b6940..c08ae91769b9d 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_paginated_nodes.test.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/__test__/get_paginated_nodes.test.js
@@ -45,7 +45,7 @@ describe('getPaginatedNodes', () => {
       }),
     },
   };
-  const esIndexPattern = '.monitoring-es-*,monitoring-es-*';
+  const esIndexPattern = '.monitoring-es-*';
   const clusterUuid = '1abc';
   const metricSet = ['foo', 'bar'];
   const pagination = { index: 0, size: 10 };
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_paginated_nodes.js b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_paginated_nodes.js
index e18d328e8725b..66393ef69df1d 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_paginated_nodes.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/nodes/get_nodes/get_paginated_nodes.js
@@ -20,7 +20,7 @@ import { getMetrics } from '../../../details/get_metrics';
  * and returns that so the caller can perform their normal call to get the time-series data.
  *
  * @param {*} req - Server request object
- * @param {*} esIndexPattern - The index pattern to search against (`.monitoring-es-*,monitoring-es-*`)
+ * @param {*} esIndexPattern - The index pattern to search against (`.monitoring-es-*`)
  * @param {*} uuids - The optional `clusterUuid` and `nodeUuid` to filter the results from
  * @param {*} metricSet - The array of metrics that are sortable in the UI
  * @param {*} pagination - ({ index, size })
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
index 1d48d300f8eb6..8362ebec0206b 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/elasticsearch/verify_monitoring_auth.js
@@ -30,7 +30,7 @@ export async function verifyMonitoringAuth(req) {
 
 /**
  * Reach out to the Monitoring cluster and ensure that it believes the current user has the privileges necessary
- * to make API calls against .monitoring-*,monitoring-* indices.
+ * to make API calls against .monitoring-* indices.
  *
  * @param req {Object} the server route handler request object
  * @return {Promise} That either resolves with no response (void) or an exception.
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/logstash/get_paginated_pipelines.js b/x-pack/legacy/plugins/monitoring/server/lib/logstash/get_paginated_pipelines.js
index ffc7e9ce1d6c2..5dcdf5b676219 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/logstash/get_paginated_pipelines.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/logstash/get_paginated_pipelines.js
@@ -20,7 +20,7 @@ import { getMetrics } from '../details/get_metrics';
  * and returns that so the caller can perform their normal call to get the time-series data.
  *
  * @param {*} req - Server request object
- * @param {*} lsIndexPattern - The index pattern to search against (`.monitoring-logstash-*,monitoring-logstash-*`)
+ * @param {*} lsIndexPattern - The index pattern to search against (`.monitoring-logstash-*`)
  * @param {*} uuids - The optional `clusterUuid` and `logstashUuid` to filter the results from
  * @param {*} metricSet - The array of metrics that are sortable in the UI
  * @param {*} pagination - ({ index, size })
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/__test__/get_collection_status_regular_index.js b/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/__test__/get_collection_status_regular_index.js
deleted file mode 100644
index 86a0533ee07db..0000000000000
--- a/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/__test__/get_collection_status_regular_index.js
+++ /dev/null
@@ -1,241 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-import { getCollectionStatus } from '../';
-import { getIndexPatterns } from '../../../cluster/get_index_patterns';
-
-const liveClusterUuid = 'a12';
-const mockReq = (searchResult = {}) => {
-  return {
-    server: {
-      newPlatform: {
-        setup: {
-          plugins: {
-            usageCollection: {
-              getCollectorByType: () => ({
-                isReady: () => false,
-              }),
-            },
-          },
-        },
-      },
-      config() {
-        return {
-          get: sinon
-            .stub()
-            .withArgs('server.uuid')
-            .returns('kibana-1234'),
-        };
-      },
-      usage: {
-        collectorSet: {
-          getCollectorByType: () => ({
-            isReady: () => false,
-          }),
-        },
-      },
-      plugins: {
-        elasticsearch: {
-          getCluster() {
-            return {
-              callWithRequest(_req, type, params) {
-                if (
-                  type === 'transport.request' &&
-                  params &&
-                  params.path === '/_cluster/state/cluster_uuid'
-                ) {
-                  return Promise.resolve({ cluster_uuid: liveClusterUuid });
-                }
-                if (type === 'transport.request' && params && params.path === '/_nodes') {
-                  return Promise.resolve({ nodes: {} });
-                }
-                if (type === 'cat.indices') {
-                  return Promise.resolve([1]);
-                }
-                return Promise.resolve(searchResult);
-              },
-            };
-          },
-        },
-      },
-    },
-  };
-};
-
-describe('getCollectionStatus none system index', () => {
-  it('should handle all stack products with internal monitoring', async () => {
-    const req = mockReq({
-      aggregations: {
-        indices: {
-          buckets: [
-            {
-              key: 'monitoring-es-7-2019',
-              es_uuids: { buckets: [{ key: 'es_1' }] },
-            },
-            {
-              key: 'monitoring-kibana-7-2019',
-              kibana_uuids: { buckets: [{ key: 'kibana_1' }] },
-            },
-            {
-              key: 'monitoring-beats-7-2019',
-              beats_uuids: {
-                buckets: [
-                  { key: 'apm_1', beat_type: { buckets: [{ key: 'apm-server' }] } },
-                  { key: 'beats_1' },
-                ],
-              },
-            },
-            {
-              key: 'monitoring-logstash-7-2019',
-              logstash_uuids: { buckets: [{ key: 'logstash_1' }] },
-            },
-          ],
-        },
-      },
-    });
-
-    const result = await getCollectionStatus(req, getIndexPatterns(req.server));
-
-    expect(result.kibana.totalUniqueInstanceCount).to.be(1);
-    expect(result.kibana.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.kibana.byUuid.kibana_1.isInternalCollector).to.be(true);
-
-    expect(result.beats.totalUniqueInstanceCount).to.be(1);
-    expect(result.beats.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.beats.byUuid.beats_1.isInternalCollector).to.be(true);
-
-    expect(result.apm.totalUniqueInstanceCount).to.be(1);
-    expect(result.apm.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.apm.byUuid.apm_1.isInternalCollector).to.be(true);
-
-    expect(result.logstash.totalUniqueInstanceCount).to.be(1);
-    expect(result.logstash.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.logstash.byUuid.logstash_1.isInternalCollector).to.be(true);
-
-    expect(result.elasticsearch.totalUniqueInstanceCount).to.be(1);
-    expect(result.elasticsearch.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.elasticsearch.byUuid.es_1.isInternalCollector).to.be(true);
-  });
-
-  it('should handle some stack products as fully migrated', async () => {
-    const req = mockReq({
-      aggregations: {
-        indices: {
-          buckets: [
-            {
-              key: 'monitoring-es-7-mb-2019',
-              es_uuids: { buckets: [{ key: 'es_1' }] },
-            },
-            {
-              key: 'monitoring-kibana-7-mb-2019',
-              kibana_uuids: { buckets: [{ key: 'kibana_1' }] },
-            },
-            {
-              key: 'monitoring-beats-7-2019',
-              beats_uuids: { buckets: [{ key: 'beats_1' }] },
-            },
-            {
-              key: 'monitoring-logstash-7-2019',
-              logstash_uuids: { buckets: [{ key: 'logstash_1' }] },
-            },
-          ],
-        },
-      },
-    });
-
-    const result = await getCollectionStatus(req, getIndexPatterns(req.server));
-
-    expect(result.kibana.totalUniqueInstanceCount).to.be(1);
-    expect(result.kibana.totalUniqueFullyMigratedCount).to.be(1);
-    expect(result.kibana.byUuid.kibana_1.isFullyMigrated).to.be(true);
-
-    expect(result.beats.totalUniqueInstanceCount).to.be(1);
-    expect(result.beats.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.beats.byUuid.beats_1.isInternalCollector).to.be(true);
-
-    expect(result.logstash.totalUniqueInstanceCount).to.be(1);
-    expect(result.logstash.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.logstash.byUuid.logstash_1.isInternalCollector).to.be(true);
-
-    expect(result.elasticsearch.totalUniqueInstanceCount).to.be(1);
-    expect(result.elasticsearch.totalUniqueFullyMigratedCount).to.be(1);
-    expect(result.elasticsearch.byUuid.es_1.isFullyMigrated).to.be(true);
-  });
-
-  it('should handle some stack products as partially migrated', async () => {
-    const req = mockReq({
-      aggregations: {
-        indices: {
-          buckets: [
-            {
-              key: 'monitoring-es-7-mb-2019',
-              es_uuids: { buckets: [{ key: 'es_1' }] },
-            },
-            {
-              key: 'monitoring-kibana-7-mb-2019',
-              kibana_uuids: { buckets: [{ key: 'kibana_1' }, { key: 'kibana_2' }] },
-            },
-            {
-              key: 'monitoring-kibana-7-2019',
-              kibana_uuids: { buckets: [{ key: 'kibana_1', by_timestamp: { value: 12 } }] },
-            },
-            {
-              key: 'monitoring-beats-7-2019',
-              beats_uuids: { buckets: [{ key: 'beats_1' }] },
-            },
-            {
-              key: 'monitoring-logstash-7-2019',
-              logstash_uuids: { buckets: [{ key: 'logstash_1' }] },
-            },
-          ],
-        },
-      },
-    });
-
-    const result = await getCollectionStatus(req, getIndexPatterns(req.server));
-
-    expect(result.kibana.totalUniqueInstanceCount).to.be(2);
-    expect(result.kibana.totalUniqueFullyMigratedCount).to.be(1);
-    expect(result.kibana.byUuid.kibana_1.isPartiallyMigrated).to.be(true);
-    expect(result.kibana.byUuid.kibana_1.lastInternallyCollectedTimestamp).to.be(12);
-
-    expect(result.beats.totalUniqueInstanceCount).to.be(1);
-    expect(result.beats.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.beats.byUuid.beats_1.isInternalCollector).to.be(true);
-
-    expect(result.logstash.totalUniqueInstanceCount).to.be(1);
-    expect(result.logstash.totalUniqueFullyMigratedCount).to.be(0);
-    expect(result.logstash.byUuid.logstash_1.isInternalCollector).to.be(true);
-
-    expect(result.elasticsearch.totalUniqueInstanceCount).to.be(1);
-    expect(result.elasticsearch.totalUniqueFullyMigratedCount).to.be(1);
-    expect(result.elasticsearch.byUuid.es_1.isFullyMigrated).to.be(true);
-  });
-
-  it('should detect products based on other indices', async () => {
-    const req = mockReq(
-      {},
-      {
-        responses: [
-          { hits: { total: { value: 1 } } },
-          { hits: { total: { value: 1 } } },
-          { hits: { total: { value: 1 } } },
-          { hits: { total: { value: 1 } } },
-          { hits: { total: { value: 1 } } },
-        ],
-      }
-    );
-
-    const result = await getCollectionStatus(req, getIndexPatterns(req.server), liveClusterUuid);
-
-    expect(result.kibana.detected.doesExist).to.be(true);
-    expect(result.elasticsearch.detected.doesExist).to.be(true);
-    expect(result.beats.detected.mightExist).to.be(true);
-    expect(result.logstash.detected.mightExist).to.be(true);
-  });
-});
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/get_collection_status.js b/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/get_collection_status.js
index a12b48510a6ff..42d100b8af75e 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/get_collection_status.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/setup/collection/get_collection_status.js
@@ -242,7 +242,7 @@ async function hasNecessaryPermissions(req) {
  * Determines if we should ignore this bucket from this product.
  *
  * We need this logic because APM and Beats are separate products, but their
- * monitoring data appears in the same index (.monitoring-beats-*,monitoring-beats-*) and the single
+ * monitoring data appears in the same index (.monitoring-beats-*) and the single
  * way to determine the difference between two documents in that index
  * is `beats_stats.beat.type` which we are performing a terms agg in the above query.
  * If that value is `apm-server` and we're attempting to calculating status for beats
@@ -325,7 +325,7 @@ async function getLiveElasticsearchCollectionEnabled(req) {
  * }
 
  * @param {*} req Standard request object. Can contain a timeRange to use for the query
- * @param {*} indexPatterns Map of index patterns to search against (will be all .monitoring-*,monitoring-* indices)
+ * @param {*} indexPatterns Map of index patterns to search against (will be all .monitoring-* indices)
  * @param {*} clusterUuid Optional and will be used to filter down the query if used
  * @param {*} nodeUuid Optional and will be used to filter down the query if used
  * @param {*} skipLiveData Optional and will not make any live api calls if set to true
diff --git a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_all_stats.js b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_all_stats.js
index ea6792433ea0b..f27fde50242f4 100644
--- a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_all_stats.js
+++ b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_all_stats.js
@@ -19,11 +19,11 @@ describe.skip('get_all_stats', () => {
       get: sinon
         .stub()
         .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*,monitoring-es-N-*')
+        .returns('.monitoring-es-N-*')
         .withArgs('xpack.monitoring.kibana.index_pattern')
-        .returns('.monitoring-kibana-N-*,monitoring-kibana-N-*')
+        .returns('.monitoring-kibana-N-*')
         .withArgs('xpack.monitoring.logstash.index_pattern')
-        .returns('.monitoring-logstash-N-*,monitoring-logstash-N-*')
+        .returns('.monitoring-logstash-N-*')
         .withArgs('xpack.monitoring.max_bucket_size')
         .returns(size),
     }),
diff --git a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_cluster_uuids.js b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_cluster_uuids.js
index 820e6e2c1ec28..1f62c677dbb21 100644
--- a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_cluster_uuids.js
+++ b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_cluster_uuids.js
@@ -20,7 +20,7 @@ describe('get_cluster_uuids', () => {
       get: sinon
         .stub()
         .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*,monitoring-es-N-*')
+        .returns('.monitoring-es-N-*')
         .withArgs('xpack.monitoring.max_bucket_size')
         .returns(size),
     }),
diff --git a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_es_stats.js b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_es_stats.js
index 570a19e0766d4..536e831640fad 100644
--- a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_es_stats.js
+++ b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_es_stats.js
@@ -20,7 +20,7 @@ describe('get_es_stats', () => {
       get: sinon
         .stub()
         .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*,monitoring-es-N-*')
+        .returns('.monitoring-es-N-*')
         .withArgs('xpack.monitoring.max_bucket_size')
         .returns(size),
     }),
diff --git a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_high_level_stats.js b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_high_level_stats.js
index dbdd3b8dbce4a..1c1f8dc888d01 100644
--- a/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_high_level_stats.js
+++ b/x-pack/legacy/plugins/monitoring/server/telemetry_collection/__tests__/get_high_level_stats.js
@@ -24,7 +24,7 @@ describe('get_high_level_stats', () => {
       get: sinon
         .stub()
         .withArgs(`xpack.monitoring.${product}.index_pattern`)
-        .returns(`.monitoring-${product}-N-*,monitoring-${product}-N-*`)
+        .returns(`.monitoring-${product}-N-*`)
         .withArgs('xpack.monitoring.max_bucket_size')
         .returns(size),
     }),
diff --git a/x-pack/legacy/plugins/oss_telemetry/index.ts b/x-pack/legacy/plugins/oss_telemetry/index.ts
deleted file mode 100644
index fce861c7d3f46..0000000000000
--- a/x-pack/legacy/plugins/oss_telemetry/index.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { Logger, PluginInitializerContext, CoreStart } from 'kibana/server';
-import { Legacy } from 'kibana';
-import { PLUGIN_ID } from './constants';
-import { OssTelemetryPlugin } from './server/plugin';
-import { LegacyPluginInitializer } from '../../../../src/legacy/plugin_discovery/types';
-import { getTaskManagerSetup, getTaskManagerStart } from '../task_manager/server';
-
-export const ossTelemetry: LegacyPluginInitializer = kibana => {
-  return new kibana.Plugin({
-    id: PLUGIN_ID,
-    require: ['elasticsearch', 'xpack_main'],
-    configPrefix: 'xpack.oss_telemetry',
-
-    init(server: Legacy.Server) {
-      const plugin = new OssTelemetryPlugin({
-        logger: {
-          get: () =>
-            ({
-              info: (message: string) => server.log(['info', 'task_manager'], message),
-              debug: (message: string) => server.log(['debug', 'task_manager'], message),
-              warn: (message: string) => server.log(['warn', 'task_manager'], message),
-              error: (message: string) => server.log(['error', 'task_manager'], message),
-            } as Logger),
-        },
-      } as PluginInitializerContext);
-
-      const deps = {
-        usageCollection: server.newPlatform.setup.plugins.usageCollection,
-        __LEGACY: {
-          config: server.config(),
-          xpackMainStatus: ((server.plugins.xpack_main as unknown) as { status: any }).status
-            .plugin,
-        },
-      };
-
-      plugin.setup(server.newPlatform.setup.core, {
-        ...deps,
-        taskManager: getTaskManagerSetup(server),
-      });
-
-      plugin.start((server.newPlatform.setup.core as unknown) as CoreStart, {
-        ...deps,
-        taskManager: getTaskManagerStart(server),
-      });
-    },
-  });
-};
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts
deleted file mode 100644
index 9d547c1b22099..0000000000000
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { registerVisualizationsCollector } from './visualizations/register_usage_collector';
-import { OssTelemetryStartDependencies } from '../../plugin';
-
-export function registerCollectors(deps: OssTelemetryStartDependencies) {
-  registerVisualizationsCollector(deps.usageCollection, deps.taskManager);
-}
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts b/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts
deleted file mode 100644
index 0aac319cf5818..0000000000000
--- a/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { CoreSetup, CoreStart, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
-import {
-  TaskManagerSetupContract,
-  TaskManagerStartContract,
-} from '../../../../plugins/task_manager/server';
-import { registerCollectors } from './lib/collectors';
-import { registerTasks, scheduleTasks } from './lib/tasks';
-import KbnServer from '../../../../../src/legacy/server/kbn_server';
-import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/server';
-
-export interface LegacyConfig {
-  get: (key: string) => string | number | boolean;
-}
-
-interface OssTelemetryDependencies {
-  usageCollection: UsageCollectionSetup;
-  __LEGACY: {
-    config: LegacyConfig;
-    xpackMainStatus: { kbnServer: KbnServer };
-  };
-}
-export interface OssTelemetrySetupDependencies extends OssTelemetryDependencies {
-  taskManager?: TaskManagerSetupContract;
-}
-export interface OssTelemetryStartDependencies extends OssTelemetryDependencies {
-  taskManager?: TaskManagerStartContract;
-}
-
-export class OssTelemetryPlugin implements Plugin {
-  private logger: Logger;
-
-  constructor(initializerContext: PluginInitializerContext) {
-    this.logger = initializerContext.logger.get();
-  }
-
-  public setup(core: CoreSetup, deps: OssTelemetrySetupDependencies) {
-    registerTasks({
-      taskManager: deps.taskManager,
-      logger: this.logger,
-      elasticsearch: core.elasticsearch,
-      config: deps.__LEGACY.config,
-    });
-  }
-
-  public start(core: CoreStart, deps: OssTelemetryStartDependencies) {
-    registerCollectors(deps);
-    scheduleTasks({
-      taskManager: deps.taskManager,
-      xpackMainStatus: deps.__LEGACY.xpackMainStatus,
-      logger: this.logger,
-    });
-  }
-}
diff --git a/x-pack/legacy/plugins/reporting/export_types/common/lib/screenshots/index.ts b/x-pack/legacy/plugins/reporting/export_types/common/lib/screenshots/index.ts
index b83021d5e38dd..9fd3ee391ddbb 100644
--- a/x-pack/legacy/plugins/reporting/export_types/common/lib/screenshots/index.ts
+++ b/x-pack/legacy/plugins/reporting/export_types/common/lib/screenshots/index.ts
@@ -5,7 +5,7 @@
  */
 
 import * as Rx from 'rxjs';
-import { first, mergeMap, toArray } from 'rxjs/operators';
+import { first, concatMap, take, toArray, mergeMap } from 'rxjs/operators';
 import { ServerFacade, CaptureConfig, HeadlessChromiumDriverFactory } from '../../../../types';
 import { ScreenshotResults, ScreenshotObservableOpts } from './types';
 import { injectCustomCss } from './inject_css';
@@ -37,12 +37,11 @@ export function screenshotsObservableFactory(
       { viewport: layout.getBrowserViewport(), browserTimezone },
       logger
     );
-
     return Rx.from(urls).pipe(
-      mergeMap(url => {
+      concatMap(url => {
         return create$.pipe(
           mergeMap(({ driver, exit$ }) => {
-            const screenshot$ = Rx.of(driver).pipe(
+            const screenshot$ = Rx.of(1).pipe(
               mergeMap(() => openUrl(driver, url, conditionalHeaders, logger)),
               mergeMap(() => skipTelemetry(driver, logger)),
               mergeMap(() => scanPage(driver, layout, logger)),
@@ -85,10 +84,11 @@ export function screenshotsObservableFactory(
             );
 
             return Rx.race(screenshot$, exit$);
-          })
+          }),
+          first()
         );
       }),
-      first(),
+      take(urls.length),
       toArray()
     );
   };
diff --git a/x-pack/legacy/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx b/x-pack/legacy/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
index fde053f8dbdfc..f8d8fdf481dd6 100644
--- a/x-pack/legacy/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
+++ b/x-pack/legacy/plugins/reporting/public/panel_actions/get_csv_panel_action.tsx
@@ -8,7 +8,7 @@ import { i18n } from '@kbn/i18n';
 import moment from 'moment-timezone';
 
 import { npSetup, npStart } from 'ui/new_platform';
-import { IAction, IncompatibleActionError } from '../../../../../../src/plugins/ui_actions/public';
+import { Action, IncompatibleActionError } from '../../../../../../src/plugins/ui_actions/public';
 
 import {
   ViewMode,
@@ -32,7 +32,7 @@ interface ActionContext {
   embeddable: ISearchEmbeddable;
 }
 
-class GetCsvReportPanelAction implements IAction<ActionContext> {
+class GetCsvReportPanelAction implements Action<ActionContext> {
   private isDownloading: boolean;
   public readonly type = CSV_REPORTING_ACTION;
   public readonly id = CSV_REPORTING_ACTION;
diff --git a/x-pack/legacy/plugins/reporting/server/lib/get_user.ts b/x-pack/legacy/plugins/reporting/server/lib/get_user.ts
index 350004ddb78f8..ab02dfe0743f0 100644
--- a/x-pack/legacy/plugins/reporting/server/lib/get_user.ts
+++ b/x-pack/legacy/plugins/reporting/server/lib/get_user.ts
@@ -6,27 +6,14 @@
 
 import { Legacy } from 'kibana';
 import { KibanaRequest } from '../../../../../../src/core/server';
-import { Logger, ServerFacade } from '../../types';
+import { ServerFacade } from '../../types';
 import { ReportingSetupDeps } from '../plugin';
 
-export function getUserFactory(
-  server: ServerFacade,
-  security: ReportingSetupDeps['security'],
-  logger: Logger
-) {
+export function getUserFactory(server: ServerFacade, security: ReportingSetupDeps['security']) {
   /*
    * Legacy.Request because this is called from routing middleware
    */
   return async (request: Legacy.Request) => {
-    if (!security) {
-      return null;
-    }
-
-    try {
-      return await security.authc.getCurrentUser(KibanaRequest.from(request));
-    } catch (err) {
-      logger.error(err, ['getUser']);
-      return null;
-    }
+    return security?.authc.getCurrentUser(KibanaRequest.from(request)) ?? null;
   };
 }
diff --git a/x-pack/legacy/plugins/reporting/server/routes/lib/authorized_user_pre_routing.ts b/x-pack/legacy/plugins/reporting/server/routes/lib/authorized_user_pre_routing.ts
index 874027251570c..57c3fcee222da 100644
--- a/x-pack/legacy/plugins/reporting/server/routes/lib/authorized_user_pre_routing.ts
+++ b/x-pack/legacy/plugins/reporting/server/routes/lib/authorized_user_pre_routing.ts
@@ -22,7 +22,7 @@ export const authorizedUserPreRoutingFactory = function authorizedUserPreRouting
   plugins: ReportingSetupDeps,
   logger: Logger
 ) {
-  const getUser = getUserFactory(server, plugins.security, logger);
+  const getUser = getUserFactory(server, plugins.security);
   const config = server.config();
 
   return async function authorizedUserPreRouting(request: Legacy.Request) {
diff --git a/x-pack/legacy/plugins/rollup/public/crud_app/sections/job_list/detail_panel/detail_panel.js b/x-pack/legacy/plugins/rollup/public/crud_app/sections/job_list/detail_panel/detail_panel.js
index 4534ef698b718..f774b1d7f63b7 100644
--- a/x-pack/legacy/plugins/rollup/public/crud_app/sections/job_list/detail_panel/detail_panel.js
+++ b/x-pack/legacy/plugins/rollup/public/crud_app/sections/job_list/detail_panel/detail_panel.js
@@ -232,7 +232,7 @@ export class DetailPanel extends Component {
         onClose={closeDetailPanel}
         aria-labelledby="rollupJobDetailsFlyoutTitle"
         size="m"
-        maxWidth={400}
+        maxWidth={550}
       >
         <EuiFlyoutHeader>
           <EuiTitle
diff --git a/x-pack/legacy/plugins/rollup/public/index_pattern_creation/components/rollup_prompt/rollup_prompt.js b/x-pack/legacy/plugins/rollup/public/index_pattern_creation/components/rollup_prompt/rollup_prompt.js
index 7a944c5e9a5c0..42c950f0b0d74 100644
--- a/x-pack/legacy/plugins/rollup/public/index_pattern_creation/components/rollup_prompt/rollup_prompt.js
+++ b/x-pack/legacy/plugins/rollup/public/index_pattern_creation/components/rollup_prompt/rollup_prompt.js
@@ -13,7 +13,7 @@ export const RollupPrompt = () => (
     <p>
       Kibana&apos;s support for rollup index patterns is in beta. You might encounter issues using
       these patterns in saved searches, visualizations, and dashboards. They are not supported in
-      advanced features, such as TSVB, Timelion, and Machine Learning.
+      some advanced features, such as Timelion, and Machine Learning.
     </p>
     <p>
       You can match a rollup index pattern against one rollup index and zero or more regular
diff --git a/x-pack/legacy/plugins/rollup/public/index_pattern_creation/rollup_index_pattern_creation_config.js b/x-pack/legacy/plugins/rollup/public/index_pattern_creation/rollup_index_pattern_creation_config.js
index 82a4c5a888594..f0eb21a219442 100644
--- a/x-pack/legacy/plugins/rollup/public/index_pattern_creation/rollup_index_pattern_creation_config.js
+++ b/x-pack/legacy/plugins/rollup/public/index_pattern_creation/rollup_index_pattern_creation_config.js
@@ -56,7 +56,6 @@ export class RollupIndexPatternCreationConfig extends IndexPatternCreationConfig
     this.rollupJobs = [];
     this.rollupIndicesCapabilities = {};
     this.rollupIndices = [];
-    this.settingUp = this.setRollupIndices();
   }
 
   async setRollupIndices() {
@@ -77,7 +76,7 @@ export class RollupIndexPatternCreationConfig extends IndexPatternCreationConfig
   }
 
   async getIndexPatternCreationOption(urlHandler) {
-    await this.settingUp;
+    await this.setRollupIndices();
     return this.rollupIndices && this.rollupIndices.length
       ? {
           text: rollupIndexPatternButtonText,
diff --git a/x-pack/legacy/plugins/rollup/public/legacy.ts b/x-pack/legacy/plugins/rollup/public/legacy.ts
index a2738372ff346..17597672a898e 100644
--- a/x-pack/legacy/plugins/rollup/public/legacy.ts
+++ b/x-pack/legacy/plugins/rollup/public/legacy.ts
@@ -5,9 +5,8 @@
  */
 
 import { npSetup, npStart } from 'ui/new_platform';
-import { editorConfigProviders } from 'ui/vis/config';
-import { aggTypeFilters } from 'ui/agg_types/filter';
-import { aggTypeFieldFilters } from 'ui/agg_types/param_types/filter';
+import { aggTypeFilters } from 'ui/agg_types';
+import { aggTypeFieldFilters } from 'ui/agg_types';
 import { addSearchStrategy } from '../../../../../src/plugins/data/public';
 import { RollupPlugin } from './plugin';
 import { setup as management } from '../../../../../src/legacy/core_plugins/management/public/legacy';
@@ -20,7 +19,6 @@ export const setup = plugin.setup(npSetup.core, {
   __LEGACY: {
     aggTypeFilters,
     aggTypeFieldFilters,
-    editorConfigProviders,
     addSearchStrategy,
     addBadgeExtension,
     addToggleExtension,
diff --git a/x-pack/legacy/plugins/rollup/public/legacy_imports.ts b/x-pack/legacy/plugins/rollup/public/legacy_imports.ts
index 981f97963591e..07155a4b0a60e 100644
--- a/x-pack/legacy/plugins/rollup/public/legacy_imports.ts
+++ b/x-pack/legacy/plugins/rollup/public/legacy_imports.ts
@@ -7,6 +7,5 @@
 // @ts-ignore
 export { findIllegalCharactersInIndexName, INDEX_ILLEGAL_CHARACTERS_VISIBLE } from 'ui/indices';
 
-export { AggTypeFilters } from 'ui/agg_types/filter';
-export { AggTypeFieldFilters } from 'ui/agg_types/param_types/filter';
-export { EditorConfigProviderRegistry } from 'ui/vis/config';
+export { AggTypeFilters } from 'ui/agg_types';
+export { AggTypeFieldFilters } from 'ui/agg_types';
diff --git a/x-pack/legacy/plugins/rollup/public/plugin.ts b/x-pack/legacy/plugins/rollup/public/plugin.ts
index 97c03fd1fdfc2..4dae078c90f57 100644
--- a/x-pack/legacy/plugins/rollup/public/plugin.ts
+++ b/x-pack/legacy/plugins/rollup/public/plugin.ts
@@ -6,11 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
-import {
-  EditorConfigProviderRegistry,
-  AggTypeFilters,
-  AggTypeFieldFilters,
-} from './legacy_imports';
+import { AggTypeFilters, AggTypeFieldFilters } from './legacy_imports';
 import { SearchStrategyProvider } from '../../../../../src/plugins/data/public';
 import { ManagementSetup as ManagementSetupLegacy } from '../../../../../src/legacy/core_plugins/management/public/np_ready';
 import { rollupBadgeExtension, rollupToggleExtension } from './extend_index_management';
@@ -23,8 +19,6 @@ import { getRollupSearchStrategy } from './search/rollup_search_strategy';
 import { initAggTypeFilter } from './visualize/agg_type_filter';
 // @ts-ignore
 import { initAggTypeFieldFilter } from './visualize/agg_type_field_filter';
-// @ts-ignore
-import { initEditorConfig } from './visualize/editor_config';
 import { CONFIG_ROLLUPS } from '../common';
 import {
   FeatureCatalogueCategory,
@@ -42,7 +36,6 @@ export interface RollupPluginSetupDependencies {
   __LEGACY: {
     aggTypeFilters: AggTypeFilters;
     aggTypeFieldFilters: AggTypeFieldFilters;
-    editorConfigProviders: EditorConfigProviderRegistry;
     addSearchStrategy: (searchStrategy: SearchStrategyProvider) => void;
     managementLegacy: ManagementSetupLegacy;
     addBadgeExtension: (badgeExtension: any) => void;
@@ -59,7 +52,6 @@ export class RollupPlugin implements Plugin {
       __LEGACY: {
         aggTypeFilters,
         aggTypeFieldFilters,
-        editorConfigProviders,
         addSearchStrategy,
         managementLegacy,
         addBadgeExtension,
@@ -81,7 +73,6 @@ export class RollupPlugin implements Plugin {
       addSearchStrategy(getRollupSearchStrategy(core.http.fetch));
       initAggTypeFilter(aggTypeFilters);
       initAggTypeFieldFilter(aggTypeFieldFilters);
-      initEditorConfig(editorConfigProviders);
     }
 
     if (home) {
diff --git a/x-pack/legacy/plugins/rollup/public/visualize/editor_config.js b/x-pack/legacy/plugins/rollup/public/visualize/editor_config.js
deleted file mode 100644
index 5c1eb7c8ee3b7..0000000000000
--- a/x-pack/legacy/plugins/rollup/public/visualize/editor_config.js
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export function initEditorConfig(editorConfigProviders) {
-  // Limit agg params based on rollup capabilities
-  editorConfigProviders.register((indexPattern, aggConfig) => {
-    if (indexPattern.type !== 'rollup') {
-      return {};
-    }
-
-    const aggTypeName = aggConfig.type && aggConfig.type.name;
-
-    // Exclude certain param options for terms:
-    // otherBucket, missingBucket, orderBy, orderAgg
-    if (aggTypeName === 'terms') {
-      return {
-        otherBucket: {
-          hidden: true,
-        },
-        missingBucket: {
-          hidden: true,
-        },
-      };
-    }
-
-    const rollupAggs = indexPattern.typeMeta && indexPattern.typeMeta.aggs;
-    const field = aggConfig.params && aggConfig.params.field && aggConfig.params.field.name;
-    const fieldAgg =
-      rollupAggs && field && rollupAggs[aggTypeName] && rollupAggs[aggTypeName][field];
-
-    if (!rollupAggs || !field || !fieldAgg) {
-      return {};
-    }
-
-    // Set interval and base interval for histograms based on rollup capabilities
-    if (aggTypeName === 'histogram') {
-      const interval = fieldAgg.interval;
-      return interval
-        ? {
-            intervalBase: {
-              fixedValue: interval,
-            },
-            interval: {
-              base: interval,
-              help: i18n.translate('xpack.rollupJobs.editorConfig.histogram.interval.helpText', {
-                defaultMessage: 'Must be a multiple of rollup configuration interval: {interval}',
-                values: { interval },
-              }),
-            },
-          }
-        : {};
-    }
-
-    // Set date histogram time zone based on rollup capabilities
-    if (aggTypeName === 'date_histogram') {
-      // Interval is deprecated on date_histogram rollups, but may still be present
-      // See https://github.com/elastic/kibana/pull/36310
-      const interval = fieldAgg.calendar_interval || fieldAgg.fixed_interval || fieldAgg.interval;
-      return {
-        useNormalizedEsInterval: {
-          fixedValue: false,
-        },
-        interval: {
-          default: interval,
-          timeBase: interval,
-          help: i18n.translate(
-            'xpack.rollupJobs.editorConfig.dateHistogram.customInterval.helpText',
-            {
-              defaultMessage: 'Must be a multiple of rollup configuration interval: {interval}',
-              values: { interval },
-            }
-          ),
-        },
-      };
-    }
-
-    return {};
-  });
-}
diff --git a/x-pack/legacy/plugins/security/index.js b/x-pack/legacy/plugins/security/index.js
index 4988c30a1398b..9016398463b5f 100644
--- a/x-pack/legacy/plugins/security/index.js
+++ b/x-pack/legacy/plugins/security/index.js
@@ -130,7 +130,7 @@ export const security = kibana =>
         );
 
       server.expose({
-        getUser: request => securityPlugin.authc.getCurrentUser(KibanaRequest.from(request)),
+        getUser: async request => securityPlugin.authc.getCurrentUser(KibanaRequest.from(request)),
       });
 
       initLoginView(securityPlugin, server);
diff --git a/x-pack/legacy/plugins/siem/public/app/app.tsx b/x-pack/legacy/plugins/siem/public/app/app.tsx
index 5f9199735d8c0..030cb72750649 100644
--- a/x-pack/legacy/plugins/siem/public/app/app.tsx
+++ b/x-pack/legacy/plugins/siem/public/app/app.tsx
@@ -16,9 +16,8 @@ import euiDarkVars from '@elastic/eui/dist/eui_theme_dark.json';
 import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 import { BehaviorSubject } from 'rxjs';
 import { pluck } from 'rxjs/operators';
-import { I18nContext } from 'ui/i18n';
 
-import { KibanaContextProvider, useUiSetting$ } from '../lib/kibana';
+import { KibanaContextProvider, useKibana, useUiSetting$ } from '../lib/kibana';
 import { Storage } from '../../../../../../src/plugins/kibana_utils/public';
 
 import { DEFAULT_DARK_MODE } from '../../common/constants';
@@ -27,7 +26,7 @@ import { compose } from '../lib/compose/kibana_compose';
 import { AppFrontendLibs, AppApolloClient } from '../lib/lib';
 import { CoreStart, StartPlugins } from '../plugin';
 import { PageRouter } from '../routes';
-import { createStore } from '../store';
+import { createStore, createInitialState } from '../store';
 import { GlobalToaster, ManageGlobalToaster } from '../components/toasters';
 import { MlCapabilitiesProvider } from '../components/ml/permissions/ml_capabilities_provider';
 
@@ -46,33 +45,30 @@ const AppPluginRootComponent: React.FC<AppPluginRootComponentProps> = ({
   apolloClient,
   history,
 }) => (
-  <EuiErrorBoundary>
-    <I18nContext>
-      <ManageGlobalToaster>
-        <ReduxStoreProvider store={store}>
-          <ApolloProvider client={apolloClient}>
-            <ApolloClientContext.Provider value={apolloClient}>
-              <ThemeProvider theme={theme}>
-                <MlCapabilitiesProvider>
-                  <PageRouter history={history} />
-                </MlCapabilitiesProvider>
-              </ThemeProvider>
-              <ErrorToastDispatcher />
-              <GlobalToaster />
-            </ApolloClientContext.Provider>
-          </ApolloProvider>
-        </ReduxStoreProvider>
-      </ManageGlobalToaster>
-    </I18nContext>
-  </EuiErrorBoundary>
+  <ManageGlobalToaster>
+    <ReduxStoreProvider store={store}>
+      <ApolloProvider client={apolloClient}>
+        <ApolloClientContext.Provider value={apolloClient}>
+          <ThemeProvider theme={theme}>
+            <MlCapabilitiesProvider>
+              <PageRouter history={history} />
+            </MlCapabilitiesProvider>
+          </ThemeProvider>
+          <ErrorToastDispatcher />
+          <GlobalToaster />
+        </ApolloClientContext.Provider>
+      </ApolloProvider>
+    </ReduxStoreProvider>
+  </ManageGlobalToaster>
 );
 
 const AppPluginRoot = memo(AppPluginRootComponent);
 
 const StartAppComponent: FC<AppFrontendLibs> = libs => {
+  const { i18n } = useKibana().services;
   const history = createHashHistory();
   const libs$ = new BehaviorSubject(libs);
-  const store = createStore(undefined, libs$.pipe(pluck('apolloClient')));
+  const store = createStore(createInitialState(), libs$.pipe(pluck('apolloClient')));
   const [darkMode] = useUiSetting$<boolean>(DEFAULT_DARK_MODE);
   const theme = useMemo(
     () => ({
@@ -83,7 +79,16 @@ const StartAppComponent: FC<AppFrontendLibs> = libs => {
   );
 
   return (
-    <AppPluginRoot store={store} apolloClient={libs.apolloClient} history={history} theme={theme} />
+    <EuiErrorBoundary>
+      <i18n.Context>
+        <AppPluginRoot
+          store={store}
+          apolloClient={libs.apolloClient}
+          history={history}
+          theme={theme}
+        />
+      </i18n.Context>
+    </EuiErrorBoundary>
   );
 };
 
@@ -103,7 +108,7 @@ const SiemAppComponent: React.FC<SiemAppComponentProps> = ({ core, plugins }) =>
       ...plugins,
     }}
   >
-    <StartApp {...compose()} />
+    <StartApp {...compose(core)} />
   </KibanaContextProvider>
 );
 
diff --git a/x-pack/legacy/plugins/siem/public/components/charts/areachart.tsx b/x-pack/legacy/plugins/siem/public/components/charts/areachart.tsx
index 71f22efadc6ed..57f78080abc60 100644
--- a/x-pack/legacy/plugins/siem/public/components/charts/areachart.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/charts/areachart.tsx
@@ -18,7 +18,7 @@ import {
 import { getOr, get, isNull, isNumber } from 'lodash/fp';
 import { AutoSizer } from '../auto_sizer';
 import { ChartPlaceHolder } from './chart_place_holder';
-import { useTimeZone } from '../../hooks';
+import { useTimeZone } from '../../lib/kibana';
 import {
   chartDefaultSettings,
   ChartSeriesConfigs,
diff --git a/x-pack/legacy/plugins/siem/public/components/charts/barchart.tsx b/x-pack/legacy/plugins/siem/public/components/charts/barchart.tsx
index 8c342ad2d037f..d9dd302dae724 100644
--- a/x-pack/legacy/plugins/siem/public/components/charts/barchart.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/charts/barchart.tsx
@@ -9,7 +9,7 @@ import { Chart, BarSeries, Axis, Position, ScaleType, Settings } from '@elastic/
 import { getOr, get, isNumber } from 'lodash/fp';
 import deepmerge from 'deepmerge';
 
-import { useTimeZone } from '../../hooks';
+import { useTimeZone } from '../../lib/kibana';
 import { AutoSizer } from '../auto_sizer';
 import { ChartPlaceHolder } from './chart_place_holder';
 import {
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.test.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.test.tsx
index c752273777d2f..a807b4d6a838b 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.test.tsx
@@ -11,12 +11,6 @@ import { useIndexPatterns } from '../../hooks/use_index_patterns';
 import { EmbeddedMapComponent } from './embedded_map';
 import { SetQuery } from './types';
 
-jest.mock('../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
-
 const mockUseIndexPatterns = useIndexPatterns as jest.Mock;
 jest.mock('../../hooks/use_index_patterns');
 mockUseIndexPatterns.mockImplementation(() => [true, []]);
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
index cbbb4f8c6249e..b1b47f7c6b775 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
@@ -25,10 +25,7 @@ import * as i18n from './translations';
 import { MapEmbeddable, SetQuery } from './types';
 import { Query, esFilters } from '../../../../../../../src/plugins/data/public';
 import { useKibana, useUiSetting$ } from '../../lib/kibana';
-import {
-  SavedObjectFinderProps,
-  SavedObjectFinderUi,
-} from '../../../../../../../src/plugins/kibana_react/public';
+import { getSavedObjectFinder } from '../../../../../../../src/plugins/saved_objects/public';
 
 interface EmbeddableMapProps {
   maintainRatio?: boolean;
@@ -177,14 +174,6 @@ export const EmbeddedMapComponent = ({
     }
   }, [startDate, endDate]);
 
-  const SavedObjectFinder = (props: SavedObjectFinderProps) => (
-    <SavedObjectFinderUi
-      {...props}
-      savedObjects={services.savedObjects}
-      uiSettings={services.uiSettings}
-    />
-  );
-
   return isError ? null : (
     <Embeddable>
       <EmbeddableHeader title={i18n.EMBEDDABLE_HEADER_TITLE}>
@@ -213,7 +202,7 @@ export const EmbeddedMapComponent = ({
             notifications={services.notifications}
             overlays={services.overlays}
             inspector={services.inspector}
-            SavedObjectFinder={SavedObjectFinder}
+            SavedObjectFinder={getSavedObjectFinder(services.savedObjects, services.uiSettings)}
           />
         ) : !isLoading && isIndexError ? (
           <IndexPatternsMissingPrompt data-test-subj="missing-prompt" />
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/index_patterns_missing_prompt.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/index_patterns_missing_prompt.tsx
index cba7e5ba1fd93..abd33505b67b9 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/index_patterns_missing_prompt.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/index_patterns_missing_prompt.tsx
@@ -7,13 +7,13 @@
 import { EuiButton, EuiCode, EuiEmptyPrompt } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
-import chrome from 'ui/chrome';
 
-import { useKibana } from '../../lib/kibana';
+import { useKibana, useBasePath } from '../../lib/kibana';
 import * as i18n from './translations';
 
 export const IndexPatternsMissingPromptComponent = () => {
-  const docLinks = useKibana().services.docLinks;
+  const { docLinks } = useKibana().services;
+  const kibanaBasePath = `${useBasePath()}/app/kibana`;
 
   return (
     <EuiEmptyPrompt
@@ -29,7 +29,7 @@ export const IndexPatternsMissingPromptComponent = () => {
               values={{
                 defaultIndex: (
                   <a
-                    href={`${chrome.getBasePath()}/app/kibana#/management/kibana/settings`}
+                    href={`${kibanaBasePath}#/management/kibana/settings`}
                     rel="noopener noreferrer"
                     target="_blank"
                   >
@@ -61,7 +61,7 @@ export const IndexPatternsMissingPromptComponent = () => {
       }
       actions={
         <EuiButton
-          href={`${chrome.getBasePath()}/app/kibana#/management/kibana/index_patterns`}
+          href={`${kibanaBasePath}#/management/kibana/index_patterns`}
           color="primary"
           target="_blank"
           fill
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/map_tool_tip.test.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/map_tool_tip.test.tsx
index 2daaeb53e45f2..ff6e8859be049 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/map_tool_tip.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/map_tool_tip.test.tsx
@@ -9,12 +9,6 @@ import React from 'react';
 import { MapToolTipComponent } from './map_tool_tip';
 import { MapFeature } from '../types';
 
-jest.mock('../../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
-
 describe('MapToolTip', () => {
   test('placeholder component renders correctly against snapshot', () => {
     const wrapper = shallow(<MapToolTipComponent />);
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
index a9d70e4f35d35..c90af16b0d99a 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/map_tool_tip/point_tool_tip_content.test.tsx
@@ -14,12 +14,6 @@ import { HostDetailsLink, IPDetailsLink } from '../../links';
 import { useMountAppended } from '../../../utils/use_mount_appended';
 import { FlowTarget } from '../../../graphql/types';
 
-jest.mock('../../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
-
 describe('PointToolTipContent', () => {
   const mount = useMountAppended();
 
diff --git a/x-pack/legacy/plugins/siem/public/components/formatted_date/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/formatted_date/index.test.tsx
index 0d8222ce85e1b..2ca67057039df 100644
--- a/x-pack/legacy/plugins/siem/public/components/formatted_date/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/formatted_date/index.test.tsx
@@ -7,13 +7,13 @@
 import { mount, shallow } from 'enzyme';
 import React from 'react';
 
-import { useDateFormat, useTimeZone } from '../../hooks';
+import { useDateFormat, useTimeZone } from '../../lib/kibana';
 
 import { TestProviders } from '../../mock';
 import { getEmptyString, getEmptyValue } from '../empty_value';
 import { PreferenceFormattedDate, FormattedDate, FormattedRelativePreferenceDate } from '.';
 
-jest.mock('../../hooks');
+jest.mock('../../lib/kibana');
 const mockUseDateFormat = useDateFormat as jest.Mock;
 const mockUseTimeZone = useTimeZone as jest.Mock;
 
diff --git a/x-pack/legacy/plugins/siem/public/components/formatted_date/index.tsx b/x-pack/legacy/plugins/siem/public/components/formatted_date/index.tsx
index fb579a14b0457..f74ee995c965b 100644
--- a/x-pack/legacy/plugins/siem/public/components/formatted_date/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/formatted_date/index.tsx
@@ -8,9 +8,8 @@ import moment from 'moment-timezone';
 import React from 'react';
 import { FormattedRelative } from '@kbn/i18n/react';
 
-import { useDateFormat, useTimeZone } from '../../hooks';
+import { useDateFormat, useTimeZone, useUiSetting$ } from '../../lib/kibana';
 import { getOrEmptyTagFromValue } from '../empty_value';
-import { useUiSetting$ } from '../../lib/kibana';
 import { LocalizedDateTooltip } from '../localized_date_tooltip';
 import { getMaybeDate } from './maybe_date';
 
diff --git a/x-pack/legacy/plugins/siem/public/components/help_menu/index.tsx b/x-pack/legacy/plugins/siem/public/components/help_menu/index.tsx
index 732d83ac6e736..e74299f57c934 100644
--- a/x-pack/legacy/plugins/siem/public/components/help_menu/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/help_menu/index.tsx
@@ -5,13 +5,14 @@
  */
 
 import React, { useEffect } from 'react';
-import chrome from 'ui/chrome';
 import { i18n } from '@kbn/i18n';
-import { documentationLinks } from 'ui/documentation_links';
+import { useKibana } from '../../lib/kibana';
 
 export const HelpMenu = React.memo(() => {
+  const { chrome, docLinks } = useKibana().services;
+
   useEffect(() => {
-    chrome.helpExtension.set({
+    chrome.setHelpExtension({
       appName: i18n.translate('xpack.siem.chrome.help.appName', {
         defaultMessage: 'SIEM',
       }),
@@ -20,7 +21,7 @@ export const HelpMenu = React.memo(() => {
           content: i18n.translate('xpack.siem.chrome.helpMenu.documentation', {
             defaultMessage: 'SIEM documentation',
           }),
-          href: documentationLinks.siem.guide,
+          href: docLinks.links.siem.guide,
           iconType: 'documents',
           linkType: 'custom',
         },
diff --git a/x-pack/legacy/plugins/siem/public/components/link_to/link_to.tsx b/x-pack/legacy/plugins/siem/public/components/link_to/link_to.tsx
index 3eda945c9224e..dc8c696301611 100644
--- a/x-pack/legacy/plugins/siem/public/components/link_to/link_to.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/link_to/link_to.tsx
@@ -62,13 +62,11 @@ export const LinkToPage = React.memo<LinkToPageProps>(({ match }) => (
       component={RedirectToDetectionEnginePage}
       exact
       path={`${match.url}/:pageName(${SiemPageName.detections})`}
-      strict
     />
     <Route
       component={RedirectToDetectionEnginePage}
       exact
       path={`${match.url}/:pageName(${SiemPageName.detections})/:tabName(${DetectionEngineTab.alerts}|${DetectionEngineTab.signals})`}
-      strict
     />
     <Route
       component={RedirectToRulesPage}
diff --git a/x-pack/legacy/plugins/siem/public/components/ml/anomaly/use_anomalies_table_data.ts b/x-pack/legacy/plugins/siem/public/components/ml/anomaly/use_anomalies_table_data.ts
index 48277b0b6fa52..0baa1ef7cdd05 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml/anomaly/use_anomalies_table_data.ts
+++ b/x-pack/legacy/plugins/siem/public/components/ml/anomaly/use_anomalies_table_data.ts
@@ -14,9 +14,8 @@ import { useStateToaster } from '../../toasters';
 import { errorToToaster } from '../api/error_to_toaster';
 
 import * as i18n from './translations';
-import { useUiSetting$ } from '../../../lib/kibana';
+import { useTimeZone, useUiSetting$ } from '../../../lib/kibana';
 import { DEFAULT_ANOMALY_SCORE } from '../../../../common/constants';
-import { useTimeZone } from '../../../hooks';
 
 interface Args {
   influencers?: InfluencerInput[];
diff --git a/x-pack/legacy/plugins/siem/public/components/ml/api/anomalies_table_data.ts b/x-pack/legacy/plugins/siem/public/components/ml/api/anomalies_table_data.ts
index cb84d9182d2e0..35dbbf012272e 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml/api/anomalies_table_data.ts
+++ b/x-pack/legacy/plugins/siem/public/components/ml/api/anomalies_table_data.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
 import { Anomalies, InfluencerInput, CriteriaFields } from '../types';
 import { throwIfNotOk } from '../../../hooks/api/api';
+import { KibanaServices } from '../../../lib/kibana';
 
 export interface Body {
   jobIds: string[];
@@ -22,7 +22,7 @@ export interface Body {
 }
 
 export const anomaliesTableData = async (body: Body, signal: AbortSignal): Promise<Anomalies> => {
-  const response = await npStart.core.http.fetch<Anomalies>(
+  const response = await KibanaServices.get().http.fetch<Anomalies>(
     '/api/ml/results/anomalies_table_data',
     {
       method: 'POST',
diff --git a/x-pack/legacy/plugins/siem/public/components/ml/api/get_ml_capabilities.ts b/x-pack/legacy/plugins/siem/public/components/ml/api/get_ml_capabilities.ts
index dcfd7365f8e0d..feafbba2024dc 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml/api/get_ml_capabilities.ts
+++ b/x-pack/legacy/plugins/siem/public/components/ml/api/get_ml_capabilities.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
-
 import { InfluencerInput, MlCapabilities } from '../types';
 import { throwIfNotOk } from '../../../hooks/api/api';
+import { KibanaServices } from '../../../lib/kibana';
 
 export interface Body {
   jobIds: string[];
@@ -23,12 +22,15 @@ export interface Body {
 }
 
 export const getMlCapabilities = async (signal: AbortSignal): Promise<MlCapabilities> => {
-  const response = await npStart.core.http.fetch<MlCapabilities>('/api/ml/ml_capabilities', {
-    method: 'GET',
-    asResponse: true,
-    asSystemRequest: true,
-    signal,
-  });
+  const response = await KibanaServices.get().http.fetch<MlCapabilities>(
+    '/api/ml/ml_capabilities',
+    {
+      method: 'GET',
+      asResponse: true,
+      asSystemRequest: true,
+      signal,
+    }
+  );
 
   await throwIfNotOk(response.response);
   return response.body!;
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/api.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/api.tsx
index cf939d8e09b7e..120fd8c404ffd 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/api.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/api.tsx
@@ -4,8 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
-
 import {
   CheckRecognizerProps,
   CloseJobsResponse,
@@ -21,6 +19,7 @@ import {
 } from './types';
 import { throwIfErrorAttached, throwIfErrorAttachedToSetup } from '../ml/api/throw_if_not_ok';
 import { throwIfNotOk } from '../../hooks/api/api';
+import { KibanaServices } from '../../lib/kibana';
 
 /**
  * Checks the ML Recognizer API to see if a given indexPattern has any compatible modules
@@ -32,7 +31,7 @@ export const checkRecognizer = async ({
   indexPatternName,
   signal,
 }: CheckRecognizerProps): Promise<RecognizerModule[]> => {
-  const response = await npStart.core.http.fetch<RecognizerModule[]>(
+  const response = await KibanaServices.get().http.fetch<RecognizerModule[]>(
     `/api/ml/modules/recognize/${indexPatternName}`,
     {
       method: 'GET',
@@ -53,7 +52,7 @@ export const checkRecognizer = async ({
  * @param signal to cancel request
  */
 export const getModules = async ({ moduleId = '', signal }: GetModulesProps): Promise<Module[]> => {
-  const response = await npStart.core.http.fetch<Module[]>(
+  const response = await KibanaServices.get().http.fetch<Module[]>(
     `/api/ml/modules/get_module/${moduleId}`,
     {
       method: 'GET',
@@ -83,7 +82,7 @@ export const setupMlJob = async ({
   groups = ['siem'],
   prefix = '',
 }: MlSetupArgs): Promise<SetupMlResponse> => {
-  const response = await npStart.core.http.fetch<SetupMlResponse>(
+  const response = await KibanaServices.get().http.fetch<SetupMlResponse>(
     `/api/ml/modules/setup/${configTemplate}`,
     {
       method: 'POST',
@@ -119,7 +118,7 @@ export const startDatafeeds = async ({
   datafeedIds: string[];
   start: number;
 }): Promise<StartDatafeedResponse> => {
-  const response = await npStart.core.http.fetch<StartDatafeedResponse>(
+  const response = await KibanaServices.get().http.fetch<StartDatafeedResponse>(
     '/api/ml/jobs/force_start_datafeeds',
     {
       method: 'POST',
@@ -149,7 +148,7 @@ export const stopDatafeeds = async ({
 }: {
   datafeedIds: string[];
 }): Promise<[StopDatafeedResponse | ErrorResponse, CloseJobsResponse]> => {
-  const stopDatafeedsResponse = await npStart.core.http.fetch<StopDatafeedResponse>(
+  const stopDatafeedsResponse = await KibanaServices.get().http.fetch<StopDatafeedResponse>(
     '/api/ml/jobs/stop_datafeeds',
     {
       method: 'POST',
@@ -165,7 +164,7 @@ export const stopDatafeeds = async ({
   const stopDatafeedsResponseJson = stopDatafeedsResponse.body!;
 
   const datafeedPrefix = 'datafeed-';
-  const closeJobsResponse = await npStart.core.http.fetch<CloseJobsResponse>(
+  const closeJobsResponse = await KibanaServices.get().http.fetch<CloseJobsResponse>(
     '/api/ml/jobs/close_jobs',
     {
       method: 'POST',
@@ -194,13 +193,16 @@ export const stopDatafeeds = async ({
  * @param signal to cancel request
  */
 export const getJobsSummary = async (signal: AbortSignal): Promise<JobSummary[]> => {
-  const response = await npStart.core.http.fetch<JobSummary[]>('/api/ml/jobs/jobs_summary', {
-    method: 'POST',
-    body: JSON.stringify({}),
-    asResponse: true,
-    asSystemRequest: true,
-    signal,
-  });
+  const response = await KibanaServices.get().http.fetch<JobSummary[]>(
+    '/api/ml/jobs/jobs_summary',
+    {
+      method: 'POST',
+      body: JSON.stringify({}),
+      asResponse: true,
+      asSystemRequest: true,
+      signal,
+    }
+  );
 
   await throwIfNotOk(response.response);
   return response.body!;
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.test.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.test.tsx
index fa524d8ff3dbc..c9307afbd3dbf 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.test.tsx
@@ -11,6 +11,8 @@ import { mockSiemJobs } from '../__mocks__/api';
 import { cloneDeep } from 'lodash/fp';
 import { SiemJob } from '../types';
 
+jest.mock('../../../lib/kibana');
+
 describe('JobsTableComponent', () => {
   let siemJobs: SiemJob[];
   let onJobStateChangeMock = jest.fn();
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.tsx
index 34597f1761629..5bca802a21747 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/jobs_table/jobs_table.tsx
@@ -6,7 +6,6 @@
 
 /* eslint-disable react/display-name */
 
-import chrome from 'ui/chrome';
 import React, { useEffect, useState } from 'react';
 
 import {
@@ -23,6 +22,7 @@ import {
 } from '@elastic/eui';
 
 import styled from 'styled-components';
+import { useBasePath } from '../../../lib/kibana';
 import * as i18n from './translations';
 import { JobSwitch } from './job_switch';
 import { SiemJob } from '../types';
@@ -38,7 +38,8 @@ const truncateThreshold = 200;
 
 const getJobsTableColumns = (
   isLoading: boolean,
-  onJobStateChange: (job: SiemJob, latestTimestampMs: number, enable: boolean) => Promise<void>
+  onJobStateChange: (job: SiemJob, latestTimestampMs: number, enable: boolean) => Promise<void>,
+  basePath: string
 ) => [
   {
     name: i18n.COLUMN_JOB_NAME,
@@ -46,7 +47,7 @@ const getJobsTableColumns = (
       <JobNameWrapper>
         <EuiLink
           data-test-subj="jobs-table-link"
-          href={`${chrome.getBasePath()}/app/ml#/jobs?mlManagement=(jobId:${encodeURI(id)})`}
+          href={`${basePath}/app/ml#/jobs?mlManagement=(jobId:${encodeURI(id)})`}
           target="_blank"
         >
           <EuiText size="s">{id}</EuiText>
@@ -97,6 +98,7 @@ export interface JobTableProps {
 
 export const JobsTableComponent = ({ isLoading, jobs, onJobStateChange }: JobTableProps) => {
   const [pageIndex, setPageIndex] = useState(0);
+  const basePath = useBasePath();
   const pageSize = 5;
 
   const pagination = {
@@ -114,7 +116,7 @@ export const JobsTableComponent = ({ isLoading, jobs, onJobStateChange }: JobTab
     <EuiBasicTable
       data-test-subj="jobs-table"
       compressed={true}
-      columns={getJobsTableColumns(isLoading, onJobStateChange)}
+      columns={getJobsTableColumns(isLoading, onJobStateChange, basePath)}
       items={getPaginatedItems(jobs, pageIndex, pageSize)}
       loading={isLoading}
       noItemsMessage={<NoItemsMessage />}
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.test.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.test.tsx
index e611a5234da5e..a179c0e266940 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.test.tsx
@@ -8,6 +8,8 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import { PopoverDescriptionComponent } from './popover_description';
 
+jest.mock('../../lib/kibana');
+
 describe('JobsTableFilters', () => {
   test('renders correctly against snapshot', () => {
     const wrapper = shallow(<PopoverDescriptionComponent />);
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
index c9cc1c5d4e539..20e8dd2492fef 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/popover_description.tsx
@@ -7,7 +7,8 @@
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
 import { EuiLink, EuiText } from '@elastic/eui';
-import chrome from 'ui/chrome';
+
+import { useBasePath } from '../../lib/kibana';
 
 export const PopoverDescriptionComponent = () => (
   <EuiText size="s">
@@ -16,7 +17,7 @@ export const PopoverDescriptionComponent = () => (
       defaultMessage="Run any of the Machine Learning jobs below to view anomalous events throughout the SIEM application. We’ve provided a few common detection jobs to get you started. If you wish to add your own custom jobs, simply create and tag them with “SIEM” from the {machineLearning} application for inclusion here."
       values={{
         machineLearning: (
-          <EuiLink href={`${chrome.getBasePath()}/app/ml`} target="_blank">
+          <EuiLink href={`${useBasePath()}/app/ml`} target="_blank">
             <FormattedMessage
               id="xpack.siem.components.mlPopup.machineLearningLink"
               defaultMessage="Machine Learning"
@@ -27,7 +28,6 @@ export const PopoverDescriptionComponent = () => (
     />
   </EuiText>
 );
-
 PopoverDescriptionComponent.displayName = 'PopoverDescriptionComponent';
 
 export const PopoverDescription = React.memo(PopoverDescriptionComponent);
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.test.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.test.tsx
index 2ba08073b25b9..1d2d344c3b7af 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.test.tsx
@@ -8,6 +8,8 @@ import { shallow } from 'enzyme';
 import React from 'react';
 import { UpgradeContentsComponent } from './upgrade_contents';
 
+jest.mock('../../lib/kibana');
+
 describe('JobsTableFilters', () => {
   test('renders correctly against snapshot', () => {
     const wrapper = shallow(<UpgradeContentsComponent />);
diff --git a/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.tsx b/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.tsx
index a337e234f11d3..5a483e0d5b876 100644
--- a/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/ml_popover/upgrade_contents.tsx
@@ -5,7 +5,6 @@
  */
 
 import React from 'react';
-import chrome from 'ui/chrome';
 
 import styled from 'styled-components';
 import {
@@ -18,6 +17,7 @@ import {
   EuiFlexItem,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { useBasePath } from '../../lib/kibana';
 import * as i18n from './translations';
 
 const PopoverContentsDiv = styled.div`
@@ -59,7 +59,7 @@ export const UpgradeContentsComponent = () => (
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
         <EuiButton
-          href={`${chrome.getBasePath()}/app/kibana#/management/elasticsearch/license_management`}
+          href={`${useBasePath()}/app/kibana#/management/elasticsearch/license_management`}
           iconType="gear"
           target="_blank"
         >
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.test.ts b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.test.ts
index fc0a37bc751c7..7770780fb9613 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.test.ts
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.test.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import chrome from 'ui/chrome';
 import '../../../mock/match_media';
 import { encodeIpv6 } from '../../../lib/helpers';
 
@@ -13,23 +12,11 @@ import { RouteSpyState, SiemRouteType } from '../../../utils/route/types';
 import { TabNavigationProps } from '../tab_navigation/types';
 import { NetworkRouteType } from '../../../pages/network/navigation/types';
 
-jest.mock('ui/chrome', () => ({
-  getBasePath: () => {
-    return '<basepath>';
-  },
-  breadcrumbs: {
-    set: jest.fn(),
-  },
-  getUiSettingsClient: () => ({
-    get: jest.fn(),
-  }),
-}));
-
-jest.mock('../../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
+const setBreadcrumbsMock = jest.fn();
+const chromeMock = {
+  setBreadcrumbs: setBreadcrumbsMock,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+} as any;
 
 const mockDefaultTab = (pageName: string): SiemRouteType | undefined => {
   switch (pageName) {
@@ -217,10 +204,11 @@ describe('Navigation Breadcrumbs', () => {
       ]);
     });
   });
+
   describe('setBreadcrumbs()', () => {
     test('should call chrome breadcrumb service with correct breadcrumbs', () => {
-      setBreadcrumbs(getMockObject('hosts', '/hosts', hostName));
-      expect(chrome.breadcrumbs.set).toBeCalledWith([
+      setBreadcrumbs(getMockObject('hosts', '/hosts', hostName), chromeMock);
+      expect(setBreadcrumbsMock).toBeCalledWith([
         { text: 'SIEM', href: '#/link-to/overview' },
         {
           text: 'Hosts',
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
index 91055bca066c4..e8d5032fd7548 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import chrome, { Breadcrumb } from 'ui/chrome';
-
 import { getOr, omit } from 'lodash/fp';
+
+import { ChromeBreadcrumb } from '../../../../../../../../src/core/public';
 import { APP_NAME } from '../../../../common/constants';
+import { StartServices } from '../../../plugin';
 import { getBreadcrumbs as getHostDetailsBreadcrumbs } from '../../../pages/hosts/details/utils';
 import { getBreadcrumbs as getIPDetailsBreadcrumbs } from '../../../pages/network/ip_details';
 import { getBreadcrumbs as getDetectionRulesBreadcrumbs } from '../../../pages/detection_engine/rules/utils';
@@ -19,14 +20,17 @@ import { TabNavigationProps } from '../tab_navigation/types';
 import { getSearch } from '../helpers';
 import { SearchNavTab } from '../types';
 
-export const setBreadcrumbs = (spyState: RouteSpyState & TabNavigationProps) => {
+export const setBreadcrumbs = (
+  spyState: RouteSpyState & TabNavigationProps,
+  chrome: StartServices['chrome']
+) => {
   const breadcrumbs = getBreadcrumbsForRoute(spyState);
   if (breadcrumbs) {
-    chrome.breadcrumbs.set(breadcrumbs);
+    chrome.setBreadcrumbs(breadcrumbs);
   }
 };
 
-export const siemRootBreadcrumb: Breadcrumb[] = [
+export const siemRootBreadcrumb: ChromeBreadcrumb[] = [
   {
     text: APP_NAME,
     href: getOverviewUrl(),
@@ -44,7 +48,7 @@ const isDetectionsRoutes = (spyState: RouteSpyState) =>
 
 export const getBreadcrumbsForRoute = (
   object: RouteSpyState & TabNavigationProps
-): Breadcrumb[] | null => {
+): ChromeBreadcrumb[] | null => {
   const spyState: RouteSpyState = omit('navTabs', object);
   if (isHostsRoutes(spyState) && object.navTabs) {
     const tempNav: SearchNavTab = { urlKey: 'host', isDetailPage: false };
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/helpers.ts b/x-pack/legacy/plugins/siem/public/components/navigation/helpers.ts
index b61ef7165dcc3..7a5cc106dbcd8 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/helpers.ts
@@ -53,7 +53,7 @@ export const getSearch = (tab: SearchNavTab, urlState: TabNavigationProps): stri
           replaceStateKeyInQueryString(
             urlKey,
             urlStateToReplace
-          )(getQueryStringFromLocation(myLocation))
+          )(getQueryStringFromLocation(myLocation.search))
         );
       },
       {
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/navigation/index.test.tsx
index 56be39f67b1bd..ac7a4a0ee52b7 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/index.test.tsx
@@ -61,79 +61,83 @@ describe('SIEM Navigation', () => {
   };
   const wrapper = mount(<SiemNavigationComponent {...mockProps} />);
   test('it calls setBreadcrumbs with correct path on mount', () => {
-    expect(setBreadcrumbs).toHaveBeenNthCalledWith(1, {
-      detailName: undefined,
-      navTabs: {
-        detections: {
-          disabled: false,
-          href: '#/link-to/detections',
-          id: 'detections',
-          name: 'Detections',
-          urlKey: 'detections',
-        },
-        hosts: {
-          disabled: false,
-          href: '#/link-to/hosts',
-          id: 'hosts',
-          name: 'Hosts',
-          urlKey: 'host',
-        },
-        network: {
-          disabled: false,
-          href: '#/link-to/network',
-          id: 'network',
-          name: 'Network',
-          urlKey: 'network',
-        },
-        overview: {
-          disabled: false,
-          href: '#/link-to/overview',
-          id: 'overview',
-          name: 'Overview',
-          urlKey: 'overview',
-        },
-        timelines: {
-          disabled: false,
-          href: '#/link-to/timelines',
-          id: 'timelines',
-          name: 'Timelines',
-          urlKey: 'timeline',
-        },
-      },
-      pageName: 'hosts',
-      pathName: '/hosts',
-      search: '',
-      tabName: 'authentications',
-      query: { query: '', language: 'kuery' },
-      filters: [],
-      savedQuery: undefined,
-      timeline: {
-        id: '',
-        isOpen: false,
-      },
-      timerange: {
-        global: {
-          linkTo: ['timeline'],
-          timerange: {
-            from: 1558048243696,
-            fromStr: 'now-24h',
-            kind: 'relative',
-            to: 1558134643697,
-            toStr: 'now',
+    expect(setBreadcrumbs).toHaveBeenNthCalledWith(
+      1,
+      {
+        detailName: undefined,
+        navTabs: {
+          detections: {
+            disabled: false,
+            href: '#/link-to/detections',
+            id: 'detections',
+            name: 'Detections',
+            urlKey: 'detections',
+          },
+          hosts: {
+            disabled: false,
+            href: '#/link-to/hosts',
+            id: 'hosts',
+            name: 'Hosts',
+            urlKey: 'host',
+          },
+          network: {
+            disabled: false,
+            href: '#/link-to/network',
+            id: 'network',
+            name: 'Network',
+            urlKey: 'network',
+          },
+          overview: {
+            disabled: false,
+            href: '#/link-to/overview',
+            id: 'overview',
+            name: 'Overview',
+            urlKey: 'overview',
+          },
+          timelines: {
+            disabled: false,
+            href: '#/link-to/timelines',
+            id: 'timelines',
+            name: 'Timelines',
+            urlKey: 'timeline',
           },
         },
+        pageName: 'hosts',
+        pathName: '/hosts',
+        search: '',
+        tabName: 'authentications',
+        query: { query: '', language: 'kuery' },
+        filters: [],
+        savedQuery: undefined,
         timeline: {
-          linkTo: ['global'],
-          timerange: {
-            from: 1558048243696,
-            fromStr: 'now-24h',
-            kind: 'relative',
-            to: 1558134643697,
-            toStr: 'now',
+          id: '',
+          isOpen: false,
+        },
+        timerange: {
+          global: {
+            linkTo: ['timeline'],
+            timerange: {
+              from: 1558048243696,
+              fromStr: 'now-24h',
+              kind: 'relative',
+              to: 1558134643697,
+              toStr: 'now',
+            },
+          },
+          timeline: {
+            linkTo: ['global'],
+            timerange: {
+              from: 1558048243696,
+              fromStr: 'now-24h',
+              kind: 'relative',
+              to: 1558134643697,
+              toStr: 'now',
+            },
           },
         },
       },
-    });
+      undefined
+    );
   });
   test('it calls setBreadcrumbs with correct path on update', () => {
     wrapper.setProps({
@@ -142,76 +146,80 @@ describe('SIEM Navigation', () => {
       tabName: undefined,
     });
     wrapper.update();
-    expect(setBreadcrumbs).toHaveBeenNthCalledWith(1, {
-      detailName: undefined,
-      filters: [],
-      navTabs: {
-        detections: {
-          disabled: false,
-          href: '#/link-to/detections',
-          id: 'detections',
-          name: 'Detections',
-          urlKey: 'detections',
-        },
-        hosts: {
-          disabled: false,
-          href: '#/link-to/hosts',
-          id: 'hosts',
-          name: 'Hosts',
-          urlKey: 'host',
-        },
-        network: {
-          disabled: false,
-          href: '#/link-to/network',
-          id: 'network',
-          name: 'Network',
-          urlKey: 'network',
-        },
-        overview: {
-          disabled: false,
-          href: '#/link-to/overview',
-          id: 'overview',
-          name: 'Overview',
-          urlKey: 'overview',
-        },
-        timelines: {
-          disabled: false,
-          href: '#/link-to/timelines',
-          id: 'timelines',
-          name: 'Timelines',
-          urlKey: 'timeline',
-        },
-      },
-      pageName: 'hosts',
-      pathName: '/hosts',
-      query: { language: 'kuery', query: '' },
-      savedQuery: undefined,
-      search: '',
-      state: undefined,
-      tabName: 'authentications',
-      timeline: { id: '', isOpen: false },
-      timerange: {
-        global: {
-          linkTo: ['timeline'],
-          timerange: {
-            from: 1558048243696,
-            fromStr: 'now-24h',
-            kind: 'relative',
-            to: 1558134643697,
-            toStr: 'now',
+    expect(setBreadcrumbs).toHaveBeenNthCalledWith(
+      1,
+      {
+        detailName: undefined,
+        filters: [],
+        navTabs: {
+          detections: {
+            disabled: false,
+            href: '#/link-to/detections',
+            id: 'detections',
+            name: 'Detections',
+            urlKey: 'detections',
+          },
+          hosts: {
+            disabled: false,
+            href: '#/link-to/hosts',
+            id: 'hosts',
+            name: 'Hosts',
+            urlKey: 'host',
+          },
+          network: {
+            disabled: false,
+            href: '#/link-to/network',
+            id: 'network',
+            name: 'Network',
+            urlKey: 'network',
+          },
+          overview: {
+            disabled: false,
+            href: '#/link-to/overview',
+            id: 'overview',
+            name: 'Overview',
+            urlKey: 'overview',
+          },
+          timelines: {
+            disabled: false,
+            href: '#/link-to/timelines',
+            id: 'timelines',
+            name: 'Timelines',
+            urlKey: 'timeline',
           },
         },
-        timeline: {
-          linkTo: ['global'],
-          timerange: {
-            from: 1558048243696,
-            fromStr: 'now-24h',
-            kind: 'relative',
-            to: 1558134643697,
-            toStr: 'now',
+        pageName: 'hosts',
+        pathName: '/hosts',
+        query: { language: 'kuery', query: '' },
+        savedQuery: undefined,
+        search: '',
+        state: undefined,
+        tabName: 'authentications',
+        timeline: { id: '', isOpen: false },
+        timerange: {
+          global: {
+            linkTo: ['timeline'],
+            timerange: {
+              from: 1558048243696,
+              fromStr: 'now-24h',
+              kind: 'relative',
+              to: 1558134643697,
+              toStr: 'now',
+            },
+          },
+          timeline: {
+            linkTo: ['global'],
+            timerange: {
+              from: 1558048243696,
+              fromStr: 'now-24h',
+              kind: 'relative',
+              to: 1558134643697,
+              toStr: 'now',
+            },
           },
         },
       },
-    });
+      undefined
+    );
   });
 });
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/index.tsx b/x-pack/legacy/plugins/siem/public/components/navigation/index.tsx
index 040a6e7847b77..e40cc887ab5ff 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/index.tsx
@@ -10,6 +10,7 @@ import React, { useEffect } from 'react';
 import { connect } from 'react-redux';
 import { compose } from 'redux';
 
+import { useKibana } from '../../lib/kibana';
 import { RouteSpyState } from '../../utils/route/types';
 import { useRouteSpy } from '../../utils/route/use_route_spy';
 import { makeMapStateToProps } from '../url_state/helpers';
@@ -31,25 +32,30 @@ export const SiemNavigationComponent: React.FC<SiemNavigationComponentProps &
   flowTarget,
   state,
 }) => {
+  const { chrome } = useKibana().services;
+
   useEffect(() => {
     if (pathName) {
-      setBreadcrumbs({
-        query: urlState.query,
-        detailName,
-        filters: urlState.filters,
-        navTabs,
-        pageName,
-        pathName,
-        savedQuery: urlState.savedQuery,
-        search,
-        tabName,
-        flowTarget,
-        timerange: urlState.timerange,
-        timeline: urlState.timeline,
-        state,
-      });
+      setBreadcrumbs(
+        {
+          query: urlState.query,
+          detailName,
+          filters: urlState.filters,
+          navTabs,
+          pageName,
+          pathName,
+          savedQuery: urlState.savedQuery,
+          search,
+          tabName,
+          flowTarget,
+          timerange: urlState.timerange,
+          timeline: urlState.timeline,
+          state,
+        },
+        chrome
+      );
     }
-  }, [pathName, search, navTabs, urlState, state]);
+  }, [chrome, pathName, search, navTabs, urlState, state]);
 
   return (
     <TabNavigation
diff --git a/x-pack/legacy/plugins/siem/public/components/open_timeline/helpers.ts b/x-pack/legacy/plugins/siem/public/components/open_timeline/helpers.ts
index c6cc75d74cad7..432939b0729d7 100644
--- a/x-pack/legacy/plugins/siem/public/components/open_timeline/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/components/open_timeline/helpers.ts
@@ -28,7 +28,7 @@ import {
 import { DEFAULT_DATE_COLUMN_MIN_WIDTH, DEFAULT_COLUMN_MIN_WIDTH } from '../timeline/body/helpers';
 
 import { OpenTimelineResult, UpdateTimeline, DispatchUpdateTimeline } from './types';
-import { getDefaultFromValue, getDefaultToValue } from '../../utils/default_date_settings';
+import { getTimeRangeSettings } from '../../utils/default_date_settings';
 
 export const OPEN_TIMELINE_CLASS_NAME = 'open-timeline';
 
@@ -214,16 +214,17 @@ export const queryTimelineById = <TCache>({
         if (onOpenTimeline != null) {
           onOpenTimeline(timeline);
         } else if (updateTimeline) {
+          const { from, to } = getTimeRangeSettings();
           updateTimeline({
             duplicate,
-            from: getOr(getDefaultFromValue(), 'dateRange.start', timeline),
+            from: getOr(from, 'dateRange.start', timeline),
             id: 'timeline-1',
             notes,
             timeline: {
               ...timeline,
               show: openTimeline,
             },
-            to: getOr(getDefaultToValue(), 'dateRange.end', timeline),
+            to: getOr(to, 'dateRange.end', timeline),
           })();
         }
       })
diff --git a/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.test.tsx
index 345701c97901f..54a516fef69ed 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.test.tsx
@@ -9,21 +9,22 @@ import React from 'react';
 
 import { apolloClientObservable, mockGlobalState, TestProviders } from '../../../mock';
 import { createStore, State } from '../../../store';
-import { siemFilterManager } from '../../search_bar';
 import { AddFilterToGlobalSearchBar } from '.';
-import { esFilters } from '../../../../../../../../src/plugins/data/public';
 
-interface MockSiemFilterManager {
-  addFilters: (filters: esFilters.Filter[]) => void;
-}
-const mockSiemFilterManager: MockSiemFilterManager = siemFilterManager as MockSiemFilterManager;
-jest.mock('../../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
 const mockAddFilters = jest.fn();
-mockSiemFilterManager.addFilters = mockAddFilters;
+jest.mock('../../../lib/kibana', () => ({
+  useKibana: () => ({
+    services: {
+      data: {
+        query: {
+          filterManager: {
+            addFilters: mockAddFilters,
+          },
+        },
+      },
+    },
+  }),
+}));
 
 describe('AddFilterToGlobalSearchBar Component', () => {
   const state: State = mockGlobalState;
@@ -31,6 +32,7 @@ describe('AddFilterToGlobalSearchBar Component', () => {
 
   beforeEach(() => {
     store = createStore(state, apolloClientObservable);
+    mockAddFilters.mockClear();
   });
 
   test('Rendering', async () => {
diff --git a/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.tsx b/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.tsx
index 012d8322fa329..d6f1e2dd509be 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/page/add_filter_to_global_search_bar/index.tsx
@@ -5,12 +5,12 @@
  */
 
 import { EuiIcon, EuiPanel, EuiToolTip } from '@elastic/eui';
-import React from 'react';
+import React, { useCallback } from 'react';
 import styled from 'styled-components';
 
-import { WithHoverActions } from '../../with_hover_actions';
-import { siemFilterManager } from '../../search_bar';
 import { esFilters } from '../../../../../../../../src/plugins/data/public';
+import { WithHoverActions } from '../../with_hover_actions';
+import { useKibana } from '../../../lib/kibana';
 
 import * as i18n from './translations';
 
@@ -24,12 +24,15 @@ interface OwnProps {
 
 export const AddFilterToGlobalSearchBar = React.memo<OwnProps>(
   ({ children, filter, onFilterAdded }) => {
-    const addToKql = () => {
-      siemFilterManager.addFilters(filter);
+    const { filterManager } = useKibana().services.data.query;
+
+    const addToKql = useCallback(() => {
+      filterManager.addFilters(filter);
       if (onFilterAdded != null) {
         onFilterAdded();
       }
-    };
+    }, [filter, filterManager, onFilterAdded]);
+
     return (
       <WithHoverActions
         hoverContent={
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/users_table/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/page/network/users_table/index.test.tsx
index b23c7bd504fb7..8dc3704a089ea 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/network/users_table/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/page/network/users_table/index.test.tsx
@@ -18,12 +18,6 @@ import { createStore, networkModel, State } from '../../../../store';
 import { UsersTable } from '.';
 import { mockUsersData } from './mock';
 
-jest.mock('../../../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
-
 describe('Users Table Component', () => {
   const loadPage = jest.fn();
   const state: State = mockGlobalState;
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/helpers.ts b/x-pack/legacy/plugins/siem/public/components/recent_timelines/helpers.ts
index 61b49da01dc3a..41fa90f1776e6 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/helpers.ts
@@ -5,22 +5,16 @@
  */
 
 import { throwIfNotOk } from '../../hooks/api/api';
+import { KibanaServices } from '../../lib/kibana';
 import { MeApiResponse } from './recent_timelines';
 
-export const getMeApiUrl = (getBasePath: () => string): string =>
-  `${getBasePath()}/internal/security/me`;
-
-export const fetchUsername = async (meApiUrl: string) => {
-  const response = await fetch(meApiUrl, {
+export const fetchUsername = async () => {
+  const response = await KibanaServices.get().http.fetch<MeApiResponse>('/internal/security/me', {
     method: 'GET',
     credentials: 'same-origin',
-    headers: {
-      'content-type': 'application/json',
-    },
+    asResponse: true,
   });
 
-  await throwIfNotOk(response);
-  const apiResponse: MeApiResponse = await response.json();
-
-  return apiResponse.username;
+  await throwIfNotOk(response.response);
+  return response.body!.username;
 };
diff --git a/x-pack/legacy/plugins/siem/public/components/search_bar/index.tsx b/x-pack/legacy/plugins/siem/public/components/search_bar/index.tsx
index 089bade4a4144..7ea13ca97a9c8 100644
--- a/x-pack/legacy/plugins/siem/public/components/search_bar/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/search_bar/index.tsx
@@ -10,11 +10,10 @@ import { connect } from 'react-redux';
 import { Dispatch } from 'redux';
 import { Subscription } from 'rxjs';
 import styled from 'styled-components';
-import { IIndexPattern } from 'src/plugins/data/public';
+import { FilterManager, IIndexPattern, TimeRange, Query, esFilters } from 'src/plugins/data/public';
 import { SavedQuery } from 'src/legacy/core_plugins/data/public';
 
 import { OnTimeChangeProps } from '@elastic/eui';
-import { npStart } from 'ui/new_platform';
 
 import { inputsActions } from '../../store/inputs';
 import { InputsRange } from '../../store/inputs/model';
@@ -33,11 +32,7 @@ import {
   toStrSelector,
 } from './selectors';
 import { timelineActions, hostsActions, networkActions } from '../../store/actions';
-import { TimeRange, Query, esFilters } from '../../../../../../../src/plugins/data/public';
-
-export const siemFilterManager = npStart.plugins.data.query.filterManager;
-export const savedQueryService = npStart.plugins.data.query.savedQueries;
-const { SearchBar } = npStart.plugins.data.ui;
+import { useKibana } from '../../lib/kibana';
 
 interface SiemSearchBarRedux {
   end: number;
@@ -93,7 +88,12 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
     updateSearch,
     dataTestSubj,
   }) => {
-    const { timefilter } = npStart.plugins.data.query.timefilter;
+    const { data } = useKibana().services;
+    const {
+      timefilter: { timefilter },
+      filterManager,
+    } = data.query;
+
     if (fromStr != null && toStr != null) {
       timefilter.setTime({ from: fromStr, to: toStr });
     } else if (start != null && end != null) {
@@ -114,6 +114,7 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
           isInvalid: false,
           isQuickSelection,
           updateTime: false,
+          filterManager,
         };
         let isStateUpdated = false;
 
@@ -161,12 +162,13 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
             isInvalid: false,
             isQuickSelection: true,
             updateTime: true,
+            filterManager,
           });
         } else {
           queries.forEach(q => q.refetch && (q.refetch as inputsModel.Refetch)());
         }
       },
-      [id, queries]
+      [id, queries, filterManager]
     );
 
     const onSaved = useCallback(
@@ -191,6 +193,7 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
           isInvalid: false,
           isQuickSelection,
           updateTime: false,
+          filterManager,
         };
 
         if (savedQueryUpdated.attributes.timefilter) {
@@ -227,21 +230,22 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
           },
           resetSavedQuery: true,
           savedQuery: undefined,
+          filterManager,
         });
       }
-    }, [id, end, fromStr, start, toStr, savedQuery]);
+    }, [id, end, filterManager, fromStr, start, toStr, savedQuery]);
 
     useEffect(() => {
       let isSubscribed = true;
       const subscriptions = new Subscription();
 
       subscriptions.add(
-        siemFilterManager.getUpdates$().subscribe({
+        filterManager.getUpdates$().subscribe({
           next: () => {
             if (isSubscribed) {
               setSearchBarFilter({
                 id,
-                filters: siemFilterManager.getFilters(),
+                filters: filterManager.getFilters(),
               });
             }
           },
@@ -256,7 +260,7 @@ const SearchBarComponent = memo<SiemSearchBarProps & SiemSearchBarRedux & SiemSe
     const indexPatterns = useMemo(() => [indexPattern], [indexPattern]);
     return (
       <SearchBarContainer data-test-subj={`${id}DatePicker`}>
-        <SearchBar
+        <data.ui.SearchBar
           appName="siem"
           isLoading={isLoading}
           indexPatterns={indexPatterns}
@@ -310,6 +314,7 @@ SearchBarComponent.displayName = 'SiemSearchBar';
 interface UpdateReduxSearchBar extends OnTimeChangeProps {
   id: InputsModelId;
   filters?: esFilters.Filter[];
+  filterManager: FilterManager;
   query?: Query;
   savedQuery?: SavedQuery;
   resetSavedQuery?: boolean;
@@ -325,7 +330,7 @@ type DispatchUpdateSearch = ({
   timelineId,
 }: UpdateReduxSearchBar) => void;
 
-export const dispatchUpdateSearch = (dispatch: Dispatch) => ({
+const dispatchUpdateSearch = (dispatch: Dispatch) => ({
   end,
   filters,
   id,
@@ -335,6 +340,7 @@ export const dispatchUpdateSearch = (dispatch: Dispatch) => ({
   savedQuery,
   start,
   timelineId,
+  filterManager,
   updateTime = false,
 }: UpdateReduxSearchBar): void => {
   if (updateTime) {
@@ -379,7 +385,7 @@ export const dispatchUpdateSearch = (dispatch: Dispatch) => ({
     );
   }
   if (filters != null) {
-    siemFilterManager.setFilters(filters);
+    filterManager.setFilters(filters);
   }
   if (savedQuery != null || resetSavedQuery) {
     dispatch(inputsActions.setSavedQuery({ id, savedQuery }));
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/helpers.ts b/x-pack/legacy/plugins/siem/public/components/url_state/helpers.ts
index 6ba5810f794b0..03fdbe2219acc 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/helpers.ts
@@ -4,24 +4,32 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { decode, encode, RisonValue } from 'rison-node';
-import { Location } from 'history';
+import { decode, encode } from 'rison-node';
+import * as H from 'history';
 import { QueryString } from 'ui/utils/query_string';
 import { Query, esFilters } from 'src/plugins/data/public';
 
-import { inputsSelectors, State, timelineSelectors } from '../../store';
+import { isEmpty } from 'lodash/fp';
 import { SiemPageName } from '../../pages/home/types';
+import { inputsSelectors, State, timelineSelectors } from '../../store';
+import { UrlInputsModel } from '../../store/inputs/model';
+import { formatDate } from '../super_date_picker';
 import { NavTab } from '../navigation/types';
 import { CONSTANTS, UrlStateType } from './constants';
-import { LocationTypes, UrlStateContainerPropTypes } from './types';
+import {
+  LocationTypes,
+  UrlStateContainerPropTypes,
+  ReplaceStateInLocation,
+  Timeline,
+  UpdateUrlStateString,
+} from './types';
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export const decodeRisonUrlState = (value: string | undefined): RisonValue | any | undefined => {
+export const decodeRisonUrlState = <T>(value: string | undefined): T | null => {
   try {
-    return value ? decode(value) : undefined;
+    return value ? ((decode(value) as unknown) as T) : null;
   } catch (error) {
     if (error instanceof Error && error.message.startsWith('rison decoder error')) {
-      return {};
+      return null;
     }
     throw error;
   }
@@ -30,18 +38,16 @@ export const decodeRisonUrlState = (value: string | undefined): RisonValue | any
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const encodeRisonUrlState = (state: any) => encode(state);
 
-export const getQueryStringFromLocation = (location: Location) => location.search.substring(1);
+export const getQueryStringFromLocation = (search: string) => search.substring(1);
 
 export const getParamFromQueryString = (queryString: string, key: string): string | undefined => {
   const queryParam = QueryString.decode(queryString)[key];
   return Array.isArray(queryParam) ? queryParam[0] : queryParam;
 };
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export const replaceStateKeyInQueryString = <UrlState extends any>(
-  stateKey: string,
-  urlState: UrlState | undefined
-) => (queryString: string) => {
+export const replaceStateKeyInQueryString = <T>(stateKey: string, urlState: T) => (
+  queryString: string
+): string => {
   const previousQueryValues = QueryString.decode(queryString);
   if (urlState == null || (typeof urlState === 'string' && urlState === '')) {
     delete previousQueryValues[stateKey];
@@ -60,8 +66,11 @@ export const replaceStateKeyInQueryString = <UrlState extends any>(
   });
 };
 
-export const replaceQueryStringInLocation = (location: Location, queryString: string): Location => {
-  if (queryString === getQueryStringFromLocation(location)) {
+export const replaceQueryStringInLocation = (
+  location: H.Location,
+  queryString: string
+): H.Location => {
+  if (queryString === getQueryStringFromLocation(location.search)) {
     return location;
   } else {
     return {
@@ -173,3 +182,99 @@ export const makeMapStateToProps = () => {
 
   return mapStateToProps;
 };
+
+export const updateTimerangeUrl = (
+  timeRange: UrlInputsModel,
+  isInitializing: boolean
+): UrlInputsModel => {
+  if (timeRange.global.timerange.kind === 'relative') {
+    timeRange.global.timerange.from = formatDate(timeRange.global.timerange.fromStr);
+    timeRange.global.timerange.to = formatDate(timeRange.global.timerange.toStr, { roundUp: true });
+  }
+  if (timeRange.timeline.timerange.kind === 'relative' && isInitializing) {
+    timeRange.timeline.timerange.from = formatDate(timeRange.timeline.timerange.fromStr);
+    timeRange.timeline.timerange.to = formatDate(timeRange.timeline.timerange.toStr, {
+      roundUp: true,
+    });
+  }
+  return timeRange;
+};
+
+export const updateUrlStateString = ({
+  isInitializing,
+  history,
+  newUrlStateString,
+  pathName,
+  search,
+  updateTimerange,
+  urlKey,
+}: UpdateUrlStateString): string => {
+  if (urlKey === CONSTANTS.appQuery) {
+    const queryState = decodeRisonUrlState<Query>(newUrlStateString);
+    if (queryState != null && queryState.query === '') {
+      return replaceStateInLocation({
+        history,
+        pathName,
+        search,
+        urlStateToReplace: '',
+        urlStateKey: urlKey,
+      });
+    }
+  } else if (urlKey === CONSTANTS.timerange && updateTimerange) {
+    const queryState = decodeRisonUrlState<UrlInputsModel>(newUrlStateString);
+    if (queryState != null && queryState.global != null) {
+      return replaceStateInLocation({
+        history,
+        pathName,
+        search,
+        urlStateToReplace: updateTimerangeUrl(queryState, isInitializing),
+        urlStateKey: urlKey,
+      });
+    }
+  } else if (urlKey === CONSTANTS.filters) {
+    const queryState = decodeRisonUrlState<esFilters.Filter[]>(newUrlStateString);
+    if (isEmpty(queryState)) {
+      return replaceStateInLocation({
+        history,
+        pathName,
+        search,
+        urlStateToReplace: '',
+        urlStateKey: urlKey,
+      });
+    }
+  } else if (urlKey === CONSTANTS.timeline) {
+    const queryState = decodeRisonUrlState<Timeline>(newUrlStateString);
+    if (queryState != null && queryState.id === '') {
+      return replaceStateInLocation({
+        history,
+        pathName,
+        search,
+        urlStateToReplace: '',
+        urlStateKey: urlKey,
+      });
+    }
+  }
+  return search;
+};
+
+export const replaceStateInLocation = <T>({
+  history,
+  urlStateToReplace,
+  urlStateKey,
+  pathName,
+  search,
+}: ReplaceStateInLocation<T>) => {
+  const newLocation = replaceQueryStringInLocation(
+    {
+      hash: '',
+      pathname: pathName,
+      search,
+      state: '',
+    },
+    replaceStateKeyInQueryString(urlStateKey, urlStateToReplace)(getQueryStringFromLocation(search))
+  );
+  if (history) {
+    history.replace(newLocation);
+  }
+  return newLocation.search;
+};
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
index ab290c2f2fd67..10aa388449d91 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
@@ -10,7 +10,6 @@ import React from 'react';
 import { HookWrapper } from '../../mock';
 import { SiemPageName } from '../../pages/home/types';
 import { RouteSpyState } from '../../utils/route/types';
-
 import { CONSTANTS } from './constants';
 import {
   getMockPropsObj,
@@ -22,10 +21,10 @@ import {
 } from './test_dependencies';
 import { UrlStateContainerPropTypes } from './types';
 import { useUrlStateHooks } from './use_url_state';
+import { wait } from '../../lib/helpers';
 
 let mockProps: UrlStateContainerPropTypes;
 
-// const mockUseRouteSpy: jest.Mock = useRouteSpy as jest.Mock;
 const mockRouteSpy: RouteSpyState = {
   pageName: SiemPageName.network,
   detailName: undefined,
@@ -37,12 +36,25 @@ jest.mock('../../utils/route/use_route_spy', () => ({
   useRouteSpy: () => [mockRouteSpy],
 }));
 
-jest.mock('../search_bar', () => ({
-  siemFilterManager: {
-    setFilters: jest.fn(),
+jest.mock('../super_date_picker', () => ({
+  formatDate: (date: string) => {
+    return 11223344556677;
   },
 }));
 
+jest.mock('../../lib/kibana', () => ({
+  useKibana: () => ({
+    services: {
+      data: {
+        query: {
+          filterManager: {},
+          savedQueries: {},
+        },
+      },
+    },
+  }),
+}));
+
 describe('UrlStateContainer', () => {
   afterEach(() => {
     jest.resetAllMocks();
@@ -63,19 +75,19 @@ describe('UrlStateContainer', () => {
             mount(<HookWrapper hookProps={mockProps} hook={args => useUrlStateHooks(args)} />);
 
             expect(mockSetRelativeRangeDatePicker.mock.calls[1][0]).toEqual({
-              from: 1558591200000,
+              from: 11223344556677,
               fromStr: 'now-1d/d',
               kind: 'relative',
-              to: 1558677599999,
+              to: 11223344556677,
               toStr: 'now-1d/d',
               id: 'global',
             });
 
             expect(mockSetRelativeRangeDatePicker.mock.calls[0][0]).toEqual({
-              from: 1558732849370,
+              from: 11223344556677,
               fromStr: 'now-15m',
               kind: 'relative',
-              to: 1558733749370,
+              to: 11223344556677,
               toStr: 'now',
               id: 'timeline',
             });
@@ -155,4 +167,57 @@ describe('UrlStateContainer', () => {
       });
     });
   });
+
+  describe('After Initialization, keep Relative Date up to date for global only on detections page', () => {
+    test.each(testCases)(
+      '%o',
+      async (page, namespaceLower, namespaceUpper, examplePath, type, pageName, detailName) => {
+        mockProps = getMockPropsObj({
+          page,
+          examplePath,
+          namespaceLower,
+          pageName,
+          detailName,
+        }).relativeTimeSearch.undefinedQuery;
+        const wrapper = mount(
+          <HookWrapper hookProps={mockProps} hook={args => useUrlStateHooks(args)} />
+        );
+
+        wrapper.setProps({
+          hookProps: getMockPropsObj({
+            page: CONSTANTS.hostsPage,
+            examplePath: '/hosts',
+            namespaceLower: 'hosts',
+            pageName: SiemPageName.hosts,
+            detailName: undefined,
+          }).relativeTimeSearch.undefinedQuery,
+        });
+        wrapper.update();
+        await wait();
+
+        if (CONSTANTS.detectionsPage === page) {
+          expect(mockSetRelativeRangeDatePicker.mock.calls[3][0]).toEqual({
+            from: 11223344556677,
+            fromStr: 'now-1d/d',
+            kind: 'relative',
+            to: 11223344556677,
+            toStr: 'now-1d/d',
+            id: 'global',
+          });
+
+          expect(mockSetRelativeRangeDatePicker.mock.calls[2][0]).toEqual({
+            from: 1558732849370,
+            fromStr: 'now-15m',
+            kind: 'relative',
+            to: 1558733749370,
+            toStr: 'now',
+            id: 'timeline',
+          });
+        } else {
+          // There is no change in url state, so that's expected we only have two actions
+          expect(mockSetRelativeRangeDatePicker.mock.calls.length).toEqual(2);
+        }
+      }
+    );
+  });
 });
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/index_mocked.test.tsx b/x-pack/legacy/plugins/siem/public/components/url_state/index_mocked.test.tsx
index f673b77ea13c5..6995bc8bf1d40 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/index_mocked.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/index_mocked.test.tsx
@@ -15,14 +15,21 @@ import { getFilterQuery, getMockPropsObj, mockHistory, testCases } from './test_
 import { UrlStateContainerPropTypes } from './types';
 import { useUrlStateHooks } from './use_url_state';
 
-jest.mock('../search_bar', () => ({
-  siemFilterManager: {
-    addFilters: jest.fn(),
-  },
-}));
-
 let mockProps: UrlStateContainerPropTypes;
 
+jest.mock('../../lib/kibana', () => ({
+  useKibana: () => ({
+    services: {
+      data: {
+        query: {
+          filterManager: {},
+          savedQueries: {},
+        },
+      },
+    },
+  }),
+}));
+
 describe('UrlStateContainer - lodash.throttle mocked to test update url', () => {
   afterEach(() => {
     jest.clearAllMocks();
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/initialize_redux_by_url.tsx b/x-pack/legacy/plugins/siem/public/components/url_state/initialize_redux_by_url.tsx
index 013983c78a3a5..7796fde0fbcb4 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/initialize_redux_by_url.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/initialize_redux_by_url.tsx
@@ -6,7 +6,6 @@
 
 import { get, isEmpty } from 'lodash/fp';
 import { Dispatch } from 'redux';
-import { SavedQuery } from 'src/legacy/core_plugins/data/public';
 import { Query, esFilters } from 'src/plugins/data/public';
 
 import { inputsActions } from '../../store/actions';
@@ -17,12 +16,11 @@ import {
   AbsoluteTimeRange,
   RelativeTimeRange,
 } from '../../store/inputs/model';
-import { savedQueryService, siemFilterManager } from '../search_bar';
 
 import { CONSTANTS } from './constants';
 import { decodeRisonUrlState } from './helpers';
 import { normalizeTimeRange } from './normalize_time_range';
-import { DispatchSetInitialStateFromUrl, SetInitialStateFromUrl } from './types';
+import { DispatchSetInitialStateFromUrl, SetInitialStateFromUrl, Timeline } from './types';
 import { queryTimelineById } from '../open_timeline/helpers';
 
 export const dispatchSetInitialStateFromUrl = (
@@ -30,88 +28,21 @@ export const dispatchSetInitialStateFromUrl = (
 ): DispatchSetInitialStateFromUrl => ({
   apolloClient,
   detailName,
+  filterManager,
   indexPattern,
   pageName,
+  savedQueries,
   updateTimeline,
   updateTimelineIsLoading,
   urlStateToUpdate,
 }: SetInitialStateFromUrl<unknown>): (() => void) => () => {
   urlStateToUpdate.forEach(({ urlKey, newUrlStateString }) => {
     if (urlKey === CONSTANTS.timerange) {
-      const timerangeStateData: UrlInputsModel = decodeRisonUrlState(newUrlStateString);
-
-      const globalId: InputsModelId = 'global';
-      const globalLinkTo: LinkTo = { linkTo: get('global.linkTo', timerangeStateData) };
-      const globalType: TimeRangeKinds = get('global.timerange.kind', timerangeStateData);
-
-      const timelineId: InputsModelId = 'timeline';
-      const timelineLinkTo: LinkTo = { linkTo: get('timeline.linkTo', timerangeStateData) };
-      const timelineType: TimeRangeKinds = get('timeline.timerange.kind', timerangeStateData);
-
-      if (isEmpty(globalLinkTo.linkTo)) {
-        dispatch(inputsActions.removeGlobalLinkTo());
-      } else {
-        dispatch(inputsActions.addGlobalLinkTo({ linkToId: 'timeline' }));
-      }
-
-      if (isEmpty(timelineLinkTo.linkTo)) {
-        dispatch(inputsActions.removeTimelineLinkTo());
-      } else {
-        dispatch(inputsActions.addTimelineLinkTo({ linkToId: 'global' }));
-      }
-
-      if (timelineType) {
-        if (timelineType === 'absolute') {
-          const absoluteRange = normalizeTimeRange<AbsoluteTimeRange>(
-            get('timeline.timerange', timerangeStateData)
-          );
-          dispatch(
-            inputsActions.setAbsoluteRangeDatePicker({
-              ...absoluteRange,
-              id: timelineId,
-            })
-          );
-        }
-        if (timelineType === 'relative') {
-          const relativeRange = normalizeTimeRange<RelativeTimeRange>(
-            get('timeline.timerange', timerangeStateData)
-          );
-          dispatch(
-            inputsActions.setRelativeRangeDatePicker({
-              ...relativeRange,
-              id: timelineId,
-            })
-          );
-        }
-      }
-
-      if (globalType) {
-        if (globalType === 'absolute') {
-          const absoluteRange = normalizeTimeRange<AbsoluteTimeRange>(
-            get('global.timerange', timerangeStateData)
-          );
-          dispatch(
-            inputsActions.setAbsoluteRangeDatePicker({
-              ...absoluteRange,
-              id: globalId,
-            })
-          );
-        }
-        if (globalType === 'relative') {
-          const relativeRange = normalizeTimeRange<RelativeTimeRange>(
-            get('global.timerange', timerangeStateData)
-          );
-          dispatch(
-            inputsActions.setRelativeRangeDatePicker({
-              ...relativeRange,
-              id: globalId,
-            })
-          );
-        }
-      }
+      updateTimerange(newUrlStateString, dispatch);
     }
+
     if (urlKey === CONSTANTS.appQuery && indexPattern != null) {
-      const appQuery: Query = decodeRisonUrlState(newUrlStateString);
+      const appQuery = decodeRisonUrlState<Query>(newUrlStateString);
       if (appQuery != null) {
         dispatch(
           inputsActions.setFilterQuery({
@@ -124,15 +55,15 @@ export const dispatchSetInitialStateFromUrl = (
     }
 
     if (urlKey === CONSTANTS.filters) {
-      const filters: esFilters.Filter[] = decodeRisonUrlState(newUrlStateString);
-      siemFilterManager.setFilters(filters || []);
+      const filters = decodeRisonUrlState<esFilters.Filter[]>(newUrlStateString);
+      filterManager.setFilters(filters || []);
     }
 
     if (urlKey === CONSTANTS.savedQuery) {
-      const savedQueryId: string = decodeRisonUrlState(newUrlStateString);
-      if (savedQueryId !== '') {
-        savedQueryService.getSavedQuery(savedQueryId).then((savedQueryData: SavedQuery) => {
-          siemFilterManager.setFilters(savedQueryData.attributes.filters || []);
+      const savedQueryId = decodeRisonUrlState<string>(newUrlStateString);
+      if (savedQueryId != null && savedQueryId !== '') {
+        savedQueries.getSavedQuery(savedQueryId).then(savedQueryData => {
+          filterManager.setFilters(savedQueryData.attributes.filters || []);
           dispatch(
             inputsActions.setFilterQuery({
               id: 'global',
@@ -145,7 +76,7 @@ export const dispatchSetInitialStateFromUrl = (
     }
 
     if (urlKey === CONSTANTS.timeline) {
-      const timeline = decodeRisonUrlState(newUrlStateString);
+      const timeline = decodeRisonUrlState<Timeline>(newUrlStateString);
       if (timeline != null && timeline.id !== '') {
         queryTimelineById({
           apolloClient,
@@ -159,3 +90,77 @@ export const dispatchSetInitialStateFromUrl = (
     }
   });
 };
+
+const updateTimerange = (newUrlStateString: string, dispatch: Dispatch) => {
+  const timerangeStateData = decodeRisonUrlState<UrlInputsModel>(newUrlStateString);
+
+  const globalId: InputsModelId = 'global';
+  const globalLinkTo: LinkTo = { linkTo: get('global.linkTo', timerangeStateData) };
+  const globalType: TimeRangeKinds = get('global.timerange.kind', timerangeStateData);
+
+  const timelineId: InputsModelId = 'timeline';
+  const timelineLinkTo: LinkTo = { linkTo: get('timeline.linkTo', timerangeStateData) };
+  const timelineType: TimeRangeKinds = get('timeline.timerange.kind', timerangeStateData);
+
+  if (isEmpty(globalLinkTo.linkTo)) {
+    dispatch(inputsActions.removeGlobalLinkTo());
+  } else {
+    dispatch(inputsActions.addGlobalLinkTo({ linkToId: 'timeline' }));
+  }
+
+  if (isEmpty(timelineLinkTo.linkTo)) {
+    dispatch(inputsActions.removeTimelineLinkTo());
+  } else {
+    dispatch(inputsActions.addTimelineLinkTo({ linkToId: 'global' }));
+  }
+
+  if (timelineType) {
+    if (timelineType === 'absolute') {
+      const absoluteRange = normalizeTimeRange<AbsoluteTimeRange>(
+        get('timeline.timerange', timerangeStateData)
+      );
+      dispatch(
+        inputsActions.setAbsoluteRangeDatePicker({
+          ...absoluteRange,
+          id: timelineId,
+        })
+      );
+    }
+    if (timelineType === 'relative') {
+      const relativeRange = normalizeTimeRange<RelativeTimeRange>(
+        get('timeline.timerange', timerangeStateData)
+      );
+      dispatch(
+        inputsActions.setRelativeRangeDatePicker({
+          ...relativeRange,
+          id: timelineId,
+        })
+      );
+    }
+  }
+
+  if (globalType) {
+    if (globalType === 'absolute') {
+      const absoluteRange = normalizeTimeRange<AbsoluteTimeRange>(
+        get('global.timerange', timerangeStateData)
+      );
+      dispatch(
+        inputsActions.setAbsoluteRangeDatePicker({
+          ...absoluteRange,
+          id: globalId,
+        })
+      );
+    }
+    if (globalType === 'relative') {
+      const relativeRange = normalizeTimeRange<RelativeTimeRange>(
+        get('global.timerange', timerangeStateData)
+      );
+      dispatch(
+        inputsActions.setRelativeRangeDatePicker({
+          ...relativeRange,
+          id: globalId,
+        })
+      );
+    }
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/test_dependencies.ts b/x-pack/legacy/plugins/siem/public/components/url_state/test_dependencies.ts
index 4dd92ac58b0a3..dc1b8d428bb20 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/test_dependencies.ts
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/test_dependencies.ts
@@ -217,6 +217,18 @@ export const getMockPropsObj = ({
       pageName,
       detailName
     ),
+    undefinedLinkQuery: getMockProps(
+      {
+        hash: '',
+        pathname: examplePath,
+        search: `?query=(language:kuery,query:'host.name:%22siem-es%22')&timerange=(global:(linkTo:!(timeline),timerange:(from:1558591200000,fromStr:now-1d%2Fd,kind:relative,to:1558677599999,toStr:now-1d%2Fd)),timeline:(linkTo:!(global),timerange:(from:1558732849370,fromStr:now-15m,kind:relative,to:1558733749370,toStr:now)))`,
+        state: '',
+      },
+      page,
+      null,
+      pageName,
+      detailName
+    ),
   },
   absoluteTimeSearch: {
     undefinedQuery: getMockProps(
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/types.ts b/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
index be1ae1ad63bd4..9ee469f4fd427 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
@@ -5,8 +5,15 @@
  */
 
 import ApolloClient from 'apollo-client';
+import * as H from 'history';
 import { ActionCreator } from 'typescript-fsa';
-import { IIndexPattern, Query, esFilters } from 'src/plugins/data/public';
+import {
+  IIndexPattern,
+  Query,
+  esFilters,
+  FilterManager,
+  SavedQueryService,
+} from 'src/plugins/data/public';
 
 import { UrlInputsModel } from '../../store/inputs/model';
 import { RouteSpyState } from '../../utils/route/types';
@@ -109,6 +116,7 @@ export type UrlStateContainerPropTypes = RouteSpyState &
 
 export interface PreviousLocationUrlState {
   pathName: string | undefined;
+  pageName: string | undefined;
   urlState: UrlState;
 }
 
@@ -120,8 +128,10 @@ export interface UrlStateToRedux {
 export interface SetInitialStateFromUrl<TCache> {
   apolloClient: ApolloClient<TCache> | ApolloClient<{}> | undefined;
   detailName: string | undefined;
+  filterManager: FilterManager;
   indexPattern: IIndexPattern | undefined;
   pageName: string;
+  savedQueries: SavedQueryService;
   updateTimeline: DispatchUpdateTimeline;
   updateTimelineIsLoading: ActionCreator<UpdateTimelineIsLoading>;
   urlStateToUpdate: UrlStateToRedux[];
@@ -136,3 +146,21 @@ export type DispatchSetInitialStateFromUrl = <TCache>({
   updateTimelineIsLoading,
   urlStateToUpdate,
 }: SetInitialStateFromUrl<TCache>) => () => void;
+
+export interface ReplaceStateInLocation<T> {
+  history?: H.History;
+  urlStateToReplace: T;
+  urlStateKey: string;
+  pathName: string;
+  search: string;
+}
+
+export interface UpdateUrlStateString {
+  isInitializing: boolean;
+  history?: H.History;
+  newUrlStateString: string;
+  pathName: string;
+  search: string;
+  updateTimerange: boolean;
+  urlKey: KeyUrlState;
+}
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/use_url_state.tsx b/x-pack/legacy/plugins/siem/public/components/url_state/use_url_state.tsx
index d7fece5731972..deaf9bbf5011d 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/use_url_state.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/use_url_state.tsx
@@ -4,23 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Location } from 'history';
 import { isEqual, difference, isEmpty } from 'lodash/fp';
 import { useEffect, useRef, useState } from 'react';
-import { Query, esFilters } from 'src/plugins/data/public';
 
-import { UrlInputsModel } from '../../store/inputs/model';
+import { useKibana } from '../../lib/kibana';
 import { useApolloClient } from '../../utils/apollo_context';
-
 import { CONSTANTS, UrlStateType } from './constants';
 import {
-  replaceQueryStringInLocation,
   getQueryStringFromLocation,
-  replaceStateKeyInQueryString,
   getParamFromQueryString,
-  decodeRisonUrlState,
   getUrlType,
   getTitle,
+  replaceStateInLocation,
+  updateUrlStateString,
 } from './helpers';
 import {
   UrlStateContainerPropTypes,
@@ -29,8 +25,8 @@ import {
   KeyUrlState,
   ALL_URL_STATE_KEYS,
   UrlStateToRedux,
-  Timeline,
 } from './types';
+import { SiemPageName } from '../../pages/home/types';
 
 function usePrevious(value: PreviousLocationUrlState) {
   const ref = useRef<PreviousLocationUrlState>(value);
@@ -56,94 +52,100 @@ export const useUrlStateHooks = ({
 }: UrlStateContainerPropTypes) => {
   const [isInitializing, setIsInitializing] = useState(true);
   const apolloClient = useApolloClient();
-  const prevProps = usePrevious({ pathName, urlState });
-
-  const replaceStateInLocation = (
-    urlStateToReplace: UrlInputsModel | Query | esFilters.Filter[] | Timeline | string,
-    urlStateKey: string,
-    latestLocation: Location = {
-      hash: '',
-      pathname: pathName,
-      search,
-      state: '',
-    }
-  ) => {
-    const newLocation = replaceQueryStringInLocation(
-      {
-        hash: '',
-        pathname: pathName,
-        search,
-        state: '',
-      },
-      replaceStateKeyInQueryString(
-        urlStateKey,
-        urlStateToReplace
-      )(getQueryStringFromLocation(latestLocation))
-    );
-    if (history) {
-      history.replace(newLocation);
-    }
-    return newLocation;
-  };
+  const { filterManager, savedQueries } = useKibana().services.data.query;
+  const prevProps = usePrevious({ pathName, pageName, urlState });
 
-  const handleInitialize = (initLocation: Location, type: UrlStateType) => {
-    let myLocation: Location = initLocation;
+  const handleInitialize = (type: UrlStateType, needUpdate?: boolean) => {
+    let mySearch = search;
     let urlStateToUpdate: UrlStateToRedux[] = [];
     URL_STATE_KEYS[type].forEach((urlKey: KeyUrlState) => {
       const newUrlStateString = getParamFromQueryString(
-        getQueryStringFromLocation(initLocation),
+        getQueryStringFromLocation(mySearch),
         urlKey
       );
       if (newUrlStateString) {
-        const queryState: Query | Timeline | esFilters.Filter[] = decodeRisonUrlState(
-          newUrlStateString
-        );
-
-        if (
-          urlKey === CONSTANTS.appQuery &&
-          queryState != null &&
-          (queryState as Query).query === ''
-        ) {
-          myLocation = replaceStateInLocation('', urlKey, myLocation);
-        } else if (urlKey === CONSTANTS.filters && isEmpty(queryState)) {
-          myLocation = replaceStateInLocation('', urlKey, myLocation);
-        } else if (
-          urlKey === CONSTANTS.timeline &&
-          queryState != null &&
-          (queryState as Timeline).id === ''
-        ) {
-          myLocation = replaceStateInLocation('', urlKey, myLocation);
-        }
-        if (isInitializing) {
-          urlStateToUpdate = [...urlStateToUpdate, { urlKey, newUrlStateString }];
+        mySearch = updateUrlStateString({
+          history,
+          isInitializing,
+          newUrlStateString,
+          pathName,
+          search: mySearch,
+          updateTimerange: (needUpdate ?? false) || isInitializing,
+          urlKey,
+        });
+        if (isInitializing || needUpdate) {
+          const updatedUrlStateString =
+            getParamFromQueryString(getQueryStringFromLocation(mySearch), urlKey) ??
+            newUrlStateString;
+          if (isInitializing || !isEqual(updatedUrlStateString, newUrlStateString)) {
+            urlStateToUpdate = [
+              ...urlStateToUpdate,
+              {
+                urlKey,
+                newUrlStateString: updatedUrlStateString,
+              },
+            ];
+          }
         }
       } else if (
         urlKey === CONSTANTS.appQuery &&
         urlState[urlKey] != null &&
-        (urlState[urlKey] as Query).query === ''
+        urlState[urlKey]?.query === ''
       ) {
-        myLocation = replaceStateInLocation('', urlKey, myLocation);
+        mySearch = replaceStateInLocation({
+          history,
+          pathName,
+          search: mySearch,
+          urlStateToReplace: '',
+          urlStateKey: urlKey,
+        });
       } else if (urlKey === CONSTANTS.filters && isEmpty(urlState[urlKey])) {
-        myLocation = replaceStateInLocation('', urlKey, myLocation);
+        mySearch = replaceStateInLocation({
+          history,
+          pathName,
+          search: mySearch,
+          urlStateToReplace: '',
+          urlStateKey: urlKey,
+        });
       } else if (
         urlKey === CONSTANTS.timeline &&
         urlState[urlKey] != null &&
-        (urlState[urlKey] as Timeline).id === ''
+        urlState[urlKey].id === ''
       ) {
-        myLocation = replaceStateInLocation('', urlKey, myLocation);
+        mySearch = replaceStateInLocation({
+          history,
+          pathName,
+          search: mySearch,
+          urlStateToReplace: '',
+          urlStateKey: urlKey,
+        });
       } else {
-        myLocation = replaceStateInLocation(urlState[urlKey] || '', urlKey, myLocation);
+        mySearch = replaceStateInLocation({
+          history,
+          pathName,
+          search: mySearch,
+          urlStateToReplace: urlState[urlKey] || '',
+          urlStateKey: urlKey,
+        });
       }
     });
     difference(ALL_URL_STATE_KEYS, URL_STATE_KEYS[type]).forEach((urlKey: KeyUrlState) => {
-      myLocation = replaceStateInLocation('', urlKey, myLocation);
+      mySearch = replaceStateInLocation({
+        history,
+        pathName,
+        search: mySearch,
+        urlStateToReplace: '',
+        urlStateKey: urlKey,
+      });
     });
 
     setInitialStateFromUrl({
       apolloClient,
       detailName,
+      filterManager,
       indexPattern,
       pageName,
+      savedQueries,
       updateTimeline,
       updateTimelineIsLoading,
       urlStateToUpdate,
@@ -152,41 +154,58 @@ export const useUrlStateHooks = ({
 
   useEffect(() => {
     const type: UrlStateType = getUrlType(pageName);
-    const location: Location = {
-      hash: '',
-      pathname: pathName,
-      search,
-      state: '',
-    };
-
     if (isInitializing && pageName != null && pageName !== '') {
-      handleInitialize(location, type);
+      handleInitialize(type);
       setIsInitializing(false);
     } else if (!isEqual(urlState, prevProps.urlState) && !isInitializing) {
-      let newLocation: Location = location;
+      let mySearch = search;
       URL_STATE_KEYS[type].forEach((urlKey: KeyUrlState) => {
         if (
           urlKey === CONSTANTS.appQuery &&
           urlState[urlKey] != null &&
-          (urlState[urlKey] as Query).query === ''
+          urlState[urlKey]?.query === ''
         ) {
-          newLocation = replaceStateInLocation('', urlKey, newLocation);
+          mySearch = replaceStateInLocation({
+            history,
+            pathName,
+            search: mySearch,
+            urlStateToReplace: '',
+            urlStateKey: urlKey,
+          });
         } else if (urlKey === CONSTANTS.filters && isEmpty(urlState[urlKey])) {
-          newLocation = replaceStateInLocation('', urlKey, newLocation);
+          mySearch = replaceStateInLocation({
+            history,
+            pathName,
+            search: mySearch,
+            urlStateToReplace: '',
+            urlStateKey: urlKey,
+          });
         } else if (
           urlKey === CONSTANTS.timeline &&
           urlState[urlKey] != null &&
-          (urlState[urlKey] as Timeline).id === ''
+          urlState[urlKey].id === ''
         ) {
-          newLocation = replaceStateInLocation('', urlKey, newLocation);
+          mySearch = replaceStateInLocation({
+            history,
+            pathName,
+            search: mySearch,
+            urlStateToReplace: '',
+            urlStateKey: urlKey,
+          });
         } else {
-          newLocation = replaceStateInLocation(urlState[urlKey] || '', urlKey, newLocation);
+          mySearch = replaceStateInLocation({
+            history,
+            pathName,
+            search: mySearch,
+            urlStateToReplace: urlState[urlKey] || '',
+            urlStateKey: urlKey,
+          });
         }
       });
     } else if (pathName !== prevProps.pathName) {
-      handleInitialize(location, type);
+      handleInitialize(type, pageName === SiemPageName.detections);
     }
-  });
+  }, [isInitializing, history, pathName, pageName, prevProps, urlState]);
 
   useEffect(() => {
     document.title = `${getTitle(pageName, detailName, navTabs)} - Kibana`;
diff --git a/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts b/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts
index 4f50a9bd14788..da98944d5f0c9 100644
--- a/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts
@@ -4,8 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
-
 import {
   AddRulesProps,
   DeleteRulesProps,
@@ -24,6 +22,7 @@ import {
   ImportRulesResponse,
   PrePackagedRulesStatusResponse,
 } from './types';
+import { KibanaServices } from '../../../lib/kibana';
 import { throwIfNotOk } from '../../../hooks/api/api';
 import {
   DETECTION_ENGINE_RULES_URL,
@@ -41,7 +40,7 @@ import * as i18n from '../../../pages/detection_engine/rules/translations';
  * @param signal to cancel request
  */
 export const addRule = async ({ rule, signal }: AddRulesProps): Promise<NewRule> => {
-  const response = await npStart.core.http.fetch<NewRule>(DETECTION_ENGINE_RULES_URL, {
+  const response = await KibanaServices.get().http.fetch<NewRule>(DETECTION_ENGINE_RULES_URL, {
     method: rule.id != null ? 'PUT' : 'POST',
     body: JSON.stringify(rule),
     asResponse: true,
@@ -95,7 +94,7 @@ export const fetchRules = async ({
     ...(filters.length ? { filter: filters.join(' AND ') } : {}),
   };
 
-  const response = await npStart.core.http.fetch<FetchRulesResponse>(
+  const response = await KibanaServices.get().http.fetch<FetchRulesResponse>(
     `${DETECTION_ENGINE_RULES_URL}/_find`,
     {
       method: 'GET',
@@ -117,7 +116,7 @@ export const fetchRules = async ({
  *
  */
 export const fetchRuleById = async ({ id, signal }: FetchRuleProps): Promise<Rule> => {
-  const response = await npStart.core.http.fetch<Rule>(DETECTION_ENGINE_RULES_URL, {
+  const response = await KibanaServices.get().http.fetch<Rule>(DETECTION_ENGINE_RULES_URL, {
     method: 'GET',
     query: { id },
     asResponse: true,
@@ -137,7 +136,7 @@ export const fetchRuleById = async ({ id, signal }: FetchRuleProps): Promise<Rul
  * @throws An error if response is not OK
  */
 export const enableRules = async ({ ids, enabled }: EnableRulesProps): Promise<Rule[]> => {
-  const response = await npStart.core.http.fetch<Rule[]>(
+  const response = await KibanaServices.get().http.fetch<Rule[]>(
     `${DETECTION_ENGINE_RULES_URL}/_bulk_update`,
     {
       method: 'PUT',
@@ -158,7 +157,7 @@ export const enableRules = async ({ ids, enabled }: EnableRulesProps): Promise<R
  * @throws An error if response is not OK
  */
 export const deleteRules = async ({ ids }: DeleteRulesProps): Promise<Array<Rule | RuleError>> => {
-  const response = await npStart.core.http.fetch<Rule[]>(
+  const response = await KibanaServices.get().http.fetch<Rule[]>(
     `${DETECTION_ENGINE_RULES_URL}/_bulk_delete`,
     {
       method: 'PUT',
@@ -177,7 +176,7 @@ export const deleteRules = async ({ ids }: DeleteRulesProps): Promise<Array<Rule
  * @param rules to duplicate
  */
 export const duplicateRules = async ({ rules }: DuplicateRulesProps): Promise<Rule[]> => {
-  const response = await npStart.core.http.fetch<Rule[]>(
+  const response = await KibanaServices.get().http.fetch<Rule[]>(
     `${DETECTION_ENGINE_RULES_URL}/_bulk_create`,
     {
       method: 'POST',
@@ -215,11 +214,14 @@ export const duplicateRules = async ({ rules }: DuplicateRulesProps): Promise<Ru
  * @param signal AbortSignal for cancelling request
  */
 export const createPrepackagedRules = async ({ signal }: BasicFetchProps): Promise<boolean> => {
-  const response = await npStart.core.http.fetch<unknown>(DETECTION_ENGINE_PREPACKAGED_URL, {
-    method: 'PUT',
-    signal,
-    asResponse: true,
-  });
+  const response = await KibanaServices.get().http.fetch<unknown>(
+    DETECTION_ENGINE_PREPACKAGED_URL,
+    {
+      method: 'PUT',
+      signal,
+      asResponse: true,
+    }
+  );
 
   await throwIfNotOk(response.response);
   return true;
@@ -242,10 +244,11 @@ export const importRules = async ({
   const formData = new FormData();
   formData.append('file', fileToImport);
 
-  const response = await npStart.core.http.fetch<ImportRulesResponse>(
+  const response = await KibanaServices.get().http.fetch<ImportRulesResponse>(
     `${DETECTION_ENGINE_RULES_URL}/_import`,
     {
       method: 'POST',
+      headers: { 'Content-Type': undefined },
       query: { overwrite },
       body: formData,
       asResponse: true,
@@ -278,16 +281,19 @@ export const exportRules = async ({
       ? JSON.stringify({ objects: ruleIds.map(rule => ({ rule_id: rule })) })
       : undefined;
 
-  const response = await npStart.core.http.fetch<Blob>(`${DETECTION_ENGINE_RULES_URL}/_export`, {
-    method: 'POST',
-    body,
-    query: {
-      exclude_export_details: excludeExportDetails,
-      file_name: filename,
-    },
-    signal,
-    asResponse: true,
-  });
+  const response = await KibanaServices.get().http.fetch<Blob>(
+    `${DETECTION_ENGINE_RULES_URL}/_export`,
+    {
+      method: 'POST',
+      body,
+      query: {
+        exclude_export_details: excludeExportDetails,
+        file_name: filename,
+      },
+      signal,
+      asResponse: true,
+    }
+  );
 
   await throwIfNotOk(response.response);
   return response.body!;
@@ -308,7 +314,7 @@ export const getRuleStatusById = async ({
   id: string;
   signal: AbortSignal;
 }): Promise<RuleStatusResponse> => {
-  const response = await npStart.core.http.fetch<RuleStatusResponse>(
+  const response = await KibanaServices.get().http.fetch<RuleStatusResponse>(
     DETECTION_ENGINE_RULES_STATUS_URL,
     {
       method: 'GET',
@@ -329,7 +335,7 @@ export const getRuleStatusById = async ({
  *
  */
 export const fetchTags = async ({ signal }: { signal: AbortSignal }): Promise<string[]> => {
-  const response = await npStart.core.http.fetch<string[]>(DETECTION_ENGINE_TAGS_URL, {
+  const response = await KibanaServices.get().http.fetch<string[]>(DETECTION_ENGINE_TAGS_URL, {
     method: 'GET',
     signal,
     asResponse: true,
@@ -351,7 +357,7 @@ export const getPrePackagedRulesStatus = async ({
 }: {
   signal: AbortSignal;
 }): Promise<PrePackagedRulesStatusResponse> => {
-  const response = await npStart.core.http.fetch<PrePackagedRulesStatusResponse>(
+  const response = await KibanaServices.get().http.fetch<PrePackagedRulesStatusResponse>(
     DETECTION_ENGINE_PREPACKAGED_RULES_STATUS_URL,
     {
       method: 'GET',
diff --git a/x-pack/legacy/plugins/siem/public/containers/detection_engine/signals/api.ts b/x-pack/legacy/plugins/siem/public/containers/detection_engine/signals/api.ts
index d0da70e646124..085bde3e54ef1 100644
--- a/x-pack/legacy/plugins/siem/public/containers/detection_engine/signals/api.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/detection_engine/signals/api.ts
@@ -4,8 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
-
+import { KibanaServices } from '../../../lib/kibana';
 import { throwIfNotOk } from '../../../hooks/api/api';
 import {
   DETECTION_ENGINE_QUERY_SIGNALS_URL,
@@ -33,7 +32,7 @@ export const fetchQuerySignals = async <Hit, Aggregations>({
   query,
   signal,
 }: QuerySignals): Promise<SignalSearchResponse<Hit, Aggregations>> => {
-  const response = await npStart.core.http.fetch<SignalSearchResponse<Hit, Aggregations>>(
+  const response = await KibanaServices.get().http.fetch<SignalSearchResponse<Hit, Aggregations>>(
     DETECTION_ENGINE_QUERY_SIGNALS_URL,
     {
       method: 'POST',
@@ -59,7 +58,7 @@ export const updateSignalStatus = async ({
   status,
   signal,
 }: UpdateSignalStatusProps): Promise<unknown> => {
-  const response = await npStart.core.http.fetch(DETECTION_ENGINE_SIGNALS_STATUS_URL, {
+  const response = await KibanaServices.get().http.fetch(DETECTION_ENGINE_SIGNALS_STATUS_URL, {
     method: 'POST',
     body: JSON.stringify({ status, ...query }),
     asResponse: true,
@@ -77,7 +76,7 @@ export const updateSignalStatus = async ({
  */
 export const getSignalIndex = async ({ signal }: BasicSignals): Promise<SignalsIndex> => {
   try {
-    return await npStart.core.http.fetch<SignalsIndex>(DETECTION_ENGINE_INDEX_URL, {
+    return await KibanaServices.get().http.fetch<SignalsIndex>(DETECTION_ENGINE_INDEX_URL, {
       method: 'GET',
       signal,
     });
@@ -95,11 +94,14 @@ export const getSignalIndex = async ({ signal }: BasicSignals): Promise<SignalsI
  * @param signal AbortSignal for cancelling request
  */
 export const getUserPrivilege = async ({ signal }: BasicSignals): Promise<Privilege> => {
-  const response = await npStart.core.http.fetch<Privilege>(DETECTION_ENGINE_PRIVILEGES_URL, {
-    method: 'GET',
-    signal,
-    asResponse: true,
-  });
+  const response = await KibanaServices.get().http.fetch<Privilege>(
+    DETECTION_ENGINE_PRIVILEGES_URL,
+    {
+      method: 'GET',
+      signal,
+      asResponse: true,
+    }
+  );
 
   await throwIfNotOk(response.response);
   return response.body!;
@@ -112,7 +114,7 @@ export const getUserPrivilege = async ({ signal }: BasicSignals): Promise<Privil
  */
 export const createSignalIndex = async ({ signal }: BasicSignals): Promise<SignalsIndex> => {
   try {
-    return await npStart.core.http.fetch<SignalsIndex>(DETECTION_ENGINE_INDEX_URL, {
+    return await KibanaServices.get().http.fetch<SignalsIndex>(DETECTION_ENGINE_INDEX_URL, {
       method: 'POST',
       signal,
     });
diff --git a/x-pack/legacy/plugins/siem/public/hooks/api/api.tsx b/x-pack/legacy/plugins/siem/public/hooks/api/api.tsx
index f5f32da7d8c0b..e29e2ed193f94 100644
--- a/x-pack/legacy/plugins/siem/public/hooks/api/api.tsx
+++ b/x-pack/legacy/plugins/siem/public/hooks/api/api.tsx
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { npStart } from 'ui/new_platform';
 import * as i18n from '../translations';
+import { StartServices } from '../../plugin';
 import { parseJsonFromBody, ToasterErrors } from '../../components/ml/api/throw_if_not_ok';
 import { IndexPatternSavedObject, IndexPatternSavedObjectAttributes } from '../types';
 
@@ -14,8 +14,10 @@ import { IndexPatternSavedObject, IndexPatternSavedObjectAttributes } from '../t
  *
  * TODO: Refactor to context provider: https://github.com/elastic/siem-team/issues/448
  */
-export const getIndexPatterns = async (): Promise<IndexPatternSavedObject[]> => {
-  const response = await npStart.core.savedObjects.client.find<IndexPatternSavedObjectAttributes>({
+export const getIndexPatterns = async (
+  savedObjects: StartServices['savedObjects']
+): Promise<IndexPatternSavedObject[]> => {
+  const response = await savedObjects.client.find<IndexPatternSavedObjectAttributes>({
     type: 'index-pattern',
     fields: ['title'],
     perPage: 10000,
diff --git a/x-pack/legacy/plugins/siem/public/hooks/use_index_patterns.tsx b/x-pack/legacy/plugins/siem/public/hooks/use_index_patterns.tsx
index 35bed69e8617e..e10d4873f1b6e 100644
--- a/x-pack/legacy/plugins/siem/public/hooks/use_index_patterns.tsx
+++ b/x-pack/legacy/plugins/siem/public/hooks/use_index_patterns.tsx
@@ -6,6 +6,7 @@
 
 import { useEffect, useState } from 'react';
 
+import { useKibana } from '../lib/kibana';
 import { useStateToaster } from '../components/toasters';
 import { errorToToaster } from '../components/ml/api/error_to_toaster';
 
@@ -19,6 +20,7 @@ export const useIndexPatterns = (refreshToggle = false): Return => {
   const [indexPatterns, setIndexPatterns] = useState<IndexPatternSavedObject[]>([]);
   const [isLoading, setIsLoading] = useState(true);
   const [, dispatchToaster] = useStateToaster();
+  const { savedObjects } = useKibana().services;
 
   useEffect(() => {
     let isSubscribed = true;
@@ -26,7 +28,7 @@ export const useIndexPatterns = (refreshToggle = false): Return => {
 
     async function fetchIndexPatterns() {
       try {
-        const data = await getIndexPatterns();
+        const data = await getIndexPatterns(savedObjects);
 
         if (isSubscribed) {
           setIndexPatterns(data);
diff --git a/x-pack/legacy/plugins/siem/public/lib/compose/helpers.test.ts b/x-pack/legacy/plugins/siem/public/lib/compose/helpers.test.ts
index b135e299e2e43..af4521b4f6e2c 100644
--- a/x-pack/legacy/plugins/siem/public/lib/compose/helpers.test.ts
+++ b/x-pack/legacy/plugins/siem/public/lib/compose/helpers.test.ts
@@ -21,7 +21,7 @@ const mockHttpLink = { mockHttpLink: 'mockHttpLink' };
 // @ts-ignore
 withClientState.mockReturnValue(mockWithClientState);
 // @ts-ignore
-apolloLinkHttp.HttpLink.mockImplementation(() => mockHttpLink);
+apolloLinkHttp.createHttpLink.mockImplementation(() => mockHttpLink);
 
 describe('getLinks helper', () => {
   test('It should return links in correct order', () => {
@@ -31,7 +31,7 @@ describe('getLinks helper', () => {
         introspectionQueryResultData,
       }),
     });
-    const links = getLinks(mockCache);
+    const links = getLinks(mockCache, 'basePath');
     expect(links[0]).toEqual(errorLink);
     expect(links[1]).toEqual(reTryOneTimeOnErrorLink);
     expect(links[2]).toEqual(mockWithClientState);
diff --git a/x-pack/legacy/plugins/siem/public/lib/compose/helpers.ts b/x-pack/legacy/plugins/siem/public/lib/compose/helpers.ts
index 9cdd4148134ad..b698fc55cc5e5 100644
--- a/x-pack/legacy/plugins/siem/public/lib/compose/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/lib/compose/helpers.ts
@@ -4,23 +4,22 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { HttpLink } from 'apollo-link-http';
+import { createHttpLink } from 'apollo-link-http';
 import { withClientState } from 'apollo-link-state';
 import { InMemoryCache } from 'apollo-cache-inmemory';
-import chrome from 'ui/chrome';
 
 import { errorLink, reTryOneTimeOnErrorLink } from '../../containers/errors';
 
-export const getLinks = (cache: InMemoryCache) => [
+export const getLinks = (cache: InMemoryCache, basePath: string) => [
   errorLink,
   reTryOneTimeOnErrorLink,
   withClientState({
     cache,
     resolvers: {},
   }),
-  new HttpLink({
+  createHttpLink({
     credentials: 'same-origin',
     headers: { 'kbn-xsrf': 'true' },
-    uri: `${chrome.getBasePath()}/api/siem/graphql`,
+    uri: `${basePath}/api/siem/graphql`,
   }),
 ];
diff --git a/x-pack/legacy/plugins/siem/public/lib/compose/kibana_compose.tsx b/x-pack/legacy/plugins/siem/public/lib/compose/kibana_compose.tsx
index 00dfbcd8a4d8f..c742ced4c504c 100644
--- a/x-pack/legacy/plugins/siem/public/lib/compose/kibana_compose.tsx
+++ b/x-pack/legacy/plugins/siem/public/lib/compose/kibana_compose.tsx
@@ -7,29 +7,26 @@
 import { InMemoryCache, IntrospectionFragmentMatcher } from 'apollo-cache-inmemory';
 import ApolloClient from 'apollo-client';
 import { ApolloLink } from 'apollo-link';
-import 'ui/autoload/all';
-// @ts-ignore: path dynamic for kibana
-import { uiModules } from 'ui/modules';
 
 import introspectionQueryResultData from '../../graphql/introspection.json';
+import { CoreStart } from '../../plugin';
 import { AppFrontendLibs } from '../lib';
 import { getLinks } from './helpers';
 
-export function compose(): AppFrontendLibs {
+export function compose(core: CoreStart): AppFrontendLibs {
   const cache = new InMemoryCache({
     dataIdFromObject: () => null,
     fragmentMatcher: new IntrospectionFragmentMatcher({
       introspectionQueryResultData,
     }),
   });
+  const basePath = core.http.basePath.get();
 
-  const graphQLOptions = {
+  const apolloClient = new ApolloClient({
     connectToDevTools: process.env.NODE_ENV !== 'production',
     cache,
-    link: ApolloLink.from(getLinks(cache)),
-  };
-
-  const apolloClient = new ApolloClient(graphQLOptions);
+    link: ApolloLink.from(getLinks(cache, basePath)),
+  });
 
   const libs: AppFrontendLibs = {
     apolloClient,
diff --git a/x-pack/legacy/plugins/siem/public/lib/kibana/__mocks__/index.ts b/x-pack/legacy/plugins/siem/public/lib/kibana/__mocks__/index.ts
index 93fd37c4d14cb..227680d79912f 100644
--- a/x-pack/legacy/plugins/siem/public/lib/kibana/__mocks__/index.ts
+++ b/x-pack/legacy/plugins/siem/public/lib/kibana/__mocks__/index.ts
@@ -12,8 +12,12 @@ import {
   createWithKibanaMock,
 } from '../../../mock/kibana_react';
 
+export const KibanaServices = { get: jest.fn() };
 export const useKibana = jest.fn(createUseKibanaMock());
 export const useUiSetting = jest.fn(createUseUiSettingMock());
 export const useUiSetting$ = jest.fn(createUseUiSetting$Mock());
+export const useTimeZone = jest.fn();
+export const useDateFormat = jest.fn();
+export const useBasePath = jest.fn(() => '/test/base/path');
 export const withKibana = jest.fn(createWithKibanaMock());
 export const KibanaContextProvider = jest.fn(createKibanaContextProviderMock());
diff --git a/x-pack/legacy/plugins/siem/public/hooks/use_ui_settings.ts b/x-pack/legacy/plugins/siem/public/lib/kibana/hooks.ts
similarity index 78%
rename from x-pack/legacy/plugins/siem/public/hooks/use_ui_settings.ts
rename to x-pack/legacy/plugins/siem/public/lib/kibana/hooks.ts
index 7eb0242e8e116..a4a70c77833c0 100644
--- a/x-pack/legacy/plugins/siem/public/hooks/use_ui_settings.ts
+++ b/x-pack/legacy/plugins/siem/public/lib/kibana/hooks.ts
@@ -6,8 +6,8 @@
 
 import moment from 'moment-timezone';
 
-import { DEFAULT_DATE_FORMAT, DEFAULT_DATE_FORMAT_TZ } from '../../common/constants';
-import { useUiSetting } from '../lib/kibana';
+import { DEFAULT_DATE_FORMAT, DEFAULT_DATE_FORMAT_TZ } from '../../../common/constants';
+import { useUiSetting, useKibana } from './kibana_react';
 
 export const useDateFormat = (): string => useUiSetting<string>(DEFAULT_DATE_FORMAT);
 
@@ -15,3 +15,5 @@ export const useTimeZone = (): string => {
   const timeZone = useUiSetting<string>(DEFAULT_DATE_FORMAT_TZ);
   return timeZone === 'Browser' ? moment.tz.guess() : timeZone;
 };
+
+export const useBasePath = (): string => useKibana().services.http.basePath.get();
diff --git a/x-pack/legacy/plugins/siem/public/lib/kibana/index.ts b/x-pack/legacy/plugins/siem/public/lib/kibana/index.ts
index 012a1cfef5da2..fd201d51e73a6 100644
--- a/x-pack/legacy/plugins/siem/public/lib/kibana/index.ts
+++ b/x-pack/legacy/plugins/siem/public/lib/kibana/index.ts
@@ -4,28 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  KibanaContextProvider,
-  KibanaReactContextValue,
-  useKibana,
-  useUiSetting,
-  useUiSetting$,
-  withKibana,
-} from '../../../../../../../src/plugins/kibana_react/public';
-import { StartServices } from '../../plugin';
-
-export type KibanaContext = KibanaReactContextValue<StartServices>;
-export interface WithKibanaProps {
-  kibana: KibanaContext;
-}
-
-// eslint-disable-next-line react-hooks/rules-of-hooks
-const typedUseKibana = () => useKibana<StartServices>();
-
-export {
-  KibanaContextProvider,
-  typedUseKibana as useKibana,
-  useUiSetting,
-  useUiSetting$,
-  withKibana,
-};
+export * from './hooks';
+export * from './kibana_react';
+export * from './services';
diff --git a/x-pack/legacy/plugins/siem/public/lib/kibana/kibana_react.ts b/x-pack/legacy/plugins/siem/public/lib/kibana/kibana_react.ts
new file mode 100644
index 0000000000000..012a1cfef5da2
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/lib/kibana/kibana_react.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  KibanaContextProvider,
+  KibanaReactContextValue,
+  useKibana,
+  useUiSetting,
+  useUiSetting$,
+  withKibana,
+} from '../../../../../../../src/plugins/kibana_react/public';
+import { StartServices } from '../../plugin';
+
+export type KibanaContext = KibanaReactContextValue<StartServices>;
+export interface WithKibanaProps {
+  kibana: KibanaContext;
+}
+
+// eslint-disable-next-line react-hooks/rules-of-hooks
+const typedUseKibana = () => useKibana<StartServices>();
+
+export {
+  KibanaContextProvider,
+  typedUseKibana as useKibana,
+  useUiSetting,
+  useUiSetting$,
+  withKibana,
+};
diff --git a/x-pack/legacy/plugins/siem/public/lib/kibana/services.ts b/x-pack/legacy/plugins/siem/public/lib/kibana/services.ts
new file mode 100644
index 0000000000000..3a6a3f13dc5ce
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/lib/kibana/services.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { StartServices } from '../../plugin';
+
+type GlobalServices = Pick<StartServices, 'http' | 'uiSettings'>;
+
+export class KibanaServices {
+  private static services?: GlobalServices;
+
+  public static init({ http, uiSettings }: StartServices) {
+    this.services = { http, uiSettings };
+  }
+
+  public static get(): GlobalServices {
+    if (!this.services) {
+      throw new Error(
+        'Kibana services not set - are you trying to import this module from outside of the SIEM app?'
+      );
+    }
+
+    return this.services;
+  }
+}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals/index.tsx
index e65adcf3a6920..7eb8e07ada762 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals/index.tsx
@@ -129,7 +129,9 @@ const SignalsTableComponent: React.FC<SignalsTableComponentProps> = ({
         dataProviders: [],
         indexPattern: indexPatterns,
         browserFields,
-        filters: globalFilters,
+        filters: isEmpty(defaultFilters)
+          ? globalFilters
+          : [...(defaultFilters ?? []), ...globalFilters],
         kqlQuery: globalQuery,
         kqlMode: globalQuery.language,
         start: from,
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.test.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.test.tsx
new file mode 100644
index 0000000000000..2758625c0d4af
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.test.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { showInitialLoadingSpinner } from './helpers';
+
+describe('helpers', () => {
+  describe('showInitialLoadingSpinner', () => {
+    test('it should (only) show the spinner during initial loading, while we are fetching data', () => {
+      expect(showInitialLoadingSpinner({ isInitialLoading: true, isLoadingSignals: true })).toBe(
+        true
+      );
+    });
+
+    test('it should STOP showing the spinner (during initial loading) when the first data fetch completes', () => {
+      expect(showInitialLoadingSpinner({ isInitialLoading: true, isLoadingSignals: false })).toBe(
+        false
+      );
+    });
+
+    test('it should NOT show the spinner after initial loading has completed, even if the user requests more data (e.g. by clicking Refresh)', () => {
+      expect(showInitialLoadingSpinner({ isInitialLoading: false, isLoadingSignals: true })).toBe(
+        false
+      );
+    });
+
+    test('it should NOT show the spinner after initial loading has completed', () => {
+      expect(showInitialLoadingSpinner({ isInitialLoading: false, isLoadingSignals: false })).toBe(
+        false
+      );
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx
index 551850fa610db..27ee552146092 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/helpers.tsx
@@ -76,3 +76,17 @@ export const getSignalsHistogramQuery = (
     },
   },
 });
+
+/**
+ * Returns `true` when the signals histogram initial loading spinner should be shown
+ *
+ * @param isInitialLoading The loading spinner will only be displayed if this value is `true`, because after initial load, a different, non-spinner loading indicator is displayed
+ * @param isLoadingSignals When `true`, IO is being performed to request signals (for rendering in the histogram)
+ */
+export const showInitialLoadingSpinner = ({
+  isInitialLoading,
+  isLoadingSignals,
+}: {
+  isInitialLoading: boolean;
+  isLoadingSignals: boolean;
+}): boolean => isInitialLoading && isLoadingSignals;
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/index.tsx
index 29aaa951ff71a..4de471d6733cf 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/components/signals_histogram_panel/index.tsx
@@ -23,7 +23,7 @@ import { InspectButtonContainer } from '../../../../components/inspect';
 import { useQuerySignals } from '../../../../containers/detection_engine/signals/use_query';
 import { MatrixLoader } from '../../../../components/matrix_histogram/matrix_loader';
 
-import { formatSignalsData, getSignalsHistogramQuery } from './helpers';
+import { formatSignalsData, getSignalsHistogramQuery, showInitialLoadingSpinner } from './helpers';
 import * as i18n from './translations';
 
 const DEFAULT_PANEL_HEIGHT = 300;
@@ -54,7 +54,6 @@ interface SignalsHistogramPanelProps {
   from: number;
   query?: Query;
   legendPosition?: Position;
-  loadingInitial?: boolean;
   panelHeight?: number;
   signalIndexName: string | null;
   setQuery: (params: RegisterQuery) => void;
@@ -75,7 +74,6 @@ export const SignalsHistogramPanel = memo<SignalsHistogramPanelProps>(
     query,
     from,
     legendPosition = 'right',
-    loadingInitial = false,
     panelHeight = DEFAULT_PANEL_HEIGHT,
     setQuery,
     signalIndexName,
@@ -86,7 +84,7 @@ export const SignalsHistogramPanel = memo<SignalsHistogramPanelProps>(
     title = i18n.HISTOGRAM_HEADER,
     updateDateRange,
   }) => {
-    const [isInitialLoading, setIsInitialLoading] = useState(loadingInitial || true);
+    const [isInitialLoading, setIsInitialLoading] = useState(true);
     const [defaultNumberFormat] = useUiSetting$<string>(DEFAULT_NUMBER_FORMAT);
     const [totalSignalsObj, setTotalSignalsObj] = useState<SignalsTotal>(defaultTotalSignalsObj);
     const [selectedStackByOption, setSelectedStackByOption] = useState<SignalsHistogramOption>(
@@ -124,10 +122,16 @@ export const SignalsHistogramPanel = memo<SignalsHistogramPanelProps>(
     const formattedSignalsData = useMemo(() => formatSignalsData(signalsData), [signalsData]);
 
     useEffect(() => {
-      if (!loadingInitial && isInitialLoading && !isLoadingSignals && signalsData) {
+      let canceled = false;
+
+      if (!canceled && !showInitialLoadingSpinner({ isInitialLoading, isLoadingSignals })) {
         setIsInitialLoading(false);
       }
-    }, [loadingInitial, isLoadingSignals, signalsData]);
+
+      return () => {
+        canceled = true; // prevent long running data fetches from updating state after unmounting
+      };
+    }, [isInitialLoading, isLoadingSignals, setIsInitialLoading]);
 
     useEffect(() => {
       return () => {
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine.tsx
index d854c377e6ec8..229593901691b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiButton, EuiSpacer, EuiTab, EuiTabs } from '@elastic/eui';
+import { EuiButton, EuiSpacer } from '@elastic/eui';
 import React, { useCallback, useMemo } from 'react';
 import { useParams } from 'react-router-dom';
 import { StickyContainer } from 'react-sticky';
@@ -24,6 +24,8 @@ import {
 } from '../../components/link_to/redirect_to_detection_engine';
 import { SiemSearchBar } from '../../components/search_bar';
 import { WrapperPage } from '../../components/wrapper_page';
+import { SiemNavigation } from '../../components/navigation';
+import { NavTab } from '../../components/navigation/types';
 import { State } from '../../store';
 import { inputsSelectors } from '../../store/inputs';
 import { setAbsoluteRangeDatePicker as dispatchSetAbsoluteRangeDatePicker } from '../../store/inputs/actions';
@@ -60,18 +62,22 @@ export interface DispatchProps {
 
 type DetectionEnginePageComponentProps = ReduxProps & DispatchProps;
 
-const detectionsTabs = [
-  {
+const detectionsTabs: Record<string, NavTab> = {
+  [DetectionEngineTab.signals]: {
     id: DetectionEngineTab.signals,
     name: i18n.SIGNAL,
+    href: getDetectionEngineTabUrl(DetectionEngineTab.signals),
     disabled: false,
+    urlKey: 'detections',
   },
-  {
+  [DetectionEngineTab.alerts]: {
     id: DetectionEngineTab.alerts,
     name: i18n.ALERT,
+    href: getDetectionEngineTabUrl(DetectionEngineTab.alerts),
     disabled: false,
+    urlKey: 'detections',
   },
-];
+};
 
 const DetectionEnginePageComponent: React.FC<DetectionEnginePageComponentProps> = ({
   filters,
@@ -98,24 +104,6 @@ const DetectionEnginePageComponent: React.FC<DetectionEnginePageComponentProps>
     [setAbsoluteRangeDatePicker]
   );
 
-  const tabs = useMemo(
-    () => (
-      <EuiTabs>
-        {detectionsTabs.map(tab => (
-          <EuiTab
-            isSelected={tab.id === tabName}
-            disabled={tab.disabled}
-            key={tab.id}
-            href={getDetectionEngineTabUrl(tab.id)}
-          >
-            {tab.name}
-          </EuiTab>
-        ))}
-      </EuiTabs>
-    ),
-    [detectionsTabs, tabName]
-  );
-
   const indexToAdd = useMemo(() => (signalIndexName == null ? [] : [signalIndexName]), [
     signalIndexName,
   ]);
@@ -169,7 +157,7 @@ const DetectionEnginePageComponent: React.FC<DetectionEnginePageComponentProps>
                 <GlobalTime>
                   {({ to, from, deleteQuery, setQuery }) => (
                     <>
-                      {tabs}
+                      <SiemNavigation navTabs={detectionsTabs} />
                       <EuiSpacer />
                       {tabName === DetectionEngineTab.signals && (
                         <>
@@ -177,7 +165,6 @@ const DetectionEnginePageComponent: React.FC<DetectionEnginePageComponentProps>
                             deleteQuery={deleteQuery}
                             filters={filters}
                             from={from}
-                            loadingInitial={loading}
                             query={query}
                             setQuery={setQuery}
                             showTotalSignalsCount={true}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_empty_page.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_empty_page.tsx
index bf7a2109fd3b5..7516bb13a9e75 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_empty_page.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/detection_engine_empty_page.tsx
@@ -5,19 +5,16 @@
  */
 
 import React from 'react';
-import chrome from 'ui/chrome';
 
 import { useKibana } from '../../lib/kibana';
 import { EmptyPage } from '../../components/empty_page';
 import * as i18n from '../common/translations';
 
-const basePath = chrome.getBasePath();
-
 export const DetectionEngineEmptyPage = React.memo(() => (
   <EmptyPage
     actionPrimaryIcon="gear"
     actionPrimaryLabel={i18n.EMPTY_ACTION_PRIMARY}
-    actionPrimaryUrl={`${basePath}/app/kibana#/home/tutorial_directory/siem`}
+    actionPrimaryUrl={`${useKibana().services.http.basePath.get()}/app/kibana#/home/tutorial_directory/siem`}
     actionSecondaryIcon="popout"
     actionSecondaryLabel={i18n.EMPTY_ACTION_SECONDARY}
     actionSecondaryTarget="_blank"
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/utils.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/utils.ts
index 55772aa73ecf3..11942c57a4d27 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/utils.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Breadcrumb } from 'ui/chrome';
 import { isEmpty } from 'lodash/fp';
 
+import { ChromeBreadcrumb } from '../../../../../../../../src/core/public';
 import {
   getDetectionEngineUrl,
   getDetectionEngineTabUrl,
@@ -50,7 +50,7 @@ const isRuleCreatePage = (pathname: string) =>
 const isRuleEditPage = (pathname: string) =>
   pathname.includes('/rules') && pathname.includes('/edit');
 
-export const getBreadcrumbs = (params: RouteSpyState, search: string[]): Breadcrumb[] => {
+export const getBreadcrumbs = (params: RouteSpyState, search: string[]): ChromeBreadcrumb[] => {
   let breadcrumb = [
     {
       text: i18nDetections.PAGE_TITLE,
diff --git a/x-pack/legacy/plugins/siem/public/pages/hosts/details/utils.ts b/x-pack/legacy/plugins/siem/public/pages/hosts/details/utils.ts
index c321478f10174..c4680dc3d795e 100644
--- a/x-pack/legacy/plugins/siem/public/pages/hosts/details/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/hosts/details/utils.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Breadcrumb } from 'ui/chrome';
 import { get, isEmpty } from 'lodash/fp';
 
+import { ChromeBreadcrumb } from '../../../../../../../../src/core/public';
 import { hostsModel } from '../../../store';
 import { HostsTableType } from '../../../store/hosts/model';
 import { getHostsUrl, getHostDetailsUrl } from '../../../components/link_to/redirect_to_hosts';
@@ -25,7 +25,7 @@ const TabNameMappedToI18nKey: Record<HostsTableType, string> = {
   [HostsTableType.alerts]: i18n.NAVIGATION_ALERTS_TITLE,
 };
 
-export const getBreadcrumbs = (params: HostRouteSpyState, search: string[]): Breadcrumb[] => {
+export const getBreadcrumbs = (params: HostRouteSpyState, search: string[]): ChromeBreadcrumb[] => {
   let breadcrumb = [
     {
       text: i18n.PAGE_TITLE,
diff --git a/x-pack/legacy/plugins/siem/public/pages/hosts/hosts_empty_page.tsx b/x-pack/legacy/plugins/siem/public/pages/hosts/hosts_empty_page.tsx
index c29e532b3d513..bded0b90e187b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/hosts/hosts_empty_page.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/hosts/hosts_empty_page.tsx
@@ -5,17 +5,15 @@
  */
 
 import React from 'react';
-import chrome from 'ui/chrome';
 
 import { EmptyPage } from '../../components/empty_page';
 import { useKibana } from '../../lib/kibana';
 
 import * as i18n from '../common/translations';
 
-const basePath = chrome.getBasePath();
-
 export const HostsEmptyPage = React.memo(() => {
-  const docLinks = useKibana().services.docLinks;
+  const { http, docLinks } = useKibana().services;
+  const basePath = http.basePath.get();
 
   return (
     <EmptyPage
diff --git a/x-pack/legacy/plugins/siem/public/pages/network/ip_details/utils.ts b/x-pack/legacy/plugins/siem/public/pages/network/ip_details/utils.ts
index a468812e2718d..1488dd556c0b9 100644
--- a/x-pack/legacy/plugins/siem/public/pages/network/ip_details/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/network/ip_details/utils.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Breadcrumb } from 'ui/chrome';
 import { get, isEmpty } from 'lodash/fp';
 
+import { ChromeBreadcrumb } from '../../../../../../../../src/core/public';
 import { decodeIpv6 } from '../../../lib/helpers';
 import { getNetworkUrl, getIPDetailsUrl } from '../../../components/link_to/redirect_to_network';
 import { networkModel } from '../../../store/network';
@@ -24,7 +24,10 @@ const TabNameMappedToI18nKey: Record<NetworkRouteType, string> = {
   [NetworkRouteType.tls]: i18n.NAVIGATION_TLS_TITLE,
 };
 
-export const getBreadcrumbs = (params: NetworkRouteSpyState, search: string[]): Breadcrumb[] => {
+export const getBreadcrumbs = (
+  params: NetworkRouteSpyState,
+  search: string[]
+): ChromeBreadcrumb[] => {
   let breadcrumb = [
     {
       text: i18n.PAGE_TITLE,
diff --git a/x-pack/legacy/plugins/siem/public/pages/network/network_empty_page.tsx b/x-pack/legacy/plugins/siem/public/pages/network/network_empty_page.tsx
index 78a3ae147fd0f..22db00400bf8a 100644
--- a/x-pack/legacy/plugins/siem/public/pages/network/network_empty_page.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/network/network_empty_page.tsx
@@ -5,16 +5,14 @@
  */
 
 import React from 'react';
-import chrome from 'ui/chrome';
 
 import { useKibana } from '../../lib/kibana';
 import { EmptyPage } from '../../components/empty_page';
 import * as i18n from '../common/translations';
 
-const basePath = chrome.getBasePath();
-
 export const NetworkEmptyPage = React.memo(() => {
-  const docLinks = useKibana().services.docLinks;
+  const { http, docLinks } = useKibana().services;
+  const basePath = http.basePath.get();
 
   return (
     <EmptyPage
diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/overview.test.tsx b/x-pack/legacy/plugins/siem/public/pages/overview/overview.test.tsx
index be43ae8f5ed64..b20cd84295566 100644
--- a/x-pack/legacy/plugins/siem/public/pages/overview/overview.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/overview/overview.test.tsx
@@ -16,18 +16,12 @@ import { mocksSource } from '../../containers/source/mock';
 import { Overview } from './index';
 
 jest.mock('ui/chrome', () => ({
-  getBasePath: () => {
-    return '<basepath>';
-  },
   getKibanaVersion: () => {
     return 'v8.0.0';
   },
   breadcrumbs: {
     set: jest.fn(),
   },
-  getUiSettingsClient: () => ({
-    get: jest.fn(),
-  }),
 }));
 
 // Test will fail because we will to need to mock some core services to make the test work
diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/overview_empty/index.tsx b/x-pack/legacy/plugins/siem/public/pages/overview/overview_empty/index.tsx
index 9565b764b09e7..1325826f172c7 100644
--- a/x-pack/legacy/plugins/siem/public/pages/overview/overview_empty/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/overview/overview_empty/index.tsx
@@ -5,16 +5,14 @@
  */
 
 import React from 'react';
-import chrome from 'ui/chrome';
 
 import * as i18nCommon from '../../common/translations';
 import { EmptyPage } from '../../../components/empty_page';
 import { useKibana } from '../../../lib/kibana';
 
-const basePath = chrome.getBasePath();
-
 const OverviewEmptyComponent: React.FC = () => {
-  const docLinks = useKibana().services.docLinks;
+  const { http, docLinks } = useKibana().services;
+  const basePath = http.basePath.get();
 
   return (
     <EmptyPage
diff --git a/x-pack/legacy/plugins/siem/public/plugin.tsx b/x-pack/legacy/plugins/siem/public/plugin.tsx
index 74fc913d2b573..8be5510cda83a 100644
--- a/x-pack/legacy/plugins/siem/public/plugin.tsx
+++ b/x-pack/legacy/plugins/siem/public/plugin.tsx
@@ -16,9 +16,10 @@ import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 import { IEmbeddableStart } from '../../../../../src/plugins/embeddable/public';
 import { Start as NewsfeedStart } from '../../../../../src/plugins/newsfeed/public';
 import { Start as InspectorStart } from '../../../../../src/plugins/inspector/public';
-import { IUiActionsStart } from '../../../../../src/plugins/ui_actions/public';
+import { UiActionsStart } from '../../../../../src/plugins/ui_actions/public';
 import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/public';
 import { initTelemetry } from './lib/telemetry';
+import { KibanaServices } from './lib/kibana';
 
 export { AppMountParameters, CoreSetup, CoreStart, PluginInitializerContext };
 
@@ -31,7 +32,7 @@ export interface StartPlugins {
   embeddable: IEmbeddableStart;
   inspector: InspectorStart;
   newsfeed?: NewsfeedStart;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
 }
 export type StartServices = CoreStart & StartPlugins;
 
@@ -55,10 +56,10 @@ export class Plugin implements IPlugin<Setup, Start> {
       id: this.id,
       title: this.name,
       async mount(context, params) {
-        const [coreStart, pluginsStart] = await core.getStartServices();
+        const [coreStart, startPlugins] = await core.getStartServices();
         const { renderApp } = await import('./app');
 
-        return renderApp(coreStart, pluginsStart as StartPlugins, params);
+        return renderApp(coreStart, startPlugins as StartPlugins, params);
       },
     });
 
@@ -66,6 +67,8 @@ export class Plugin implements IPlugin<Setup, Start> {
   }
 
   public start(core: CoreStart, plugins: StartPlugins) {
+    KibanaServices.init({ ...core, ...plugins });
+
     return {};
   }
 
diff --git a/x-pack/legacy/plugins/siem/public/store/inputs/reducer.ts b/x-pack/legacy/plugins/siem/public/store/inputs/reducer.ts
index 8f9f8809a1e86..b64d7cea47e0f 100644
--- a/x-pack/legacy/plugins/siem/public/store/inputs/reducer.ts
+++ b/x-pack/legacy/plugins/siem/public/store/inputs/reducer.ts
@@ -7,6 +7,7 @@
 import { get } from 'lodash/fp';
 import { reducerWithInitialState } from 'typescript-fsa-reducers';
 
+import { getIntervalSettings, getTimeRangeSettings } from '../../utils/default_date_settings';
 import {
   deleteAllQuery,
   setAbsoluteRangeDatePicker,
@@ -39,14 +40,6 @@ import {
   deleteOneQuery as helperDeleteOneQuery,
 } from './helpers';
 import { InputsModel, TimeRange } from './model';
-import {
-  getDefaultFromValue,
-  getDefaultToValue,
-  getDefaultFromString,
-  getDefaultToString,
-  getDefaultIntervalKind,
-  getDefaultIntervalDuration,
-} from '../../utils/default_date_settings';
 
 export type InputsState = InputsModel;
 
@@ -54,16 +47,10 @@ export const initialInputsState: InputsState = {
   global: {
     timerange: {
       kind: 'relative',
-      fromStr: getDefaultFromString(),
-      toStr: getDefaultToString(),
-      from: getDefaultFromValue(),
-      to: getDefaultToValue(),
+      ...getTimeRangeSettings(false),
     },
     queries: [],
-    policy: {
-      kind: getDefaultIntervalKind(),
-      duration: getDefaultIntervalDuration(),
-    },
+    policy: getIntervalSettings(false),
     linkTo: ['timeline'],
     query: {
       query: '',
@@ -74,16 +61,10 @@ export const initialInputsState: InputsState = {
   timeline: {
     timerange: {
       kind: 'relative',
-      fromStr: getDefaultFromString(),
-      toStr: getDefaultToString(),
-      from: getDefaultFromValue(),
-      to: getDefaultToValue(),
+      ...getTimeRangeSettings(false),
     },
     queries: [],
-    policy: {
-      kind: getDefaultIntervalKind(),
-      duration: getDefaultIntervalDuration(),
-    },
+    policy: getIntervalSettings(false),
     linkTo: ['global'],
     query: {
       query: '',
@@ -93,6 +74,54 @@ export const initialInputsState: InputsState = {
   },
 };
 
+export const createInitialInputsState = (): InputsState => {
+  const { from, fromStr, to, toStr } = getTimeRangeSettings();
+  const { kind, duration } = getIntervalSettings();
+
+  return {
+    global: {
+      timerange: {
+        kind: 'relative',
+        fromStr,
+        toStr,
+        from,
+        to,
+      },
+      queries: [],
+      policy: {
+        kind,
+        duration,
+      },
+      linkTo: ['timeline'],
+      query: {
+        query: '',
+        language: 'kuery',
+      },
+      filters: [],
+    },
+    timeline: {
+      timerange: {
+        kind: 'relative',
+        fromStr,
+        toStr,
+        from,
+        to,
+      },
+      queries: [],
+      policy: {
+        kind,
+        duration,
+      },
+      linkTo: ['global'],
+      query: {
+        query: '',
+        language: 'kuery',
+      },
+      filters: [],
+    },
+  };
+};
+
 export const inputsReducer = reducerWithInitialState(initialInputsState)
   .case(setTimelineRangeDatePicker, (state, { from, to }) => {
     return {
diff --git a/x-pack/legacy/plugins/siem/public/store/reducer.ts b/x-pack/legacy/plugins/siem/public/store/reducer.ts
index 3c93dfa61b768..32554653febd5 100644
--- a/x-pack/legacy/plugins/siem/public/store/reducer.ts
+++ b/x-pack/legacy/plugins/siem/public/store/reducer.ts
@@ -9,7 +9,7 @@ import { combineReducers } from 'redux';
 import { appReducer, AppState, initialAppState } from './app';
 import { dragAndDropReducer, DragAndDropState, initialDragAndDropState } from './drag_and_drop';
 import { hostsReducer, HostsState, initialHostsState } from './hosts';
-import { initialInputsState, inputsReducer, InputsState } from './inputs';
+import { createInitialInputsState, initialInputsState, inputsReducer, InputsState } from './inputs';
 import { initialNetworkState, networkReducer, NetworkState } from './network';
 import { initialTimelineState, timelineReducer } from './timeline/reducer';
 import { TimelineState } from './timeline/types';
@@ -32,6 +32,11 @@ export const initialState: State = {
   timeline: initialTimelineState,
 };
 
+export const createInitialState = (): State => ({
+  ...initialState,
+  inputs: createInitialInputsState(),
+});
+
 export const reducer = combineReducers<State>({
   app: appReducer,
   dragAndDrop: dragAndDropReducer,
diff --git a/x-pack/legacy/plugins/siem/public/utils/default_date_settings.test.ts b/x-pack/legacy/plugins/siem/public/utils/default_date_settings.test.ts
index 2507c2cf81c51..9dc179ba7a6e2 100644
--- a/x-pack/legacy/plugins/siem/public/utils/default_date_settings.test.ts
+++ b/x-pack/legacy/plugins/siem/public/utils/default_date_settings.test.ts
@@ -4,19 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import chrome from 'ui/chrome';
+import moment from 'moment';
+
 import {
-  getDefaultFromString,
+  getTimeRangeSettings,
+  getIntervalSettings,
   DefaultTimeRangeSetting,
-  getDefaultToString,
-  getDefaultFromValue,
-  getDefaultToValue,
-  getDefaultFromMoment,
-  getDefaultToMoment,
   DefaultIntervalSetting,
-  getDefaultIntervalKind,
-  getDefaultIntervalDuration,
-  parseDateString,
   parseDateWithDefault,
 } from './default_date_settings';
 import {
@@ -28,8 +22,8 @@ import {
   DEFAULT_INTERVAL_VALUE,
   DEFAULT_INTERVAL_TYPE,
 } from '../../common/constants';
+import { KibanaServices } from '../lib/kibana';
 import { Policy } from '../store/inputs/model';
-import moment from 'moment';
 
 // Change the constants to be static values so we can test against those instead of
 // relative sliding date times. Jest cannot access these outer scoped variables so
@@ -46,6 +40,9 @@ jest.mock('../../common/constants', () => ({
   DEFAULT_SIEM_TIME_RANGE: 'siem:timeDefaults',
 }));
 
+jest.mock('../lib/kibana');
+const mockGetServices = KibanaServices.get as jest.Mock;
+
 /**
  * We utilize the internal chrome mocking that is built in to be able to mock different time range
  * scenarios here or the absence of a time range setting.
@@ -59,16 +56,20 @@ const mockTimeRange = (
     value: DEFAULT_INTERVAL_VALUE,
   }
 ) => {
-  chrome.getUiSettingsClient().get.mockImplementation((key: string) => {
-    switch (key) {
-      case DEFAULT_SIEM_TIME_RANGE:
-        return timeRange;
-      case DEFAULT_SIEM_REFRESH_INTERVAL:
-        return interval;
-      default:
-        throw new Error(`Unexpected config key: ${key}`);
-    }
-  });
+  mockGetServices.mockImplementation(() => ({
+    uiSettings: {
+      get: (key: string) => {
+        switch (key) {
+          case DEFAULT_SIEM_TIME_RANGE:
+            return timeRange;
+          case DEFAULT_SIEM_REFRESH_INTERVAL:
+            return interval;
+          default:
+            throw new Error(`Unexpected config key: ${key}`);
+        }
+      },
+    },
+  }));
 };
 
 /**
@@ -87,445 +88,392 @@ const isMalformedTimeRange = (timeRange: unknown): timeRange is DefaultTimeRange
 const isMalformedInterval = (interval: unknown): interval is DefaultIntervalSetting =>
   typeof interval === 'object';
 
-describe('default_date_settings', () => {
-  beforeEach(() => {
-    chrome.getUiSettingsClient().get.mockClear();
-  });
-
-  describe('#getDefaultFromString', () => {
+describe('getTimeRangeSettings', () => {
+  describe('fromStr', () => {
     test('should return the DEFAULT_FROM constant by default', () => {
       mockTimeRange();
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe(DEFAULT_FROM);
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe(DEFAULT_FROM);
     });
 
     test('should return a custom from range', () => {
       mockTimeRange({ from: 'now-15m' });
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe('now-15m');
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe('now-15m');
     });
 
     test('should return the DEFAULT_FROM when the whole object is null', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe(DEFAULT_FROM);
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe(DEFAULT_FROM);
     });
 
     test('should return the DEFAULT_FROM when the whole object is undefined', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe(DEFAULT_FROM);
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe(DEFAULT_FROM);
     });
 
     test('should return the DEFAULT_FROM when the from value is null', () => {
       mockTimeRange({ from: null });
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe(DEFAULT_FROM);
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe(DEFAULT_FROM);
     });
 
     test('should return the DEFAULT_FROM when the from value is undefined', () => {
       mockTimeRange({ from: undefined });
-      const stringDefault = getDefaultFromString();
-      expect(stringDefault).toBe(DEFAULT_FROM);
+      const { fromStr } = getTimeRangeSettings();
+      expect(fromStr).toBe(DEFAULT_FROM);
     });
 
     test('should return the DEFAULT_FROM when the from value is malformed', () => {
       const malformedTimeRange = { from: true };
       if (isMalformedTimeRange(malformedTimeRange)) {
         mockTimeRange(malformedTimeRange);
-        const stringDefault = getDefaultFromString();
-        expect(stringDefault).toBe(DEFAULT_FROM);
+        const { fromStr } = getTimeRangeSettings();
+        expect(fromStr).toBe(DEFAULT_FROM);
       } else {
         throw Error('Was expecting an object to be used for the malformed time range');
       }
     });
+
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
+
+      it('is DEFAULT_FROM', () => {
+        const { fromStr } = getTimeRangeSettings(false);
+        expect(fromStr).toBe(DEFAULT_FROM);
+      });
+    });
   });
 
-  describe('#getDefaultToString', () => {
+  describe('toStr', () => {
     test('should return the DEFAULT_TO constant by default', () => {
       mockTimeRange();
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe(DEFAULT_TO);
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe(DEFAULT_TO);
     });
 
     test('should return a custom from range', () => {
       mockTimeRange({ to: 'now-15m' });
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe('now-15m');
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe('now-15m');
     });
 
     test('should return the DEFAULT_TO when the whole object is null', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe(DEFAULT_TO);
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe(DEFAULT_TO);
     });
 
     test('should return the DEFAULT_TO when the whole object is undefined', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe(DEFAULT_TO);
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe(DEFAULT_TO);
     });
 
     test('should return the DEFAULT_TO when the to value is null', () => {
       mockTimeRange({ from: null });
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe(DEFAULT_TO);
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe(DEFAULT_TO);
     });
 
     test('should return the DEFAULT_TO when the from value is undefined', () => {
       mockTimeRange({ to: undefined });
-      const stringDefault = getDefaultToString();
-      expect(stringDefault).toBe(DEFAULT_TO);
+      const { toStr } = getTimeRangeSettings();
+      expect(toStr).toBe(DEFAULT_TO);
     });
 
     test('should return the DEFAULT_TO when the to value is malformed', () => {
       const malformedTimeRange = { to: true };
       if (isMalformedTimeRange(malformedTimeRange)) {
         mockTimeRange(malformedTimeRange);
-        const stringDefault = getDefaultToString();
-        expect(stringDefault).toBe(DEFAULT_TO);
+        const { toStr } = getTimeRangeSettings();
+        expect(toStr).toBe(DEFAULT_TO);
       } else {
         throw Error('Was expecting an object to be used for the malformed time range');
       }
     });
+
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
+
+      it('is DEFAULT_TO', () => {
+        const { toStr } = getTimeRangeSettings(false);
+        expect(toStr).toBe(DEFAULT_TO);
+      });
+    });
   });
 
-  describe('#getDefaultFromValue', () => {
+  describe('from', () => {
     test('should return DEFAULT_FROM', () => {
       mockTimeRange();
-      const value = getDefaultFromValue();
-      expect(value).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
     });
 
     test('should return a custom from range', () => {
-      const from = '2019-08-30T17:49:18.396Z';
-      mockTimeRange({ from });
-      const value = getDefaultFromValue();
-      expect(value).toBe(new Date(from).valueOf());
+      const mockFrom = '2019-08-30T17:49:18.396Z';
+      mockTimeRange({ from: mockFrom });
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(mockFrom).valueOf());
     });
 
     test('should return the DEFAULT_FROM when the whole object is null', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultFromValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
     });
 
     test('should return the DEFAULT_FROM when the whole object is undefined', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultFromValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
     });
 
     test('should return the DEFAULT_FROM when the from value is null', () => {
       mockTimeRange({ from: null });
-      const stringDefault = getDefaultFromValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
     });
 
     test('should return the DEFAULT_FROM when the from value is undefined', () => {
       mockTimeRange({ from: undefined });
-      const stringDefault = getDefaultFromValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      const { from } = getTimeRangeSettings();
+      expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
     });
 
     test('should return the DEFAULT_FROM when the from value is malformed', () => {
       const malformedTimeRange = { from: true };
       if (isMalformedTimeRange(malformedTimeRange)) {
         mockTimeRange(malformedTimeRange);
-        const stringDefault = getDefaultFromValue();
-        expect(stringDefault).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+        const { from } = getTimeRangeSettings();
+        expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
       } else {
         throw Error('Was expecting an object to be used for the malformed time range');
       }
     });
+
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
+
+      it('is DEFAULT_FROM in epoch', () => {
+        const { from } = getTimeRangeSettings(false);
+        expect(from).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+      });
+    });
   });
 
-  describe('#getDefaultToValue', () => {
+  describe('to', () => {
     test('should return DEFAULT_TO', () => {
       mockTimeRange();
-      const value = getDefaultToValue();
-      expect(value).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
     });
 
     test('should return a custom from range', () => {
-      const to = '2000-08-30T17:49:18.396Z';
-      mockTimeRange({ to });
-      const value = getDefaultToValue();
-      expect(value).toBe(new Date(to).valueOf());
+      const mockTo = '2000-08-30T17:49:18.396Z';
+      mockTimeRange({ to: mockTo });
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(mockTo).valueOf());
     });
 
     test('should return the DEFAULT_TO_DATE when the whole object is null', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultToValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
     });
 
     test('should return the DEFAULT_TO_DATE when the whole object is undefined', () => {
       mockTimeRange(null);
-      const stringDefault = getDefaultToValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
     });
 
     test('should return the DEFAULT_TO_DATE when the from value is null', () => {
       mockTimeRange({ from: null });
-      const stringDefault = getDefaultToValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
     });
 
     test('should return the DEFAULT_TO_DATE when the from value is undefined', () => {
       mockTimeRange({ from: undefined });
-      const stringDefault = getDefaultToValue();
-      expect(stringDefault).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      const { to } = getTimeRangeSettings();
+      expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
     });
 
     test('should return the DEFAULT_TO_DATE when the from value is malformed', () => {
       const malformedTimeRange = { from: true };
       if (isMalformedTimeRange(malformedTimeRange)) {
         mockTimeRange(malformedTimeRange);
-        const stringDefault = getDefaultToValue();
-        expect(stringDefault).toBe(new Date(DEFAULT_TO_DATE).valueOf());
-      } else {
-        throw Error('Was expecting an object to be used for the malformed time range');
-      }
-    });
-  });
-
-  describe('#getDefaultFromMoment', () => {
-    test('should return DEFAULT_FROM', () => {
-      mockTimeRange();
-      const value = getDefaultFromMoment();
-      expect(value.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
-    });
-
-    test('should return a custom from range', () => {
-      const from = '2019-08-30T17:49:18.396Z';
-      mockTimeRange({ from });
-      const value = getDefaultFromMoment();
-      expect(value.valueOf()).toBe(new Date(from).valueOf());
-    });
-
-    test('should return the DEFAULT_FROM when the whole object is null', () => {
-      mockTimeRange(null);
-      const defaultMoment = getDefaultFromMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
-    });
-
-    test('should return the DEFAULT_FROM when the whole object is undefined', () => {
-      mockTimeRange(null);
-      const defaultMoment = getDefaultFromMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
-    });
-
-    test('should return the DEFAULT_FROM when the from value is null', () => {
-      mockTimeRange({ from: null });
-      const defaultMoment = getDefaultFromMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
-    });
-
-    test('should return the DEFAULT_FROM when the from value is undefined', () => {
-      mockTimeRange({ from: undefined });
-      const defaultMoment = getDefaultFromMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
-    });
-
-    test('should return the DEFAULT_FROM when the from value is malformed', () => {
-      const malformedTimeRange = { from: true };
-      if (isMalformedTimeRange(malformedTimeRange)) {
-        mockTimeRange(malformedTimeRange);
-        const defaultMoment = getDefaultFromMoment();
-        expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_FROM_DATE).valueOf());
+        const { to } = getTimeRangeSettings();
+        expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
       } else {
         throw Error('Was expecting an object to be used for the malformed time range');
       }
     });
-  });
-
-  describe('#getDefaultToMoment', () => {
-    test('should return DEFAULT_TO', () => {
-      mockTimeRange();
-      const value = getDefaultToMoment();
-      expect(value.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-    });
-
-    test('should return a custom range', () => {
-      const to = '2019-08-30T17:49:18.396Z';
-      mockTimeRange({ to });
-      const value = getDefaultToMoment();
-      expect(value.valueOf()).toBe(new Date(to).valueOf());
-    });
 
-    test('should return the DEFAULT_TO when the whole object is null', () => {
-      mockTimeRange(null);
-      const defaultMoment = getDefaultToMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-    });
-
-    test('should return the DEFAULT_TO when the whole object is undefined', () => {
-      mockTimeRange(null);
-      const defaultMoment = getDefaultToMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-    });
-
-    test('should return the DEFAULT_TO when the from value is null', () => {
-      mockTimeRange({ from: null });
-      const defaultMoment = getDefaultToMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-    });
-
-    test('should return the DEFAULT_TO when the from value is undefined', () => {
-      mockTimeRange({ from: undefined });
-      const defaultMoment = getDefaultToMoment();
-      expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-    });
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
 
-    test('should return the DEFAULT_TO when the from value is malformed', () => {
-      const malformedTimeRange = { from: true };
-      if (isMalformedTimeRange(malformedTimeRange)) {
-        mockTimeRange(malformedTimeRange);
-        const defaultMoment = getDefaultToMoment();
-        expect(defaultMoment.valueOf()).toBe(new Date(DEFAULT_TO).valueOf());
-      } else {
-        throw Error('Was expecting an object to be used for the malformed time range');
-      }
+      it('is DEFAULT_TO in epoch', () => {
+        const { to } = getTimeRangeSettings(false);
+        expect(to).toBe(new Date(DEFAULT_TO_DATE).valueOf());
+      });
     });
   });
+});
 
-  describe('#getDefaultIntervalKind', () => {
+describe('getIntervalSettings', () => {
+  describe('kind', () => {
     test('should return default', () => {
       mockTimeRange();
-      const value = getDefaultIntervalKind();
-      expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+      const { kind } = getIntervalSettings();
+      expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
     });
 
     test('should return an interval when given non paused value', () => {
       const interval: DefaultIntervalSetting = { pause: false };
       mockTimeRange(undefined, interval);
-      const value = getDefaultIntervalKind();
+      const { kind } = getIntervalSettings();
       const expected: Policy['kind'] = 'interval';
-      expect(value).toBe(expected);
+      expect(kind).toBe(expected);
     });
 
     test('should return a manual when given a paused value', () => {
       const interval: DefaultIntervalSetting = { pause: true };
       mockTimeRange(undefined, interval);
-      const value = getDefaultIntervalKind();
+      const { kind } = getIntervalSettings();
       const expected: Policy['kind'] = 'manual';
-      expect(value).toBe(expected);
+      expect(kind).toBe(expected);
     });
 
     test('should return the default when the whole object is null', () => {
       mockTimeRange(undefined, null);
-      const value = getDefaultIntervalKind();
-      expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+      const { kind } = getIntervalSettings();
+      expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
     });
 
     test('should return the default when the whole object is undefined', () => {
       mockTimeRange(undefined, undefined);
-      const value = getDefaultIntervalKind();
-      expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+      const { kind } = getIntervalSettings();
+      expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
     });
 
     test('should return the default when the value is null', () => {
       mockTimeRange(undefined, { pause: null });
-      const value = getDefaultIntervalKind();
-      expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+      const { kind } = getIntervalSettings();
+      expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
     });
 
     test('should return the default when the value is undefined', () => {
       mockTimeRange(undefined, { pause: undefined });
-      const value = getDefaultIntervalKind();
-      expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+      const { kind } = getIntervalSettings();
+      expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
     });
 
     test('should return the default when the from value is malformed', () => {
       const malformedInterval = { pause: 'whoops a string' };
       if (isMalformedInterval(malformedInterval)) {
         mockTimeRange(undefined, malformedInterval);
-        const value = getDefaultIntervalKind();
-        expect(value).toBe(DEFAULT_INTERVAL_TYPE);
+        const { kind } = getIntervalSettings();
+        expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
       } else {
         throw Error('Was expecting an object to be used for the malformed interval');
       }
     });
+
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
+
+      it('is DEFAULT_INTERVAL_TYPE', () => {
+        const { kind } = getIntervalSettings(false);
+        expect(kind).toBe(DEFAULT_INTERVAL_TYPE);
+      });
+    });
   });
 
-  describe('#getDefaultIntervalDuration', () => {
+  describe('duration', () => {
     test('should return default', () => {
       mockTimeRange();
-      const value = getDefaultIntervalDuration();
-      expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+      const { duration } = getIntervalSettings();
+      expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
     });
 
     test('should return a value when given a paused value', () => {
       const interval: DefaultIntervalSetting = { value: 5 };
       mockTimeRange(undefined, interval);
-      const value = getDefaultIntervalDuration();
+      const { duration } = getIntervalSettings();
       const expected: Policy['duration'] = 5;
-      expect(value).toBe(expected);
+      expect(duration).toBe(expected);
     });
 
     test('should return the default when the whole object is null', () => {
       mockTimeRange(undefined, null);
-      const value = getDefaultIntervalDuration();
-      expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+      const { duration } = getIntervalSettings();
+      expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
     });
 
     test('should return the default when the whole object is undefined', () => {
       mockTimeRange(undefined, undefined);
-      const value = getDefaultIntervalDuration();
-      expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+      const { duration } = getIntervalSettings();
+      expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
     });
 
     test('should return the default when the value is null', () => {
       mockTimeRange(undefined, { value: null });
-      const value = getDefaultIntervalDuration();
-      expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+      const { duration } = getIntervalSettings();
+      expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
     });
 
     test('should return the default when the value is undefined', () => {
       mockTimeRange(undefined, { value: undefined });
-      const value = getDefaultIntervalDuration();
-      expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+      const { duration } = getIntervalSettings();
+      expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
     });
 
     test('should return the default when the value is malformed', () => {
       const malformedInterval = { value: 'whoops a string' };
       if (isMalformedInterval(malformedInterval)) {
         mockTimeRange(undefined, malformedInterval);
-        const value = getDefaultIntervalDuration();
-        expect(value).toBe(DEFAULT_INTERVAL_VALUE);
+        const { duration } = getIntervalSettings();
+        expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
       } else {
         throw Error('Was expecting an object to be used for the malformed interval');
       }
     });
-  });
 
-  describe('#parseDateString', () => {
-    test('should return the first value as a moment if everything is ok', () => {
-      const value = parseDateString(
-        '1930-05-31T13:03:54.234Z',
-        '1940-05-31T13:03:54.234Z',
-        moment('1950-05-31T13:03:54.234Z')
-      );
-      expect(value.valueOf()).toBe(new Date('1930-05-31T13:03:54.234Z').valueOf());
-    });
+    describe('without UISettings', () => {
+      beforeEach(() => {
+        mockGetServices.mockImplementation(() => {
+          throw new Error('should not have been called');
+        });
+      });
 
-    test('should return the second value as a moment if the first is null', () => {
-      const value = parseDateString(
-        null,
-        '1940-05-31T13:03:54.234Z',
-        moment('1950-05-31T13:03:54.234Z')
-      );
-      expect(value.valueOf()).toBe(new Date('1940-05-31T13:03:54.234Z').valueOf());
-    });
-
-    test('should return the second value as a moment if the first is undefined', () => {
-      const value = parseDateString(
-        null,
-        '1940-05-31T13:03:54.234Z',
-        moment('1950-05-31T13:03:54.234Z')
-      );
-      expect(value.valueOf()).toBe(new Date('1940-05-31T13:03:54.234Z').valueOf());
+      it('is DEFAULT_INTERVAL_VALUE', () => {
+        const { duration } = getIntervalSettings(false);
+        expect(duration).toBe(DEFAULT_INTERVAL_VALUE);
+      });
     });
   });
 
diff --git a/x-pack/legacy/plugins/siem/public/utils/default_date_settings.ts b/x-pack/legacy/plugins/siem/public/utils/default_date_settings.ts
index 273988c167255..c4869a4851ae5 100644
--- a/x-pack/legacy/plugins/siem/public/utils/default_date_settings.ts
+++ b/x-pack/legacy/plugins/siem/public/utils/default_date_settings.ts
@@ -4,10 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import chrome from 'ui/chrome';
 import dateMath from '@elastic/datemath';
 import moment from 'moment';
-import { isString, isBoolean, isNumber } from 'lodash/fp';
+import { isBoolean, isNumber, isString } from 'lodash/fp';
+
 import {
   DEFAULT_SIEM_TIME_RANGE,
   DEFAULT_SIEM_REFRESH_INTERVAL,
@@ -16,6 +16,7 @@ import {
   DEFAULT_INTERVAL_TYPE,
   DEFAULT_INTERVAL_VALUE,
 } from '../../common/constants';
+import { KibanaServices } from '../lib/kibana';
 import { Policy } from '../store/inputs/model';
 
 interface DefaultTimeRange {
@@ -29,7 +30,6 @@ interface DefaultInterval {
 }
 
 export type DefaultTimeRangeSetting = DefaultTimeRange | null | undefined;
-
 export type DefaultIntervalSetting = DefaultInterval | null | undefined;
 
 // Defaults for if everything fails including dateMath.parse(DEFAULT_FROM) or dateMath.parse(DEFAULT_TO)
@@ -38,117 +38,37 @@ const DEFAULT_FROM_MOMENT = moment().subtract(24, 'hours');
 const DEFAULT_TO_MOMENT = moment();
 
 /**
- * Returns the default SIEM time range "from" string. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultFromString = (): string => {
-  const defaultTimeRange: DefaultTimeRangeSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_TIME_RANGE);
-  if (defaultTimeRange != null && isString(defaultTimeRange.from)) {
-    return defaultTimeRange.from;
-  } else {
-    return DEFAULT_FROM;
-  }
-};
-
-/**
- * Returns the default SIEM time range "to" string. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
+ * Retrieves timeRange settings to populate filters
+ *
+ * @param {Boolean} uiSettings Whether to respect the user's UI settings. Defaults to true.
  */
-export const getDefaultToString = (): string => {
-  const defaultTimeRange: DefaultTimeRangeSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_TIME_RANGE);
-  if (defaultTimeRange != null && isString(defaultTimeRange.to)) {
-    return defaultTimeRange.to;
-  } else {
-    return DEFAULT_TO;
-  }
-};
-
-/**
- * Returns the default SIEM time range "from" Epoch. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultFromValue = (): number => getDefaultFromMoment().valueOf();
-
-/**
- * Returns the default SIEM time range "from" moment. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultFromMoment = (): moment.Moment => {
-  const defaultTimeRange: DefaultTimeRangeSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_TIME_RANGE);
-  if (defaultTimeRange != null && isString(defaultTimeRange.from)) {
-    return parseDateString(defaultTimeRange.from, DEFAULT_FROM, DEFAULT_FROM_MOMENT);
-  } else {
-    return parseDateWithDefault(DEFAULT_FROM, DEFAULT_FROM_MOMENT);
-  }
-};
+export const getTimeRangeSettings = (uiSettings = true) => {
+  const timeRange = uiSettings
+    ? KibanaServices.get().uiSettings.get<DefaultTimeRangeSetting>(DEFAULT_SIEM_TIME_RANGE)
+    : null;
 
-/**
- * Returns the default SIEM time range "to" Epoch. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultToValue = (): number => getDefaultToMoment().valueOf();
+  const fromStr = (isString(timeRange?.from) && timeRange?.from) || DEFAULT_FROM;
+  const toStr = (isString(timeRange?.to) && timeRange?.to) || DEFAULT_TO;
+  const from = parseDateWithDefault(fromStr, DEFAULT_FROM_MOMENT).valueOf();
+  const to = parseDateWithDefault(toStr, DEFAULT_TO_MOMENT).valueOf();
 
-/**
- * Returns the default SIEM time range "to" moment. This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultToMoment = (): moment.Moment => {
-  const defaultTimeRange: DefaultTimeRangeSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_TIME_RANGE);
-  if (defaultTimeRange != null && isString(defaultTimeRange.to)) {
-    return parseDateString(defaultTimeRange.to, DEFAULT_TO, DEFAULT_TO_MOMENT);
-  } else {
-    return parseDateWithDefault(DEFAULT_TO, DEFAULT_TO_MOMENT);
-  }
+  return { from, fromStr, to, toStr };
 };
 
 /**
- * Returns the default SIEM interval "kind". This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
+ * Retrieves refreshInterval settings to populate filters
+ *
+ * @param {Boolean} uiSettings Whether to respect the user's UI settings. Defaults to true.
  */
-export const getDefaultIntervalKind = (): Policy['kind'] => {
-  const defaultInterval: DefaultIntervalSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_REFRESH_INTERVAL);
-  if (defaultInterval != null && isBoolean(defaultInterval.pause)) {
-    return defaultInterval.pause ? 'manual' : 'interval';
-  } else {
-    return DEFAULT_INTERVAL_TYPE;
-  }
-};
+export const getIntervalSettings = (uiSettings = true): Policy => {
+  const interval = uiSettings
+    ? KibanaServices.get().uiSettings.get<DefaultIntervalSetting>(DEFAULT_SIEM_REFRESH_INTERVAL)
+    : null;
 
-/**
- * Returns the default SIEM interval "duration". This should be used only in
- * non-ReactJS code. For ReactJS code, use the settings context hook instead
- */
-export const getDefaultIntervalDuration = (): Policy['duration'] => {
-  const defaultInterval: DefaultIntervalSetting = chrome
-    .getUiSettingsClient()
-    .get(DEFAULT_SIEM_REFRESH_INTERVAL);
-  if (defaultInterval != null && isNumber(defaultInterval.value)) {
-    return defaultInterval.value;
-  } else {
-    return DEFAULT_INTERVAL_VALUE;
-  }
-};
+  const duration = (isNumber(interval?.value) && interval?.value) || DEFAULT_INTERVAL_VALUE;
+  const kind = isBoolean(interval?.pause) && !interval?.pause ? 'interval' : DEFAULT_INTERVAL_TYPE;
 
-export const parseDateString = (
-  dateString: string | null | undefined,
-  defaultDateString: string,
-  defaultDate: moment.Moment
-): moment.Moment => {
-  if (dateString != null) {
-    return parseDateWithDefault(dateString, defaultDate);
-  } else {
-    return parseDateWithDefault(defaultDateString, defaultDate);
-  }
+  return { kind, duration };
 };
 
 export const parseDateWithDefault = (
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/_mock_server.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/_mock_server.ts
index 4bf7b3279374b..5b85012fd9f08 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/_mock_server.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/_mock_server.ts
@@ -58,7 +58,6 @@ export const createMockServer = (config: Record<string, string> = defaultConfig)
     })),
   };
   server.decorate('request', 'getAlertsClient', () => alertsClient);
-  server.decorate('request', 'getBasePath', () => '/s/default');
   server.plugins.elasticsearch = (elasticsearch as unknown) as ElasticsearchPlugin;
   server.plugins.spaces = { getSpaceId: () => 'default' };
   server.plugins.actions = {
@@ -91,7 +90,6 @@ export const createMockServerWithoutAlertClientDecoration = (
   } as any; // The types have really bad conflicts at the moment so I have to use any
 
   const actionsClient = actionsClientMock.create();
-  serverWithoutAlertClient.decorate('request', 'getBasePath', () => '/s/default');
 
   return {
     serverWithoutAlertClient: serverWithoutAlertClient as ServerFacade & Hapi.Server,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
index 6a42aed123fa3..19c4279e06b03 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -84,7 +84,7 @@ export const typicalSetStatusSignalByIdsPayload = (): Partial<SignalsStatusRestP
 });
 
 export const typicalSetStatusSignalByQueryPayload = (): Partial<SignalsStatusRestParams> => ({
-  query: { range: { '@timestamp': { gte: 'now-2M', lte: 'now/M' } } },
+  query: { bool: { filter: { range: { '@timestamp': { gte: 'now-2M', lte: 'now/M' } } } } },
   status: 'closed',
 });
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/index/signals_policy.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/index/signals_policy.json
index 640d8e14190cd..4fc7eebd4373c 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/index/signals_policy.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/index/signals_policy.json
@@ -5,8 +5,8 @@
         "min_age": "0ms",
         "actions": {
           "rollover": {
-            "max_size": "10gb",
-            "max_age": "7d"
+            "max_size": "50gb",
+            "max_age": "30d"
           }
         }
       }
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
index 7c49a1942ee91..4755869c3d908 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
@@ -33,7 +33,11 @@ export const setSignalsStatusRouteDef = (server: ServerFacade): Hapi.ServerRoute
         queryObject = { ids: { values: signalIds } };
       }
       if (query) {
-        queryObject = query;
+        queryObject = {
+          bool: {
+            filter: query,
+          },
+        };
       }
       try {
         return callWithRequest(request, 'updateByQuery', {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json
index c685d96cdf57b..fd46a09d4ced0 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/403_response_to_a_post.json
@@ -1,13 +1,13 @@
 {
-  "description": "A POST request to web application returned a 403 response which indicates the web application declined to process the request because the action requested was disallowed.",
+  "description": "A POST request to web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed",
   "false_positives": [
-    "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity."
+    "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity."
   ],
   "index": [
     "apm-*-transaction*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Web Application Suspicious Activity: POST Request Declined",
   "query": "http.response.status_code:403 and http.request.method:post",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json
index 64264452d468b..a6235c889902b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/405_response_method_not_allowed.json
@@ -1,13 +1,13 @@
 {
-  "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method was not allowed for the resource.",
+  "description": "A request to web application returned a 405 response which indicates the web application declined to process the request because the HTTP method is not allowed for the resource",
   "false_positives": [
-    "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity."
+    "Security scans and tests may result in these errors. Misconfigured or buggy applications may produce large numbers of these errors. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity."
   ],
   "index": [
     "apm-*-transaction*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Web Application Suspicious Activity: Unauthorized Method",
   "query": "http.response.status_code:405",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json
index 56d142fdf3ef8..397db1367f402 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_adversary_behavior_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Adversary behavior detected.",
+  "description": "Elastic Endpoint detected an Adversary Behavior. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Adversary Behavior - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:rules_engine_event",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json
index 6805696ce6bc9..fdd875e95b3d3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_detected.json
@@ -1,11 +1,13 @@
 {
-  "description": "Elastic Endpoint Security Alert - Credential dumping detected.",
+  "description": "Elastic Endpoint detected Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Cred Dumping - Detected - Elastic Endpoint",
+  "max_signals": 100,
+  "name": "Credential Dumping - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:detection",
   "risk_score": 73,
   "rule_id": "571afc56-5ed9-465d-a2a9-045f099f6e7e",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json
index 68c0f5cad8252..8ed63c55ef213 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_dumping_prevented.json
@@ -1,11 +1,13 @@
 {
-  "description": "Elastic Endpoint Security Alert - Credential dumping prevented.",
+  "description": "Elastic Endpoint prevented Credential Dumping. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Cred Dumping - Prevented - Elastic Endpoint",
+  "max_signals": 100,
+  "name": "Credential Dumping - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:cred_theft_event and endgame.metadata.type:prevention",
   "risk_score": 47,
   "rule_id": "db8c33a8-03cd-4988-9e2c-d0a4863adb13",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json
index 0d0d9c71a2ec1..98c4e5341d9e8 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_detected.json
@@ -1,11 +1,13 @@
 {
-  "description": "Elastic Endpoint Security Alert - Credential manipulation detected.",
+  "description": "Elastic Endpoint detected Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Cred Manipulation - Detected - Elastic Endpoint",
+  "max_signals": 100,
+  "name": "Credential Manipulation - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:detection",
   "risk_score": 73,
   "rule_id": "c0be5f31-e180-48ed-aa08-96b36899d48f",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json
index df49c80e3097b..4234e3d955794 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_cred_manipulation_prevented.json
@@ -1,17 +1,20 @@
 {
-  "description": "Elastic Endpoint Security Alert - Credential manipulation prevented.",
+  "description": "Elastic Endpoint prevented Credential Manipulation. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Cred Manipulation - Prevented - Elastic Endpoint",
+  "max_signals": 100,
+  "name": "Credential Manipulation - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:token_manipulation_event and endgame.metadata.type:prevention",
   "risk_score": 47,
   "rule_id": "c9e38e64-3f4c-4bf3-ad48-0e61a60ea1fa",
   "severity": "medium",
   "tags": [
-    "Elastic"
+    "Elastic",
+    "Endpoint"
   ],
   "type": "query",
   "version": 1
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json
index 9c3896a70b3a0..9971075d7e617 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Exploit detected.",
+  "description": "Elastic Endpoint detected an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Exploit - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:detection",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json
index 4632ae6a1487b..233552fc1de13 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_exploit_prevented.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Exploit prevented.",
+  "description": "Elastic Endpoint prevented an Exploit. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Exploit - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:exploit_event and endgame.metadata.type:prevention",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json
index 68831392942d4..64d686fb984c9 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Malware detected.",
+  "description": "Elastic Endpoint detected Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Malware - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:detection",
   "risk_score": 99,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json
index 56b41df2a3349..72f2134f23ab2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_malware_prevented.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Malware prevented.",
+  "description": "Elastic Endpoint prevented Malware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Malware - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:file_classification_event and endgame.metadata.type:prevention",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json
index 268dc9cf89121..3755dd4cd5dac 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Permission theft detected.",
+  "description": "Elastic Endpoint detected Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Permission Theft - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:detection",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json
index 6deda3d0453b2..d869407586372 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_permission_theft_prevented.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Permission theft prevented.",
+  "description": "Elastic Endpoint prevented Permission Theft. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Permission Theft - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:token_protection_event and endgame.metadata.type:prevention",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json
index 25a03e611fe3e..1078cf69394e2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Process injection detected.",
+  "description": "Elastic Endpoint detected Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Process Injection - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:detection",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json
index 6c549d70a9d41..8b68fc6925f9b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_process_injection_prevented.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Process injection prevented.",
+  "description": "Elastic Endpoint prevented Process Injection. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Process Injection - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:kernel_shellcode_event and endgame.metadata.type:prevention",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json
index 4a118cf8ab861..a332c7011e94b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_detected.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Ransomware detected.",
+  "description": "Elastic Endpoint detected Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Ransomware - Detected - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:detection",
   "risk_score": 99,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json
index 8b48e8f4c1758..087c91d2105ce 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security_ransomware_prevented.json
@@ -1,10 +1,12 @@
 {
-  "description": "Elastic Endpoint Security Alert - Ransomware prevented.",
+  "description": "Elastic Endpoint prevented Ransomware. Click the Elastic Endpoint icon in the event.module column or the link in the rule.reference column in the External Alerts tab of the SIEM Detections page for additional information.",
+  "from": "now-660s",
   "index": [
     "endgame-*"
   ],
+  "interval": "10m",
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Ransomware - Prevented - Elastic Endpoint",
   "query": "event.kind:alert and event.module:endgame and event.action:ransomware_event and endgame.metadata.type:prevention",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json
index 374691f670b74..43aead33925c1 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adding_the_hidden_file_attribute_with_via_attribexe.json
@@ -1,10 +1,10 @@
 {
-  "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection",
+  "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.",
   "index": [
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Adding Hidden File Attribute via Attrib",
   "query": "    event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"attrib.exe\" and process.args:\"+h\"",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json
index 47f171dd7be0e..387726168cb10 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_adobe_hijack_persistence.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Adobe Hijack Persistence",
   "query": "file.path:(\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" or \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\") and event.action:\"File created (rule: FileCreate)\" and not process.name:msiexeec.exe",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json
deleted file mode 100644
index 7ec960eea6302..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_powershell.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "An adversary can leverage a computer's peripheral devices or applications to capture audio recordings for the purpose of listening into sensitive conversations to gather information.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Audio Capture via PowerShell",
-  "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"powershell.exe\" and process.args:\"WindowsAudioDevice-Powershell-Cmdlet\"",
-  "risk_score": 21,
-  "rule_id": "b27b9f47-0a20-4807-8377-7f899b4fbada",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0003",
-        "name": "Collection",
-        "reference": "https://attack.mitre.org/tactics/TA0009/"
-      },
-      "technique": [
-        {
-          "id": "T1123",
-          "name": "Audio Capture",
-          "reference": "https://attack.mitre.org/techniques/T1123/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json
deleted file mode 100644
index 87bdfc4980124..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_audio_capture_via_soundrecorder.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "An adversary can leverage a computer's peripheral devices or applications to capture audio recordings for the purpose of listening into sensitive conversations to gather information.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Audio Capture via SoundRecorder",
-  "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"SoundRecorder.exe\" and process.args:\"/FILE\"",
-  "risk_score": 21,
-  "rule_id": "f8e06892-ed10-4452-892e-2c5a38d552f1",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0003",
-        "name": "Collection",
-        "reference": "https://attack.mitre.org/tactics/TA0009/"
-      },
-      "technique": [
-        {
-          "id": "T1123",
-          "name": "Audio Capture",
-          "reference": "https://attack.mitre.org/techniques/T1123/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json
deleted file mode 100644
index 2fa63fa51f7c1..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_event_viewer.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe.  Attackers bypass UAC to stealthily execute code with elevated permissions.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Bypass UAC via Event Viewer",
-  "query": "process.parent.name:eventvwr.exe and event.action:\"Process Create (rule: ProcessCreate)\" and not process.executable:(\"C:\\Windows\\System32\\mmc.exe\" or \"C:\\Windows\\SysWOW64\\mmc.exe\")",
-  "risk_score": 21,
-  "rule_id": "59547add-a400-4baa-aa0c-66c72efdb77f",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0004",
-        "name": "Privilege Escalation",
-        "reference": "https://attack.mitre.org/tactics/TA0004/"
-      },
-      "technique": [
-        {
-          "id": "T1088",
-          "name": "Bypass User Account Control",
-          "reference": "https://attack.mitre.org/techniques/T1088/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json
deleted file mode 100644
index fdc716dcb3ebe..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_cmstp.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies User Account Control (UAC) bypass via cmstp.exe.  Attackers bypass UAC to stealthily execute code with elevated permissions.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Bypass UAC via Cmstp",
-  "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:\"cmstp.exe\" and process.parent.args:(\"/s\" and \"/au\")",
-  "risk_score": 21,
-  "rule_id": "2f7403da-1a4c-46bb-8ecc-c1a596e10cd0",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0004",
-        "name": "Privilege Escalation",
-        "reference": "https://attack.mitre.org/tactics/TA0004/"
-      },
-      "technique": [
-        {
-          "id": "T1088",
-          "name": "Bypass User Account Control",
-          "reference": "https://attack.mitre.org/techniques/T1088/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json
deleted file mode 100644
index 484a01e0211ab..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_bypass_uac_via_sdclt.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies User Account Control (UAC) bypass via sdclt.exe.  Attackers bypass UAC to stealthily execute code with elevated permissions.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Bypass UAC via Sdclt",
-  "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"sdclt.exe\" and process.args:\"/kickoffelev\" and not process.executable:(\"C:\\Windows\\System32\\sdclt.exe\" or \"C:\\Windows\\System32\\control.exe\" or \"C:\\Windows\\SysWOW64\\sdclt.exe\" or \"C:\\Windows\\SysWOW64\\control.exe\")",
-  "risk_score": 21,
-  "rule_id": "f68d83a1-24cb-4b8d-825b-e8af400b9670",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0004",
-        "name": "Privilege Escalation",
-        "reference": "https://attack.mitre.org/tactics/TA0004/"
-      },
-      "technique": [
-        {
-          "id": "T1088",
-          "name": "Bypass User Account Control",
-          "reference": "https://attack.mitre.org/techniques/T1088/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json
index e9729ff102619..135e81148475f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_clearing_windows_event_logs.json
@@ -1,10 +1,10 @@
 {
-  "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt evade detection or destroy forensic evidence on a system.",
+  "description": "Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.",
   "index": [
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Clearing Windows Event Logs",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\" and (process.name:\"wevtutil.exe\" and process.args:\"cl\") or (process.name:\"powershell.exe\" and process.args:\"Clear-EventLog\")",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json
index 479bb4a2a6d7c..815e2abd0fc96 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_delete_volume_usn_journal_with_fsutil.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Delete Volume USN Journal with Fsutil",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\"  and   process.name:\"fsutil.exe\" and    process.args:(\"usn\" and \"deletejournal\")",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json
index 204925e4b677b..d990e071b2123 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_deleting_backup_catalogs_with_wbadmin.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Deleting Backup Catalogs with Wbadmin",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\"  and process.name:\"wbadmin.exe\" and  process.args:(\"delete\" and \"catalog\")",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json
index b6398a9985e7e..9d1cebb32c865 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_direct_outbound_smb_connection.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Direct Outbound SMB Connection",
   "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and destination.port:445 and   not process.pid:4 and not destination.ip:(\"127.0.0.1\" or \"::1\")",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json
index 32b43cc24e91b..7ead979f27bb1 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_disable_windows_firewall_rules_with_netsh.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Disable Windows Firewall Rules via Netsh",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"netsh.exe\" and process.args:(\"firewall\" and \"set\" and \"disable\") or process.args:(\"advfirewall\" and \"state\" and \"off\")",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json
deleted file mode 100644
index 5740453b6ae6d..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_dll_search_order_hijack.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "description": "Detects writing DLL files to known locations associated with Windows files vulnerable to DLL search order hijacking.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "DLL Search Order Hijack",
-  "query": " event.action:\"File created (rule: FileCreate)\"  and    not winlog.user.identifier:(\"S-1-5-18\" or \"S-1-5-19\" or \"S-1-5-20\") and    file.path:(\"C\\Windows\\ehome\\cryptbase.dll\" or               \"C\\Windows\\System32\\Sysprep\\cryptbase.dll\" or               \"C\\Windows\\System32\\Sysprep\\cryptsp.dll\" or               \"C\\Windows\\System32\\Sysprep\\rpcrtremote.dll\" or               \"C\\Windows\\System32\\Sysprep\\uxtheme.dll\" or               \"C\\Windows\\System32\\Sysprep\\dwmapi.dll\" or               \"C\\Windows\\System32\\Sysprep\\shcore.dll\" or               \"C\\Windows\\System32\\Sysprep\\oleacc.dll\" or               \"C\\Windows\\System32\\ntwdblib.dll\") ",
-  "risk_score": 47,
-  "rule_id": "73fbc44c-c3cd-48a8-a473-f4eb2065c716",
-  "severity": "medium",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0004",
-        "name": "Privilege Escalation",
-        "reference": "https://attack.mitre.org/tactics/TA0004/"
-      },
-      "technique": [
-        {
-          "id": "T1088",
-          "name": "Bypass User Account Control",
-          "reference": "https://attack.mitre.org/techniques/T1088/"
-        }
-      ]
-    },
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
-      },
-      "technique": [
-        {
-          "id": "T1088",
-          "name": "Bypass User Account Control",
-          "reference": "https://attack.mitre.org/techniques/T1088/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json
index 37e1c26885a15..2cb92f0a26c90 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_encoding_or_decoding_files_via_certutil.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Encoding or Decoding Files via CertUtil",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\" and    process.name:\"certutil.exe\" and    process.args:(\"-encode\" or \"/encode\" or \"-decode\" or \"/decode\")",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json
index dc4991f86a0f5..e7f46b46c2ce2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_scheduled_task_commands.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Local Scheduled Task Commands",
   "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:schtasks.exe and process.args:(\"/create\" or \"-create\" or \"/S\" or \"-s\" or \"/run\" or \"-run\" or \"/change\" or \"-change\")",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json
index eb6f2377376f2..b018435ea0214 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_local_service_commands.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Local Service Commands",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\" and  process.name:sc.exe and process.args:(\"create\" or \"config\" or \"failure\" or \"start\")",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json
deleted file mode 100644
index 26bd65b897c63..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_modification_of_boot_configuration.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Modification of Boot Configuration",
-  "query": "event.action:\"Process Create (rule: ProcessCreate)\" and   process.name:\"bcdedit.exe\" and    process.args:\"set\" and    process.args:(     (\"bootstatuspolicy\" and \"ignoreallfailures\") or      (\"recoveryenabled\" and \"no\")   ) ",
-  "risk_score": 73,
-  "rule_id": "b9ab2f7f-f719-4417-9599-e0252fffe2d8",
-  "severity": "high",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
-      },
-      "technique": [
-        {
-          "id": "T1107",
-          "name": "File Deletion",
-          "reference": "https://attack.mitre.org/techniques/T1107/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json
index d40ffed523c6a..7d84e0bda06e5 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msbuild_making_network_connections.json
@@ -4,9 +4,9 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "MsBuild Making Network Connections",
-  "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:msbuild.exe and not destination.ip:(\"127.0.0.1\" or \"::1\")",
+  "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:MSBuild.exe and not destination.ip:(\"127.0.0.1\" or \"::1\")",
   "risk_score": 47,
   "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b",
   "severity": "medium",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json
index 7905d80c6e8c2..44141b08fb8f0 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_mshta_making_network_connections.json
@@ -4,9 +4,9 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Network Connection via Mshta",
-  "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:\"mshta.exe\" and not process.name:\"mshta.exe\"",
+  "query": "event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:\"mshta.exe\"",
   "references": [
     "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
   ],
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json
deleted file mode 100644
index 16ef15589f48f..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_msxsl_making_network_connections.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Network Connection via MsXsl",
-  "query": "process.name:msxsl.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
-  "risk_score": 47,
-  "rule_id": "d7351b03-135d-43ba-8b36-cc9b07854525",
-  "severity": "medium",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1220",
-          "name": "XSL Script Processing",
-          "reference": "https://attack.mitre.org/techniques/T1220/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json
index fd210005118b8..580f73c25a4a2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_psexec_lateral_movement_command.json
@@ -7,9 +7,9 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "PsExec Network Connection",
-  "query": "process.name:psexec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" ",
+  "query": "process.name:PsExec.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" ",
   "risk_score": 21,
   "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce",
   "severity": "low",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json
index a5d71e23a1215..95aabc49b5302 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_office_child_process.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Suspicious MS Office Child Process",
   "query": " event.action:\"Process Create (rule: ProcessCreate)\" and    process.parent.name:(\"winword.exe\" or \"excel.exe\" or \"powerpnt.exe\" or \"eqnedt32.exe\" or \"fltldr.exe\" or \"mspub.exe\" or \"msaccess.exe\") and process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json
index 86716d6608049..f31228d0130f8 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_ms_outlook_child_process.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Suspicious MS Outlook Child Process",
   "query": "  event.action:\"Process Create (rule: ProcessCreate)\" and  process.parent.name:\"outlook.exe\" and    process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json
deleted file mode 100644
index b0fbccf1b67a7..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_suspicious_pdf_reader_child_process.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Suspicious PDF Reader Child Process",
-  "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"acrord32.exe\" or \"rdrcef.exe\" or \"foxitphantomPDF.exe\" or \"foxitreader.exe\") and    process.name:(\"arp.exe\" or \"dsquery.exe\" or \"dsget.exe\" or \"gpresult.exe\" or \"hostname.exe\" or \"ipconfig.exe\" or \"nbtstat.exe\" or \"net.exe\" or \"net1.exe\" or \"netsh.exe\" or \"netstat.exe\" or \"nltest.exe\" or \"ping.exe\" or \"qprocess.exe\" or \"quser.exe\" or \"qwinsta.exe\" or \"reg.exe\" or \"sc.exe\" or \"systeminfo.exe\" or \"tasklist.exe\" or \"tracert.exe\" or \"whoami.exe\" or \"bginfo.exe\" or \"cdb.exe\" or \"cmstp.exe\" or \"csi.exe\" or \"dnx.exe\" or \"fsi.exe\" or \"ieexec.exe\" or \"iexpress.exe\" or \"installutil.exe\" or \"Microsoft.Workflow.Compiler.exe\" or \"msbuild.exe\" or \"mshta.exe\" or \"msxsl.exe\" or \"odbcconf.exe\" or \"rcsi.exe\" or \"regsvr32.exe\" or \"xwizard.exe\" or \"atbroker.exe\" or \"forfiles.exe\" or \"schtasks.exe\" or \"regasm.exe\" or \"regsvcs.exe\" or \"cmd.exe\" or \"cscript.exe\" or \"powershell.exe\" or \"pwsh.exe\" or \"wmic.exe\" or \"wscript.exe\" or \"bitsadmin.exe\" or \"certutil.exe\" or \"ftp.exe\") ",
-  "risk_score": 73,
-  "rule_id": "afcac7b1-d092-43ff-a136-aa7accbda38f",
-  "severity": "high",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1193",
-          "name": "Spearphishing Attachment",
-          "reference": "https://attack.mitre.org/techniques/T1193/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json
index 984b522596c1e..a38232f37843e 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_system_shells_via_services.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "System Shells via Services",
   "query": " event.action:\"Process Create (rule: ProcessCreate)\" and    process.parent.name:\"services.exe\" and    process.name:(\"cmd.exe\" or \"powershell.exe\")",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json
index 03b9bebb655c3..820c69cb3c809 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_network_connection_via_rundll32.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Unusual Network Connection via RunDLL32",
   "query": "process.name:rundll32.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json
index 72eb17863e0d3..21d3d2741378a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_parentchild_relationship.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Unusual Parent-Child Relationship ",
   "query": "   event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.executable:* and   (      (process.name:\"smss.exe\" and not process.parent.name:(\"System\" or \"smss.exe\")) or       (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\" or \"svchost.exe\")) or       (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or       (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or       (process.name:\"lsass.exe\" and not process.parent.name:\"wininit.exe\") or       (process.name:\"LogonUI.exe\" and not process.parent.name:(\"winlogon.exe\" or \"wininit.exe\")) or       (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or       (process.name:\"svchost.exe\" and not process.parent.name:(\"services.exe\" or \"MsMpEng.exe\")) or      (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or       (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or       (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\" or \"svchost.exe\")) or       (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\" or \"winlogon.exe\"))    )",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json
index 8ca16198ff175..ee861e19341af 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_unusual_process_network_connection.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Unusual Process Network Connection",
   "query": " event.action:\"Network connection detected (rule: NetworkConnect)\" and process.name:(bginfo.exe or cdb.exe or cmstp.exe or csi.exe or dnx.exe or fsi.exe or ieexec.exe or iexpress.exe or Microsoft.Workflow.Compiler.exe or odbcconf.exe or rcsi.exe or xwizard.exe)",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json
index dee3d18bd5eda..5a7aeab224548 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_account_creation.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "User Account Creation",
   "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(\"net.exe\" or \"net1.exe\") and not process.parent.name:\"net.exe\" and process.args:(\"user\" and (\"/add\" or \"/ad\")) ",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json
deleted file mode 100644
index 4ed6a06b18d3b..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_user_added_to_administrator_group.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies attempts to add a user to an administrative group with the \"net.exe\" command. This is sometimes done by attackers to increase access of a compromised account or create new account.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "User Added to Administrator Group",
-  "query": " event.action:\"Process Create (rule: ProcessCreate)\" and process.name:(\"net.exe\" or \"net1.exe\") and not process.parent.name:\"net.exe\" and process.args:(\"group\" and \"admin\" and \"/add\") ",
-  "risk_score": 47,
-  "rule_id": "4426de6f-6103-44aa-a77e-49d672836c27",
-  "severity": "medium",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0003",
-        "name": "Persistence",
-        "reference": "https://attack.mitre.org/tactics/TA0003/"
-      },
-      "technique": [
-        {
-          "id": "T1098",
-          "name": "Account Manipulation",
-          "reference": "https://attack.mitre.org/techniques/T1098/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json
index cdeeb1563dfde..80c0dd962c099 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_vssadmin.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Volume Shadow Copy Deletion via VssAdmin",
   "query": "  event.action:\"Process Create (rule: ProcessCreate)\"  and process.name:\"vssadmin.exe\" and process.args:(\"delete\" and \"shadows\") ",
   "risk_score": 73,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json
index 9465cf84d73f4..d90aca1e2eaf4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_volume_shadow_copy_deletion_via_wmic.json
@@ -4,9 +4,9 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Volume Shadow Copy Deletion via WMIC",
-  "query": "  event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"wmic.exe\" and process.args:(\"shadowcopy\" and \"delete\")",
+  "query": "  event.action:\"Process Create (rule: ProcessCreate)\" and process.name:\"WMIC.exe\" and process.args:(\"shadowcopy\" and \"delete\")",
   "risk_score": 73,
   "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57",
   "severity": "high",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json
index f3df1276de53d..8f6e97cdd7bdb 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_windows_script_executing_powershell.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Windows Script Executing PowerShell",
   "query": "event.action:\"Process Create (rule: ProcessCreate)\" and process.parent.name:(\"wscript.exe\" or \"cscript.exe\") and process.name:\"powershell.exe\"",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json
deleted file mode 100644
index a50d9e64f2e2b..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/eql_wmic_command_lateral_movement.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "description": "Identifies use of wmic.exe to run commands on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.",
-  "false_positives": [
-    "The WMIC utility provides a command-line interface for WMI, which can be used for an array of administrative capabilities. It's important to baseline your environment to determine any abnormal use of this tool."
-  ],
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "WMIC Command Lateral Movement",
-  "query": "   event.action:\"Process Create (rule: ProcessCreate)\" and  process.name:\"wmic.exe\" and process.args:(\"/node\" or \"-node\") and process.args:(\"call\" or \"set\")",
-  "risk_score": 21,
-  "rule_id": "9616587f-6396-42d0-bd31-ef8dbd806210",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0008",
-        "name": "Lateral Movement",
-        "reference": "https://attack.mitre.org/tactics/TA0008/"
-      },
-      "technique": [
-        {
-          "id": "T1047",
-          "name": "Windows Management Instrumentation",
-          "reference": "https://attack.mitre.org/techniques/T1047/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts
index b454501e9f563..d9841948f35a5 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/index.ts
@@ -26,99 +26,79 @@ import rule16 from './elastic_endpoint_security_ransomware_detected.json';
 import rule17 from './elastic_endpoint_security_ransomware_prevented.json';
 import rule18 from './eql_adding_the_hidden_file_attribute_with_via_attribexe.json';
 import rule19 from './eql_adobe_hijack_persistence.json';
-import rule20 from './eql_audio_capture_via_powershell.json';
-import rule21 from './eql_audio_capture_via_soundrecorder.json';
-import rule22 from './eql_bypass_uac_event_viewer.json';
-import rule23 from './eql_bypass_uac_via_cmstp.json';
-import rule24 from './eql_bypass_uac_via_sdclt.json';
-import rule25 from './eql_clearing_windows_event_logs.json';
-import rule26 from './eql_delete_volume_usn_journal_with_fsutil.json';
-import rule27 from './eql_deleting_backup_catalogs_with_wbadmin.json';
-import rule28 from './eql_direct_outbound_smb_connection.json';
-import rule29 from './eql_disable_windows_firewall_rules_with_netsh.json';
-import rule30 from './eql_dll_search_order_hijack.json';
-import rule31 from './eql_encoding_or_decoding_files_via_certutil.json';
-import rule32 from './eql_local_scheduled_task_commands.json';
-import rule33 from './eql_local_service_commands.json';
-import rule34 from './eql_modification_of_boot_configuration.json';
-import rule35 from './eql_msbuild_making_network_connections.json';
-import rule36 from './eql_mshta_making_network_connections.json';
-import rule37 from './eql_msxsl_making_network_connections.json';
-import rule38 from './eql_psexec_lateral_movement_command.json';
-import rule39 from './eql_suspicious_ms_office_child_process.json';
-import rule40 from './eql_suspicious_ms_outlook_child_process.json';
-import rule41 from './eql_suspicious_pdf_reader_child_process.json';
-import rule42 from './eql_system_shells_via_services.json';
-import rule43 from './eql_unusual_network_connection_via_rundll32.json';
-import rule44 from './eql_unusual_parentchild_relationship.json';
-import rule45 from './eql_unusual_process_network_connection.json';
-import rule46 from './eql_user_account_creation.json';
-import rule47 from './eql_user_added_to_administrator_group.json';
-import rule48 from './eql_volume_shadow_copy_deletion_via_vssadmin.json';
-import rule49 from './eql_volume_shadow_copy_deletion_via_wmic.json';
-import rule50 from './eql_windows_script_executing_powershell.json';
-import rule51 from './eql_wmic_command_lateral_movement.json';
-import rule52 from './linux_hping_activity.json';
-import rule53 from './linux_iodine_activity.json';
-import rule54 from './linux_kernel_module_activity.json';
-import rule55 from './linux_ldso_process_activity.json';
-import rule56 from './linux_mknod_activity.json';
-import rule57 from './linux_netcat_network_connection.json';
-import rule58 from './linux_nmap_activity.json';
-import rule59 from './linux_nping_activity.json';
-import rule60 from './linux_process_started_in_temp_directory.json';
-import rule61 from './linux_shell_activity_by_web_server.json';
-import rule62 from './linux_socat_activity.json';
-import rule63 from './linux_strace_activity.json';
-import rule64 from './linux_tcpdump_activity.json';
-import rule65 from './linux_whoami_commmand.json';
-import rule66 from './network_dns_directly_to_the_internet.json';
-import rule67 from './network_ftp_file_transfer_protocol_activity_to_the_internet.json';
-import rule68 from './network_irc_internet_relay_chat_protocol_activity_to_the_internet.json';
-import rule69 from './network_nat_traversal_port_activity.json';
-import rule70 from './network_port_26_activity.json';
-import rule71 from './network_port_8000_activity_to_the_internet.json';
-import rule72 from './network_pptp_point_to_point_tunneling_protocol_activity.json';
-import rule73 from './network_proxy_port_activity_to_the_internet.json';
-import rule74 from './network_rdp_remote_desktop_protocol_from_the_internet.json';
-import rule75 from './network_rdp_remote_desktop_protocol_to_the_internet.json';
-import rule76 from './network_rpc_remote_procedure_call_from_the_internet.json';
-import rule77 from './network_rpc_remote_procedure_call_to_the_internet.json';
-import rule78 from './network_smb_windows_file_sharing_activity_to_the_internet.json';
-import rule79 from './network_smtp_to_the_internet.json';
-import rule80 from './network_sql_server_port_activity_to_the_internet.json';
-import rule81 from './network_ssh_secure_shell_from_the_internet.json';
-import rule82 from './network_ssh_secure_shell_to_the_internet.json';
-import rule83 from './network_telnet_port_activity.json';
-import rule84 from './network_tor_activity_to_the_internet.json';
-import rule85 from './network_vnc_virtual_network_computing_from_the_internet.json';
-import rule86 from './network_vnc_virtual_network_computing_to_the_internet.json';
-import rule87 from './null_user_agent.json';
-import rule88 from './sqlmap_user_agent.json';
-import rule89 from './windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json';
-import rule90 from './windows_certutil_connecting_to_the_internet.json';
-import rule91 from './windows_command_prompt_connecting_to_the_internet.json';
-import rule92 from './windows_command_shell_started_by_internet_explorer.json';
-import rule93 from './windows_command_shell_started_by_powershell.json';
-import rule94 from './windows_command_shell_started_by_svchost.json';
-import rule95 from './windows_defense_evasion_via_filter_manager.json';
-import rule96 from './windows_execution_via_compiled_html_file.json';
-import rule97 from './windows_execution_via_connection_manager.json';
-import rule98 from './windows_execution_via_net_com_assemblies.json';
-import rule99 from './windows_execution_via_regsvr32.json';
-import rule100 from './windows_execution_via_trusted_developer_utilities.json';
-import rule101 from './windows_html_help_executable_program_connecting_to_the_internet.json';
-import rule102 from './windows_misc_lolbin_connecting_to_the_internet.json';
-import rule103 from './windows_net_command_activity_by_the_system_account.json';
-import rule104 from './windows_persistence_via_application_shimming.json';
-import rule105 from './windows_priv_escalation_via_accessibility_features.json';
-import rule106 from './windows_process_discovery_via_tasklist_command.json';
-import rule107 from './windows_process_execution_via_wmi.json';
-import rule108 from './windows_register_server_program_connecting_to_the_internet.json';
-import rule109 from './windows_signed_binary_proxy_execution.json';
-import rule110 from './windows_signed_binary_proxy_execution_download.json';
-import rule111 from './windows_suspicious_process_started_by_a_script.json';
-import rule112 from './windows_whoami_command_activity.json';
+import rule20 from './eql_clearing_windows_event_logs.json';
+import rule21 from './eql_delete_volume_usn_journal_with_fsutil.json';
+import rule22 from './eql_deleting_backup_catalogs_with_wbadmin.json';
+import rule23 from './eql_direct_outbound_smb_connection.json';
+import rule24 from './eql_disable_windows_firewall_rules_with_netsh.json';
+import rule25 from './eql_encoding_or_decoding_files_via_certutil.json';
+import rule26 from './eql_local_scheduled_task_commands.json';
+import rule27 from './eql_local_service_commands.json';
+import rule28 from './eql_msbuild_making_network_connections.json';
+import rule29 from './eql_mshta_making_network_connections.json';
+import rule30 from './eql_psexec_lateral_movement_command.json';
+import rule31 from './eql_suspicious_ms_office_child_process.json';
+import rule32 from './eql_suspicious_ms_outlook_child_process.json';
+import rule33 from './eql_system_shells_via_services.json';
+import rule34 from './eql_unusual_network_connection_via_rundll32.json';
+import rule35 from './eql_unusual_parentchild_relationship.json';
+import rule36 from './eql_unusual_process_network_connection.json';
+import rule37 from './eql_user_account_creation.json';
+import rule38 from './eql_volume_shadow_copy_deletion_via_vssadmin.json';
+import rule39 from './eql_volume_shadow_copy_deletion_via_wmic.json';
+import rule40 from './eql_windows_script_executing_powershell.json';
+import rule41 from './linux_hping_activity.json';
+import rule42 from './linux_iodine_activity.json';
+import rule43 from './linux_kernel_module_activity.json';
+import rule44 from './linux_mknod_activity.json';
+import rule45 from './linux_netcat_network_connection.json';
+import rule46 from './linux_nmap_activity.json';
+import rule47 from './linux_nping_activity.json';
+import rule48 from './linux_process_started_in_temp_directory.json';
+import rule49 from './linux_shell_activity_by_web_server.json';
+import rule50 from './linux_socat_activity.json';
+import rule51 from './linux_strace_activity.json';
+import rule52 from './linux_tcpdump_activity.json';
+import rule53 from './linux_whoami_commmand.json';
+import rule54 from './network_dns_directly_to_the_internet.json';
+import rule55 from './network_ftp_file_transfer_protocol_activity_to_the_internet.json';
+import rule56 from './network_irc_internet_relay_chat_protocol_activity_to_the_internet.json';
+import rule57 from './network_nat_traversal_port_activity.json';
+import rule58 from './network_port_26_activity.json';
+import rule59 from './network_port_8000_activity_to_the_internet.json';
+import rule60 from './network_pptp_point_to_point_tunneling_protocol_activity.json';
+import rule61 from './network_proxy_port_activity_to_the_internet.json';
+import rule62 from './network_rdp_remote_desktop_protocol_from_the_internet.json';
+import rule63 from './network_rdp_remote_desktop_protocol_to_the_internet.json';
+import rule64 from './network_rpc_remote_procedure_call_from_the_internet.json';
+import rule65 from './network_rpc_remote_procedure_call_to_the_internet.json';
+import rule66 from './network_smb_windows_file_sharing_activity_to_the_internet.json';
+import rule67 from './network_smtp_to_the_internet.json';
+import rule68 from './network_sql_server_port_activity_to_the_internet.json';
+import rule69 from './network_ssh_secure_shell_from_the_internet.json';
+import rule70 from './network_ssh_secure_shell_to_the_internet.json';
+import rule71 from './network_telnet_port_activity.json';
+import rule72 from './network_tor_activity_to_the_internet.json';
+import rule73 from './network_vnc_virtual_network_computing_from_the_internet.json';
+import rule74 from './network_vnc_virtual_network_computing_to_the_internet.json';
+import rule75 from './null_user_agent.json';
+import rule76 from './sqlmap_user_agent.json';
+import rule77 from './windows_command_prompt_connecting_to_the_internet.json';
+import rule78 from './windows_command_shell_started_by_powershell.json';
+import rule79 from './windows_command_shell_started_by_svchost.json';
+import rule80 from './windows_defense_evasion_via_filter_manager.json';
+import rule81 from './windows_execution_via_compiled_html_file.json';
+import rule82 from './windows_execution_via_regsvr32.json';
+import rule83 from './windows_execution_via_trusted_developer_utilities.json';
+import rule84 from './windows_html_help_executable_program_connecting_to_the_internet.json';
+import rule85 from './windows_misc_lolbin_connecting_to_the_internet.json';
+import rule86 from './windows_persistence_via_application_shimming.json';
+import rule87 from './windows_priv_escalation_via_accessibility_features.json';
+import rule88 from './windows_process_discovery_via_tasklist_command.json';
+import rule89 from './windows_register_server_program_connecting_to_the_internet.json';
+import rule90 from './windows_signed_binary_proxy_execution.json';
+import rule91 from './windows_suspicious_process_started_by_a_script.json';
+import rule92 from './windows_whoami_command_activity.json';
 export const rawRules = [
   rule1,
   rule2,
@@ -212,24 +192,4 @@ export const rawRules = [
   rule90,
   rule91,
   rule92,
-  rule93,
-  rule94,
-  rule95,
-  rule96,
-  rule97,
-  rule98,
-  rule99,
-  rule100,
-  rule101,
-  rule102,
-  rule103,
-  rule104,
-  rule105,
-  rule106,
-  rule107,
-  rule108,
-  rule109,
-  rule110,
-  rule111,
-  rule112,
 ];
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json
index 517e16fb3d284..c4b14389c0f75 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_hping_activity.json
@@ -1,5 +1,5 @@
 {
-  "description": "Hping ran on a Linux host. Hping is FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications including scanning and firewall auditing.",
+  "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.",
   "false_positives": [
     "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon."
   ],
@@ -7,9 +7,9 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Hping Process Activity",
-  "query": "process.name: hping  and event.action:executed",
+  "query": "process.name: (hping3 or hping2 or hping) and event.action:executed",
   "references": [
     "https://en.wikipedia.org/wiki/Hping"
   ],
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json
index 49f18ef9871a1..b8455a4d2b21d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_iodine_activity.json
@@ -1,5 +1,5 @@
 {
-  "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol in order to circumvent firewalls, network security groups or network access lists while evading detection.",
+  "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.",
   "false_positives": [
     "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon."
   ],
@@ -7,7 +7,7 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Potential DNS Tunneling via Iodine",
   "query": "process.name: (iodine or iodined) and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json
index 8c94694ca4d04..f1d12de674488 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_kernel_module_activity.json
@@ -1,5 +1,5 @@
 {
-  "description": "Identifies loadable kernel module errors, often indicative of potential persistence attempts.",
+  "description": "Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.",
   "false_positives": [
     "Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon."
   ],
@@ -7,7 +7,7 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Persistence via Kernel Module Modification",
   "query": "process.name: (insmod or kmod or modprobe or rmod) and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json
deleted file mode 100644
index 82a2a16080160..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_ldso_process_activity.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "description": "The dynamic linker, ld.so, runs in a privileged context and can be used to escape restrictive environments by spawning a shell in order to elevate privileges or move laterally.",
-  "false_positives": [
-    "ld.so is a dual-use tool that can be used for benign or malicious activity. Some normal use of this command may originate from developers or administrators. Use of ld.so by non-engineers or ordinary users is uncommon."
-  ],
-  "index": [
-    "auditbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Ld.so Process Activity",
-  "query": "process.name:ld.so and event.action:executed",
-  "risk_score": 21,
-  "rule_id": "3f31a31c-f7cf-4268-a0df-ec1a98099e7f",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Linux"
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json
index 8f4e1f40fad12..b0d4c29dc00d3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_mknod_activity.json
@@ -1,13 +1,13 @@
 {
-  "description": "The Linux mknod program is sometimes used in the command payload of remote command injection (RCI) and other exploits to export a command shell when the traditional version of netcat is not available to the payload.",
+  "description": "The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command  shell when the traditional version of netcat is not available to the payload.",
   "false_positives": [
-    "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by web servers is more likely to be suspicious."
+    "Mknod is a Linux system program. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely to be suspicious."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Mknod Process Activity",
   "query": "process.name: mknod and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json
index b06a342d24977..6ab1c1285c0d7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_netcat_network_connection.json
@@ -1,13 +1,13 @@
 {
-  "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration. ",
+  "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.",
   "false_positives": [
-    "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools and frameworks."
+    "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Netcat Network Activity",
   "query": "process.name: (nc or ncat or netcat or netcat.openbsd or netcat.traditional) and event.action: (connected-to or bound-socket or socket_opened)",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json
index 406cd8e026e7a..5d7169219a6f1 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nmap_activity.json
@@ -1,13 +1,13 @@
 {
-  "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning and security testing. It can map and discover networks, identify listening services and operating systems. It is sometimes used to gather information in support of exploitation, execution or lateral movement.",
+  "description": "Nmap was executed on a Linux host. Nmap is a FOSS tool for network scanning  and security testing. It can map and discover networks, and identify listening  services and operating systems. It is sometimes used to gather information in  support of exploitation, execution or lateral movement.",
   "false_positives": [
-    "Security testing tools and frameworks may run nmap in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon."
+    "Security testing tools and frameworks may run `Nmap` in the course of security auditing. Some normal use of this command may originate from security engineers and network or server administrators. Use of nmap by ordinary users is uncommon."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Nmap Process Activity",
   "query": "process.name: nmap",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json
index de53e05e70fa3..6a713d22e3219 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_nping_activity.json
@@ -1,13 +1,13 @@
 {
-  "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications including denial of service testing.",
+  "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has  the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.",
   "false_positives": [
-    "Some normal use of this command may originate from security engineers and network or server administrators but this is usually not routine or unannounced. Use of nping by non-engineers or ordinary users is uncommon."
+    "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or  unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Nping Process Activity",
   "query": "process.name: nping and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json
index 4ed021a4c864d..c80bb4eb41615 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_process_started_in_temp_directory.json
@@ -1,13 +1,13 @@
 {
   "description": "Identifies processes running in a temporary folder. This is sometimes done by adversaries to hide malware.",
   "false_positives": [
-    "Build systems like Jenkins may start processes in the /tmp directory. These can be exempted by name or by username."
+    "Build systems, like Jenkins, may start processes in the `/tmp` directory. These  can be exempted by name or by username."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Unusual Process Execution - Temp",
   "query": "process.working_directory: /tmp and event.action:executed",
   "risk_score": 47,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json
index ac817762fdb71..d9455ab7d5b3e 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_shell_activity_by_web_server.json
@@ -7,9 +7,9 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Potential Shell via Web Server",
-  "query": "process.name: bash and (user.name: apache or www) and event.action:executed",
+  "query": "process.name: bash and user.name: (apache or www or \"www-data\") and event.action:executed",
   "references": [
     "https://pentestlab.blog/tag/web-shell/"
   ],
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json
index 481a99518d4ed..56fb41dc5f78f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_socat_activity.json
@@ -1,13 +1,13 @@
 {
-  "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Socat is also sometimes used for lateral movement. ",
+  "description": "A Socat process is running on a Linux host. Socat is often used as a persistence mechanism by exporting a reverse shell, or by serving a shell on a listening port. Socat is also sometimes used for lateral movement.",
   "false_positives": [
-    "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by web servers is more likely to be suspicious."
+    "Socat is a dual-use tool that can be used for benign or malicious activity. Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. Usage by web servers is more likely  to be suspicious."
   ],
   "index": [
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Socat Process Activity",
   "query": "process.name:socat and not process.args:\"-V\" and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json
index f5488ae49d0fb..fdf52e7c728c6 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_strace_activity.json
@@ -7,7 +7,7 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Strace Process Activity",
   "query": "process.name: strace and event.action:executed",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json
index b6dc7f1689770..908e892026ee3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_tcpdump_activity.json
@@ -1,5 +1,5 @@
 {
-  "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet 'sniffing' tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.",
+  "description": "The Tcpdump program ran on a Linux host. Tcpdump is a network monitoring or packet sniffing tool that can be used to capture insecure credentials or data in motion. Sniffing can also be used to discover details of network services as a prelude to lateral movement or defense evasion.",
   "false_positives": [
     "Some normal use of this command may originate from server or network administrators engaged in network troubleshooting."
   ],
@@ -7,7 +7,7 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Network Sniffing via Tcpdump",
   "query": "process.name: tcpdump and event.action:executed",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json
index 91c6d2bcc9f95..052ff34d15dcd 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/linux_whoami_commmand.json
@@ -1,5 +1,5 @@
 {
-  "description": "The whoami application was executed on a Linux host. This is often used by tools and persistence mechanisms to test for privileged access.",
+  "description": "The whoami application was executed on a Linux host. This is often used by  tools and persistence mechanisms to test for privileged access.",
   "false_positives": [
     "Security testing tools and frameworks may run this command. Some normal use of this command may originate from automation tools and frameworks."
   ],
@@ -7,7 +7,7 @@
     "auditbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "User Discovery via Whoami",
   "query": "process.name: whoami and event.action:executed",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json
index 3d1b07a267eca..72e2ca1490417 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_dns_directly_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects internal network client sending DNS traffic directly to the Internet.\nThis is atypical behavior for a managed network and can be indicative of malware,\nexfiltration, command and control or simply misconfiguration. This also impacts your\norganization's ability to provide enterprise monitoring and logging of DNS and opens\nyour network to a variety of abuses or malicious communications.\n",
+  "description": "This rule detects when an internal network client sends DNS traffic directly to the Internet.\nThis is atypical behavior for a managed network, and can be indicative of malware,\nexfiltration, command and control, or, simply, misconfiguration. This DNS activity also impacts your\norganization's ability to provide enterprise monitoring and logging of DNS, and opens\nyour network to a variety of abuses and malicious communications.\n",
   "false_positives": [
-    "DNS servers should be excluded from this rule as this is expected behavior for them. Endpoints usually query local DNS servers defined in their DHCP scopes but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it would tend to break intra-net name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations; in that case, such devices or networks can be excluded from this rule if this is expected behavior."
+    "Exclude DNS servers from this rule as this is expected behavior. Endpoints usually query local DNS servers defined in their DHCP scopes, but this may be overridden if a user configures their endpoint to use a remote DNS server. This is uncommon in managed enterprise networks because it could break intranet name resolution when split horizon DNS is utilized. Some consumer VPN services and browser plug-ins may send DNS traffic to remote Internet destinations. In that case, such devices or networks can be excluded from this rule when this is expected behavior."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "DNS Activity to the Internet",
   "query": "destination.port:53 and (\n    network.direction: outbound or (\n        source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip:( 169.254.169.254/32 or 127.0.0.53/32 or 10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or 224.0.0.251 or ff02\\:\\:fb or 255.255.255.255 )\n    )\n)\n",
   "references": [
@@ -22,7 +22,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json
index ef7b39412c808..54daf8a2091a7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ftp_file_transfer_protocol_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that may indicate the use of FTP network connections to the Internet.\nThe File Transfer Protocol (FTP) has been around in its current form since the\n1980's. It can be an efficient and normal procedure on your network to send and\nreceive files. Because it is common and efficient, adversaries will also often\nuse this protocol to ex-filtrate data from your network or download new tools.\nAdditionally, FTP is a plain-text protocol which may expose your user name and\npassword, if intercepted. FTP activity involving servers subject to regulations or compliance standards may be unauthorized.\n",
+  "description": "This rule detects events that may indicate the use of FTP network connections to the Internet.\nThe File Transfer Protocol (FTP) has been around in its current form since the\n1980s. It can be a common and efficient procedure on your network to send and\nreceive files. Because of this, adversaries will also often use this protocol\nto exfiltrate data from your network or download new tools. Additionally, FTP\nis a plain-text protocol which, if intercepted, may expose usernames and\npasswords. FTP activity involving servers subject to regulations or compliance\nstandards may be unauthorized.\n",
   "false_positives": [
-    "FTP servers should be excluded from this rule as this is expected behavior for them. Some business work-flows may use FTP for data exchange. These work-flows often have expected characteristics such as users, sources and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP work-flow or business requirement is often suspicious. NEW NEW"
+    "FTP servers should be excluded from this rule as this is expected behavior. Some business workflows may use FTP for data exchange. These workflows often have expected characteristics such as users, sources, and destinations. FTP activity involving an unusual source or destination may be more suspicious. FTP activity involving a production server that has no known associated FTP workflow or business requirement is often suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "FTP (File Transfer Protocol) Activity to the Internet",
   "query": "network.transport: tcp and destination.port: (20 or 21) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json
index 2700eae977482..d01006a225886 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_irc_internet_relay_chat_protocol_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that use common ports for IRC to the Internet. IRC (Internet Relay Chat)\nis a common protocol that can be used chat and file transfer. This protocol\nalso makes a good candidate for remote control of malware and data transfer in\nand out of a network.\n",
+  "description": "This rule detects events that use common ports for Internet Relay Chat (IRC) to the Internet.\nIRC is a common protocol that can be used for chat and file transfers. This\nprotocol is also a good candidate for remote control of malware and data\ntransfers to and from a network.\n",
   "false_positives": [
-    "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATted web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some legacy applications may use these ports but this is very uncommon and usually appears only in local traffic using private IPs which this rule does not match."
+    "IRC activity may be normal behavior for developers and engineers but is unusual for non-engineering end users. IRC activity involving an unusual source or destination may be more suspicious. IRC activity involving a production server is often suspicious. Because these ports are in the ephemeral range, this rule may false under certain conditions, such as when a NAT-ed web server replies to a client which has used a port in the range by coincidence. In this case, these servers can be excluded. Some legacy applications may use these ports, but this is very uncommon and usually only appears in local traffic using private IPs, which does not match this rule's conditions."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "IRC (Internet Relay Chat) Protocol Activity to the Internet",
   "query": "network.transport: tcp and destination.port:(6667 or 6697) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json
index e87e296017a36..c66a9e9d77fe4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_nat_traversal_port_activity.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that could be describing IPSEC NAT Traversal traffic.\nIPSEC is a VPN technology that allows one system to talk to another using\nencrypted tunnels. NAT Traversal enables these tunnels to communicate over\nthe Internet where one of the sides is behind a NAT router gateway. This may\nbe common on your network, but this technique is also used by threat actors\nto avoid detection.\n",
+  "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic.\nIPSEC is a VPN technology that allows one system to talk to another using\nencrypted tunnels. NAT Traversal enables these tunnels to communicate over the\nInternet where one of the sides is behind a NAT router gateway. This may be\ncommon on your network, but this technique is also used by threat actors to\navoid detection.\n",
   "false_positives": [
-    "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions such as when a application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded if desired."
+    "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "IPSEC NAT Traversal Port Activity",
   "query": "network.transport: udp and destination.port: 4500",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json
index 352fc5e44dc80..7b26141898532 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_26_activity.json
@@ -1,18 +1,18 @@
 {
-  "description": "This signal detects events that may indicate use of SMTP on TCP port 26. This\nport is commonly used by several popular mail transfer agents to deconflict\nwith the default SMTP port 25. This port has also been used by a malware family\ncalled BadPatch for command and control of Windows systems.\n",
+  "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This\nport is commonly used by several popular mail transfer agents to deconflict\nwith the default SMTP port 25. This port has also been used by a malware family\ncalled BadPatch for command and control of Windows systems.\n",
   "false_positives": [
-    "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior for them."
+    "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SMTP on Port 26/TCP",
-  "query": "network.transport: tcp and destination.port: 26",
+  "query": "network.transport: tcp and destination.port: 26\n",
   "references": [
     "https://unit42.paloaltonetworks.com/unit42-badpatch/",
     "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/"
@@ -22,7 +22,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json
index 2b3d08a7c80d9..7551119cd5a84 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_port_8000_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
   "description": "TCP Port 8000 is commonly used for development environments of web server\nsoftware. It generally should not be exposed directly to the Internet. If you are\nrunning software like this on the Internet, you should consider placing it behind\na reverse proxy.\n",
   "false_positives": [
-    "Because this port is in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet."
+    "Because this port is in the ephemeral range, this rule may false under certain conditions, such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded. Some applications may use this port but this is very uncommon and usually appears in local traffic using private IPs, which this rule does not match. Some cloud environments, particularly development environments, may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "TCP Port 8000 Activity to the Internet",
   "query": "network.transport: tcp and destination.port: 8000 and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json
index b008ca2c2bee6..eeb38f756c67a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_pptp_point_to_point_tunneling_protocol_activity.json
@@ -1,24 +1,24 @@
 {
-  "description": "This signal detects events that may indicate use of a PPTP VPN connection. Some threat actors use these types of connections to tunnel their traffic while avoiding detection.",
+  "description": "This rule detects events that may indicate use of a PPTP VPN connection. Some\nthreat actors use these types of connections to tunnel their traffic while\navoiding detection.\n",
   "false_positives": [
-    "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions such as when an application server with replies to a client which has used this port by coincidence. This is uncommon but such servers can be excluded if desired."
+    "Some networks may utilize PPTP protocols but this is uncommon as more modern VPN technologies are available. Usage that is unfamiliar to local network administrators can be unexpected and suspicious. Torrenting applications may use this port. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server replies to a client that used this port by coincidence. This is uncommon but such servers can be excluded."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "PPTP (Point to Point Tunneling Protocol) Activity",
-  "query": "network.transport: tcp and destination.port: 1723",
+  "query": "network.transport: tcp and destination.port: 1723\n",
   "risk_score": 21,
   "rule_id": "d2053495-8fe7-4168-b3df-dad844046be3",
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json
index f7c6ffddcaf9e..981a7bdffcfed 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_proxy_port_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that may describe network events of proxy use to the\nInternet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically\nenvironments will use an internal IP address for a proxy server. It can also\nbe used to circumvent network controls and detection mechanisms.\n",
+  "description": "This rule detects events that may describe network events of proxy use to the\nInternet. It includes popular HTTP proxy ports and SOCKS proxy ports. Typically,\nenvironments will use an internal IP address for a proxy server. It can also\nbe used to circumvent network controls and detection mechanisms.\n",
   "false_positives": [
-    "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs which this rule does not match. Proxies are widely used as a security technology but in enterprise environments this is usually local traffic which this rule does not match. Internet proxy services using these ports can be white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired."
+    "Some proxied applications may use these ports but this usually occurs in local traffic using private IPs\n    which this rule does not match. Proxies are widely used as a security technology but in enterprise environments\n    this is usually local traffic which this rule does not match. Internet proxy services using these ports can be\n    white-listed if desired. Some screen recording applications may use these ports. Proxy port activity involving\n    an unusual source or destination may be more suspicious. Some cloud environments may use this port when VPNs or\n    direct connects are not in use and cloud instances are accessed across the Internet. Because these ports are in\n    the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a\n    client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "Proxy Port Activity to the Internet",
   "query": "network.transport: tcp and destination.port: (3128 or 8080 or 1080) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json
index e3853c30e6ad9..504df93f2f8ed 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_from_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of RDP traffic\nfrom the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of RDP traffic\nfrom the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "false_positives": [
-    "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected."
+    "  Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to\n  server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the\n  Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump\n  servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may\n  be required by some work-flows such as remote access and support for specialized software products and\n  servers. Such work-flows are usually known and not unexpected."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "RDP (Remote Desktop Protocol) from the Internet",
   "query": "network.transport: tcp and destination.port: 3389 and (\n    network.direction: inbound or (\n        not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n        and destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json
index 55b9716af9346..2d9fa6ba06dfd 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rdp_remote_desktop_protocol_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of RDP traffic\nto the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of RDP traffic\nto the Internet. RDP is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "false_positives": [
-    "RDP connections may be made directly to Internet destinations in order to access Windows cloud server instances but such connections are usually made only by engineers. In such cases, only RDP gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious."
+    "RDP connections may be made directly to Internet destinations in order to access\n    Windows cloud server instances but such connections are usually made only by engineers.\n    In such cases, only RDP gateways, bastions or jump servers may be expected Internet\n    destinations and can be exempted from this rule. RDP may be required by some work-flows\n    such as remote access and support for specialized software products and servers. Such\n    work-flows are usually known and not unexpected. Usage that is unfamiliar to server or\n    network owners can be unexpected and suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "RDP (Remote Desktop Protocol) to the Internet",
   "query": "network.transport: tcp and destination.port: 3389 and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json
index 1570d3d155fea..d50c79db81ba5 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_from_the_internet.json
@@ -1,13 +1,13 @@
 {
-  "description": "This signal detects network events that may indicate the use of RPC traffic\nfrom the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of RPC traffic\nfrom the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "RPC (Remote Procedure Call) from the Internet",
   "query": "network.transport: tcp and destination.port: 135 and (\n    network.direction: inbound or (\n        not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 73,
@@ -15,7 +15,7 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json
index 91db97dabdd46..ade7b661a7909 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_rpc_remote_procedure_call_to_the_internet.json
@@ -1,13 +1,13 @@
 {
-  "description": "This signal detects network events that may indicate the use of RPC traffic\nto the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of RPC traffic\nto the Internet. RPC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "RPC (Remote Procedure Call) to the Internet",
   "query": "network.transport: tcp and destination.port: 135 and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 73,
@@ -15,7 +15,7 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json
index 991c626c11d33..62c2fafb7404f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smb_windows_file_sharing_activity_to_the_internet.json
@@ -1,13 +1,13 @@
 {
-  "description": "This signal detects network events that may indicate the use of Windows\nfile sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly\nused within networks to share files, printers, and other system resources amongst\ntrusted systems. It should almost never be directly exposed to the Internet, as\nit is frequently targeted and exploited by threat actors as an initial access\nor back-door vector or for data exfiltration.\n",
+  "description": "This rule detects network events that may indicate the use of Windows\nfile sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly\nused within networks to share files, printers, and other system resources amongst\ntrusted systems. It should almost never be directly exposed to the Internet, as\nit is frequently targeted and exploited by threat actors as an initial access\nor back-door vector or for data exfiltration.\n",
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SMB (Windows File Sharing) Activity to the Internet",
   "query": "network.transport: tcp and destination.port: (139 or 445) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 73,
@@ -15,7 +15,7 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json
index 68daf71d9992a..02fca5603910e 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_smtp_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that may describe SMTP traffic from internal\nhosts to a host across the Internet. In an enterprise network, there is typically\na dedicate host that is internal that could perform this function. It is also\nfrequently abused by threat actors for command and control or data exfiltration.\n",
+  "description": "This rule detects events that may describe SMTP traffic from internal\nhosts to a host across the Internet. In an enterprise network, there is typically\na dedicated internal host that performs this function. It is also\nfrequently abused by threat actors for command and control, or data exfiltration.\n",
   "false_positives": [
-    "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and / or personal devices may send email traffic to remote Internet destinations; in that case, such devices or networks can be excluded from this rule if this is expected behavior."
+    "NATed servers that process email traffic may false and should be excluded from this rule as this is expected behavior for them. Consumer and  personal devices may send email traffic to remote Internet destinations. In this case, such devices or networks can be excluded from this rule if this is expected behavior."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SMTP to the Internet",
   "query": "network.transport: tcp and destination.port: (25 or 465 or 587) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json
index df779d47246a5..67e6a08ddf791 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_sql_server_port_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects events that may describe database traffic\n(MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases\nshould almost never be directly exposed to the Internet, as they are\nfrequently targeted by threat actors to gain initial access to network resources.\n",
+  "description": "This rule detects events that may describe database traffic\n(MS SQL, Oracle, MySQL, and Postgresql) across the Internet. Databases\nshould almost never be directly exposed to the Internet, as they are\nfrequently targeted by threat actors to gain initial access to network resources.\n",
   "false_positives": [
-    "Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used a port in the range by coincidence. In this case, such servers can be excluded if desired. Some cloud environments may use this port when VPNs or direct connects are not in use and database instances are accessed directly across the Internet."
+    "Because these ports are in the ephemeral range, this rule may false under certain conditions\n    such as when a NATed web server replies to a client which has used a port in the range by\n    coincidence. In this case, such servers can be excluded if desired. Some cloud environments may\n    use this port when VPNs or direct connects are not in use and database instances are accessed\n    directly across the Internet."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SQL Traffic to the Internet",
   "query": "network.transport: tcp and destination.port: (1433 or 1521 or 3336 or 5432) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json
index 6c278700450b1..052600a0db68a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_from_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "false_positives": [
-    "Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected."
+    "Some network security policies allow SSH directly from the Internet but usage that is\n    unfamiliar to server or network owners can be unexpected and suspicious. SSH services may\n    be exposed directly to the Internet in some networks such as cloud environments. In such\n    cases, only SSH gateways, bastions or jump servers may be expected expose SSH directly to\n    the Internet and can be exempted from this rule. SSH may be required by some work-flows\n    such as remote access and support for specialized software products and servers. Such\n    work-flows are usually known and not unexpected."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SSH (Secure Shell) from the Internet",
   "query": "network.transport: tcp and destination.port:22 and (\n    network.direction: inbound or (\n        not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json
index 63f2dbc8a34f1..e3c3135c9240d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_ssh_secure_shell_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of SSH traffic\nfrom the Internet. SSH is commonly used by system administrators to remotely\ncontrol a system using the command line shell. If it is exposed to the Internet,\nit should be done with strong security controls as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "false_positives": [
-    "SSH connections may be made directly to Internet destinations in order to access Linux cloud server instances but such connections are usually made only by engineers. In such cases, only SSH gateways, bastions or jump servers may be expected Internet destinations and can be exempted from this rule. SSH may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious."
+    "SSH connections may be made directly to Internet destinations in order to access Linux\n    cloud server instances but such connections are usually made only by engineers. In such cases,\n    only SSH gateways, bastions or jump servers may be expected Internet destinations and can be\n    exempted from this rule. SSH may be required by some work-flows such as remote access and support\n    for specialized software products and servers. Such work-flows are usually known and not unexpected.\n    Usage that is unfamiliar to server or network owners can be unexpected and suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "SSH (Secure Shell) to the Internet",
   "query": "network.transport: tcp and destination.port:22 and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 21,
@@ -18,7 +18,7 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json
index 0d28f0ea53d9a..c05791c8a107d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_telnet_port_activity.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of Telnet traffic.\nTelnet is commonly used by system administrators to remotely control older or embed ed\nsystems using the command line shell. It should almost never be directly exposed to\nthe Internet, as it is frequently targeted and exploited by threat actors as an\ninitial access or back-door vector. As a plain-text protocol, it may also expose\n",
+  "description": "This rule detects network events that may indicate the use of Telnet traffic.\nTelnet is commonly used by system administrators to remotely control older or embed ed\nsystems using the command line shell. It should almost never be directly exposed to\nthe Internet, as it is frequently targeted and exploited by threat actors as an\ninitial access or back-door vector. As a plain-text protocol, it may also expose\nusernames and passwords to anyone capable of observing the traffic.\n",
   "false_positives": [
-    "IoT (Internet of Things) devices and networks may use telnet and can be excluded if desired. Some business work-flows may use Telnet for administration of older devices. These often have a predictable behavior. Telnet activity involving an unusual source or destination may be more suspicious. Telnet activity involving a production server that has no known associated Telnet work-flow or business requirement is often suspicious."
+    "IoT (Internet of Things) devices and networks may use telnet and can be excluded if\n    desired. Some business work-flows may use Telnet for administration of older devices. These\n    often have a predictable behavior. Telnet activity involving an unusual source or destination\n    may be more suspicious. Telnet activity involving a production server that has no known\n    associated Telnet work-flow or business requirement is often suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "Telnet Port Activity",
   "query": "network.transport: tcp and destination.port: 23",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json
index 80893e9404f02..64397716eded2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_tor_activity_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of Tor traffic\nto the Internet. Tor is a network protocol that sends traffic through a\nseries of encrypted tunnels used to conceal a user's location and usage.\nTor may be used by threat actors as an alternate communication pathway to\nconceal the actor's identity and avoid detection.\n",
+  "description": "This rule detects network events that may indicate the use of Tor traffic\nto the Internet. Tor is a network protocol that sends traffic through a\nseries of encrypted tunnels used to conceal a user's location and usage.\nTor may be used by threat actors as an alternate communication pathway to\nconceal the actor's identity and avoid detection.\n",
   "false_positives": [
-    "Tor client activity is uncommon in managed enterprise networks but may be common in unmanaged or public networks where few security policies apply. Because these ports are in the ephemeral range, this rule may false under certain conditions such as when a NATed web server replies to a client which has used one of these ports by coincidence. In this case, such servers can be excluded if desired."
+    "Tor client activity is uncommon in managed enterprise networks but may be common\n    in unmanaged or public networks where few security policies apply. Because these ports\n    are in the ephemeral range, this rule may false under certain conditions such as when a\n    NATed web server replies to a client which has used one of these ports by coincidence.\n    In this case, such servers can be excluded if desired."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "Tor Activity to the Internet",
   "query": "network.transport: tcp and destination.port: (9001 or 9030) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json
index e64138dd053fa..dc4fbb281f762 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_from_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of VNC traffic\nfrom the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of VNC traffic\nfrom the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
   "false_positives": [
-    "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious."
+    "VNC connections may be received directly to Linux cloud server instances but\n    such connections are usually made only by engineers. VNC is less common than SSH\n    or RDP but may be required by some work-flows such as remote access and support\n    for specialized software products or servers. Such work-flows are usually known\n    and not unexpected. Usage that is unfamiliar to server or network owners can be\n    unexpected and suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "VNC (Virtual Network Computing) from the Internet",
   "query": "network.transport: tcp and (destination.port >= 5800 and destination.port <= 5810) and (\n    network.direction: inbound or (\n        not source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 73,
@@ -18,7 +18,7 @@
   "severity": "high",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json
index 8c43419c3ead5..7da5db39d9bfe 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/network_vnc_virtual_network_computing_to_the_internet.json
@@ -1,16 +1,16 @@
 {
-  "description": "This signal detects network events that may indicate the use of VNC traffic\nto the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.\n",
+  "description": "This rule detects network events that may indicate the use of VNC traffic\nto the Internet. VNC is commonly used by system administrators to remotely\ncontrol a system for maintenance or to use shared resources. It should almost\nnever be directly exposed to the Internet, as it is frequently targeted and\nexploited by threat actors as an initial access or back-door vector.",
   "false_positives": [
-    "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious."
+    "VNC connections may be made directly to Linux cloud server instances but such\n    connections are usually made only by engineers. VNC is less common than SSH or RDP\n    but may be required by some work flows such as remote access and support for\n    specialized software products or servers. Such work-flows are usually known and not\n    unexpected. Usage that is unfamiliar to server or network owners can be unexpected\n    and suspicious."
   ],
   "index": [
     "auditbeat-*",
-    "endgame-*",
     "filebeat-*",
     "packetbeat-*",
     "winlogbeat-*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "VNC (Virtual Network Computing) to the Internet",
   "query": "network.transport: tcp and (destination.port >= 5800 and destination.port <= 5810) and (\n    network.direction: outbound or (\n        source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) and\n        not destination.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n    )\n)\n",
   "risk_score": 47,
@@ -18,7 +18,7 @@
   "severity": "medium",
   "tags": [
     "Elastic",
-    "network"
+    "Network"
   ],
   "threat": [
     {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/notice.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/notice.ts
index cd24d823b8cd6..a597220db752f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/notice.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/notice.ts
@@ -9,8 +9,6 @@
  * - windows_priv_escalation_via_accessibility_features.json
  * - windows_persistence_via_application_shimming.json
  * - windows_execution_via_trusted_developer_utilities.json
- * - windows_execution_via_net_com_assemblies.json
- * - windows_execution_via_connection_manager.json
  *
  * MIT License
  *
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json
index 7975c30a4ea38..c08d910a3b355 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/null_user_agent.json
@@ -1,7 +1,7 @@
 {
   "description": "A request to a web application server contained no identifying user agent string.",
   "false_positives": [
-    "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, or the user is unauthorized, or the request is unusual, these may be suspicious or malicious activity."
+    "Some normal applications and scripts may contain no user agent. Most legitimate web requests from the Internet contain a user agent string. Requests from web browsers almost always contain a user agent string. If the source is unexpected, the user unauthorized, or the request unusual, these may indicate suspicious or malicious activity."
   ],
   "filters": [
     {
@@ -25,7 +25,7 @@
     "apm-*-transaction*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Web Application Suspicious Activity: No User Agent",
   "query": "url.path: *",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json
index 44e112d09a45b..5c03c3a76e4a7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/sqlmap_user_agent.json
@@ -1,12 +1,13 @@
 {
-  "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11 which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. ",
+  "description": "This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.",
   "false_positives": [
-    "This signal does not indicate that a SQL injection attack occurred, only that the sqlmap tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity."
+    "This rule does not indicate that a SQL injection attack occurred, only that the `sqlmap` tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity."
   ],
   "index": [
     "apm-*-transaction*"
   ],
   "language": "kuery",
+  "max_signals": 100,
   "name": "Web Application Suspicious Activity: sqlmap User Agent",
   "query": "user_agent.original:\"sqlmap/1.3.11#stable (http://sqlmap.org)\"",
   "references": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json
deleted file mode 100644
index 9b3784345b013..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_background_intelligent_transfer_service_bits_connecting_to_the_internet.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "description": "Adversaries may abuse the Background Intelligent Transfer Service (BITS) to download, execute, or clean up after performing a malicious action.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Background Intelligent Transfer Service (BITS) connecting to the Internet",
-  "query": "process.name:bitsadmin.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
-  "risk_score": 21,
-  "rule_id": "7edadee3-98ae-472c-b1c4-8c0a2c4877cc",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
-      },
-      "technique": [
-        {
-          "id": "T1197",
-          "name": "BITS Jobs",
-          "reference": "https://attack.mitre.org/techniques/T1197/"
-        }
-      ]
-    },
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0003",
-        "name": "Persistence",
-        "reference": "https://attack.mitre.org/tactics/TA0003/"
-      },
-      "technique": [
-        {
-          "id": "T1197",
-          "name": "BITS Jobs",
-          "reference": "https://attack.mitre.org/techniques/T1197/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json
deleted file mode 100644
index 0a960fc427d7b..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_certutil_connecting_to_the_internet.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Certutil Network Connection",
-  "query": "process.name:certutil.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
-  "risk_score": 21,
-  "rule_id": "1a2cf526-6784-4c51-a2b9-f0adcc05d85c",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0011",
-        "name": "Command and Control",
-        "reference": "https://attack.mitre.org/tactics/TA0011/"
-      },
-      "technique": [
-        {
-          "id": "T1105",
-          "name": "Remote File Copy",
-          "reference": "https://attack.mitre.org/techniques/T1105/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json
index 87dbd4cd70777..7ab8034ef4083 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_prompt_connecting_to_the_internet.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Command Prompt Network Connection",
   "query": "process.name:cmd.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json
deleted file mode 100644
index a214ab4544b97..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_internet_explorer.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies a suspicious parent child process relationship with cmd.exe spawning form Internet Explorer.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Internet Explorer spawning cmd.exe",
-  "query": "process.parent.name:iexplore.exe and process.name:cmd.exe",
-  "risk_score": 21,
-  "rule_id": "7a6e1e81-deae-4cf6-b807-9a768fff3c06",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1059",
-          "name": "Command-Line Interface",
-          "reference": "https://attack.mitre.org/techniques/T1059/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json
index 187cc9d344902..d914fd2e91a07 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_powershell.json
@@ -4,8 +4,8 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
-  "name": "PowerShell spawning cmd.exe",
+  "max_signals": 100,
+  "name": "PowerShell spawning Cmd",
   "query": "process.parent.name:powershell.exe and process.name:cmd.exe",
   "risk_score": 21,
   "rule_id": "0f616aee-8161-4120-857e-742366f5eeb3",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json
index 81114bf8b8766..b7f0c54fedf62 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_command_shell_started_by_svchost.json
@@ -4,8 +4,8 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Svchost spawning cmd.exe",
+  "max_signals": 100,
+  "name": "Svchost spawning Cmd",
   "query": "process.parent.name:svchost.exe and process.name:cmd.exe",
   "risk_score": 21,
   "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json
index 7c999c1fc1e03..86242fd1081a1 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_defense_evasion_via_filter_manager.json
@@ -4,15 +4,14 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Potential Evasion via Filter Manager",
-  "query": "event.code:1 and process.name:fltmc.exe",
+  "query": "event.code:1 and process.name:fltMC.exe",
   "risk_score": 21,
   "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a",
   "severity": "low",
   "tags": [
     "Elastic",
-    "D-SA",
     "Windows"
   ],
   "threat": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json
index 62c8942dda9c3..7789b0723b3fc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_compiled_html_file.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Process Activity via Compiled HTML File",
   "query": "event.code:1 and process.name:hh.exe",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json
deleted file mode 100644
index 657487232fe81..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_connection_manager.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "description": "Various Windows utilities may be used to execute commands, possibly without invoking cmd.exe, including the Program Compatibility Assistant (pcalua.exe) or forfiles.exe.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Indirect Command Execution",
-  "query": "event.code:1 and process.parent.name:pcalua.exe or (process.name:bash.exe or process.name:forfiles.exe or process.name:pcalua.exe)",
-  "risk_score": 21,
-  "rule_id": "f2728299-167a-489c-913c-2e0955ac3c40",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "D-SA",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
-      },
-      "technique": [
-        {
-          "id": "T1202",
-          "name": "Indirect Command Execution",
-          "reference": "https://attack.mitre.org/techniques/T1202/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json
deleted file mode 100644
index 80d91fa515342..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_net_com_assemblies.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "description": "Adversaries can use Regsvcs.exe and Regasm.exe to proxy execution of code through a trusted Windows utility.",
-  "false_positives": [
-    "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool."
-  ],
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Execution via Regsvcs/Regasm",
-  "query": "event.code:1 and (process.name:regasm.exe or process.name:regsvcs.exe)",
-  "risk_score": 21,
-  "rule_id": "5c12412f-602c-4120-8c4f-69d723dbba04",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "D-SA",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1121",
-          "name": "Regsvcs/Regasm",
-          "reference": "https://attack.mitre.org/techniques/T1121/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json
index 6b2c54d527963..e8e7ddfc168dc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_regsvr32.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Suspicious Script Object Execution",
   "query": "event.code: 1 and scrobj.dll and (process.name:certutil.exe or process.name:regsvr32.exe or process.name:rundll32.exe)",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json
index e722d311b86c7..bd2376a0897f4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_execution_via_trusted_developer_utilities.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Trusted Developer Application Usage",
   "query": "event.code:1 and (process.name:MSBuild.exe or process.name:msxsl.exe)",
   "risk_score": 21,
@@ -15,7 +15,6 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "D-SA",
     "Windows"
   ],
   "threat": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json
index 2b4d774281b84..32fa953388be3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_html_help_executable_program_connecting_to_the_internet.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Network Connection via Compiled HTML File",
   "query": "process.name:hh.exe and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json
index 8a4cb75588bff..0015371f03067 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_misc_lolbin_connecting_to_the_internet.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Network Connection via Signed Binary",
   "query": "(process.name:expand.exe or process.name:extrac.exe or process.name:ieexec.exe or process.name:makecab.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json
deleted file mode 100644
index 5b3257daec8fb..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_net_command_activity_by_the_system_account.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "description": "Identifies attempts to create new users via the SYSTEM account.",
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Net command via SYSTEM account",
-  "query": "process.name: (net.exe or net1.exe) and user.name:SYSTEM",
-  "risk_score": 21,
-  "rule_id": "c3f5dc81-a8b4-4144-95a7-d0a818d7355d",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0003",
-        "name": "Persistence",
-        "reference": "https://attack.mitre.org/tactics/TA0003/"
-      },
-      "technique": [
-        {
-          "id": "T1136",
-          "name": "Create Account",
-          "reference": "https://attack.mitre.org/techniques/T1136/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json
index 2c10382cdbc7c..6eaac7b9e6cab 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_persistence_via_application_shimming.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Potential Application Shimming via Sdbinst",
   "query": "event.code:1 and process.name:sdbinst.exe",
   "risk_score": 21,
@@ -12,7 +12,6 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "D-SA",
     "Windows"
   ],
   "threat": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json
index 23d05aaf526e3..b2463633b0c5d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_priv_escalation_via_accessibility_features.json
@@ -4,7 +4,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Potential Modification of Accessibility Binaries",
   "query": "event.code:1 and process.parent.name:winlogon.exe and (process.name:atbroker.exe or process.name:displayswitch.exe or process.name:magnify.exe or process.name:narrator.exe or process.name:osk.exe or process.name:sethc.exe or process.name:utilman.exe)",
   "risk_score": 21,
@@ -12,7 +12,6 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "D-SA",
     "Windows"
   ],
   "threat": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json
index 5f5215ddff8c6..a0542ef59d8cd 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_discovery_via_tasklist_command.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Process Discovery via Tasklist",
   "query": "event.code:1 and process.name:tasklist.exe",
   "risk_score": 21,
@@ -15,7 +15,6 @@
   "severity": "low",
   "tags": [
     "Elastic",
-    "D-SA",
     "Windows"
   ],
   "threat": [
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json
deleted file mode 100644
index 6d6343330a7ff..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_process_execution_via_wmi.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "description": "Identifies use of scrcons.exe, which is a Windows Management Instrumentation (WMI) Standard Event Consumer scripting application.",
-  "false_positives": [
-    " Windows Management Instrumentation (WMI) processes can be used for an array of administrative capabilities. It's important to baseline your environment to determine any abnormal use of this tool."
-  ],
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Execution via Scrcons",
-  "query": "process.name:scrcons.exe",
-  "risk_score": 21,
-  "rule_id": "7e6cd4b9-6346-4683-b3e6-6a3e66f3208f",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1047",
-          "name": "Windows Management Instrumentation",
-          "reference": "https://attack.mitre.org/techniques/T1047/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json
index b35e016be15d7..d0f2e809c1aa7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_register_server_program_connecting_to_the_internet.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Network Connection via Regsvr",
   "query": "(process.name:regsvr32.exe or process.name:regsvr64.exe) and event.action:\"Network connection detected (rule: NetworkConnect)\" and not destination.ip:169.254.169.254/32 and not destination.ip:10.0.0.0/8 and not destination.ip:172.16.0.0/12 and not destination.ip:192.168.0.0/16",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json
index cf5135cc490eb..be4ccef2a0887 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Execution via Signed Binary",
   "query": "event.code:1 and http and (process.name:certutil.exe or process.name:msiexec.exe)",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json
deleted file mode 100644
index 117a40d0fdcee..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_signed_binary_proxy_execution_download.json
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application whitelisting and signature validation.",
-  "false_positives": [
-    "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual."
-  ],
-  "index": [
-    "winlogbeat-*"
-  ],
-  "language": "kuery",
-  "max_signals": 33,
-  "name": "Potential Download via Signed Binary",
-  "query": " event.code:3 and http and (process.name:certutil.exe or process.name:replace.exe)",
-  "risk_score": 21,
-  "rule_id": "68ecc190-cce2-4021-b976-c7c846ac0a00",
-  "severity": "low",
-  "tags": [
-    "Elastic",
-    "Windows"
-  ],
-  "threat": [
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0005",
-        "name": "Defense Evasion",
-        "reference": "https://attack.mitre.org/tactics/TA0005/"
-      },
-      "technique": [
-        {
-          "id": "T1218",
-          "name": "Signed Binary Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1218/"
-        }
-      ]
-    },
-    {
-      "framework": "MITRE ATT&CK",
-      "tactic": {
-        "id": "TA0002",
-        "name": "Execution",
-        "reference": "https://attack.mitre.org/tactics/TA0002/"
-      },
-      "technique": [
-        {
-          "id": "T1218",
-          "name": "Signed Binary Proxy Execution",
-          "reference": "https://attack.mitre.org/techniques/T1218/"
-        }
-      ]
-    }
-  ],
-  "type": "query",
-  "version": 1
-}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json
index 3691c59d784fb..235a04f8063fc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_suspicious_process_started_by_a_script.json
@@ -7,8 +7,8 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
-  "name": "Suspicious Process Spawning from Script Interpreter",
+  "max_signals": 100,
+  "name": "Suspicious Process spawning from Script Interpreter",
   "query": "(process.parent.name:cmd.exe or process.parent.name:cscript.exe or process.parent.name:mshta.exe or process.parent.name:powershell.exe or process.parent.name:rundll32.exe or process.parent.name:wscript.exe or process.parent.name:wmiprvse.exe) and (process.name:bitsadmin.exe or process.name:certutil.exe or mshta.exe or process.name:nslookup.exe or process.name:schtasks.exe) and event.code:1",
   "risk_score": 21,
   "rule_id": "89db767d-99f9-479f-8052-9205fd3090c4",
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json
index 3618d304dc32a..678160f945ba0 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules/windows_whoami_command_activity.json
@@ -7,7 +7,7 @@
     "winlogbeat-*"
   ],
   "language": "kuery",
-  "max_signals": 33,
+  "max_signals": 100,
   "name": "Whoami Process Activity",
   "query": "process.name:whoami.exe and event.code:1",
   "risk_score": 21,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
index 1b13a010bbea3..1d423c8b375d1 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
@@ -14,7 +14,7 @@ import {
   SavedObjectsClientContract,
 } from 'kibana/server';
 import { SIGNALS_ID } from '../../../../common/constants';
-import { AlertsClient } from '../../../../../alerting/server/alerts_client';
+import { AlertsClient } from '../../../../../alerting/server';
 import { ActionsClient } from '../../../../../../../plugins/actions/server';
 import { RuleAlertParams, RuleTypeParams, RuleAlertParamsRest } from '../types';
 import { RequestFacade } from '../../../types';
diff --git a/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.test.tsx b/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.test.tsx
index aa3c6acf26236..3c6b2332bbbdc 100644
--- a/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.test.tsx
+++ b/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.test.tsx
@@ -5,33 +5,30 @@
  */
 
 import { AdvancedSettingsService } from './advanced_settings_service';
-jest.mock('ui/management', () => {
-  return {
-    PAGE_TITLE_COMPONENT: 'page_title_component',
-    PAGE_SUBTITLE_COMPONENT: 'page_subtitle_component',
-  };
-});
+import { advancedSettingsMock } from '../../../../../../src/plugins/advanced_settings/public/mocks';
+
+const componentRegistryMock = advancedSettingsMock.createSetupContract();
 
 describe('Advanced Settings Service', () => {
   describe('#setup', () => {
     it('registers space-aware components to augment the advanced settings screen', () => {
       const deps = {
         getActiveSpace: jest.fn().mockResolvedValue({ id: 'foo', name: 'foo-space' }),
-        registerSettingsComponent: jest.fn(),
+        componentRegistry: componentRegistryMock,
       };
 
       const advancedSettingsService = new AdvancedSettingsService();
       advancedSettingsService.setup(deps);
 
-      expect(deps.registerSettingsComponent).toHaveBeenCalledTimes(2);
-      expect(deps.registerSettingsComponent).toHaveBeenCalledWith(
-        'page_title_component',
+      expect(deps.componentRegistry.register).toHaveBeenCalledTimes(2);
+      expect(deps.componentRegistry.register).toHaveBeenCalledWith(
+        componentRegistryMock.componentType.PAGE_TITLE_COMPONENT,
         expect.any(Function),
         true
       );
 
-      expect(deps.registerSettingsComponent).toHaveBeenCalledWith(
-        'page_subtitle_component',
+      expect(deps.componentRegistry.register).toHaveBeenCalledWith(
+        componentRegistryMock.componentType.PAGE_SUBTITLE_COMPONENT,
         expect.any(Function),
         true
       );
diff --git a/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.tsx b/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.tsx
index 9c6c2fcc2cdda..a1552add18f2d 100644
--- a/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.tsx
+++ b/x-pack/legacy/plugins/spaces/public/advanced_settings/advanced_settings_service.tsx
@@ -4,25 +4,29 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import React from 'react';
-import { PAGE_TITLE_COMPONENT, PAGE_SUBTITLE_COMPONENT } from 'ui/management';
 import { Space } from '../../common/model/space';
 import { AdvancedSettingsTitle, AdvancedSettingsSubtitle } from './components';
+import { AdvancedSettingsSetup } from '../../../../../../src/plugins/advanced_settings/public';
 
 interface SetupDeps {
   getActiveSpace: () => Promise<Space>;
-  registerSettingsComponent: (
-    id: string,
-    component: string | React.FC<any>,
-    allowOverride: boolean
-  ) => void;
+  componentRegistry: AdvancedSettingsSetup['component'];
 }
 
 export class AdvancedSettingsService {
-  public setup({ getActiveSpace, registerSettingsComponent }: SetupDeps) {
+  public setup({ getActiveSpace, componentRegistry }: SetupDeps) {
     const PageTitle = () => <AdvancedSettingsTitle getActiveSpace={getActiveSpace} />;
     const SubTitle = () => <AdvancedSettingsSubtitle getActiveSpace={getActiveSpace} />;
 
-    registerSettingsComponent(PAGE_TITLE_COMPONENT, PageTitle, true);
-    registerSettingsComponent(PAGE_SUBTITLE_COMPONENT, SubTitle, true);
+    componentRegistry.register(
+      componentRegistry.componentType.PAGE_TITLE_COMPONENT,
+      PageTitle,
+      true
+    );
+    componentRegistry.register(
+      componentRegistry.componentType.PAGE_SUBTITLE_COMPONENT,
+      SubTitle,
+      true
+    );
   }
 }
diff --git a/x-pack/legacy/plugins/spaces/public/legacy.ts b/x-pack/legacy/plugins/spaces/public/legacy.ts
index 1dffbd2661714..200cae5498595 100644
--- a/x-pack/legacy/plugins/spaces/public/legacy.ts
+++ b/x-pack/legacy/plugins/spaces/public/legacy.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { registerSettingsComponent } from 'ui/management';
 import { npSetup, npStart } from 'ui/new_platform';
 import { setup as managementSetup } from '../../../../../src/legacy/core_plugins/management/public/legacy';
 import { plugin } from '.';
@@ -16,9 +15,7 @@ const spacesPlugin: SpacesPlugin = plugin();
 const pluginsSetup: PluginsSetup = {
   home: npSetup.plugins.home,
   management: managementSetup,
-  __managementLegacyCompat: {
-    registerSettingsComponent,
-  },
+  advancedSettings: npSetup.plugins.advancedSettings,
 };
 
 const pluginsStart: PluginsStart = {
diff --git a/x-pack/legacy/plugins/spaces/public/plugin.tsx b/x-pack/legacy/plugins/spaces/public/plugin.tsx
index 1ddb69a5b595c..e6271ac3a0a70 100644
--- a/x-pack/legacy/plugins/spaces/public/plugin.tsx
+++ b/x-pack/legacy/plugins/spaces/public/plugin.tsx
@@ -8,6 +8,7 @@ import { CoreSetup, CoreStart, Plugin } from 'src/core/public';
 import { HomePublicPluginSetup } from 'src/plugins/home/public';
 import { ManagementSetup } from 'src/legacy/core_plugins/management/public';
 import { ManagementStart } from 'src/plugins/management/public';
+import { AdvancedSettingsSetup } from 'src/plugins/advanced_settings/public';
 import { SpacesManager } from './spaces_manager';
 import { initSpacesNavControl } from './nav_control';
 import { createSpacesFeatureCatalogueEntry } from './create_feature_catalogue_entry';
@@ -22,13 +23,7 @@ export interface SpacesPluginStart {
 export interface PluginsSetup {
   home?: HomePublicPluginSetup;
   management: ManagementSetup;
-  __managementLegacyCompat: {
-    registerSettingsComponent: (
-      id: string,
-      component: string | React.FC<any>,
-      allowOverride: boolean
-    ) => void;
-  };
+  advancedSettings: AdvancedSettingsSetup;
 }
 
 export interface PluginsStart {
@@ -53,7 +48,7 @@ export class SpacesPlugin implements Plugin<void, SpacesPluginStart, PluginsSetu
     const advancedSettingsService = new AdvancedSettingsService();
     advancedSettingsService.setup({
       getActiveSpace: () => this.spacesManager.getActiveSpace(),
-      registerSettingsComponent: plugins.__managementLegacyCompat.registerSettingsComponent,
+      componentRegistry: plugins.advancedSettings.component,
     });
 
     if (plugins.home) {
diff --git a/x-pack/legacy/plugins/task_manager/server/index.ts b/x-pack/legacy/plugins/task_manager/server/index.ts
index 98d67a38c20d0..ff25d8a1e0e5d 100644
--- a/x-pack/legacy/plugins/task_manager/server/index.ts
+++ b/x-pack/legacy/plugins/task_manager/server/index.ts
@@ -51,9 +51,7 @@ export function taskManager(kibana: any) {
       server.expose(
         createLegacyApi(
           getTaskManagerSetup(server)!
-            .registerLegacyAPI({
-              savedObjectSchemas,
-            })
+            .registerLegacyAPI({})
             .then((taskManagerPlugin: TaskManager) => {
               // we can't tell the Kibana Platform Task Manager plugin to
               // to wait to `start` as that happens before legacy plugins
diff --git a/x-pack/legacy/plugins/transform/public/app/sections/create_transform/create_transform_section.tsx b/x-pack/legacy/plugins/transform/public/app/sections/create_transform/create_transform_section.tsx
index f63f3b6d6e7be..ae82f03718c02 100644
--- a/x-pack/legacy/plugins/transform/public/app/sections/create_transform/create_transform_section.tsx
+++ b/x-pack/legacy/plugins/transform/public/app/sections/create_transform/create_transform_section.tsx
@@ -16,7 +16,6 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiPageContent,
-  EuiPageBody,
   EuiPageContentBody,
   EuiSpacer,
   EuiTitle,
@@ -41,53 +40,51 @@ export const CreateTransformSection: FC<Props> = ({ match }) => {
   return (
     <PrivilegesWrapper privileges={APP_CREATE_TRANSFORM_CLUSTER_PRIVILEGES}>
       <KibanaProvider savedObjectId={match.params.savedObjectId}>
-        <EuiPageBody data-test-subj="transformPageCreateTransform">
-          <EuiPageContent>
-            <EuiTitle size="l">
-              <EuiFlexGroup alignItems="center">
-                <EuiFlexItem grow={true}>
-                  <h1>
-                    <FormattedMessage
-                      id="xpack.transform.transformsWizard.createTransformTitle"
-                      defaultMessage="Create transform"
-                    />
-                    <span>&nbsp;</span>
-                    <EuiBetaBadge
-                      label={i18n.translate('xpack.transform.transformsWizard.betaBadgeLabel', {
-                        defaultMessage: `Beta`,
-                      })}
-                      tooltipContent={i18n.translate(
-                        'xpack.transform.transformsWizard.betaBadgeTooltipContent',
-                        {
-                          defaultMessage: `Transforms are a beta feature. We'd love to hear your feedback.`,
-                        }
-                      )}
-                    />
-                  </h1>
-                </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty
-                    href={documentationLinksService.getTransformsDocUrl()}
-                    target="_blank"
-                    iconType="help"
-                    data-test-subj="documentationLink"
-                  >
-                    <FormattedMessage
-                      id="xpack.transform.transformsWizard.transformDocsLinkText"
-                      defaultMessage="Transform docs"
-                    />
-                  </EuiButtonEmpty>
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            </EuiTitle>
-            <EuiPageContentBody>
-              <EuiSpacer size="l" />
-              <RenderOnlyWithInitializedKibanaContext>
-                <Wizard />
-              </RenderOnlyWithInitializedKibanaContext>
-            </EuiPageContentBody>
-          </EuiPageContent>
-        </EuiPageBody>
+        <EuiPageContent data-test-subj="transformPageCreateTransform">
+          <EuiTitle size="l">
+            <EuiFlexGroup alignItems="center">
+              <EuiFlexItem grow={true}>
+                <h1>
+                  <FormattedMessage
+                    id="xpack.transform.transformsWizard.createTransformTitle"
+                    defaultMessage="Create transform"
+                  />
+                  <span>&nbsp;</span>
+                  <EuiBetaBadge
+                    label={i18n.translate('xpack.transform.transformsWizard.betaBadgeLabel', {
+                      defaultMessage: `Beta`,
+                    })}
+                    tooltipContent={i18n.translate(
+                      'xpack.transform.transformsWizard.betaBadgeTooltipContent',
+                      {
+                        defaultMessage: `Transforms are a beta feature. We'd love to hear your feedback.`,
+                      }
+                    )}
+                  />
+                </h1>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiButtonEmpty
+                  href={documentationLinksService.getTransformsDocUrl()}
+                  target="_blank"
+                  iconType="help"
+                  data-test-subj="documentationLink"
+                >
+                  <FormattedMessage
+                    id="xpack.transform.transformsWizard.transformDocsLinkText"
+                    defaultMessage="Transform docs"
+                  />
+                </EuiButtonEmpty>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiTitle>
+          <EuiPageContentBody>
+            <EuiSpacer size="l" />
+            <RenderOnlyWithInitializedKibanaContext>
+              <Wizard />
+            </RenderOnlyWithInitializedKibanaContext>
+          </EuiPageContentBody>
+        </EuiPageContent>
       </KibanaProvider>
     </PrivilegesWrapper>
   );
diff --git a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
index 368c5aa806fe8..ff8bb7e2f432d 100644
--- a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
+++ b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
@@ -8,7 +8,7 @@ import { EuiModalBody, EuiModalHeader, EuiModalHeaderTitle } from '@elastic/eui'
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { FC } from 'react';
-import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/kibana_react/public';
+import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/saved_objects/public';
 import { useAppDependencies } from '../../../../app_dependencies';
 
 interface SearchSelectionProps {
diff --git a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
index 2bd03df9957d2..6eb03c6537e0e 100644
--- a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
+++ b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/transform_management_section.tsx
@@ -16,7 +16,6 @@ import {
   EuiFlexItem,
   EuiModal,
   EuiOverlayMask,
-  EuiPageBody,
   EuiPageContent,
   EuiPageContentBody,
   EuiSpacer,
@@ -74,68 +73,66 @@ export const TransformManagement: FC = () => {
 
   return (
     <Fragment>
-      <EuiPageBody data-test-subj="transformPageTransformList">
-        <EuiPageContent>
-          <EuiTitle size="l">
-            <EuiFlexGroup alignItems="center">
-              <EuiFlexItem grow={true}>
-                <h1 data-test-subj="transformAppTitle">
-                  <FormattedMessage
-                    id="xpack.transform.transformList.transformTitle"
-                    defaultMessage="Transforms"
-                  />
-                  <span>&nbsp;</span>
-                  <EuiBetaBadge
-                    label={i18n.translate('xpack.transform.transformList.betaBadgeLabel', {
-                      defaultMessage: `Beta`,
-                    })}
-                    tooltipContent={i18n.translate(
-                      'xpack.transform.transformList.betaBadgeTooltipContent',
-                      {
-                        defaultMessage: `Transforms are a beta feature. We'd love to hear your feedback.`,
-                      }
-                    )}
-                  />
-                </h1>
-              </EuiFlexItem>
-              <EuiFlexItem grow={false}>
-                <EuiButtonEmpty
-                  href={documentationLinksService.getTransformsDocUrl()}
-                  target="_blank"
-                  iconType="help"
-                  data-test-subj="documentationLink"
-                >
-                  <FormattedMessage
-                    id="xpack.transform.transformList.transformDocsLinkText"
-                    defaultMessage="Transform docs"
-                  />
-                </EuiButtonEmpty>
-              </EuiFlexItem>
-            </EuiFlexGroup>
-          </EuiTitle>
-          <EuiSpacer size="s" />
-          <EuiTitle size="s">
-            <EuiText color="subdued">
-              <FormattedMessage
-                id="xpack.transform.transformList.transformDescription"
-                defaultMessage="Use transforms to pivot existing Elasticsearch indices into summarized or entity-centric indices."
-              />
-            </EuiText>
-          </EuiTitle>
-          <EuiPageContentBody>
-            <EuiSpacer size="l" />
-            <TransformStatsBar transformsList={transforms} />
-            <EuiSpacer size="s" />
-            <TransformList
-              errorMessage={errorMessage}
-              isInitialized={isInitialized}
-              onCreateTransform={onOpenModal}
-              transforms={transforms}
-              transformsLoading={transformsLoading}
+      <EuiPageContent data-test-subj="transformPageTransformList">
+        <EuiTitle size="l">
+          <EuiFlexGroup alignItems="center">
+            <EuiFlexItem grow={true}>
+              <h1 data-test-subj="transformAppTitle">
+                <FormattedMessage
+                  id="xpack.transform.transformList.transformTitle"
+                  defaultMessage="Transforms"
+                />
+                <span>&nbsp;</span>
+                <EuiBetaBadge
+                  label={i18n.translate('xpack.transform.transformList.betaBadgeLabel', {
+                    defaultMessage: `Beta`,
+                  })}
+                  tooltipContent={i18n.translate(
+                    'xpack.transform.transformList.betaBadgeTooltipContent',
+                    {
+                      defaultMessage: `Transforms are a beta feature. We'd love to hear your feedback.`,
+                    }
+                  )}
+                />
+              </h1>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty
+                href={documentationLinksService.getTransformsDocUrl()}
+                target="_blank"
+                iconType="help"
+                data-test-subj="documentationLink"
+              >
+                <FormattedMessage
+                  id="xpack.transform.transformList.transformDocsLinkText"
+                  defaultMessage="Transform docs"
+                />
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiTitle>
+        <EuiSpacer size="s" />
+        <EuiTitle size="s">
+          <EuiText color="subdued">
+            <FormattedMessage
+              id="xpack.transform.transformList.transformDescription"
+              defaultMessage="Use transforms to pivot existing Elasticsearch indices into summarized or entity-centric indices."
             />
-          </EuiPageContentBody>
-        </EuiPageContent>
-      </EuiPageBody>
+          </EuiText>
+        </EuiTitle>
+        <EuiPageContentBody>
+          <EuiSpacer size="l" />
+          <TransformStatsBar transformsList={transforms} />
+          <EuiSpacer size="s" />
+          <TransformList
+            errorMessage={errorMessage}
+            isInitialized={isInitialized}
+            onCreateTransform={onOpenModal}
+            transforms={transforms}
+            transformsLoading={transformsLoading}
+          />
+        </EuiPageContentBody>
+      </EuiPageContent>
       {isSearchSelectionVisible && (
         <EuiOverlayMask>
           <EuiModal
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/index.ts b/x-pack/legacy/plugins/triggers_actions_ui/index.ts
index 19930363d30bf..5874fbc59463f 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/index.ts
+++ b/x-pack/legacy/plugins/triggers_actions_ui/index.ts
@@ -29,7 +29,6 @@ export function triggersActionsUI(kibana: any) {
         .default();
     },
     uiExports: {
-      managementSections: ['plugins/triggers_actions_ui/legacy'],
       styleSheetPaths: resolve(__dirname, 'public/index.scss'),
       injectDefaultVars(server: Legacy.Server) {
         const serverConfig = server.config();
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/expression.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/expression.tsx
deleted file mode 100644
index 907a61677b263..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/expression.tsx
+++ /dev/null
@@ -1,1000 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useState, Fragment, useEffect } from 'react';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiFlexItem,
-  EuiFlexGroup,
-  EuiExpression,
-  EuiPopover,
-  EuiPopoverTitle,
-  EuiSelect,
-  EuiSpacer,
-  EuiComboBox,
-  EuiFieldNumber,
-  EuiComboBoxOptionProps,
-  EuiText,
-  EuiFormRow,
-  EuiCallOut,
-} from '@elastic/eui';
-import { AlertTypeModel, Alert, ValidationResult } from '../../../../types';
-import { Comparator, AggregationType, GroupByType } from './types';
-import { AGGREGATION_TYPES, COMPARATORS } from './constants';
-import {
-  getMatchingIndicesForThresholdAlertType,
-  getThresholdAlertTypeFields,
-  loadIndexPatterns,
-} from './lib/api';
-import { useAppDependencies } from '../../../app_context';
-import { getTimeOptions, getTimeFieldOptions } from '../../../lib/get_time_options';
-import { getTimeUnitLabel } from '../../../lib/get_time_unit_label';
-import { ThresholdVisualization } from './visualization';
-
-const DEFAULT_VALUES = {
-  AGGREGATION_TYPE: 'count',
-  TERM_SIZE: 5,
-  THRESHOLD_COMPARATOR: COMPARATORS.GREATER_THAN,
-  TIME_WINDOW_SIZE: 5,
-  TIME_WINDOW_UNIT: 'm',
-  TRIGGER_INTERVAL_SIZE: 1,
-  TRIGGER_INTERVAL_UNIT: 'm',
-  THRESHOLD: [1000, 5000],
-  GROUP_BY: 'all',
-};
-
-const expressionFieldsWithValidation = [
-  'index',
-  'timeField',
-  'aggField',
-  'termSize',
-  'termField',
-  'threshold0',
-  'threshold1',
-  'timeWindowSize',
-];
-
-const validateAlertType = (alert: Alert): ValidationResult => {
-  const {
-    index,
-    timeField,
-    aggType,
-    aggField,
-    groupBy,
-    termSize,
-    termField,
-    threshold,
-    timeWindowSize,
-  } = alert.params;
-  const validationResult = { errors: {} };
-  const errors = {
-    aggField: new Array<string>(),
-    termSize: new Array<string>(),
-    termField: new Array<string>(),
-    timeWindowSize: new Array<string>(),
-    threshold0: new Array<string>(),
-    threshold1: new Array<string>(),
-    index: new Array<string>(),
-    timeField: new Array<string>(),
-  };
-  validationResult.errors = errors;
-  if (!index) {
-    errors.index.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredIndexText', {
-        defaultMessage: 'Index is required.',
-      })
-    );
-  }
-  if (!timeField) {
-    errors.timeField.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredTimeFieldText', {
-        defaultMessage: 'Time field is required.',
-      })
-    );
-  }
-  if (aggType && aggregationTypes[aggType].fieldRequired && !aggField) {
-    errors.aggField.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredAggFieldText', {
-        defaultMessage: 'Aggregation field is required.',
-      })
-    );
-  }
-  if (!termSize) {
-    errors.termSize.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredTermSizedText', {
-        defaultMessage: 'Term size is required.',
-      })
-    );
-  }
-  if (groupBy && groupByTypes[groupBy].sizeRequired && !termField) {
-    errors.termField.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredtTermFieldText', {
-        defaultMessage: 'Term field is required.',
-      })
-    );
-  }
-  if (!timeWindowSize) {
-    errors.timeWindowSize.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredTimeWindowSizeText', {
-        defaultMessage: 'Time window size is required.',
-      })
-    );
-  }
-  if (threshold && threshold.length > 0 && !threshold[0]) {
-    errors.threshold0.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredThreshold0Text', {
-        defaultMessage: 'Threshold0, is required.',
-      })
-    );
-  }
-  if (threshold && threshold.length > 1 && !threshold[1]) {
-    errors.threshold1.push(
-      i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredThreshold1Text', {
-        defaultMessage: 'Threshold1 is required.',
-      })
-    );
-  }
-  return validationResult;
-};
-
-export function getActionType(): AlertTypeModel {
-  return {
-    id: 'threshold',
-    name: 'Index Threshold',
-    iconClass: 'alert',
-    alertParamsExpression: IndexThresholdAlertTypeExpression,
-    validate: validateAlertType,
-  };
-}
-
-export const aggregationTypes: { [key: string]: AggregationType } = {
-  count: {
-    text: 'count()',
-    fieldRequired: false,
-    value: AGGREGATION_TYPES.COUNT,
-    validNormalizedTypes: [],
-  },
-  avg: {
-    text: 'average()',
-    fieldRequired: true,
-    validNormalizedTypes: ['number'],
-    value: AGGREGATION_TYPES.AVERAGE,
-  },
-  sum: {
-    text: 'sum()',
-    fieldRequired: true,
-    validNormalizedTypes: ['number'],
-    value: AGGREGATION_TYPES.SUM,
-  },
-  min: {
-    text: 'min()',
-    fieldRequired: true,
-    validNormalizedTypes: ['number', 'date'],
-    value: AGGREGATION_TYPES.MIN,
-  },
-  max: {
-    text: 'max()',
-    fieldRequired: true,
-    validNormalizedTypes: ['number', 'date'],
-    value: AGGREGATION_TYPES.MAX,
-  },
-};
-
-export const comparators: { [key: string]: Comparator } = {
-  [COMPARATORS.GREATER_THAN]: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.comparators.isAboveLabel',
-      {
-        defaultMessage: 'Is above',
-      }
-    ),
-    value: COMPARATORS.GREATER_THAN,
-    requiredValues: 1,
-  },
-  [COMPARATORS.GREATER_THAN_OR_EQUALS]: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.comparators.isAboveOrEqualsLabel',
-      {
-        defaultMessage: 'Is above or equals',
-      }
-    ),
-    value: COMPARATORS.GREATER_THAN_OR_EQUALS,
-    requiredValues: 1,
-  },
-  [COMPARATORS.LESS_THAN]: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.comparators.isBelowLabel',
-      {
-        defaultMessage: 'Is below',
-      }
-    ),
-    value: COMPARATORS.LESS_THAN,
-    requiredValues: 1,
-  },
-  [COMPARATORS.LESS_THAN_OR_EQUALS]: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.comparators.isBelowOrEqualsLabel',
-      {
-        defaultMessage: 'Is below or equals',
-      }
-    ),
-    value: COMPARATORS.LESS_THAN_OR_EQUALS,
-    requiredValues: 1,
-  },
-  [COMPARATORS.BETWEEN]: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.comparators.isBetweenLabel',
-      {
-        defaultMessage: 'Is between',
-      }
-    ),
-    value: COMPARATORS.BETWEEN,
-    requiredValues: 2,
-  },
-};
-
-export const groupByTypes: { [key: string]: GroupByType } = {
-  all: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.groupByLabel.allDocumentsLabel',
-      {
-        defaultMessage: 'all documents',
-      }
-    ),
-    sizeRequired: false,
-    value: 'all',
-    validNormalizedTypes: [],
-  },
-  top: {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.groupByLabel.topLabel',
-      {
-        defaultMessage: 'top',
-      }
-    ),
-    sizeRequired: true,
-    value: 'top',
-    validNormalizedTypes: ['number', 'date', 'keyword'],
-  },
-};
-
-interface Props {
-  alert: Alert;
-  setAlertParams: (property: string, value: any) => void;
-  setAlertProperty: (key: string, value: any) => void;
-  errors: { [key: string]: string[] };
-  hasErrors?: boolean;
-}
-
-export const IndexThresholdAlertTypeExpression: React.FunctionComponent<Props> = ({
-  alert,
-  setAlertParams,
-  setAlertProperty,
-  errors,
-  hasErrors,
-}) => {
-  const { http } = useAppDependencies();
-
-  const {
-    index,
-    timeField,
-    aggType,
-    aggField,
-    groupBy,
-    termSize,
-    termField,
-    thresholdComparator,
-    threshold,
-    timeWindowSize,
-    timeWindowUnit,
-  } = alert.params;
-
-  const firstFieldOption = {
-    text: i18n.translate(
-      'xpack.triggersActionsUI.sections.alertAdd.threshold.timeFieldOptionLabel',
-      {
-        defaultMessage: 'Select a field',
-      }
-    ),
-    value: '',
-  };
-
-  const [aggTypePopoverOpen, setAggTypePopoverOpen] = useState(false);
-  const [indexPopoverOpen, setIndexPopoverOpen] = useState(false);
-  const [indexPatterns, setIndexPatterns] = useState([]);
-  const [esFields, setEsFields] = useState<Record<string, any>>([]);
-  const [indexOptions, setIndexOptions] = useState<IOption[]>([]);
-  const [timeFieldOptions, setTimeFieldOptions] = useState([firstFieldOption]);
-  const [isIndiciesLoading, setIsIndiciesLoading] = useState<boolean>(false);
-  const [alertThresholdPopoverOpen, setAlertThresholdPopoverOpen] = useState(false);
-  const [alertDurationPopoverOpen, setAlertDurationPopoverOpen] = useState(false);
-  const [aggFieldPopoverOpen, setAggFieldPopoverOpen] = useState(false);
-  const [groupByPopoverOpen, setGroupByPopoverOpen] = useState(false);
-
-  const andThresholdText = i18n.translate(
-    'xpack.triggersActionsUI.sections.alertAdd.threshold.andLabel',
-    {
-      defaultMessage: 'AND',
-    }
-  );
-
-  const hasExpressionErrors = !!Object.keys(errors).find(
-    errorKey => expressionFieldsWithValidation.includes(errorKey) && errors[errorKey].length >= 1
-  );
-
-  const getIndexPatterns = async () => {
-    const indexPatternObjects = await loadIndexPatterns();
-    const titles = indexPatternObjects.map((indexPattern: any) => indexPattern.attributes.title);
-    setIndexPatterns(titles);
-  };
-
-  const expressionErrorMessage = i18n.translate(
-    'xpack.triggersActionsUI.sections.alertAdd.threshold.fixErrorInExpressionBelowValidationMessage',
-    {
-      defaultMessage: 'Expression contains errors.',
-    }
-  );
-
-  const setDefaultExpressionValues = () => {
-    setAlertProperty('params', {
-      aggType: DEFAULT_VALUES.AGGREGATION_TYPE,
-      termSize: DEFAULT_VALUES.TERM_SIZE,
-      thresholdComparator: DEFAULT_VALUES.THRESHOLD_COMPARATOR,
-      timeWindowSize: DEFAULT_VALUES.TIME_WINDOW_SIZE,
-      timeWindowUnit: DEFAULT_VALUES.TIME_WINDOW_UNIT,
-      triggerIntervalUnit: DEFAULT_VALUES.TRIGGER_INTERVAL_UNIT,
-      groupBy: DEFAULT_VALUES.GROUP_BY,
-      threshold: DEFAULT_VALUES.THRESHOLD,
-    });
-  };
-
-  const getFields = async (indexes: string[]) => {
-    return await getThresholdAlertTypeFields({ indexes, http });
-  };
-
-  useEffect(() => {
-    getIndexPatterns();
-  }, []);
-
-  useEffect(() => {
-    setDefaultExpressionValues();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
-
-  interface IOption {
-    label: string;
-    options: Array<{ value: string; label: string }>;
-  }
-
-  const getIndexOptions = async (pattern: string, indexPatternsParam: string[]) => {
-    const options: IOption[] = [];
-
-    if (!pattern) {
-      return options;
-    }
-
-    const matchingIndices = (await getMatchingIndicesForThresholdAlertType({
-      pattern,
-      http,
-    })) as string[];
-    const matchingIndexPatterns = indexPatternsParam.filter(anIndexPattern => {
-      return anIndexPattern.includes(pattern);
-    }) as string[];
-
-    if (matchingIndices.length || matchingIndexPatterns.length) {
-      const matchingOptions = _.uniq([...matchingIndices, ...matchingIndexPatterns]);
-
-      options.push({
-        label: i18n.translate(
-          'xpack.triggersActionsUI.sections.alertAdd.threshold.indicesAndIndexPatternsLabel',
-          {
-            defaultMessage: 'Based on your indices and index patterns',
-          }
-        ),
-        options: matchingOptions.map(match => {
-          return {
-            label: match,
-            value: match,
-          };
-        }),
-      });
-    }
-
-    options.push({
-      label: i18n.translate('xpack.triggersActionsUI.sections.alertAdd.threshold.chooseLabel', {
-        defaultMessage: 'Choose…',
-      }),
-      options: [
-        {
-          value: pattern,
-          label: pattern,
-        },
-      ],
-    });
-
-    return options;
-  };
-
-  const indexPopover = (
-    <Fragment>
-      <EuiSpacer />
-      <EuiFlexGroup justifyContent="spaceBetween">
-        <EuiFlexItem>
-          <EuiFormRow
-            id="indexSelectSearchBox"
-            fullWidth
-            label={
-              <FormattedMessage
-                id="xpack.triggersActionsUI.sections.alertAdd.threshold.indicesToQueryLabel"
-                defaultMessage="Indices to query"
-              />
-            }
-            isInvalid={hasErrors && index !== undefined}
-            error={errors.index}
-            helpText={
-              <FormattedMessage
-                id="xpack.triggersActionsUI.sections.alertAdd.threshold.howToBroadenSearchQueryDescription"
-                defaultMessage="Use * to broaden your query."
-              />
-            }
-          >
-            <EuiComboBox
-              fullWidth
-              async
-              isLoading={isIndiciesLoading}
-              isInvalid={hasErrors && index !== undefined}
-              noSuggestions={!indexOptions.length}
-              options={indexOptions}
-              data-test-subj="thresholdIndexesComboBox"
-              selectedOptions={(index || []).map((anIndex: string) => {
-                return {
-                  label: anIndex,
-                  value: anIndex,
-                };
-              })}
-              onChange={async (selected: EuiComboBoxOptionProps[]) => {
-                setAlertParams(
-                  'index',
-                  selected.map(aSelected => aSelected.value)
-                );
-                const indices = selected.map(s => s.value as string);
-
-                // reset time field and expression fields if indices are deleted
-                if (indices.length === 0) {
-                  setTimeFieldOptions([firstFieldOption]);
-                  setAlertParams('timeFields', []);
-
-                  setDefaultExpressionValues();
-                  return;
-                }
-                const currentEsFields = await getFields(indices);
-                const timeFields = getTimeFieldOptions(currentEsFields as any);
-
-                setEsFields(currentEsFields);
-                setAlertParams('timeFields', timeFields);
-                setTimeFieldOptions([firstFieldOption, ...timeFields]);
-              }}
-              onSearchChange={async search => {
-                setIsIndiciesLoading(true);
-                setIndexOptions(await getIndexOptions(search, indexPatterns));
-                setIsIndiciesLoading(false);
-              }}
-              onBlur={() => {
-                if (!index) {
-                  setAlertParams('index', []);
-                }
-              }}
-            />
-          </EuiFormRow>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiFormRow
-            id="timeField"
-            fullWidth
-            label={
-              <FormattedMessage
-                id="xpack.triggersActionsUI.sections.alertAdd.threshold.timeFieldLabel"
-                defaultMessage="Time field"
-              />
-            }
-            isInvalid={hasErrors && timeField !== undefined}
-            error={errors.timeField}
-          >
-            <EuiSelect
-              options={timeFieldOptions}
-              isInvalid={hasErrors && timeField !== undefined}
-              fullWidth
-              name="watchTimeField"
-              data-test-subj="watchTimeFieldSelect"
-              value={timeField}
-              onChange={e => {
-                setAlertParams('timeField', e.target.value);
-              }}
-              onBlur={() => {
-                if (timeField === undefined) {
-                  setAlertParams('timeField', '');
-                }
-              }}
-            />
-          </EuiFormRow>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <EuiSpacer />
-    </Fragment>
-  );
-
-  return (
-    <Fragment>
-      {hasExpressionErrors ? (
-        <Fragment>
-          <EuiSpacer />
-          <EuiCallOut color="danger" size="s" title={expressionErrorMessage} />
-          <EuiSpacer />
-        </Fragment>
-      ) : null}
-      <EuiFlexGroup gutterSize="s" wrap>
-        <EuiFlexItem grow={false}>
-          <EuiPopover
-            id="indexPopover"
-            button={
-              <EuiExpression
-                description={i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.indexLabel',
-                  {
-                    defaultMessage: 'index',
-                  }
-                )}
-                value={index || firstFieldOption.text}
-                isActive={indexPopoverOpen}
-                onClick={() => {
-                  setIndexPopoverOpen(true);
-                }}
-                color={index ? 'secondary' : 'danger'}
-              />
-            }
-            isOpen={indexPopoverOpen}
-            closePopover={() => {
-              setIndexPopoverOpen(false);
-            }}
-            ownFocus
-            withTitle
-            anchorPosition="downLeft"
-            zIndex={8000}
-          >
-            <div style={{ width: '450px' }}>
-              <EuiPopoverTitle>
-                {i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.indexButtonLabel',
-                  {
-                    defaultMessage: 'index',
-                  }
-                )}
-              </EuiPopoverTitle>
-              {indexPopover}
-            </div>
-          </EuiPopover>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiPopover
-            id="aggTypePopover"
-            button={
-              <EuiExpression
-                description={i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.whenLabel',
-                  {
-                    defaultMessage: 'when',
-                  }
-                )}
-                value={
-                  aggregationTypes[aggType]
-                    ? aggregationTypes[aggType].text
-                    : aggregationTypes[DEFAULT_VALUES.AGGREGATION_TYPE].text
-                }
-                isActive={aggTypePopoverOpen}
-                onClick={() => {
-                  setAggTypePopoverOpen(true);
-                }}
-              />
-            }
-            isOpen={aggTypePopoverOpen}
-            closePopover={() => {
-              setAggTypePopoverOpen(false);
-            }}
-            ownFocus
-            withTitle
-            anchorPosition="downLeft"
-          >
-            <div>
-              <EuiPopoverTitle>
-                {i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.whenButtonLabel',
-                  {
-                    defaultMessage: 'when',
-                  }
-                )}
-              </EuiPopoverTitle>
-              <EuiSelect
-                value={aggType || ''}
-                fullWidth
-                onChange={e => {
-                  setAlertParams('aggType', e.target.value);
-                  setAggTypePopoverOpen(false);
-                }}
-                options={Object.values(aggregationTypes).map(({ text, value }) => {
-                  return {
-                    text,
-                    value,
-                  };
-                })}
-              />
-            </div>
-          </EuiPopover>
-        </EuiFlexItem>
-        {aggType && aggregationTypes[aggType].fieldRequired ? (
-          <EuiFlexItem grow={false}>
-            <EuiPopover
-              id="aggFieldPopover"
-              button={
-                <EuiExpression
-                  description={i18n.translate(
-                    'xpack.triggersActionsUI.sections.alertAdd.threshold.ofLabel',
-                    {
-                      defaultMessage: 'of',
-                    }
-                  )}
-                  value={aggField || firstFieldOption.text}
-                  isActive={aggFieldPopoverOpen || !aggField}
-                  onClick={() => {
-                    setAggFieldPopoverOpen(true);
-                  }}
-                  color={aggField ? 'secondary' : 'danger'}
-                />
-              }
-              isOpen={aggFieldPopoverOpen}
-              closePopover={() => {
-                setAggFieldPopoverOpen(false);
-              }}
-              anchorPosition="downLeft"
-            >
-              <div>
-                <EuiPopoverTitle>
-                  {i18n.translate(
-                    'xpack.triggersActionsUI.sections.alertAdd.threshold.ofButtonLabel',
-                    {
-                      defaultMessage: 'of',
-                    }
-                  )}
-                </EuiPopoverTitle>
-                <EuiFlexGroup>
-                  <EuiFlexItem grow={false} className="watcherThresholdAlertAggFieldContainer">
-                    <EuiFormRow
-                      isInvalid={hasErrors && aggField !== undefined}
-                      error={errors.aggField}
-                    >
-                      <EuiComboBox
-                        singleSelection={{ asPlainText: true }}
-                        isInvalid={hasErrors && aggField !== undefined}
-                        placeholder={firstFieldOption.text}
-                        options={esFields.reduce((esFieldOptions: any[], field: any) => {
-                          if (
-                            aggregationTypes[aggType].validNormalizedTypes.includes(
-                              field.normalizedType
-                            )
-                          ) {
-                            esFieldOptions.push({
-                              label: field.name,
-                            });
-                          }
-                          return esFieldOptions;
-                        }, [])}
-                        selectedOptions={aggField ? [{ label: aggField }] : []}
-                        onChange={selectedOptions => {
-                          setAlertParams(
-                            'aggField',
-                            selectedOptions.length === 1 ? selectedOptions[0].label : undefined
-                          );
-                          setAggFieldPopoverOpen(false);
-                        }}
-                      />
-                    </EuiFormRow>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-              </div>
-            </EuiPopover>
-          </EuiFlexItem>
-        ) : null}
-        <EuiFlexItem grow={false}>
-          <EuiPopover
-            id="groupByPopover"
-            button={
-              <EuiExpression
-                description={`${
-                  groupByTypes[groupBy || DEFAULT_VALUES.GROUP_BY].sizeRequired
-                    ? i18n.translate(
-                        'xpack.triggersActionsUI.sections.alertAdd.threshold.groupedOverLabel',
-                        {
-                          defaultMessage: 'grouped over',
-                        }
-                      )
-                    : i18n.translate(
-                        'xpack.triggersActionsUI.sections.alertAdd.threshold.overLabel',
-                        {
-                          defaultMessage: 'over',
-                        }
-                      )
-                }`}
-                value={`${groupByTypes[groupBy || DEFAULT_VALUES.GROUP_BY].text} ${
-                  groupByTypes[groupBy || DEFAULT_VALUES.GROUP_BY].sizeRequired
-                    ? `${termSize} ${termField ? `'${termField}'` : ''}`
-                    : ''
-                }`}
-                isActive={groupByPopoverOpen || (groupBy === 'top' && !(termSize && termField))}
-                onClick={() => {
-                  setGroupByPopoverOpen(true);
-                }}
-                color={groupBy === 'all' || (termSize && termField) ? 'secondary' : 'danger'}
-              />
-            }
-            isOpen={groupByPopoverOpen}
-            closePopover={() => {
-              setGroupByPopoverOpen(false);
-            }}
-            ownFocus
-            withTitle
-            anchorPosition="downLeft"
-          >
-            <div>
-              <EuiPopoverTitle>
-                {i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.overButtonLabel',
-                  {
-                    defaultMessage: 'over',
-                  }
-                )}
-              </EuiPopoverTitle>
-              <EuiFlexGroup>
-                <EuiFlexItem grow={false}>
-                  <EuiSelect
-                    value={groupBy}
-                    onChange={e => {
-                      setAlertParams('termSize', null);
-                      setAlertParams('termField', null);
-                      setAlertParams('groupBy', e.target.value);
-                    }}
-                    options={Object.values(groupByTypes).map(({ text, value }) => {
-                      return {
-                        text,
-                        value,
-                      };
-                    })}
-                  />
-                </EuiFlexItem>
-
-                {groupByTypes[groupBy || DEFAULT_VALUES.GROUP_BY].sizeRequired ? (
-                  <Fragment>
-                    <EuiFlexItem grow={false}>
-                      <EuiFormRow isInvalid={hasErrors} error={errors.termSize}>
-                        <EuiFieldNumber
-                          isInvalid={hasErrors}
-                          value={termSize || 0}
-                          onChange={e => {
-                            const { value } = e.target;
-                            const termSizeVal = value !== '' ? parseFloat(value) : value;
-                            setAlertParams('termSize', termSizeVal);
-                          }}
-                          min={1}
-                        />
-                      </EuiFormRow>
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiFormRow
-                        isInvalid={hasErrors && termField !== undefined}
-                        error={errors.termField}
-                      >
-                        <EuiSelect
-                          value={termField || ''}
-                          isInvalid={hasErrors && termField !== undefined}
-                          onChange={e => {
-                            setAlertParams('termField', e.target.value);
-                          }}
-                          options={esFields.reduce(
-                            (options: any, field: any) => {
-                              if (
-                                groupByTypes[
-                                  groupBy || DEFAULT_VALUES.GROUP_BY
-                                ].validNormalizedTypes.includes(field.normalizedType)
-                              ) {
-                                options.push({
-                                  text: field.name,
-                                  value: field.name,
-                                });
-                              }
-                              return options;
-                            },
-                            [firstFieldOption]
-                          )}
-                        />
-                      </EuiFormRow>
-                    </EuiFlexItem>
-                  </Fragment>
-                ) : null}
-              </EuiFlexGroup>
-            </div>
-          </EuiPopover>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiPopover
-            id="alertThresholdPopover"
-            button={
-              <EuiExpression
-                data-test-subj="alertThresholdPopover"
-                description={
-                  comparators[thresholdComparator || DEFAULT_VALUES.THRESHOLD_COMPARATOR].text
-                }
-                value={(threshold || [])
-                  .slice(
-                    0,
-                    comparators[thresholdComparator || DEFAULT_VALUES.THRESHOLD_COMPARATOR]
-                      .requiredValues
-                  )
-                  .join(` ${andThresholdText} `)}
-                isActive={Boolean(
-                  alertThresholdPopoverOpen ||
-                    (errors.threshold0 && errors.threshold0.length) ||
-                    (errors.threshold1 && errors.threshold1.length)
-                )}
-                onClick={() => {
-                  setAlertThresholdPopoverOpen(true);
-                }}
-                color={
-                  (errors.threshold0 && errors.threshold0.length) ||
-                  (errors.threshold1 && errors.threshold1.length)
-                    ? 'danger'
-                    : 'secondary'
-                }
-              />
-            }
-            isOpen={alertThresholdPopoverOpen}
-            closePopover={() => {
-              setAlertThresholdPopoverOpen(false);
-            }}
-            ownFocus
-            withTitle
-            anchorPosition="downLeft"
-          >
-            <div>
-              <EuiPopoverTitle>
-                {comparators[thresholdComparator || DEFAULT_VALUES.THRESHOLD_COMPARATOR].text}
-              </EuiPopoverTitle>
-              <EuiFlexGroup>
-                <EuiFlexItem grow={false}>
-                  <EuiSelect
-                    value={thresholdComparator}
-                    onChange={e => {
-                      setAlertParams('thresholdComparator', e.target.value);
-                    }}
-                    options={Object.values(comparators).map(({ text, value }) => {
-                      return { text, value };
-                    })}
-                  />
-                </EuiFlexItem>
-                {Array.from(
-                  Array(
-                    comparators[thresholdComparator || DEFAULT_VALUES.THRESHOLD_COMPARATOR]
-                      .requiredValues
-                  )
-                ).map((_notUsed, i) => {
-                  return (
-                    <Fragment key={`threshold${i}`}>
-                      {i > 0 ? (
-                        <EuiFlexItem
-                          grow={false}
-                          className="alertThresholdWatchInBetweenComparatorText"
-                        >
-                          <EuiText>{andThresholdText}</EuiText>
-                          {hasErrors && <EuiSpacer />}
-                        </EuiFlexItem>
-                      ) : null}
-                      <EuiFlexItem grow={false}>
-                        <EuiFormRow isInvalid={hasErrors} error={errors[`threshold${i}`]}>
-                          <EuiFieldNumber
-                            data-test-subj="alertThresholdInput"
-                            isInvalid={hasErrors}
-                            value={!threshold || threshold[i] === null ? 0 : threshold[i]}
-                            min={0}
-                            step={0.1}
-                            onChange={e => {
-                              const { value } = e.target;
-                              const thresholdVal = value !== '' ? parseFloat(value) : value;
-                              const newThreshold = [...threshold];
-                              newThreshold[i] = thresholdVal;
-                              setAlertParams('threshold', newThreshold);
-                            }}
-                          />
-                        </EuiFormRow>
-                      </EuiFlexItem>
-                    </Fragment>
-                  );
-                })}
-              </EuiFlexGroup>
-            </div>
-          </EuiPopover>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiPopover
-            id="watchDurationPopover"
-            button={
-              <EuiExpression
-                description={i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.threshold.forTheLastLabel',
-                  {
-                    defaultMessage: 'for the last',
-                  }
-                )}
-                value={`${timeWindowSize} ${getTimeUnitLabel(
-                  timeWindowUnit,
-                  parseInt(timeWindowSize, 10).toString()
-                )}`}
-                isActive={alertDurationPopoverOpen || !timeWindowSize}
-                onClick={() => {
-                  setAlertDurationPopoverOpen(true);
-                }}
-                color={timeWindowSize ? 'secondary' : 'danger'}
-              />
-            }
-            isOpen={alertDurationPopoverOpen}
-            closePopover={() => {
-              setAlertDurationPopoverOpen(false);
-            }}
-            ownFocus
-            withTitle
-            anchorPosition="downLeft"
-          >
-            <div>
-              <EuiPopoverTitle>
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.alertAdd.threshold.forTheLastButtonLabel"
-                  defaultMessage="For the last"
-                />
-              </EuiPopoverTitle>
-              <EuiFlexGroup>
-                <EuiFlexItem grow={false}>
-                  <EuiFormRow isInvalid={hasErrors} error={errors.timeWindowSize}>
-                    <EuiFieldNumber
-                      isInvalid={hasErrors}
-                      min={1}
-                      value={timeWindowSize ? parseInt(timeWindowSize, 10) : 1}
-                      onChange={e => {
-                        const { value } = e.target;
-                        const timeWindowSizeVal = value !== '' ? parseInt(value, 10) : value;
-                        setAlertParams('timeWindowSize', timeWindowSizeVal);
-                      }}
-                    />
-                  </EuiFormRow>
-                </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiSelect
-                    value={timeWindowUnit}
-                    onChange={e => {
-                      setAlertParams('timeWindowUnit', e.target.value);
-                    }}
-                    options={getTimeOptions(timeWindowSize)}
-                  />
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            </div>
-          </EuiPopover>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      {hasExpressionErrors ? null : (
-        <Fragment>
-          <ThresholdVisualization alert={alert} />
-        </Fragment>
-      )}
-    </Fragment>
-  );
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/context/alerts_context.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/context/alerts_context.tsx
deleted file mode 100644
index 06be1bb7c5851..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/context/alerts_context.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useContext, createContext } from 'react';
-
-export interface AlertsContextValue {
-  alertFlyoutVisible: boolean;
-  setAlertFlyoutVisibility: React.Dispatch<React.SetStateAction<boolean>>;
-}
-
-const AlertsContext = createContext<AlertsContextValue>(null as any);
-
-export const AlertsContextProvider = ({
-  children,
-  value,
-}: {
-  value: AlertsContextValue;
-  children: React.ReactNode;
-}) => {
-  return <AlertsContext.Provider value={value}>{children}</AlertsContext.Provider>;
-};
-
-export const useAlertsContext = () => {
-  const ctx = useContext(AlertsContext);
-  if (!ctx) {
-    throw new Error('ActionsConnectorsContext has not been set.');
-  }
-  return ctx;
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.test.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.test.tsx
deleted file mode 100644
index f27f7d8c3054d..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.test.tsx
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import * as React from 'react';
-import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { coreMock } from '../../../../../../../../../src/core/public/mocks';
-import { ReactWrapper } from 'enzyme';
-import { act } from 'react-dom/test-utils';
-import { ActionsConnectorsContextProvider } from '../../context/actions_connectors_context';
-import { actionTypeRegistryMock } from '../../action_type_registry.mock';
-import { ValidationResult, ActionConnector } from '../../../types';
-import { ActionConnectorForm } from './action_connector_form';
-import { AppContextProvider } from '../../app_context';
-const actionTypeRegistry = actionTypeRegistryMock.create();
-
-describe('action_connector_form', () => {
-  let wrapper: ReactWrapper<any>;
-
-  beforeAll(async () => {
-    const mockes = coreMock.createSetup();
-    const [
-      {
-        chrome,
-        docLinks,
-        application: { capabilities },
-      },
-    ] = await mockes.getStartServices();
-    const deps = {
-      chrome,
-      docLinks,
-      toastNotifications: mockes.notifications.toasts,
-      injectedMetadata: mockes.injectedMetadata,
-      http: mockes.http,
-      uiSettings: mockes.uiSettings,
-      capabilities: {
-        ...capabilities,
-        actions: {
-          delete: true,
-          save: true,
-          show: true,
-        },
-      },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
-      actionTypeRegistry: actionTypeRegistry as any,
-      alertTypeRegistry: {} as any,
-    };
-
-    const actionType = {
-      id: 'my-action-type',
-      iconClass: 'test',
-      selectMessage: 'test',
-      validateConnector: (): ValidationResult => {
-        return { errors: {} };
-      },
-      validateParams: (): ValidationResult => {
-        const validationResult = { errors: {} };
-        return validationResult;
-      },
-      actionConnectorFields: null,
-      actionParamsFields: null,
-    };
-    actionTypeRegistry.get.mockReturnValue(actionType);
-    actionTypeRegistry.has.mockReturnValue(true);
-
-    const initialConnector = {
-      actionTypeId: actionType.id,
-      config: {},
-      secrets: {},
-    } as ActionConnector;
-
-    await act(async () => {
-      wrapper = mountWithIntl(
-        <AppContextProvider appDeps={deps}>
-          <ActionsConnectorsContextProvider
-            value={{
-              addFlyoutVisible: true,
-              setAddFlyoutVisibility: () => {},
-              editFlyoutVisible: false,
-              setEditFlyoutVisibility: () => {},
-              actionTypesIndex: {
-                'my-action-type': {
-                  id: 'my-action-type',
-                  name: 'my-action-type-name',
-                  enabled: true,
-                },
-              },
-              reloadConnectors: () => {
-                return new Promise<void>(() => {});
-              },
-            }}
-          >
-            <ActionConnectorForm
-              actionTypeName={'my-action-type-name'}
-              initialConnector={initialConnector}
-              setFlyoutVisibility={() => {}}
-            />
-          </ActionsConnectorsContextProvider>
-        </AppContextProvider>
-      );
-    });
-
-    await waitForRender(wrapper);
-  });
-
-  it('renders action_connector_form', () => {
-    const connectorNameField = wrapper.find('[data-test-subj="nameInput"]');
-    expect(connectorNameField.exists()).toBeTruthy();
-    expect(connectorNameField.first().prop('value')).toBe('');
-  });
-});
-
-async function waitForRender(wrapper: ReactWrapper<any, any>) {
-  await Promise.resolve();
-  await Promise.resolve();
-  wrapper.update();
-}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.tsx
deleted file mode 100644
index 852e713b38ed7..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_connector_form.tsx
+++ /dev/null
@@ -1,265 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React, { Fragment, useState, useReducer } from 'react';
-import {
-  EuiButton,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiForm,
-  EuiCallOut,
-  EuiLink,
-  EuiText,
-  EuiSpacer,
-  EuiButtonEmpty,
-  EuiFlyoutFooter,
-  EuiFieldText,
-  EuiFlyoutBody,
-  EuiFormRow,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { createActionConnector, updateActionConnector } from '../../lib/action_connector_api';
-import { useAppDependencies } from '../../app_context';
-import { connectorReducer } from './connector_reducer';
-import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
-import { ActionConnector, IErrorObject } from '../../../types';
-import { hasSaveActionsCapability } from '../../lib/capabilities';
-
-interface ActionConnectorProps {
-  initialConnector: ActionConnector;
-  actionTypeName: string;
-  setFlyoutVisibility: React.Dispatch<React.SetStateAction<boolean>>;
-}
-
-export const ActionConnectorForm = ({
-  initialConnector,
-  actionTypeName,
-  setFlyoutVisibility,
-}: ActionConnectorProps) => {
-  const { http, toastNotifications, capabilities, actionTypeRegistry } = useAppDependencies();
-
-  const { reloadConnectors } = useActionsConnectorsContext();
-  const canSave = hasSaveActionsCapability(capabilities);
-
-  // hooks
-  const [{ connector }, dispatch] = useReducer(connectorReducer, { connector: initialConnector });
-
-  const setActionProperty = (key: string, value: any) => {
-    dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
-  };
-
-  const setActionConfigProperty = (key: string, value: any) => {
-    dispatch({ command: { type: 'setConfigProperty' }, payload: { key, value } });
-  };
-
-  const setActionSecretsProperty = (key: string, value: any) => {
-    dispatch({ command: { type: 'setSecretsProperty' }, payload: { key, value } });
-  };
-
-  const [isSaving, setIsSaving] = useState<boolean>(false);
-  const [serverError, setServerError] = useState<{
-    body: { message: string; error: string };
-  } | null>(null);
-
-  const actionTypeRegistered = actionTypeRegistry.get(initialConnector.actionTypeId);
-  if (!actionTypeRegistered) return null;
-
-  function validateBaseProperties(actionObject: ActionConnector) {
-    const validationResult = { errors: {} };
-    const errors = {
-      name: new Array<string>(),
-    };
-    validationResult.errors = errors;
-    if (!actionObject.name) {
-      errors.name.push(
-        i18n.translate(
-          'xpack.triggersActionsUI.sections.actionConnectorForm.error.requiredNameText',
-          {
-            defaultMessage: 'Name is required.',
-          }
-        )
-      );
-    }
-    return validationResult;
-  }
-
-  const FieldsComponent = actionTypeRegistered.actionConnectorFields;
-  const errors = {
-    ...actionTypeRegistered.validateConnector(connector).errors,
-    ...validateBaseProperties(connector).errors,
-  } as IErrorObject;
-  const hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
-
-  async function onActionConnectorSave(): Promise<any> {
-    let message: string;
-    let savedConnector: ActionConnector | undefined;
-    let error;
-    if (connector.id === undefined) {
-      await createActionConnector({ http, connector })
-        .then(res => {
-          savedConnector = res;
-        })
-        .catch(errorRes => {
-          error = errorRes;
-        });
-
-      message = 'Created';
-    } else {
-      await updateActionConnector({ http, connector, id: connector.id })
-        .then(res => {
-          savedConnector = res;
-        })
-        .catch(errorRes => {
-          error = errorRes;
-        });
-      message = 'Updated';
-    }
-    if (error) {
-      return {
-        error,
-      };
-    }
-    toastNotifications.addSuccess(
-      i18n.translate(
-        'xpack.triggersActionsUI.sections.actionConnectorForm.updateSuccessNotificationText',
-        {
-          defaultMessage: "{message} '{connectorName}'",
-          values: {
-            message,
-            connectorName: savedConnector ? savedConnector.name : '',
-          },
-        }
-      )
-    );
-    return savedConnector;
-  }
-
-  return (
-    <Fragment>
-      <EuiFlyoutBody>
-        <EuiForm isInvalid={serverError !== null} error={serverError?.body.message}>
-          <EuiFormRow
-            id="actionName"
-            fullWidth
-            label={
-              <FormattedMessage
-                id="xpack.triggersActionsUI.sections.actionConnectorForm.actionNameLabel"
-                defaultMessage="Connector name"
-              />
-            }
-            isInvalid={errors.name.length > 0 && connector.name !== undefined}
-            error={errors.name}
-          >
-            <EuiFieldText
-              fullWidth
-              isInvalid={errors.name.length > 0 && connector.name !== undefined}
-              name="name"
-              placeholder="Untitled"
-              data-test-subj="nameInput"
-              value={connector.name || ''}
-              onChange={e => {
-                setActionProperty('name', e.target.value);
-              }}
-              onBlur={() => {
-                if (!connector.name) {
-                  setActionProperty('name', '');
-                }
-              }}
-            />
-          </EuiFormRow>
-          <EuiSpacer size="m" />
-          {FieldsComponent !== null ? (
-            <FieldsComponent
-              action={connector}
-              errors={errors}
-              editActionConfig={setActionConfigProperty}
-              editActionSecrets={setActionSecretsProperty}
-              hasErrors={hasErrors}
-            >
-              {initialConnector.actionTypeId === null ? (
-                <Fragment>
-                  <EuiCallOut
-                    title={i18n.translate(
-                      'xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionTypeConfigurationWarningTitleText',
-                      {
-                        defaultMessage: 'Action type may not be configured',
-                      }
-                    )}
-                    color="warning"
-                    iconType="help"
-                  >
-                    <EuiText>
-                      <p>
-                        <FormattedMessage
-                          id="xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionConfigurationWarningDescriptionText"
-                          defaultMessage="To create this connector, you must configure at least one {actionType} account. {docLink}"
-                          values={{
-                            actionType: actionTypeName,
-                            docLink: (
-                              <EuiLink target="_blank">
-                                <FormattedMessage
-                                  id="xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionConfigurationWarningHelpLinkText"
-                                  defaultMessage="Learn more."
-                                />
-                              </EuiLink>
-                            ),
-                          }}
-                        />
-                      </p>
-                    </EuiText>
-                  </EuiCallOut>
-                  <EuiSpacer />
-                </Fragment>
-              ) : null}
-            </FieldsComponent>
-          ) : null}
-        </EuiForm>
-      </EuiFlyoutBody>
-      <EuiFlyoutFooter>
-        <EuiFlexGroup justifyContent="spaceBetween">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty onClick={() => setFlyoutVisibility(false)}>
-              {i18n.translate(
-                'xpack.triggersActionsUI.sections.actionConnectorForm.cancelButtonLabel',
-                {
-                  defaultMessage: 'Cancel',
-                }
-              )}
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-          {canSave ? (
-            <EuiFlexItem grow={false}>
-              <EuiButton
-                fill
-                color="secondary"
-                data-test-subj="saveActionButton"
-                type="submit"
-                iconType="check"
-                isDisabled={hasErrors}
-                isLoading={isSaving}
-                onClick={async () => {
-                  setIsSaving(true);
-                  const savedAction = await onActionConnectorSave();
-                  setIsSaving(false);
-                  if (savedAction && savedAction.error) {
-                    return setServerError(savedAction.error);
-                  }
-                  setFlyoutVisibility(false);
-                  reloadConnectors();
-                }}
-              >
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.actionConnectorForm.saveButtonLabel"
-                  defaultMessage="Save"
-                />
-              </EuiButton>
-            </EuiFlexItem>
-          ) : null}
-        </EuiFlexGroup>
-      </EuiFlyoutFooter>
-    </Fragment>
-  );
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.tsx
deleted file mode 100644
index a3ec7ab4b3ab9..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React, { useCallback, useState, Fragment } from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiTitle,
-  EuiFlyoutHeader,
-  EuiFlyout,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiIcon,
-  EuiText,
-} from '@elastic/eui';
-import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
-import { ActionTypeMenu } from './action_type_menu';
-import { ActionConnectorForm } from './action_connector_form';
-import { ActionType, ActionConnector } from '../../../types';
-import { useAppDependencies } from '../../app_context';
-
-export const ConnectorAddFlyout = () => {
-  const { actionTypeRegistry } = useAppDependencies();
-  const { addFlyoutVisible, setAddFlyoutVisibility } = useActionsConnectorsContext();
-  const [actionType, setActionType] = useState<ActionType | undefined>(undefined);
-  const closeFlyout = useCallback(() => {
-    setAddFlyoutVisibility(false);
-    setActionType(undefined);
-  }, [setAddFlyoutVisibility, setActionType]);
-
-  if (!addFlyoutVisible) {
-    return null;
-  }
-
-  function onActionTypeChange(newActionType: ActionType) {
-    setActionType(newActionType);
-  }
-
-  let currentForm;
-  let actionTypeModel;
-  if (!actionType) {
-    currentForm = <ActionTypeMenu onActionTypeChange={onActionTypeChange} />;
-  } else {
-    actionTypeModel = actionTypeRegistry.get(actionType.id);
-    const initialConnector = {
-      actionTypeId: actionType.id,
-      config: {},
-      secrets: {},
-    } as ActionConnector;
-
-    currentForm = (
-      <ActionConnectorForm
-        actionTypeName={actionType.name}
-        initialConnector={initialConnector}
-        setFlyoutVisibility={closeFlyout}
-      />
-    );
-  }
-
-  return (
-    <EuiFlyout onClose={closeFlyout} aria-labelledby="flyoutActionAddTitle" size="m">
-      <EuiFlyoutHeader hasBorder>
-        <EuiFlexGroup gutterSize="m" alignItems="center">
-          {actionTypeModel && actionTypeModel.iconClass ? (
-            <EuiFlexItem grow={false}>
-              <EuiIcon type={actionTypeModel.iconClass} size="xl" />
-            </EuiFlexItem>
-          ) : null}
-          <EuiFlexItem>
-            {actionTypeModel && actionType ? (
-              <Fragment>
-                <EuiTitle size="s">
-                  <h3 id="flyoutTitle">
-                    <FormattedMessage
-                      defaultMessage="{actionTypeName} connector"
-                      id="xpack.triggersActionsUI.sections.addConnectorForm.flyoutTitle"
-                      values={{
-                        actionTypeName: actionType.name,
-                      }}
-                    />
-                  </h3>
-                </EuiTitle>
-                <EuiText size="s" color="subdued">
-                  {actionTypeModel.selectMessage}
-                </EuiText>
-              </Fragment>
-            ) : (
-              <EuiTitle size="s">
-                <h3 id="selectConnectorFlyoutTitle">
-                  <FormattedMessage
-                    defaultMessage="Select a connector"
-                    id="xpack.triggersActionsUI.sections.addConnectorForm.selectConnectorFlyoutTitle"
-                  />
-                </h3>
-              </EuiTitle>
-            )}
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiFlyoutHeader>
-      {currentForm}
-    </EuiFlyout>
-  );
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.tsx
deleted file mode 100644
index 408989609d2ec..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React, { useCallback } from 'react';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiTitle,
-  EuiFlyoutHeader,
-  EuiFlyout,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiIcon,
-} from '@elastic/eui';
-import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
-import { ActionConnectorForm } from './action_connector_form';
-import { useAppDependencies } from '../../app_context';
-import { ActionConnectorTableItem } from '../../../types';
-
-export interface ConnectorEditProps {
-  connector: ActionConnectorTableItem;
-}
-
-export const ConnectorEditFlyout = ({ connector }: ConnectorEditProps) => {
-  const { actionTypeRegistry } = useAppDependencies();
-  const { editFlyoutVisible, setEditFlyoutVisibility } = useActionsConnectorsContext();
-  const closeFlyout = useCallback(() => setEditFlyoutVisibility(false), [setEditFlyoutVisibility]);
-
-  if (!editFlyoutVisible) {
-    return null;
-  }
-
-  const actionTypeModel = actionTypeRegistry.get(connector.actionTypeId);
-
-  return (
-    <EuiFlyout onClose={closeFlyout} aria-labelledby="flyoutActionAddTitle" size="m">
-      <EuiFlyoutHeader hasBorder>
-        <EuiFlexGroup gutterSize="s" alignItems="center">
-          {actionTypeModel ? (
-            <EuiFlexItem grow={false}>
-              <EuiIcon type={actionTypeModel.iconClass} size="m" />
-            </EuiFlexItem>
-          ) : null}
-          <EuiFlexItem>
-            <EuiTitle size="s">
-              <h3 id="flyoutTitle">
-                <FormattedMessage
-                  defaultMessage="Edit connector"
-                  id="xpack.triggersActionsUI.sections.editConnectorForm.flyoutTitle"
-                />
-              </h3>
-            </EuiTitle>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiFlyoutHeader>
-      <ActionConnectorForm
-        key={connector.id}
-        initialConnector={{
-          ...connector,
-          secrets: {},
-        }}
-        actionTypeName={connector.actionType}
-        setFlyoutVisibility={setEditFlyoutVisibility}
-      />
-    </EuiFlyout>
-  );
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_add.tsx b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_add.tsx
deleted file mode 100644
index f11b0b948b2a7..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_add.tsx
+++ /dev/null
@@ -1,811 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React, { Fragment, useState, useCallback, useReducer, useEffect } from 'react';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import {
-  EuiButton,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiIcon,
-  EuiTitle,
-  EuiForm,
-  EuiSpacer,
-  EuiButtonEmpty,
-  EuiFlyoutFooter,
-  EuiFlyoutBody,
-  EuiFlyoutHeader,
-  EuiFlyout,
-  EuiFieldText,
-  EuiFlexGrid,
-  EuiFormRow,
-  EuiComboBox,
-  EuiKeyPadMenuItem,
-  EuiTabs,
-  EuiTab,
-  EuiLink,
-  EuiFieldNumber,
-  EuiSelect,
-  EuiIconTip,
-  EuiPortal,
-  EuiAccordion,
-  EuiButtonIcon,
-} from '@elastic/eui';
-import { useAppDependencies } from '../../app_context';
-import { createAlert } from '../../lib/alert_api';
-import { loadActionTypes, loadAllActions } from '../../lib/action_connector_api';
-import { useAlertsContext } from '../../context/alerts_context';
-import { alertReducer } from './alert_reducer';
-import {
-  AlertTypeModel,
-  Alert,
-  IErrorObject,
-  ActionTypeModel,
-  AlertAction,
-  ActionTypeIndex,
-  ActionConnector,
-} from '../../../types';
-import { ACTION_GROUPS } from '../../constants/action_groups';
-import { getTimeOptions } from '../../lib/get_time_options';
-import { SectionLoading } from '../../components/section_loading';
-
-interface Props {
-  refreshList: () => Promise<void>;
-}
-
-function validateBaseProperties(alertObject: Alert) {
-  const validationResult = { errors: {} };
-  const errors = {
-    name: new Array<string>(),
-    interval: new Array<string>(),
-    alertTypeId: new Array<string>(),
-    actionConnectors: new Array<string>(),
-  };
-  validationResult.errors = errors;
-  if (!alertObject.name) {
-    errors.name.push(
-      i18n.translate('xpack.triggersActionsUI.sections.alertAdd.error.requiredNameText', {
-        defaultMessage: 'Name is required.',
-      })
-    );
-  }
-  if (!(alertObject.schedule && alertObject.schedule.interval)) {
-    errors.interval.push(
-      i18n.translate('xpack.triggersActionsUI.sections.alertAdd.error.requiredIntervalText', {
-        defaultMessage: 'Check interval is required.',
-      })
-    );
-  }
-  if (!alertObject.alertTypeId) {
-    errors.alertTypeId.push(
-      i18n.translate('xpack.triggersActionsUI.sections.alertAdd.error.requiredAlertTypeIdText', {
-        defaultMessage: 'Alert trigger is required.',
-      })
-    );
-  }
-  return validationResult;
-}
-
-export const AlertAdd = ({ refreshList }: Props) => {
-  const { http, toastNotifications, alertTypeRegistry, actionTypeRegistry } = useAppDependencies();
-  const initialAlert = {
-    params: {},
-    alertTypeId: null,
-    schedule: {
-      interval: '1m',
-    },
-    actions: [],
-    tags: [],
-  };
-
-  const { alertFlyoutVisible, setAlertFlyoutVisibility } = useAlertsContext();
-  // hooks
-  const [alertType, setAlertType] = useState<AlertTypeModel | undefined>(undefined);
-  const [{ alert }, dispatch] = useReducer(alertReducer, { alert: initialAlert });
-  const [isSaving, setIsSaving] = useState<boolean>(false);
-  const [isLoadingActionTypes, setIsLoadingActionTypes] = useState<boolean>(false);
-  const [selectedTabId, setSelectedTabId] = useState<string>('alert');
-  const [actionTypesIndex, setActionTypesIndex] = useState<ActionTypeIndex | undefined>(undefined);
-  const [alertInterval, setAlertInterval] = useState<number | null>(null);
-  const [alertIntervalUnit, setAlertIntervalUnit] = useState<string>('m');
-  const [alertThrottle, setAlertThrottle] = useState<number | null>(null);
-  const [alertThrottleUnit, setAlertThrottleUnit] = useState<string>('');
-  const [serverError, setServerError] = useState<{
-    body: { message: string; error: string };
-  } | null>(null);
-  const [isAddActionPanelOpen, setIsAddActionPanelOpen] = useState<boolean>(true);
-  const [connectors, setConnectors] = useState<ActionConnector[]>([]);
-
-  useEffect(() => {
-    (async () => {
-      try {
-        setIsLoadingActionTypes(true);
-        const actionTypes = await loadActionTypes({ http });
-        const index: ActionTypeIndex = {};
-        for (const actionTypeItem of actionTypes) {
-          index[actionTypeItem.id] = actionTypeItem;
-        }
-        setActionTypesIndex(index);
-      } catch (e) {
-        toastNotifications.addDanger({
-          title: i18n.translate(
-            'xpack.triggersActionsUI.sections.alertAdd.unableToLoadActionTypesMessage',
-            { defaultMessage: 'Unable to load action types' }
-          ),
-        });
-      } finally {
-        setIsLoadingActionTypes(false);
-      }
-    })();
-  }, [toastNotifications, http]);
-
-  useEffect(() => {
-    dispatch({
-      command: { type: 'setAlert' },
-      payload: {
-        key: 'alert',
-        value: {
-          params: {},
-          alertTypeId: null,
-          schedule: {
-            interval: '1m',
-          },
-          actions: [],
-          tags: [],
-        },
-      },
-    });
-  }, [alertFlyoutVisible]);
-
-  useEffect(() => {
-    loadConnectors();
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [alertFlyoutVisible]);
-
-  const setAlertProperty = (key: string, value: any) => {
-    dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
-  };
-
-  const setAlertParams = (key: string, value: any) => {
-    dispatch({ command: { type: 'setAlertParams' }, payload: { key, value } });
-  };
-
-  const setActionParamsProperty = (key: string, value: any, index: number) => {
-    dispatch({ command: { type: 'setAlertActionParams' }, payload: { key, value, index } });
-  };
-
-  const setActionProperty = (key: string, value: any, index: number) => {
-    dispatch({ command: { type: 'setAlertActionProperty' }, payload: { key, value, index } });
-  };
-
-  const closeFlyout = useCallback(() => {
-    setAlertFlyoutVisibility(false);
-    setAlertType(undefined);
-    setIsAddActionPanelOpen(true);
-    setSelectedTabId('alert');
-    setServerError(null);
-  }, [setAlertFlyoutVisibility]);
-
-  if (!alertFlyoutVisible) {
-    return null;
-  }
-
-  const tagsOptions = alert.tags ? alert.tags.map((label: string) => ({ label })) : [];
-
-  async function loadConnectors() {
-    try {
-      const actionsResponse = await loadAllActions({ http });
-      setConnectors(actionsResponse.data);
-    } catch (e) {
-      toastNotifications.addDanger({
-        title: i18n.translate(
-          'xpack.triggersActionsUI.sections.alertAdd.unableToLoadActionsMessage',
-          {
-            defaultMessage: 'Unable to load connectors',
-          }
-        ),
-      });
-    }
-  }
-
-  const AlertParamsExpressionComponent = alertType ? alertType.alertParamsExpression : null;
-
-  const errors = {
-    ...(alertType ? alertType.validate(alert).errors : []),
-    ...validateBaseProperties(alert).errors,
-  } as IErrorObject;
-  const hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
-
-  const actionErrors = alert.actions.reduce((acc: any, alertAction: AlertAction) => {
-    const actionTypeConnectors = connectors.find(field => field.id === alertAction.id);
-    if (!actionTypeConnectors) {
-      return [];
-    }
-    const actionType = actionTypeRegistry.get(actionTypeConnectors.actionTypeId);
-    if (!actionType) {
-      return [];
-    }
-    const actionValidationErrors = actionType.validateParams(alertAction.params);
-    acc[alertAction.id] = actionValidationErrors;
-    return acc;
-  }, {});
-
-  const hasActionErrors = !!Object.keys(actionErrors).find(actionError => {
-    return !!Object.keys(actionErrors[actionError]).find((actionErrorKey: string) => {
-      return actionErrors[actionError][actionErrorKey].length >= 1;
-    });
-  });
-
-  const tabs = [
-    {
-      id: ACTION_GROUPS.ALERT,
-      name: i18n.translate('xpack.triggersActionsUI.sections.alertAdd.alertTabText', {
-        defaultMessage: 'Alert',
-      }),
-    },
-    {
-      id: ACTION_GROUPS.WARNING,
-      name: i18n.translate('xpack.triggersActionsUI.sections.alertAdd.warningTabText', {
-        defaultMessage: 'Warning',
-      }),
-    },
-    {
-      id: ACTION_GROUPS.UNACKNOWLEDGED,
-      name: i18n.translate('xpack.triggersActionsUI.sections.alertAdd.unacknowledgedTabText', {
-        defaultMessage: 'If unacknowledged',
-      }),
-      disabled: false,
-    },
-  ];
-
-  async function onSaveAlert(): Promise<any> {
-    try {
-      const newAlert = await createAlert({ http, alert });
-      toastNotifications.addSuccess(
-        i18n.translate('xpack.triggersActionsUI.sections.alertAdd.saveSuccessNotificationText', {
-          defaultMessage: "Saved '{alertName}'",
-          values: {
-            alertName: newAlert.id,
-          },
-        })
-      );
-      return newAlert;
-    } catch (error) {
-      return {
-        error,
-      };
-    }
-  }
-
-  function addActionType(actionTypeModel: ActionTypeModel) {
-    setIsAddActionPanelOpen(false);
-    const actionTypeConnectors = connectors.filter(
-      field => field.actionTypeId === actionTypeModel.id
-    );
-    if (actionTypeConnectors.length > 0) {
-      alert.actions.push({ id: actionTypeConnectors[0].id, group: selectedTabId, params: {} });
-    }
-  }
-
-  const alertTypeNodes = alertTypeRegistry.list().map(function(item, index) {
-    return (
-      <EuiKeyPadMenuItem
-        key={index}
-        label={item.name}
-        onClick={() => {
-          setAlertProperty('alertTypeId', item.id);
-          setAlertType(item);
-        }}
-      >
-        <EuiIcon size="xl" type={item.iconClass} />
-      </EuiKeyPadMenuItem>
-    );
-  });
-
-  const actionTypeNodes = actionTypeRegistry.list().map(function(item, index) {
-    return (
-      <EuiKeyPadMenuItem
-        key={index}
-        label={actionTypesIndex ? actionTypesIndex[item.id].name : item.id}
-        onClick={() => addActionType(item)}
-      >
-        <EuiIcon size="xl" type={item.iconClass} />
-      </EuiKeyPadMenuItem>
-    );
-  });
-
-  const alertTabs = tabs.map(function(tab, index): any {
-    return (
-      <EuiTab
-        onClick={() => {
-          setSelectedTabId(tab.id);
-          if (!alert.actions.find((action: AlertAction) => action.group === tab.id)) {
-            setIsAddActionPanelOpen(true);
-          } else {
-            setIsAddActionPanelOpen(false);
-          }
-        }}
-        isSelected={tab.id === selectedTabId}
-        disabled={tab.disabled}
-        key={index}
-      >
-        {tab.name}
-      </EuiTab>
-    );
-  });
-
-  const alertTypeDetails = (
-    <Fragment>
-      <EuiFlexGroup alignItems="center" gutterSize="s">
-        <EuiFlexItem>
-          <EuiTitle size="s">
-            <h5 id="selectedAlertTypeTitle">
-              <FormattedMessage
-                defaultMessage="Trigger: {alertType}"
-                id="xpack.triggersActionsUI.sections.alertAdd.selectedAlertTypeTitle"
-                values={{ alertType: alertType ? alertType.name : '' }}
-              />
-            </h5>
-          </EuiTitle>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiLink
-            onClick={() => {
-              setAlertProperty('alertTypeId', null);
-              setAlertType(undefined);
-            }}
-          >
-            <FormattedMessage
-              defaultMessage="Change"
-              id="xpack.triggersActionsUI.sections.alertAdd.changeAlertTypeLink"
-            />
-          </EuiLink>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      {AlertParamsExpressionComponent ? (
-        <AlertParamsExpressionComponent
-          alert={alert}
-          errors={errors}
-          setAlertParams={setAlertParams}
-          setAlertProperty={setAlertProperty}
-          hasErrors={hasErrors}
-        />
-      ) : null}
-    </Fragment>
-  );
-
-  const getSelectedOptions = (actionItemId: string) => {
-    const val = connectors.find(connector => connector.id === actionItemId);
-    if (!val) {
-      return [];
-    }
-    return [
-      {
-        label: val.name,
-        value: val.name,
-        id: actionItemId,
-      },
-    ];
-  };
-
-  const actionsListForGroup = (
-    <Fragment>
-      {alert.actions.map((actionItem: AlertAction, index: number) => {
-        const actionConnector = connectors.find(field => field.id === actionItem.id);
-        if (!actionConnector) {
-          return null;
-        }
-        const optionsList = connectors
-          .filter(field => field.actionTypeId === actionConnector.actionTypeId)
-          .map(({ name, id }) => ({
-            label: name,
-            key: id,
-            id,
-          }));
-        const actionTypeRegisterd = actionTypeRegistry.get(actionConnector.actionTypeId);
-        if (actionTypeRegisterd === null || actionItem.group !== selectedTabId) return null;
-        const ParamsFieldsComponent = actionTypeRegisterd.actionParamsFields;
-        const actionParamsErrors =
-          Object.keys(actionErrors).length > 0 ? actionErrors[actionItem.id] : [];
-        const hasActionParamsErrors = !!Object.keys(actionParamsErrors).find(
-          errorKey => actionParamsErrors[errorKey].length >= 1
-        );
-        return (
-          <EuiAccordion
-            initialIsOpen={true}
-            key={index}
-            id={index.toString()}
-            className="euiAccordionForm"
-            buttonContentClassName="euiAccordionForm__button"
-            data-test-subj="alertActionAccordion"
-            buttonContent={
-              <EuiFlexGroup gutterSize="s" alignItems="center">
-                <EuiFlexItem grow={false}>
-                  <EuiIcon type={actionTypeRegisterd.iconClass} size="m" />
-                </EuiFlexItem>
-                <EuiFlexItem>
-                  <EuiTitle size="s">
-                    <h5>
-                      <FormattedMessage
-                        defaultMessage="Action: {actionConnectorName}"
-                        id="xpack.triggersActionsUI.sections.alertAdd.selectAlertActionTypeEditTitle"
-                        values={{ actionConnectorName: actionConnector.name }}
-                      />
-                    </h5>
-                  </EuiTitle>
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            }
-            extraAction={
-              <EuiButtonIcon
-                iconType="cross"
-                color="danger"
-                className="euiAccordionForm__extraAction"
-                aria-label={i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertAdd.accordion.deleteIconAriaLabel',
-                  {
-                    defaultMessage: 'Delete',
-                  }
-                )}
-                onClick={() => {
-                  const updatedActions = alert.actions.filter(
-                    (item: AlertAction) => item.id !== actionItem.id
-                  );
-                  setAlertProperty('actions', updatedActions);
-                }}
-              />
-            }
-            paddingSize="l"
-          >
-            <EuiFormRow
-              label={
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.alertAdd.actionIdLabel"
-                  defaultMessage="{connectorInstance} instance"
-                  values={{
-                    connectorInstance: actionTypesIndex
-                      ? actionTypesIndex[actionConnector.actionTypeId].name
-                      : actionConnector.actionTypeId,
-                  }}
-                />
-              }
-              //  errorKey="name"
-              //  isShowingErrors={hasErrors}
-              //   errors={errors}
-            >
-              <EuiComboBox
-                fullWidth
-                singleSelection={{ asPlainText: true }}
-                options={optionsList}
-                selectedOptions={getSelectedOptions(actionItem.id)}
-                onChange={selectedOptions => {
-                  setActionProperty('id', selectedOptions[0].id, index);
-                }}
-                isClearable={false}
-              />
-            </EuiFormRow>
-            <EuiSpacer size="s" />
-            {ParamsFieldsComponent ? (
-              <ParamsFieldsComponent
-                action={actionItem.params}
-                index={index}
-                errors={actionParamsErrors.errors}
-                editAction={setActionParamsProperty}
-                hasErrors={hasActionParamsErrors}
-              />
-            ) : null}
-          </EuiAccordion>
-        );
-      })}
-      <EuiSpacer size="m" />
-      {!isAddActionPanelOpen ? (
-        <EuiButton
-          iconType="plusInCircle"
-          data-test-subj="addAlertActionButton"
-          onClick={() => setIsAddActionPanelOpen(true)}
-        >
-          <FormattedMessage
-            id="xpack.triggersActionsUI.sections.alertAdd.addActionButtonLabel"
-            defaultMessage="Add action"
-          />
-        </EuiButton>
-      ) : null}
-    </Fragment>
-  );
-
-  let alertTypeArea;
-  if (alertType) {
-    alertTypeArea = <Fragment>{alertTypeDetails}</Fragment>;
-  } else {
-    alertTypeArea = (
-      <Fragment>
-        <EuiTitle size="s">
-          <h5 id="alertTypeTitle">
-            <FormattedMessage
-              defaultMessage="Select a trigger"
-              id="xpack.triggersActionsUI.sections.alertAdd.selectAlertTypeTitle"
-            />
-          </h5>
-        </EuiTitle>
-        <EuiSpacer />
-        <EuiFlexGroup gutterSize="s" wrap>
-          {alertTypeNodes}
-        </EuiFlexGroup>
-      </Fragment>
-    );
-  }
-
-  const labelForAlertChecked = (
-    <>
-      <FormattedMessage
-        id="xpack.triggersActionsUI.sections.alertAdd.checkFieldLabel"
-        defaultMessage="Check every"
-      />{' '}
-      <EuiIconTip
-        position="right"
-        type="questionInCircle"
-        content={i18n.translate('xpack.triggersActionsUI.sections.alertAdd.checkWithTooltip', {
-          defaultMessage: 'This is some help text here for check alert.',
-        })}
-      />
-    </>
-  );
-
-  const labelForAlertRenotify = (
-    <>
-      <FormattedMessage
-        id="xpack.triggersActionsUI.sections.alertAdd.renotifyFieldLabel"
-        defaultMessage="Re-notify every"
-      />{' '}
-      <EuiIconTip
-        position="right"
-        type="questionInCircle"
-        content={i18n.translate('xpack.triggersActionsUI.sections.alertAdd.renotifyWithTooltip', {
-          defaultMessage: 'This is some help text here for re-notify alert.',
-        })}
-      />
-    </>
-  );
-
-  return (
-    <EuiPortal>
-      <EuiFlyout
-        ownFocus
-        onClose={closeFlyout}
-        aria-labelledby="flyoutAlertAddTitle"
-        size="m"
-        maxWidth={620}
-      >
-        <EuiFlyoutHeader hasBorder>
-          <EuiTitle size="s">
-            <h3 id="flyoutTitle">
-              <FormattedMessage
-                defaultMessage="Create Alert"
-                id="xpack.triggersActionsUI.sections.alertAdd.flyoutTitle"
-              />
-            </h3>
-          </EuiTitle>
-        </EuiFlyoutHeader>
-        <EuiFlyoutBody>
-          <EuiForm isInvalid={serverError !== null} error={serverError?.body.message}>
-            <EuiFlexGrid columns={2}>
-              <EuiFlexItem>
-                <EuiFormRow
-                  fullWidth
-                  id="alertName"
-                  label={
-                    <FormattedMessage
-                      id="xpack.triggersActionsUI.sections.alertAdd.alertNameLabel"
-                      defaultMessage="Name"
-                    />
-                  }
-                  isInvalid={hasErrors && alert.name !== undefined}
-                  error={errors.name}
-                >
-                  <EuiFieldText
-                    fullWidth
-                    isInvalid={hasErrors && alert.name !== undefined}
-                    compressed
-                    name="name"
-                    data-test-subj="alertNameInput"
-                    value={alert.name || ''}
-                    onChange={e => {
-                      setAlertProperty('name', e.target.value);
-                    }}
-                    onBlur={() => {
-                      if (!alert.name) {
-                        setAlertProperty('name', '');
-                      }
-                    }}
-                  />
-                </EuiFormRow>
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <EuiFormRow
-                  fullWidth
-                  label={i18n.translate(
-                    'xpack.triggersActionsUI.sections.actionAdd.indexAction.indexTextFieldLabel',
-                    {
-                      defaultMessage: 'Tags (optional)',
-                    }
-                  )}
-                >
-                  <EuiComboBox
-                    noSuggestions
-                    fullWidth
-                    compressed
-                    data-test-subj="tagsComboBox"
-                    selectedOptions={tagsOptions}
-                    onCreateOption={(searchValue: string) => {
-                      const newOptions = [...tagsOptions, { label: searchValue }];
-                      setAlertProperty(
-                        'tags',
-                        newOptions.map(newOption => newOption.label)
-                      );
-                    }}
-                    onChange={(selectedOptions: Array<{ label: string }>) => {
-                      setAlertProperty(
-                        'tags',
-                        selectedOptions.map(selectedOption => selectedOption.label)
-                      );
-                    }}
-                    onBlur={() => {
-                      if (!alert.tags) {
-                        setAlertProperty('tags', []);
-                      }
-                    }}
-                  />
-                </EuiFormRow>
-              </EuiFlexItem>
-            </EuiFlexGrid>
-            <EuiSpacer size="m" />
-            <EuiFlexGrid columns={2}>
-              <EuiFlexItem>
-                <EuiFormRow fullWidth compressed label={labelForAlertChecked}>
-                  <EuiFlexGroup gutterSize="s">
-                    <EuiFlexItem>
-                      <EuiFieldNumber
-                        fullWidth
-                        min={1}
-                        compressed
-                        value={alertInterval || 1}
-                        name="interval"
-                        data-test-subj="intervalInput"
-                        onChange={e => {
-                          const interval =
-                            e.target.value !== '' ? parseInt(e.target.value, 10) : null;
-                          setAlertInterval(interval);
-                          setAlertProperty('schedule', {
-                            interval: `${e.target.value}${alertIntervalUnit}`,
-                          });
-                        }}
-                      />
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiSelect
-                        fullWidth
-                        compressed
-                        value={alertIntervalUnit}
-                        options={getTimeOptions((alertInterval ? alertInterval : 1).toString())}
-                        onChange={(e: any) => {
-                          setAlertIntervalUnit(e.target.value);
-                          setAlertProperty('schedule', {
-                            interval: `${alertInterval}${e.target.value}`,
-                          });
-                        }}
-                      />
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                </EuiFormRow>
-              </EuiFlexItem>
-              <EuiFlexItem>
-                <EuiFormRow fullWidth label={labelForAlertRenotify}>
-                  <EuiFlexGroup gutterSize="s">
-                    <EuiFlexItem>
-                      <EuiFieldNumber
-                        fullWidth
-                        min={1}
-                        compressed
-                        value={alertThrottle || ''}
-                        name="throttle"
-                        data-test-subj="throttleInput"
-                        onChange={e => {
-                          const throttle =
-                            e.target.value !== '' ? parseInt(e.target.value, 10) : null;
-                          setAlertThrottle(throttle);
-                          setAlertProperty('throttle', `${e.target.value}${alertThrottleUnit}`);
-                        }}
-                      />
-                    </EuiFlexItem>
-                    <EuiFlexItem grow={false}>
-                      <EuiSelect
-                        compressed
-                        value={alert.renotifyIntervalUnit}
-                        options={getTimeOptions(alert.renotifyIntervalSize)}
-                        onChange={(e: any) => {
-                          setAlertThrottleUnit(e.target.value);
-                          setAlertProperty('throttle', `${alertThrottle}${e.target.value}`);
-                        }}
-                      />
-                    </EuiFlexItem>
-                  </EuiFlexGroup>
-                </EuiFormRow>
-              </EuiFlexItem>
-            </EuiFlexGrid>
-            <EuiSpacer size="m" />
-            <EuiTabs>{alertTabs}</EuiTabs>
-            <EuiSpacer size="m" />
-            {alertTypeArea}
-            <EuiSpacer size="xl" />
-            {actionsListForGroup}
-            {isAddActionPanelOpen ? (
-              <Fragment>
-                <EuiTitle size="s">
-                  <h5 id="alertActionTypeTitle">
-                    <FormattedMessage
-                      defaultMessage="Select an action"
-                      id="xpack.triggersActionsUI.sections.alertAdd.selectAlertActionTypeTitle"
-                    />
-                  </h5>
-                </EuiTitle>
-                <EuiSpacer />
-                <EuiFlexGroup gutterSize="s" wrap>
-                  {isLoadingActionTypes ? (
-                    <SectionLoading>
-                      <FormattedMessage
-                        id="xpack.triggersActionsUI.sections.alertAdd.loadingActionTypesDescription"
-                        defaultMessage="Loading action types…"
-                      />
-                    </SectionLoading>
-                  ) : (
-                    actionTypeNodes
-                  )}
-                </EuiFlexGroup>
-              </Fragment>
-            ) : null}
-          </EuiForm>
-        </EuiFlyoutBody>
-        <EuiFlyoutFooter>
-          <EuiFlexGroup justifyContent="spaceBetween">
-            <EuiFlexItem grow={false}>
-              <EuiButtonEmpty onClick={closeFlyout}>
-                {i18n.translate('xpack.triggersActionsUI.sections.alertAdd.cancelButtonLabel', {
-                  defaultMessage: 'Cancel',
-                })}
-              </EuiButtonEmpty>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiButton
-                fill
-                color="secondary"
-                data-test-subj="saveActionButton"
-                type="submit"
-                iconType="check"
-                isDisabled={hasErrors || hasActionErrors}
-                isLoading={isSaving}
-                onClick={async () => {
-                  setIsSaving(true);
-                  const savedAlert = await onSaveAlert();
-                  setIsSaving(false);
-                  if (savedAlert && savedAlert.error) {
-                    return setServerError(savedAlert.error);
-                  }
-                  closeFlyout();
-                  refreshList();
-                }}
-              >
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.alertAdd.saveButtonLabel"
-                  defaultMessage="Save"
-                />
-              </EuiButton>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlyoutFooter>
-      </EuiFlyout>
-    </EuiPortal>
-  );
-};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/plugin.ts b/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/plugin.ts
deleted file mode 100644
index 00dd2f51feaee..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/plugin.ts
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  CoreSetup,
-  CoreStart,
-  Plugin as CorePlugin,
-  PluginInitializerContext,
-} from 'src/core/public';
-
-import { i18n } from '@kbn/i18n';
-import { registerBuiltInActionTypes } from './application/components/builtin_action_types';
-import { registerBuiltInAlertTypes } from './application/components/builtin_alert_types';
-import { hasShowActionsCapability, hasShowAlertsCapability } from './application/lib/capabilities';
-import { PLUGIN } from './application/constants/plugin';
-import { LegacyDependencies, ActionTypeModel, AlertTypeModel } from './types';
-import { TypeRegistry } from './application/type_registry';
-
-export type Setup = void;
-export type Start = void;
-
-interface LegacyPlugins {
-  __LEGACY: LegacyDependencies;
-}
-
-export class Plugin implements CorePlugin<Setup, Start> {
-  private actionTypeRegistry: TypeRegistry<ActionTypeModel>;
-  private alertTypeRegistry: TypeRegistry<AlertTypeModel>;
-
-  constructor(initializerContext: PluginInitializerContext) {
-    const actionTypeRegistry = new TypeRegistry<ActionTypeModel>();
-    this.actionTypeRegistry = actionTypeRegistry;
-
-    const alertTypeRegistry = new TypeRegistry<AlertTypeModel>();
-    this.alertTypeRegistry = alertTypeRegistry;
-  }
-
-  public setup(
-    { application, notifications, http, uiSettings, injectedMetadata }: CoreSetup,
-    { __LEGACY }: LegacyPlugins
-  ): Setup {
-    registerBuiltInActionTypes({
-      actionTypeRegistry: this.actionTypeRegistry,
-    });
-
-    registerBuiltInAlertTypes({
-      alertTypeRegistry: this.alertTypeRegistry,
-    });
-    application.register({
-      id: PLUGIN.ID,
-      title: PLUGIN.getI18nName(i18n),
-      mount: async (
-        {
-          core: {
-            application: applicationStart,
-            docLinks,
-            chrome,
-            // Waiting for types to be updated.
-            // @ts-ignore
-            savedObjects,
-            i18n: { Context: I18nContext },
-          },
-        },
-        { element }
-      ) => {
-        const { capabilities } = applicationStart;
-
-        const canShowActions = hasShowActionsCapability(capabilities);
-        const canShowAlerts = hasShowAlertsCapability(capabilities);
-
-        if (!canShowActions && !canShowAlerts) {
-          // Render nothing
-          return () => {};
-        }
-
-        const { boot } = await import('./application/boot');
-        return boot({
-          element,
-          toastNotifications: notifications.toasts,
-          injectedMetadata,
-          http,
-          uiSettings,
-          docLinks,
-          chrome,
-          savedObjects: savedObjects.client,
-          I18nContext,
-          legacy: {
-            ...__LEGACY,
-          },
-          capabilities,
-          actionTypeRegistry: this.actionTypeRegistry,
-          alertTypeRegistry: this.alertTypeRegistry,
-        });
-      },
-    });
-  }
-
-  public start(core: CoreStart, { __LEGACY }: LegacyPlugins) {
-    const { capabilities } = core.application;
-
-    const canShowActions = hasShowActionsCapability(capabilities);
-    const canShowAlerts = hasShowAlertsCapability(capabilities);
-
-    // Don't register routes when user doesn't have access to the application
-    if (!canShowActions && !canShowAlerts) {
-      return;
-    }
-  }
-
-  public stop() {}
-}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/public/index.scss b/x-pack/legacy/plugins/triggers_actions_ui/public/index.scss
index 6faad81630b2b..3ae0ef35ee354 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/public/index.scss
+++ b/x-pack/legacy/plugins/triggers_actions_ui/public/index.scss
@@ -2,4 +2,7 @@
 @import 'src/legacy/ui/public/styles/_styling_constants';
 
 // Styling within the app
-@import '../np_ready/public/application/sections/actions_connectors_list/components/index';
+@import '../../../../plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/index';
+
+@import '../../../../plugins/triggers_actions_ui/public/application/sections/action_connector_form/index';
+
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/public/legacy.ts b/x-pack/legacy/plugins/triggers_actions_ui/public/legacy.ts
deleted file mode 100644
index 95cac99630fb4..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/public/legacy.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { CoreSetup, App, AppUnmount } from 'src/core/public';
-import { capabilities } from 'ui/capabilities';
-import { i18n } from '@kbn/i18n';
-
-/* Legacy UI imports */
-import { npSetup, npStart } from 'ui/new_platform';
-import routes from 'ui/routes';
-import { management, MANAGEMENT_BREADCRUMB } from 'ui/management';
-// @ts-ignore
-import { xpackInfo } from 'plugins/xpack_main/services/xpack_info';
-/* Legacy UI imports */
-
-import { plugin } from '../np_ready/public';
-import { manageAngularLifecycle } from './manage_angular_lifecycle';
-import { BASE_PATH } from '../np_ready/public/application/constants';
-import {
-  hasShowActionsCapability,
-  hasShowAlertsCapability,
-} from '../np_ready/public/application/lib/capabilities';
-
-const REACT_ROOT_ID = 'triggersActionsRoot';
-const canShowActions = hasShowActionsCapability(capabilities.get());
-const canShowAlerts = hasShowAlertsCapability(capabilities.get());
-
-const template = `<kbn-management-app section="kibana/triggersActions">
-<div id="triggersActionsRoot"></div>
-</kbn-management-app>`;
-
-let elem: HTMLElement;
-let mountApp: () => AppUnmount | Promise<AppUnmount>;
-let unmountApp: AppUnmount | Promise<AppUnmount>;
-routes.when(`${BASE_PATH}:section?/:subsection?/:view?/:id?`, {
-  template,
-  controller: (() => {
-    return ($route: any, $scope: any) => {
-      const shimCore: CoreSetup = {
-        ...npSetup.core,
-        application: {
-          ...npSetup.core.application,
-          register(app: App): void {
-            mountApp = () =>
-              app.mount(npStart as any, {
-                element: elem,
-                appBasePath: BASE_PATH,
-                onAppLeave: () => undefined,
-              });
-          },
-        },
-      };
-
-      // clean up previously rendered React app if one exists
-      // this happens because of React Router redirects
-      if (elem) {
-        ((unmountApp as unknown) as AppUnmount)();
-      }
-
-      $scope.$$postDigest(() => {
-        elem = document.getElementById(REACT_ROOT_ID)!;
-        const instance = plugin({} as any);
-        instance.setup(shimCore, {
-          ...(npSetup.plugins as typeof npSetup.plugins),
-          __LEGACY: {
-            MANAGEMENT_BREADCRUMB,
-          },
-        });
-
-        instance.start(npStart.core, {
-          ...(npSetup.plugins as typeof npSetup.plugins),
-          __LEGACY: {
-            MANAGEMENT_BREADCRUMB,
-          },
-        });
-
-        (mountApp() as Promise<AppUnmount>).then(fn => (unmountApp = fn));
-
-        manageAngularLifecycle($scope, $route, elem);
-      });
-    };
-  })(),
-});
-
-if (canShowActions || canShowAlerts) {
-  management.getSection('kibana').register('triggersActions', {
-    display: i18n.translate('xpack.triggersActionsUI.managementSection.displayName', {
-      defaultMessage: 'Alerts and Actions',
-    }),
-    order: 7,
-    url: `#${BASE_PATH}`,
-  });
-}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/public/manage_angular_lifecycle.ts b/x-pack/legacy/plugins/triggers_actions_ui/public/manage_angular_lifecycle.ts
deleted file mode 100644
index efd40eaf83daa..0000000000000
--- a/x-pack/legacy/plugins/triggers_actions_ui/public/manage_angular_lifecycle.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { unmountComponentAtNode } from 'react-dom';
-
-export const manageAngularLifecycle = ($scope: any, $route: any, elem: HTMLElement) => {
-  const lastRoute = $route.current;
-
-  const deregister = $scope.$on('$locationChangeSuccess', () => {
-    const currentRoute = $route.current;
-    if (lastRoute.$$route.template === currentRoute.$$route.template) {
-      $route.current = lastRoute;
-    }
-  });
-
-  $scope.$on('$destroy', () => {
-    if (deregister) {
-      deregister();
-    }
-
-    if (elem) {
-      unmountComponentAtNode(elem);
-    }
-  });
-};
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/charts/ping_histogram.tsx b/x-pack/legacy/plugins/uptime/public/components/connected/charts/ping_histogram.tsx
index cbdd921a36e81..50f91be4ff09f 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/charts/ping_histogram.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/charts/ping_histogram.tsx
@@ -19,7 +19,7 @@ import { useUrlParams } from '../../../hooks';
 
 type Props = ResponsiveWrapperProps &
   Pick<PingHistogramComponentProps, 'height' | 'data' | 'loading'> &
-  DispatchProps & { lastRefresh: number; monitorId?: string };
+  DispatchProps & { lastRefresh: number; monitorId?: string; esKuery?: string };
 
 const PingHistogramContainer: React.FC<Props> = ({
   data,
@@ -28,6 +28,7 @@ const PingHistogramContainer: React.FC<Props> = ({
   lastRefresh,
   height,
   loading,
+  esKuery,
 }) => {
   const [getUrlParams] = useUrlParams();
   const {
@@ -36,12 +37,11 @@ const PingHistogramContainer: React.FC<Props> = ({
     dateRangeStart: dateStart,
     dateRangeEnd: dateEnd,
     statusFilter,
-    filters,
   } = getUrlParams();
 
   useEffect(() => {
-    loadData({ monitorId, dateStart, dateEnd, statusFilter, filters });
-  }, [loadData, dateStart, dateEnd, monitorId, filters, statusFilter, lastRefresh]);
+    loadData({ monitorId, dateStart, dateEnd, statusFilter, filters: esKuery });
+  }, [loadData, dateStart, dateEnd, monitorId, statusFilter, lastRefresh, esKuery]);
   return (
     <PingHistogramComponent
       data={data}
@@ -57,6 +57,7 @@ interface StateProps {
   data: HistogramResult | null;
   loading: boolean;
   lastRefresh: number;
+  esKuery: string;
 }
 
 interface DispatchProps {
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/charts/snapshot_container.tsx b/x-pack/legacy/plugins/uptime/public/components/connected/charts/snapshot_container.tsx
index 6d01ebae1e100..08421cb56d14c 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/charts/snapshot_container.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/charts/snapshot_container.tsx
@@ -29,6 +29,7 @@ interface StoreProps {
   count: SnapshotType;
   lastRefresh: number;
   loading: boolean;
+  esKuery: string;
 }
 
 /**
@@ -49,14 +50,15 @@ export const Container: React.FC<Props> = ({
   height,
   lastRefresh,
   loading,
+  esKuery,
   loadSnapshotCount,
 }: Props) => {
   const [getUrlParams] = useUrlParams();
-  const { dateRangeStart, dateRangeEnd, statusFilter, filters } = getUrlParams();
+  const { dateRangeStart, dateRangeEnd, statusFilter } = getUrlParams();
 
   useEffect(() => {
-    loadSnapshotCount(dateRangeStart, dateRangeEnd, filters, statusFilter);
-  }, [dateRangeStart, dateRangeEnd, filters, lastRefresh, loadSnapshotCount, statusFilter]);
+    loadSnapshotCount(dateRangeStart, dateRangeEnd, esKuery, statusFilter);
+  }, [dateRangeStart, dateRangeEnd, esKuery, lastRefresh, loadSnapshotCount, statusFilter]);
   return <SnapshotComponent count={count} height={height} loading={loading} />;
 };
 
@@ -66,11 +68,12 @@ export const Container: React.FC<Props> = ({
  */
 const mapStateToProps = ({
   snapshot: { count, loading },
-  ui: { lastRefresh },
+  ui: { lastRefresh, esKuery },
 }: AppState): StoreProps => ({
   count,
   lastRefresh,
   loading,
+  esKuery,
 });
 
 /**
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/pages/overview_container.ts b/x-pack/legacy/plugins/uptime/public/components/connected/pages/overview_container.ts
index 406fab8f5bf01..cbd1fae77c518 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/pages/overview_container.ts
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/pages/overview_container.ts
@@ -8,7 +8,16 @@ import { connect } from 'react-redux';
 import { OverviewPageComponent } from '../../../pages/overview';
 import { selectIndexPattern } from '../../../state/selectors';
 import { AppState } from '../../../state';
+import { setEsKueryString } from '../../../state/actions';
+
+interface DispatchProps {
+  setEsKueryFilters: typeof setEsKueryString;
+}
+
+const mapDispatchToProps = (dispatch: any): DispatchProps => ({
+  setEsKueryFilters: (esFilters: string) => dispatch(setEsKueryString(esFilters)),
+});
 
 const mapStateToProps = (state: AppState) => ({ indexPattern: selectIndexPattern(state) });
 
-export const OverviewPage = connect(mapStateToProps)(OverviewPageComponent);
+export const OverviewPage = connect(mapStateToProps, mapDispatchToProps)(OverviewPageComponent);
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
index 9699a1842ccf1..280e05184837f 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/donut_chart.test.tsx.snap
@@ -7,6 +7,11 @@ exports[`DonutChart component passes correct props without errors for valid prop
 >
   <EuiFlexItem
     grow={false}
+    style={
+      Object {
+        "position": "relative",
+      }
+    }
   >
     <svg
       aria-label="Pie chart showing the current status. 32 of 127 monitors are down."
@@ -50,6 +55,7 @@ exports[`DonutChart component renders a donut chart 1`] = `
 >
   <div
     class="euiFlexItem euiFlexItem--flexGrowZero"
+    style="position:relative"
   >
     <svg
       aria-label="Pie chart showing the current status. 32 of 127 monitors are down."
@@ -160,3 +166,161 @@ exports[`DonutChart component renders a donut chart 1`] = `
   </div>
 </div>
 `;
+
+exports[`DonutChart component renders a green check when all monitors are up 1`] = `
+.c2.c2 {
+  margin-left: 0px;
+  margin-right: 0px;
+}
+
+.c3 {
+  text-align: right;
+}
+
+.c1 {
+  max-width: 260px;
+  min-width: 100px;
+}
+
+.c0 {
+  height: 42px;
+  width: 42px;
+  color: #017d73;
+  top: 51px;
+  left: 51px;
+  position: absolute;
+}
+
+@media (max-width:767px) {
+  .c1 {
+    min-width: 0px;
+    max-width: 100px;
+  }
+}
+
+<div
+  class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow"
+>
+  <div
+    class="euiFlexItem euiFlexItem--flexGrowZero"
+    style="position:relative"
+  >
+    <svg
+      aria-label="Pie chart showing the current status. 0 of 95 monitors are down."
+      height="125"
+      width="125"
+    />
+    <svg
+      aria-hidden="true"
+      class="euiIcon euiIcon--medium euiIcon-isLoading c0 greenCheckIcon"
+      focusable="false"
+      height="16"
+      role="img"
+      viewBox="0 0 16 16"
+      width="16"
+      xmlns="http://www.w3.org/2000/svg"
+    />
+  </div>
+  <div
+    class="euiFlexItem"
+  >
+    <div
+      class="c1"
+    >
+      <div
+        class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow"
+      >
+        <span
+          class="euiFlexItem euiFlexItem--flexGrowZero c2"
+        >
+          <div
+            class="euiHealth"
+          >
+            <div
+              class="euiFlexGroup euiFlexGroup--gutterExtraSmall euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow"
+            >
+              <div
+                class="euiFlexItem euiFlexItem--flexGrowZero"
+              >
+                <svg
+                  aria-hidden="true"
+                  class="euiIcon euiIcon--medium euiIcon-isLoading"
+                  focusable="false"
+                  height="16"
+                  role="img"
+                  style="fill:#bd271e"
+                  viewBox="0 0 16 16"
+                  width="16"
+                  xmlns="http://www.w3.org/2000/svg"
+                />
+              </div>
+              <div
+                class="euiFlexItem euiFlexItem--flexGrowZero"
+              />
+            </div>
+          </div>
+        </span>
+        <span
+          class="euiFlexItem euiFlexItem--flexGrowZero c2"
+        >
+          Down
+        </span>
+        <span
+          class="euiFlexItem c3"
+          data-test-subj="xpack.uptime.snapshot.donutChart.down"
+        >
+          0
+        </span>
+      </div>
+      <div
+        class="euiSpacer euiSpacer--m"
+      />
+      <div
+        class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow"
+      >
+        <span
+          class="euiFlexItem euiFlexItem--flexGrowZero c2"
+        >
+          <div
+            class="euiHealth"
+          >
+            <div
+              class="euiFlexGroup euiFlexGroup--gutterExtraSmall euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow"
+            >
+              <div
+                class="euiFlexItem euiFlexItem--flexGrowZero"
+              >
+                <svg
+                  aria-hidden="true"
+                  class="euiIcon euiIcon--medium euiIcon-isLoading"
+                  focusable="false"
+                  height="16"
+                  role="img"
+                  style="fill:#d3dae6"
+                  viewBox="0 0 16 16"
+                  width="16"
+                  xmlns="http://www.w3.org/2000/svg"
+                />
+              </div>
+              <div
+                class="euiFlexItem euiFlexItem--flexGrowZero"
+              />
+            </div>
+          </div>
+        </span>
+        <span
+          class="euiFlexItem euiFlexItem--flexGrowZero c2"
+        >
+          Up
+        </span>
+        <span
+          class="euiFlexItem c3"
+          data-test-subj="xpack.uptime.snapshot.donutChart.up"
+        >
+          95
+        </span>
+      </div>
+    </div>
+  </div>
+</div>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/donut_chart.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/donut_chart.test.tsx
index e98efc893b53b..31939c3dfdb56 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/donut_chart.test.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/donut_chart.test.tsx
@@ -32,4 +32,20 @@ describe('DonutChart component', () => {
     const wrapper = renderWithIntl(<DonutChart {...props} />);
     expect(wrapper).toMatchSnapshot();
   });
+
+  it('renders a green check when all monitors are up', () => {
+    const props = {
+      down: 0,
+      up: 95,
+      height: 125,
+      width: 125,
+    };
+
+    const wrapper = renderWithIntl(<DonutChart {...props} />);
+    expect(wrapper).toMatchSnapshot();
+
+    const greenCheck = wrapper.find('.greenCheckIcon');
+
+    expect(greenCheck).toHaveLength(1);
+  });
 });
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/donut_chart.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/donut_chart.tsx
index 35ee35e2926a8..a4bbe486a9317 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/donut_chart.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/donut_chart.tsx
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiIcon } from '@elastic/eui';
 import React, { useContext, useEffect, useRef } from 'react';
 import * as d3 from 'd3';
 import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
 import { DonutChartLegend } from './donut_chart_legend';
 import { UptimeThemeContext } from '../../../contexts';
 
@@ -18,6 +19,15 @@ interface DonutChartProps {
   width: number;
 }
 
+export const GreenCheckIcon = styled(EuiIcon)`
+  height: 42px;
+  width: 42px;
+  color: #017d73;
+  top: 51px;
+  left: 51px;
+  position: absolute;
+`;
+
 export const DonutChart = ({ height, down, up, width }: DonutChartProps) => {
   const chartElement = useRef<SVGSVGElement | null>(null);
 
@@ -32,15 +42,20 @@ export const DonutChart = ({ height, down, up, width }: DonutChartProps) => {
   useEffect(() => {
     if (chartElement.current !== null) {
       // we must remove any existing paths before painting
-      d3.selectAll('g').remove();
+      d3.select(chartElement.current)
+        .selectAll('g')
+        .remove();
+
       const svgElement = d3
         .select(chartElement.current)
         .append('g')
         .attr('transform', `translate(${width / 2}, ${height / 2})`);
+
       const color = d3.scale
         .ordinal()
         .domain(['up', 'down'])
         .range([gray, danger]);
+
       const pieGenerator = d3.layout
         .pie()
         .value(({ value }: any) => value)
@@ -69,9 +84,10 @@ export const DonutChart = ({ height, down, up, width }: DonutChartProps) => {
         .attr('fill', (d: any) => color(d.data.key));
     }
   }, [danger, down, gray, height, upCount, width]);
+
   return (
     <EuiFlexGroup alignItems="center" responsive={false}>
-      <EuiFlexItem grow={false}>
+      <EuiFlexItem grow={false} style={{ position: 'relative' }}>
         <svg
           aria-label={i18n.translate('xpack.uptime.snapshot.donutChart.ariaLabel', {
             defaultMessage:
@@ -82,6 +98,8 @@ export const DonutChart = ({ height, down, up, width }: DonutChartProps) => {
           width={width}
           height={height}
         />
+        {/* When all monitors are up we show green check icon in middle of donut to indicate, all is well */}
+        {down === 0 && <GreenCheckIcon className="greenCheckIcon" type="checkInCircleFilled" />}
       </EuiFlexItem>
       <EuiFlexItem>
         <DonutChartLegend down={down} up={up} />
diff --git a/x-pack/legacy/plugins/uptime/public/hooks/update_kuery_string.ts b/x-pack/legacy/plugins/uptime/public/hooks/update_kuery_string.ts
index 8c9eec3abe223..8a4ae01a72b4b 100644
--- a/x-pack/legacy/plugins/uptime/public/hooks/update_kuery_string.ts
+++ b/x-pack/legacy/plugins/uptime/public/hooks/update_kuery_string.ts
@@ -6,20 +6,8 @@
 
 import { combineFiltersAndUserSearch, stringifyKueries } from '../lib/helper';
 import { esKuery } from '../../../../../../src/plugins/data/common/es_query';
-import { store } from '../state';
-import { setEsKueryString } from '../state/actions';
 import { IIndexPattern } from '../../../../../../src/plugins/data/common/index_patterns';
 
-const updateEsQueryForFilterGroup = (filterQueryString: string, indexPattern: IIndexPattern) => {
-  // Update EsQuery in Redux to be used in FilterGroup
-  const searchDSL: string = filterQueryString
-    ? JSON.stringify(
-        esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(filterQueryString), indexPattern)
-      )
-    : '';
-  store.dispatch(setEsKueryString(searchDSL));
-};
-
 const getKueryString = (urlFilters: string): string => {
   let kueryString = '';
   // We are using try/catch here because this is user entered value
@@ -56,8 +44,6 @@ export const useUpdateKueryString = (
 
       esFilters = JSON.stringify(elasticsearchQuery);
     }
-    updateEsQueryForFilterGroup(filterQueryString, indexPattern);
-
     return [esFilters];
   } catch (err) {
     return [urlFilters, err];
diff --git a/x-pack/legacy/plugins/uptime/public/pages/overview.tsx b/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
index df6ffba6154e5..ce5fb619aca02 100644
--- a/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
+++ b/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
@@ -5,7 +5,7 @@
  */
 
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
-import React, { useContext } from 'react';
+import React, { useContext, useEffect } from 'react';
 import styled from 'styled-components';
 import {
   EmptyState,
@@ -27,6 +27,7 @@ interface OverviewPageProps {
   autocomplete: DataPublicPluginStart['autocomplete'];
   setBreadcrumbs: UMUpdateBreadcrumbs;
   indexPattern: IIndexPattern;
+  setEsKueryFilters: (esFilters: string) => void;
 }
 
 type Props = OverviewPageProps;
@@ -40,7 +41,12 @@ const EuiFlexItemStyled = styled(EuiFlexItem)`
   }
 `;
 
-export const OverviewPageComponent = ({ autocomplete, setBreadcrumbs, indexPattern }: Props) => {
+export const OverviewPageComponent = ({
+  autocomplete,
+  setBreadcrumbs,
+  indexPattern,
+  setEsKueryFilters,
+}: Props) => {
   const { colors } = useContext(UptimeThemeContext);
   const [getUrlParams] = useUrlParams();
   const { absoluteDateRangeStart, absoluteDateRangeEnd, ...params } = getUrlParams();
@@ -60,6 +66,10 @@ export const OverviewPageComponent = ({ autocomplete, setBreadcrumbs, indexPatte
 
   const [esFilters, error] = useUpdateKueryString(indexPattern, search, urlFilters);
 
+  useEffect(() => {
+    setEsKueryFilters(esFilters ?? '');
+  }, [esFilters, setEsKueryFilters]);
+
   const sharedProps = {
     dateRangeStart,
     dateRangeEnd,
diff --git a/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts b/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
index fe6a7a1b7eade..25498cc0cb0ee 100644
--- a/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
@@ -34,5 +34,10 @@ export const selectIndexPattern = ({ indexPattern }: AppState) => {
 };
 
 export const selectPingHistogram = ({ ping, ui }: AppState) => {
-  return { data: ping.pingHistogram, loading: ping.loading, lastRefresh: ui.lastRefresh };
+  return {
+    data: ping.pingHistogram,
+    loading: ping.loading,
+    lastRefresh: ui.lastRefresh,
+    esKuery: ui.esKuery,
+  };
 };
diff --git a/x-pack/legacy/plugins/uptime/server/graphql/monitor_states/resolvers.ts b/x-pack/legacy/plugins/uptime/server/graphql/monitor_states/resolvers.ts
index 8ddb07b3093d0..45b073086d212 100644
--- a/x-pack/legacy/plugins/uptime/server/graphql/monitor_states/resolvers.ts
+++ b/x-pack/legacy/plugins/uptime/server/graphql/monitor_states/resolvers.ts
@@ -50,8 +50,8 @@ export const createMonitorStatesResolvers: CreateUMGraphQLResolvers = (
           totalSummaryCount,
           { summaries, nextPagePagination, prevPagePagination },
         ] = await Promise.all([
-          libs.pings.getDocCount({ callES: APICaller }),
-          libs.monitorStates.getMonitorStates({
+          libs.requests.getDocCount({ callES: APICaller }),
+          libs.requests.getMonitorStates({
             callES: APICaller,
             dateRangeStart,
             dateRangeEnd,
@@ -71,7 +71,7 @@ export const createMonitorStatesResolvers: CreateUMGraphQLResolvers = (
         };
       },
       async getStatesIndexStatus(_resolver, {}, { APICaller }): Promise<StatesIndexStatus> {
-        return await libs.monitorStates.statesIndexExists({ callES: APICaller });
+        return await libs.requests.getStatesIndexStatus({ callES: APICaller });
       },
     },
   };
diff --git a/x-pack/legacy/plugins/uptime/server/graphql/monitors/resolvers.ts b/x-pack/legacy/plugins/uptime/server/graphql/monitors/resolvers.ts
index cc5744eac6ea1..19f23fa1bb934 100644
--- a/x-pack/legacy/plugins/uptime/server/graphql/monitors/resolvers.ts
+++ b/x-pack/legacy/plugins/uptime/server/graphql/monitors/resolvers.ts
@@ -29,7 +29,7 @@ export const createMonitorsResolvers: CreateUMGraphQLResolvers = (
       { monitorId, dateRangeStart, dateRangeEnd, location },
       { APICaller }
     ): Promise<MonitorChart> {
-      return libs.monitors.getMonitorChartsData({
+      return await libs.requests.getMonitorCharts({
         callES: APICaller,
         monitorId,
         dateRangeStart,
diff --git a/x-pack/legacy/plugins/uptime/server/graphql/pings/resolvers.ts b/x-pack/legacy/plugins/uptime/server/graphql/pings/resolvers.ts
index 373e1467433a2..dea7469ab6217 100644
--- a/x-pack/legacy/plugins/uptime/server/graphql/pings/resolvers.ts
+++ b/x-pack/legacy/plugins/uptime/server/graphql/pings/resolvers.ts
@@ -38,7 +38,7 @@ export const createPingsResolvers: CreateUMGraphQLResolvers = (
       { monitorId, sort, size, status, dateRangeStart, dateRangeEnd, location },
       { APICaller }
     ): Promise<PingResults> {
-      return await libs.pings.getAll({
+      return await libs.requests.getPings({
         callES: APICaller,
         dateRangeStart,
         dateRangeEnd,
@@ -50,7 +50,7 @@ export const createPingsResolvers: CreateUMGraphQLResolvers = (
       });
     },
     async getDocCount(_resolver, _args, { APICaller }): Promise<DocCount> {
-      return libs.pings.getDocCount({ callES: APICaller });
+      return libs.requests.getDocCount({ callES: APICaller });
     },
   },
 });
diff --git a/x-pack/legacy/plugins/uptime/server/graphql/types.ts b/x-pack/legacy/plugins/uptime/server/graphql/types.ts
index 529ab41a62b3b..8508066a71f98 100644
--- a/x-pack/legacy/plugins/uptime/server/graphql/types.ts
+++ b/x-pack/legacy/plugins/uptime/server/graphql/types.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RequestHandlerContext, CallAPIOptions } from 'kibana/server';
+import { RequestHandlerContext, CallAPIOptions } from 'src/core/server';
 import { UMServerLibs } from '../lib/lib';
 
 export type UMContext = RequestHandlerContext & {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/index.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/index.ts
index fbef70f106dd8..9b3b11712b99b 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/index.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/adapters/index.ts
@@ -5,8 +5,4 @@
  */
 
 export * from './framework';
-export * from './monitor_states';
-export * from './monitors';
-export * from './pings';
-export * from './stub_index_pattern';
 export * from './telemetry';
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/adapter_types.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/adapter_types.ts
deleted file mode 100644
index 4104a9287a28d..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/adapter_types.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  MonitorSummary,
-  CursorDirection,
-  SortOrder,
-  StatesIndexStatus,
-} from '../../../../common/graphql/types';
-import { UMElasticsearchQueryFn } from '../framework';
-import { Snapshot } from '../../../../common/runtime_types';
-
-export interface MonitorStatesParams {
-  dateRangeStart: string;
-  dateRangeEnd: string;
-  pagination?: CursorPagination;
-  filters?: string | null;
-  statusFilter?: string;
-}
-
-export interface GetSnapshotCountParams {
-  dateRangeStart: string;
-  dateRangeEnd: string;
-  filters?: string | null;
-  statusFilter?: string;
-}
-
-export interface UMMonitorStatesAdapter {
-  getMonitorStates: UMElasticsearchQueryFn<MonitorStatesParams, GetMonitorStatesResult>;
-  getSnapshotCount: UMElasticsearchQueryFn<GetSnapshotCountParams, Snapshot>;
-  statesIndexExists: UMElasticsearchQueryFn<{}, StatesIndexStatus>;
-}
-
-export interface CursorPagination {
-  cursorKey?: any;
-  cursorDirection: CursorDirection;
-  sortOrder: SortOrder;
-}
-
-export interface GetMonitorStatesResult {
-  summaries: MonitorSummary[];
-  nextPagePagination: string | null;
-  prevPagePagination: string | null;
-}
-
-export interface LegacyMonitorStatesQueryResult {
-  result: any;
-  statusFilter?: any;
-  searchAfter: any;
-}
-
-export interface MonitorStatesCheckGroupsResult {
-  checkGroups: string[];
-  searchAfter: any;
-}
-
-export interface EnrichMonitorStatesResult {
-  monitors: any[];
-  nextPagePagination: any | null;
-  prevPagePagination: any | null;
-}
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/elasticsearch_monitor_states_adapter.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/elasticsearch_monitor_states_adapter.ts
deleted file mode 100644
index 7ed973e6f057d..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/elasticsearch_monitor_states_adapter.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { UMMonitorStatesAdapter } from './adapter_types';
-import { INDEX_NAMES, CONTEXT_DEFAULTS } from '../../../../common/constants';
-import { fetchPage } from './search';
-import { MonitorGroupIterator } from './search/monitor_group_iterator';
-import { Snapshot } from '../../../../common/runtime_types';
-import { QueryContext } from './search/query_context';
-
-export const elasticsearchMonitorStatesAdapter: UMMonitorStatesAdapter = {
-  // Gets a page of monitor states.
-  getMonitorStates: async ({
-    callES,
-    dateRangeStart,
-    dateRangeEnd,
-    pagination,
-    filters,
-    statusFilter,
-  }) => {
-    pagination = pagination || CONTEXT_DEFAULTS.CURSOR_PAGINATION;
-    statusFilter = statusFilter === null ? undefined : statusFilter;
-    const size = 10;
-
-    const queryContext = new QueryContext(
-      callES,
-      dateRangeStart,
-      dateRangeEnd,
-      pagination,
-      filters && filters !== '' ? JSON.parse(filters) : null,
-      size,
-      statusFilter
-    );
-
-    const page = await fetchPage(queryContext);
-
-    return {
-      summaries: page.items,
-      nextPagePagination: jsonifyPagination(page.nextPagePagination),
-      prevPagePagination: jsonifyPagination(page.prevPagePagination),
-    };
-  },
-
-  getSnapshotCount: async ({
-    callES,
-    dateRangeStart,
-    dateRangeEnd,
-    filters,
-    statusFilter,
-  }): Promise<Snapshot> => {
-    if (!(statusFilter === 'up' || statusFilter === 'down' || statusFilter === undefined)) {
-      throw new Error(`Invalid status filter value '${statusFilter}'`);
-    }
-
-    const context = new QueryContext(
-      callES,
-      dateRangeStart,
-      dateRangeEnd,
-      CONTEXT_DEFAULTS.CURSOR_PAGINATION,
-      filters && filters !== '' ? JSON.parse(filters) : null,
-      Infinity,
-      statusFilter
-    );
-
-    // Calculate the total, up, and down counts.
-    const counts = await fastStatusCount(context);
-
-    // Check if the last count was accurate, if not, we need to perform a slower count with the
-    // MonitorGroupsIterator.
-    if (!(await context.hasTimespan())) {
-      // Figure out whether 'up' or 'down' is more common. It's faster to count the lower cardinality
-      // one then use subtraction to figure out its opposite.
-      const [leastCommonStatus, mostCommonStatus]: Array<'up' | 'down'> =
-        counts.up > counts.down ? ['down', 'up'] : ['up', 'down'];
-      counts[leastCommonStatus] = await slowStatusCount(context, leastCommonStatus);
-      counts[mostCommonStatus] = counts.total - counts[leastCommonStatus];
-    }
-
-    return {
-      total: statusFilter ? counts[statusFilter] : counts.total,
-      up: statusFilter === 'down' ? 0 : counts.up,
-      down: statusFilter === 'up' ? 0 : counts.down,
-    };
-  },
-
-  statesIndexExists: async ({ callES }) => {
-    // TODO: adapt this to the states index in future release
-    const {
-      _shards: { total },
-      count,
-    } = await callES('count', { index: INDEX_NAMES.HEARTBEAT });
-    return {
-      indexExists: total > 0,
-      docCount: {
-        count,
-      },
-    };
-  },
-};
-
-// To simplify the handling of the group of pagination vars they're passed back to the client as a string
-const jsonifyPagination = (p: any): string | null => {
-  if (!p) {
-    return null;
-  }
-
-  return JSON.stringify(p);
-};
-
-const fastStatusCount = async (context: QueryContext): Promise<Snapshot> => {
-  const params = {
-    index: INDEX_NAMES.HEARTBEAT,
-    body: {
-      size: 0,
-      query: { bool: { filter: await context.dateAndCustomFilters() } },
-      aggs: {
-        unique: {
-          // We set the precision threshold to 40k which is the max precision supported by cardinality
-          cardinality: { field: 'monitor.id', precision_threshold: 40000 },
-        },
-        down: {
-          filter: { range: { 'summary.down': { gt: 0 } } },
-          aggs: {
-            unique: { cardinality: { field: 'monitor.id', precision_threshold: 40000 } },
-          },
-        },
-      },
-    },
-  };
-
-  const statistics = await context.search(params);
-  const total = statistics.aggregations.unique.value;
-  const down = statistics.aggregations.down.unique.value;
-
-  return {
-    total,
-    down,
-    up: total - down,
-  };
-};
-
-const slowStatusCount = async (context: QueryContext, status: string): Promise<number> => {
-  const downContext = context.clone();
-  downContext.statusFilter = status;
-  const iterator = new MonitorGroupIterator(downContext);
-  let count = 0;
-  while (await iterator.next()) {
-    count++;
-  }
-  return count;
-};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/adapter_types.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/adapter_types.ts
deleted file mode 100644
index 8523d9c75f51f..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/adapter_types.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { MonitorChart } from '../../../../common/graphql/types';
-import { UMElasticsearchQueryFn } from '../framework';
-import {
-  MonitorDetails,
-  MonitorLocations,
-  OverviewFilters,
-} from '../../../../common/runtime_types';
-
-export interface GetMonitorChartsDataParams {
-  /** @member monitorId ID value for the selected monitor */
-  monitorId: string;
-  /** @member dateRangeStart timestamp bounds */
-  dateRangeStart: string;
-  /** @member dateRangeEnd timestamp bounds */
-  dateRangeEnd: string;
-  /** @member location optional location value for use in filtering*/
-  location?: string | null;
-}
-
-export interface GetFilterBarParams {
-  /** @param dateRangeStart timestamp bounds */
-  dateRangeStart: string;
-  /** @member dateRangeEnd timestamp bounds */
-  dateRangeEnd: string;
-  /** @member search this value should correspond to Elasticsearch DSL
-   *  generated from KQL text the user provided.
-   */
-  search?: Record<string, any>;
-  filterOptions: Record<string, string[] | number[]>;
-}
-
-export interface GetMonitorDetailsParams {
-  monitorId: string;
-  dateStart: string;
-  dateEnd: string;
-}
-
-/**
- * Fetch data for the monitor page title.
- */
-export interface GetMonitorLocationsParams {
-  /**
-   * @member monitorId the ID to query
-   */
-  monitorId: string;
-  dateStart: string;
-  dateEnd: string;
-}
-
-export interface UMMonitorsAdapter {
-  /**
-   * Fetches data used to populate monitor charts
-   */
-  getMonitorChartsData: UMElasticsearchQueryFn<GetMonitorChartsDataParams, MonitorChart>;
-
-  /**
-   * Fetch options for the filter bar.
-   */
-  getFilterBar: UMElasticsearchQueryFn<GetFilterBarParams, OverviewFilters>;
-
-  getMonitorDetails: UMElasticsearchQueryFn<GetMonitorDetailsParams, MonitorDetails>;
-
-  getMonitorLocations: UMElasticsearchQueryFn<GetMonitorLocationsParams, MonitorLocations>;
-}
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/elasticsearch_monitors_adapter.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/elasticsearch_monitors_adapter.ts
deleted file mode 100644
index e433931f03c8e..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/elasticsearch_monitors_adapter.ts
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { INDEX_NAMES, UNNAMED_LOCATION } from '../../../../common/constants';
-import { MonitorChart, LocationDurationLine } from '../../../../common/graphql/types';
-import { getHistogramIntervalFormatted } from '../../helper';
-import { MonitorError, MonitorLocation } from '../../../../common/runtime_types';
-import { UMMonitorsAdapter } from './adapter_types';
-import { generateFilterAggs } from './generate_filter_aggs';
-import { OverviewFilters } from '../../../../common/runtime_types';
-
-export const combineRangeWithFilters = (
-  dateRangeStart: string,
-  dateRangeEnd: string,
-  filters?: Record<string, any>
-) => {
-  const range = {
-    range: {
-      '@timestamp': {
-        gte: dateRangeStart,
-        lte: dateRangeEnd,
-      },
-    },
-  };
-  if (!filters) return range;
-  const clientFiltersList = Array.isArray(filters?.bool?.filter ?? {})
-    ? // i.e. {"bool":{"filter":{ ...some nested filter objects }}}
-      filters.bool.filter
-    : // i.e. {"bool":{"filter":[ ...some listed filter objects ]}}
-      Object.keys(filters?.bool?.filter ?? {}).map(key => ({
-        ...filters?.bool?.filter?.[key],
-      }));
-  filters.bool.filter = [...clientFiltersList, range];
-  return filters;
-};
-
-type SupportedFields = 'locations' | 'ports' | 'schemes' | 'tags';
-
-export const extractFilterAggsResults = (
-  responseAggregations: Record<string, any>,
-  keys: SupportedFields[]
-): OverviewFilters => {
-  const values: OverviewFilters = {
-    locations: [],
-    ports: [],
-    schemes: [],
-    tags: [],
-  };
-  keys.forEach(key => {
-    const buckets = responseAggregations[key]?.term?.buckets ?? [];
-    values[key] = buckets.map((item: { key: string | number }) => item.key);
-  });
-  return values;
-};
-
-const formatStatusBuckets = (time: any, buckets: any, docCount: any) => {
-  let up = null;
-  let down = null;
-
-  buckets.forEach((bucket: any) => {
-    if (bucket.key === 'up') {
-      up = bucket.doc_count;
-    } else if (bucket.key === 'down') {
-      down = bucket.doc_count;
-    }
-  });
-
-  return {
-    x: time,
-    up,
-    down,
-    total: docCount,
-  };
-};
-
-export const elasticsearchMonitorsAdapter: UMMonitorsAdapter = {
-  getMonitorChartsData: async ({ callES, dateRangeStart, dateRangeEnd, monitorId, location }) => {
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              { range: { '@timestamp': { gte: dateRangeStart, lte: dateRangeEnd } } },
-              { term: { 'monitor.id': monitorId } },
-              { term: { 'monitor.status': 'up' } },
-              // if location is truthy, add it as a filter. otherwise add nothing
-              ...(!!location ? [{ term: { 'observer.geo.name': location } }] : []),
-            ],
-          },
-        },
-        size: 0,
-        aggs: {
-          timeseries: {
-            date_histogram: {
-              field: '@timestamp',
-              fixed_interval: getHistogramIntervalFormatted(dateRangeStart, dateRangeEnd),
-              min_doc_count: 0,
-            },
-            aggs: {
-              location: {
-                terms: {
-                  field: 'observer.geo.name',
-                  missing: 'N/A',
-                },
-                aggs: {
-                  status: { terms: { field: 'monitor.status', size: 2, shard_size: 2 } },
-                  duration: { stats: { field: 'monitor.duration.us' } },
-                },
-              },
-            },
-          },
-        },
-      },
-    };
-
-    const result = await callES('search', params);
-
-    const dateHistogramBuckets = get<any[]>(result, 'aggregations.timeseries.buckets', []);
-    /**
-     * The code below is responsible for formatting the aggregation data we fetched above in a way
-     * that the chart components used by the client understands.
-     * There are five required values. Two are lists of points that conform to a simple (x,y) structure.
-     *
-     * The third list is for an area chart expressing a range, and it requires an (x,y,y0) structure,
-     * where y0 is the min value for the point and y is the max.
-     *
-     * Additionally, we supply the maximum value for duration and status, so the corresponding charts know
-     * what the domain size should be.
-     */
-    const monitorChartsData: MonitorChart = {
-      locationDurationLines: [],
-      status: [],
-      durationMaxValue: 0,
-      statusMaxCount: 0,
-    };
-
-    /**
-     * The following section of code enables us to provide buckets per location
-     * that have a `null` value if there is no data at the given timestamp.
-     *
-     * We maintain two `Set`s. One is per bucket, the other is persisted for the
-     * entire collection. At the end of a bucket's evaluation, if there was no object
-     * parsed for a given location line that was already started, we insert an element
-     * to the given line with a null value. Without this, our charts on the client will
-     * display a continuous line for each of the points they are provided.
-     */
-
-    // a set of all the locations found for this result
-    const resultLocations = new Set<string>();
-    const linesByLocation: { [key: string]: LocationDurationLine } = {};
-    dateHistogramBuckets.forEach(dateHistogramBucket => {
-      const x = get(dateHistogramBucket, 'key');
-      const docCount = get(dateHistogramBucket, 'doc_count', 0);
-      // a set of all the locations for the current bucket
-      const bucketLocations = new Set<string>();
-
-      dateHistogramBucket.location.buckets.forEach(
-        (locationBucket: { key: string; duration: { avg: number } }) => {
-          const locationName = locationBucket.key;
-          // store the location name in each set
-          bucketLocations.add(locationName);
-          resultLocations.add(locationName);
-
-          // create a new line for this location if it doesn't exist
-          let currentLine: LocationDurationLine = get(linesByLocation, locationName);
-          if (!currentLine) {
-            currentLine = { name: locationName, line: [] };
-            linesByLocation[locationName] = currentLine;
-            monitorChartsData.locationDurationLines.push(currentLine);
-          }
-          // add the entry for the current location's duration average
-          currentLine.line.push({ x, y: get(locationBucket, 'duration.avg', null) });
-        }
-      );
-
-      // if there are more lines in the result than are represented in the current bucket,
-      // we must add null entries
-      if (dateHistogramBucket.location.buckets.length < resultLocations.size) {
-        resultLocations.forEach(resultLocation => {
-          // the current bucket has a value for this location, do nothing
-          if (location && location !== resultLocation) return;
-          // the current bucket had no value for this location, insert a null value
-          if (!bucketLocations.has(resultLocation)) {
-            const locationLine = monitorChartsData.locationDurationLines.find(
-              ({ name }) => name === resultLocation
-            );
-            // in practice, there should always be a line present, but `find` can return `undefined`
-            if (locationLine) {
-              // this will create a gap in the line like we desire
-              locationLine.line.push({ x, y: null });
-            }
-          }
-        });
-      }
-
-      monitorChartsData.status.push(
-        formatStatusBuckets(x, get(dateHistogramBucket, 'status.buckets', []), docCount)
-      );
-    });
-
-    return monitorChartsData;
-  },
-
-  getFilterBar: async ({ callES, dateRangeStart, dateRangeEnd, search, filterOptions }) => {
-    const aggs = generateFilterAggs(
-      [
-        { aggName: 'locations', filterName: 'locations', field: 'observer.geo.name' },
-        { aggName: 'ports', filterName: 'ports', field: 'url.port' },
-        { aggName: 'schemes', filterName: 'schemes', field: 'monitor.type' },
-        { aggName: 'tags', filterName: 'tags', field: 'tags' },
-      ],
-      filterOptions
-    );
-    const filters = combineRangeWithFilters(dateRangeStart, dateRangeEnd, search);
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        size: 0,
-        query: {
-          ...filters,
-        },
-        aggs,
-      },
-    };
-
-    const { aggregations } = await callES('search', params);
-    return extractFilterAggsResults(aggregations, ['tags', 'locations', 'ports', 'schemes']);
-  },
-
-  getMonitorDetails: async ({ callES, monitorId, dateStart, dateEnd }) => {
-    const queryFilters: any = [
-      {
-        range: {
-          '@timestamp': {
-            gte: dateStart,
-            lte: dateEnd,
-          },
-        },
-      },
-      {
-        term: {
-          'monitor.id': monitorId,
-        },
-      },
-    ];
-
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        size: 1,
-        _source: ['error', '@timestamp'],
-        query: {
-          bool: {
-            must: [
-              {
-                exists: {
-                  field: 'error',
-                },
-              },
-            ],
-            filter: queryFilters,
-          },
-        },
-        sort: [
-          {
-            '@timestamp': {
-              order: 'desc',
-            },
-          },
-        ],
-      },
-    };
-
-    const result = await callES('search', params);
-
-    const data = result.hits.hits[0]?._source;
-
-    const monitorError: MonitorError | undefined = data?.error;
-    const errorTimeStamp: string | undefined = data?.['@timestamp'];
-
-    return {
-      monitorId,
-      error: monitorError,
-      timestamp: errorTimeStamp,
-    };
-  },
-
-  getMonitorLocations: async ({ callES, monitorId, dateStart, dateEnd }) => {
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        size: 0,
-        query: {
-          bool: {
-            filter: [
-              {
-                match: {
-                  'monitor.id': monitorId,
-                },
-              },
-              {
-                exists: {
-                  field: 'summary',
-                },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    gte: dateStart,
-                    lte: dateEnd,
-                  },
-                },
-              },
-            ],
-          },
-        },
-        aggs: {
-          location: {
-            terms: {
-              field: 'observer.geo.name',
-              missing: '__location_missing__',
-            },
-            aggs: {
-              most_recent: {
-                top_hits: {
-                  size: 1,
-                  sort: {
-                    '@timestamp': {
-                      order: 'desc',
-                    },
-                  },
-                  _source: ['monitor', 'summary', 'observer', '@timestamp'],
-                },
-              },
-            },
-          },
-        },
-      },
-    };
-
-    const result = await callES('search', params);
-    const locations = result?.aggregations?.location?.buckets ?? [];
-
-    const getGeo = (locGeo: { name: string; location?: string }) => {
-      if (locGeo) {
-        const { name, location } = locGeo;
-        const latLon = location?.trim().split(',');
-        return {
-          name,
-          location: latLon
-            ? {
-                lat: latLon[0],
-                lon: latLon[1],
-              }
-            : undefined,
-        };
-      } else {
-        return {
-          name: UNNAMED_LOCATION,
-        };
-      }
-    };
-
-    const monLocs: MonitorLocation[] = [];
-    locations.forEach((loc: any) => {
-      const mostRecentLocation = loc.most_recent.hits.hits[0]._source;
-      const location: MonitorLocation = {
-        summary: mostRecentLocation?.summary,
-        geo: getGeo(mostRecentLocation?.observer?.geo),
-        timestamp: mostRecentLocation['@timestamp'],
-      };
-      monLocs.push(location);
-    });
-
-    return {
-      monitorId,
-      locations: monLocs,
-    };
-  },
-};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/index.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/index.ts
deleted file mode 100644
index d02068a11e8d8..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export * from './adapter_types';
-export { elasticsearchMonitorsAdapter } from './elasticsearch_monitors_adapter';
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/elasticsearch_pings_adapter.test.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/elasticsearch_pings_adapter.test.ts
deleted file mode 100644
index 866ab110928b4..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/elasticsearch_pings_adapter.test.ts
+++ /dev/null
@@ -1,495 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { set } from 'lodash';
-import { elasticsearchPingsAdapter as adapter } from '../es_pings';
-
-describe('ElasticsearchPingsAdapter class', () => {
-  let mockHits: any[];
-  let mockEsSearchResult: any;
-  let mockEsCountResult: any;
-  const standardMockResponse: any = {
-    aggregations: {
-      timeseries: {
-        buckets: [
-          {
-            key: 1,
-            up: {
-              doc_count: 2,
-            },
-            down: {
-              doc_count: 1,
-            },
-          },
-          {
-            key: 2,
-            up: {
-              doc_count: 2,
-            },
-            down: {
-              bucket_count: 1,
-            },
-          },
-        ],
-        interval: '1s',
-      },
-    },
-  };
-
-  beforeEach(() => {
-    mockHits = [
-      {
-        _source: {
-          '@timestamp': '2018-10-30T18:51:59.792Z',
-        },
-      },
-      {
-        _source: {
-          '@timestamp': '2018-10-30T18:53:59.792Z',
-        },
-      },
-      {
-        _source: {
-          '@timestamp': '2018-10-30T18:55:59.792Z',
-        },
-      },
-    ];
-    mockEsSearchResult = {
-      hits: {
-        total: {
-          value: mockHits.length,
-        },
-        hits: mockHits,
-      },
-      aggregations: {
-        locations: {
-          buckets: [{ key: 'foo' }],
-        },
-      },
-    };
-    mockEsCountResult = {
-      count: mockHits.length,
-    };
-  });
-
-  describe('getPingHistogram', () => {
-    it('returns a single bucket if array has 1', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue({
-        aggregations: {
-          timeseries: {
-            buckets: [
-              {
-                key: 1,
-                up: {
-                  doc_count: 2,
-                },
-                down: {
-                  doc_count: 1,
-                },
-              },
-            ],
-          },
-        },
-      });
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: 'now-15m',
-        dateEnd: 'now',
-        filters: '',
-      });
-      result.interval = '10s';
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-
-    it('returns expected result for no status filter', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-
-      mockEsClient.mockReturnValue(standardMockResponse);
-
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: 'now-15m',
-        dateEnd: 'now',
-        filters: '',
-      });
-      result.interval = '1m';
-
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-
-    it('handles status + additional user queries', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue({
-        aggregations: {
-          timeseries: {
-            buckets: [
-              {
-                key: 1,
-                up: {
-                  doc_count: 2,
-                },
-                down: {
-                  doc_count: 1,
-                },
-              },
-              {
-                key: 2,
-                up: {
-                  doc_count: 2,
-                },
-                down: {
-                  doc_count: 2,
-                },
-              },
-              {
-                key: 3,
-                up: {
-                  doc_count: 3,
-                },
-                down: {
-                  doc_count: 1,
-                },
-              },
-            ],
-          },
-        },
-      });
-      const searchFilter = {
-        bool: {
-          must: [
-            { match: { 'monitor.id': { query: 'auto-http-0X89BB0F9A6C81D178', operator: 'and' } } },
-            { match: { 'monitor.name': { query: 'my-new-test-site-name', operator: 'and' } } },
-          ],
-        },
-      };
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: '1234',
-        dateEnd: '5678',
-        filters: JSON.stringify(searchFilter),
-        monitorId: undefined,
-        statusFilter: 'down',
-      });
-      result.interval = '1h';
-
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-
-    it('handles simple_text_query without issues', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue({
-        aggregations: {
-          timeseries: {
-            buckets: [
-              {
-                key: 1,
-                up: {
-                  doc_count: 2,
-                },
-                down: {
-                  doc_count: 1,
-                },
-              },
-              {
-                key: 2,
-                up: {
-                  doc_count: 1,
-                },
-                down: {
-                  doc_count: 2,
-                },
-              },
-              {
-                key: 3,
-                up: {
-                  doc_count: 3,
-                },
-                down: {
-                  doc_count: 1,
-                },
-              },
-            ],
-          },
-        },
-      });
-      const filters = `{"bool":{"must":[{"simple_query_string":{"query":"http"}}]}}`;
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: 'now-15m',
-        dateEnd: 'now',
-        filters,
-      });
-
-      result.interval = '1m';
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-
-    it('returns a down-filtered array for when filtered by down status', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(standardMockResponse);
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: '1234',
-        dateEnd: '5678',
-        filters: '',
-        monitorId: undefined,
-        statusFilter: 'down',
-      });
-
-      result.interval = '1d';
-
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-
-    it('returns a down-filtered array for when filtered by up status', async () => {
-      expect.assertions(2);
-      const mockEsClient = jest.fn();
-
-      mockEsClient.mockReturnValue(standardMockResponse);
-
-      const result = await adapter.getPingHistogram({
-        callES: mockEsClient,
-        dateStart: '1234',
-        dateEnd: '5678',
-        filters: '',
-        monitorId: undefined,
-        statusFilter: 'up',
-      });
-
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(result).toMatchSnapshot();
-    });
-  });
-
-  describe('getDocCount', () => {
-    it('returns data in appropriate shape', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsCountResult);
-      const { count } = await adapter.getDocCount({ callES: mockEsClient });
-      expect(count).toEqual(3);
-    });
-  });
-
-  describe('getAll', () => {
-    let expectedGetAllParams: any;
-    beforeEach(() => {
-      expectedGetAllParams = {
-        index: 'heartbeat-8*',
-        body: {
-          query: {
-            bool: {
-              filter: [{ range: { '@timestamp': { gte: 'now-1h', lte: 'now' } } }],
-            },
-          },
-          aggregations: {
-            locations: {
-              terms: {
-                field: 'observer.geo.name',
-                missing: 'N/A',
-                size: 1000,
-              },
-            },
-          },
-          sort: [{ '@timestamp': { order: 'desc' } }],
-          size: 12,
-        },
-      };
-    });
-
-    it('returns data in the appropriate shape', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      const result = await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        sort: 'asc',
-        size: 12,
-      });
-      const count = 3;
-
-      expect(result.total).toBe(count);
-
-      const pings = result.pings!;
-      expect(pings).toHaveLength(count);
-      expect(pings[0].timestamp).toBe('2018-10-30T18:51:59.792Z');
-      expect(pings[1].timestamp).toBe('2018-10-30T18:53:59.792Z');
-      expect(pings[2].timestamp).toBe('2018-10-30T18:55:59.792Z');
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-    });
-
-    it('creates appropriate sort and size parameters', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        sort: 'asc',
-        size: 12,
-      });
-      set(expectedGetAllParams, 'body.sort[0]', { '@timestamp': { order: 'asc' } });
-
-      expect(mockEsClient).toHaveBeenCalledTimes(1);
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
-    });
-
-    it('omits the sort param when no sort passed', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        size: 12,
-      });
-
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
-    });
-
-    it('omits the size param when no size passed', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        sort: 'desc',
-      });
-      delete expectedGetAllParams.body.size;
-      set(expectedGetAllParams, 'body.sort[0].@timestamp.order', 'desc');
-
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
-    });
-
-    it('adds a filter for monitor ID', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        monitorId: 'testmonitorid',
-      });
-      delete expectedGetAllParams.body.size;
-      expectedGetAllParams.body.query.bool.filter.push({ term: { 'monitor.id': 'testmonitorid' } });
-
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
-    });
-
-    it('adds a filter for monitor status', async () => {
-      const mockEsClient = jest.fn();
-      mockEsClient.mockReturnValue(mockEsSearchResult);
-      await adapter.getAll({
-        callES: mockEsClient,
-        dateRangeStart: 'now-1h',
-        dateRangeEnd: 'now',
-        status: 'down',
-      });
-      delete expectedGetAllParams.body.size;
-      expectedGetAllParams.body.query.bool.filter.push({ term: { 'monitor.status': 'down' } });
-
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
-    });
-  });
-
-  describe('getLatestMonitorStatus', () => {
-    let expectedGetLatestSearchParams: any;
-    beforeEach(() => {
-      expectedGetLatestSearchParams = {
-        index: 'heartbeat-8*',
-        body: {
-          query: {
-            bool: {
-              filter: [
-                {
-                  range: {
-                    '@timestamp': {
-                      gte: 'now-1h',
-                      lte: 'now',
-                    },
-                  },
-                },
-                {
-                  term: { 'monitor.id': 'testMonitor' },
-                },
-              ],
-            },
-          },
-          aggs: {
-            by_id: {
-              terms: {
-                field: 'monitor.id',
-                size: 1000,
-              },
-              aggs: {
-                latest: {
-                  top_hits: {
-                    size: 1,
-                    sort: {
-                      '@timestamp': { order: 'desc' },
-                    },
-                  },
-                },
-              },
-            },
-          },
-          size: 0,
-        },
-      };
-      mockEsSearchResult = {
-        aggregations: {
-          by_id: {
-            buckets: [
-              {
-                latest: {
-                  hits: {
-                    hits: [
-                      {
-                        _source: {
-                          '@timestamp': 123456,
-                          monitor: {
-                            id: 'testMonitor',
-                          },
-                        },
-                      },
-                    ],
-                  },
-                },
-              },
-            ],
-          },
-        },
-      };
-    });
-
-    it('returns data in expected shape', async () => {
-      const mockEsClient = jest.fn(async (_request: any, _params: any) => mockEsSearchResult);
-      const result = await adapter.getLatestMonitorStatus({
-        callES: mockEsClient,
-        dateStart: 'now-1h',
-        dateEnd: 'now',
-        monitorId: 'testMonitor',
-      });
-      expect(result.timestamp).toBe(123456);
-      expect(result.monitor).not.toBeFalsy();
-      // @ts-ignore monitor will be defined
-      expect(result.monitor.id).toBe('testMonitor');
-      expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetLatestSearchParams);
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_pings.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_pings.ts
deleted file mode 100644
index 93e3a1bd9397b..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_pings.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { INDEX_NAMES } from '../../../../common/constants';
-import { HttpBody, Ping, PingResults } from '../../../../common/graphql/types';
-import { UMPingsAdapter } from './types';
-import { esGetPingHistogram } from './es_get_ping_historgram';
-
-export const elasticsearchPingsAdapter: UMPingsAdapter = {
-  getAll: async ({
-    callES,
-    dateRangeStart,
-    dateRangeEnd,
-    monitorId,
-    status,
-    sort,
-    size,
-    location,
-  }) => {
-    const sortParam = { sort: [{ '@timestamp': { order: sort ?? 'desc' } }] };
-    const sizeParam = size ? { size } : undefined;
-    const filter: any[] = [{ range: { '@timestamp': { gte: dateRangeStart, lte: dateRangeEnd } } }];
-    if (monitorId) {
-      filter.push({ term: { 'monitor.id': monitorId } });
-    }
-    if (status) {
-      filter.push({ term: { 'monitor.status': status } });
-    }
-
-    let postFilterClause = {};
-    if (location) {
-      postFilterClause = { post_filter: { term: { 'observer.geo.name': location } } };
-    }
-    const queryContext = { bool: { filter } };
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        query: {
-          ...queryContext,
-        },
-        ...sortParam,
-        ...sizeParam,
-        aggregations: {
-          locations: {
-            terms: {
-              field: 'observer.geo.name',
-              missing: 'N/A',
-              size: 1000,
-            },
-          },
-        },
-        ...postFilterClause,
-      },
-    };
-
-    const {
-      hits: { hits, total },
-      aggregations: aggs,
-    } = await callES('search', params);
-
-    const locations = get(aggs, 'locations', { buckets: [{ key: 'N/A', doc_count: 0 }] });
-
-    const pings: Ping[] = hits.map(({ _id, _source }: any) => {
-      const timestamp = _source['@timestamp'];
-
-      // Calculate here the length of the content string in bytes, this is easier than in client JS, where
-      // we don't have access to Buffer.byteLength. There are some hacky ways to do this in the
-      // client but this is cleaner.
-      const httpBody = get<HttpBody>(_source, 'http.response.body');
-      if (httpBody && httpBody.content) {
-        httpBody.content_bytes = Buffer.byteLength(httpBody.content);
-      }
-
-      return { id: _id, timestamp, ..._source };
-    });
-
-    const results: PingResults = {
-      total: total.value,
-      locations: locations.buckets.map((bucket: { key: string }) => bucket.key),
-      pings,
-    };
-
-    return results;
-  },
-
-  // Get The monitor latest state sorted by timestamp with date range
-  getLatestMonitorStatus: async ({ callES, dateStart, dateEnd, monitorId }) => {
-    // TODO: Write tests for this function
-
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        query: {
-          bool: {
-            filter: [
-              {
-                range: {
-                  '@timestamp': {
-                    gte: dateStart,
-                    lte: dateEnd,
-                  },
-                },
-              },
-              ...(monitorId ? [{ term: { 'monitor.id': monitorId } }] : []),
-            ],
-          },
-        },
-        size: 0,
-        aggs: {
-          by_id: {
-            terms: {
-              field: 'monitor.id',
-              size: 1000,
-            },
-            aggs: {
-              latest: {
-                top_hits: {
-                  size: 1,
-                  sort: {
-                    '@timestamp': { order: 'desc' },
-                  },
-                },
-              },
-            },
-          },
-        },
-      },
-    };
-
-    const result = await callES('search', params);
-    const ping: any = result.aggregations.by_id.buckets?.[0]?.latest.hits?.hits?.[0] ?? {};
-
-    return {
-      ...ping?._source,
-      timestamp: ping?._source?.['@timestamp'],
-    };
-  },
-
-  // Get the monitor meta info regardless of timestamp
-  getMonitor: async ({ callES, monitorId }) => {
-    const params = {
-      index: INDEX_NAMES.HEARTBEAT,
-      body: {
-        size: 1,
-        _source: ['url', 'monitor', 'observer'],
-        query: {
-          bool: {
-            filter: [
-              {
-                term: {
-                  'monitor.id': monitorId,
-                },
-              },
-            ],
-          },
-        },
-        sort: [
-          {
-            '@timestamp': {
-              order: 'desc',
-            },
-          },
-        ],
-      },
-    };
-
-    const result = await callES('search', params);
-
-    return result.hits.hits[0]?._source;
-  },
-
-  getPingHistogram: esGetPingHistogram,
-
-  getDocCount: async ({ callES }) => {
-    const { count } = await callES('count', { index: INDEX_NAMES.HEARTBEAT });
-
-    return { count };
-  },
-};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/stub_index_pattern.ts b/x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/stub_index_pattern.ts
deleted file mode 100644
index 49ec86af25040..0000000000000
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/stub_index_pattern/stub_index_pattern.ts
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { APICaller } from 'kibana/server';
-import {
-  IndexPatternsFetcher,
-  IIndexPattern,
-} from '../../../../../../../../src/plugins/data/server';
-import { INDEX_NAMES } from '../../../../common/constants';
-import { UMElasticsearchQueryFn } from '../framework';
-
-export interface StubIndexPatternAdapter {
-  getUptimeIndexPattern: UMElasticsearchQueryFn<any>;
-}
-
-export const stubIndexPatternAdapter: StubIndexPatternAdapter = {
-  getUptimeIndexPattern: async callES => {
-    const indexPatternsFetcher = new IndexPatternsFetcher((...rest: Parameters<APICaller>) =>
-      callES(...rest)
-    );
-
-    // Since `getDynamicIndexPattern` is called in setup_request (and thus by every endpoint)
-    // and since `getFieldsForWildcard` will throw if the specified indices don't exist,
-    // we have to catch errors here to avoid all endpoints returning 500 for users without APM data
-    // (would be a bad first time experience)
-    try {
-      const fields = await indexPatternsFetcher.getFieldsForWildcard({
-        pattern: INDEX_NAMES.HEARTBEAT,
-      });
-
-      const indexPattern: IIndexPattern = {
-        fields,
-        title: INDEX_NAMES.HEARTBEAT,
-      };
-
-      return indexPattern;
-    } catch (e) {
-      const notExists = e.output?.statusCode === 404;
-      if (notExists) {
-        // eslint-disable-next-line no-console
-        console.error(
-          `Could not get dynamic index pattern because indices "${INDEX_NAMES.HEARTBEAT}" don't exist`
-        );
-        return;
-      }
-
-      // re-throw
-      throw e;
-    }
-  },
-};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/compose/kibana.ts b/x-pack/legacy/plugins/uptime/server/lib/compose/kibana.ts
index b44a890de3819..875a5d9dc8c5c 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/compose/kibana.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/compose/kibana.ts
@@ -5,23 +5,19 @@
  */
 
 import { UMKibanaBackendFrameworkAdapter } from '../adapters/framework';
-import { elasticsearchMonitorsAdapter } from '../adapters/monitors';
-import { elasticsearchPingsAdapter } from '../adapters/pings';
+import * as requests from '../requests';
 import { licenseCheck } from '../domains';
 import { UMDomainLibs, UMServerLibs } from '../lib';
-import { elasticsearchMonitorStatesAdapter } from '../adapters/monitor_states';
-import { stubIndexPatternAdapter } from '../adapters/stub_index_pattern';
 import { UptimeCorePlugins, UptimeCoreSetup } from '../adapters/framework';
 
 export function compose(server: UptimeCoreSetup, plugins: UptimeCorePlugins): UMServerLibs {
   const framework = new UMKibanaBackendFrameworkAdapter(server);
 
   const domainLibs: UMDomainLibs = {
+    requests: {
+      ...requests,
+    },
     license: licenseCheck,
-    monitors: elasticsearchMonitorsAdapter,
-    monitorStates: elasticsearchMonitorStatesAdapter,
-    pings: elasticsearchPingsAdapter,
-    stubIndexPattern: stubIndexPatternAdapter,
   };
 
   return {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/helper/index.ts b/x-pack/legacy/plugins/uptime/server/lib/helper/index.ts
index eae8023b66ff4..0dcbc0a424b5e 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/helper/index.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/helper/index.ts
@@ -5,6 +5,7 @@
  */
 
 export { getFilterClause } from './get_filter_clause';
+export { parseRelativeDate } from './get_histogram_interval';
 export { getHistogramIntervalFormatted } from './get_histogram_interval_formatted';
 export { parseFilterQuery } from './parse_filter_query';
 export { assertCloseTo } from './assert_close_to';
diff --git a/x-pack/legacy/plugins/uptime/server/lib/lib.ts b/x-pack/legacy/plugins/uptime/server/lib/lib.ts
index e5ab9940d482d..a7121eaec6679 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/lib.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/lib.ts
@@ -4,21 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  UMBackendFrameworkAdapter,
-  UMMonitorsAdapter,
-  UMMonitorStatesAdapter,
-  UMPingsAdapter,
-  StubIndexPatternAdapter,
-} from './adapters';
+import { UMBackendFrameworkAdapter } from './adapters';
 import { UMLicenseCheck } from './domains';
+import { UptimeRequests } from './requests';
 
 export interface UMDomainLibs {
+  requests: UptimeRequests;
   license: UMLicenseCheck;
-  monitors: UMMonitorsAdapter;
-  monitorStates: UMMonitorStatesAdapter;
-  pings: UMPingsAdapter;
-  stubIndexPattern: StubIndexPatternAdapter;
 }
 
 export interface UMServerLibs extends UMDomainLibs {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/extract_filter_aggs_results.test.ts.snap b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/extract_filter_aggs_results.test.ts.snap
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/extract_filter_aggs_results.test.ts.snap
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/extract_filter_aggs_results.test.ts.snap
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/generate_filter_aggs.test.ts.snap b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/generate_filter_aggs.test.ts.snap
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/generate_filter_aggs.test.ts.snap
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/generate_filter_aggs.test.ts.snap
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/elasticsearch_monitors_adapter.test.ts.snap b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/get_monitor_charts.test.ts.snap
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/__snapshots__/elasticsearch_monitors_adapter.test.ts.snap
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/get_monitor_charts.test.ts.snap
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/__snapshots__/elasticsearch_pings_adapter.test.ts.snap b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/get_ping_histogram.test.ts.snap
similarity index 70%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/__snapshots__/elasticsearch_pings_adapter.test.ts.snap
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/get_ping_histogram.test.ts.snap
index 1b31f44557df0..0dafa5144c25a 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/__tests__/__snapshots__/elasticsearch_pings_adapter.test.ts.snap
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/__snapshots__/get_ping_histogram.test.ts.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram handles simple_text_query without issues 1`] = `
+exports[`getPingHistogram handles simple_text_query without issues 1`] = `
 Object {
   "histogram": Array [
     Object {
@@ -26,7 +26,7 @@ Object {
 }
 `;
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram handles status + additional user queries 1`] = `
+exports[`getPingHistogram handles status + additional user queries 1`] = `
 Object {
   "histogram": Array [
     Object {
@@ -52,7 +52,7 @@ Object {
 }
 `;
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram returns a down-filtered array for when filtered by down status 1`] = `
+exports[`getPingHistogram returns a down-filtered array for when filtered by down status 1`] = `
 Object {
   "histogram": Array [
     Object {
@@ -72,7 +72,7 @@ Object {
 }
 `;
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram returns a down-filtered array for when filtered by up status 1`] = `
+exports[`getPingHistogram returns a down-filtered array for when filtered by up status 1`] = `
 Object {
   "histogram": Array [
     Object {
@@ -92,7 +92,7 @@ Object {
 }
 `;
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram returns a single bucket if array has 1 1`] = `
+exports[`getPingHistogram returns a single bucket if array has 1 1`] = `
 Object {
   "histogram": Array [
     Object {
@@ -106,7 +106,7 @@ Object {
 }
 `;
 
-exports[`ElasticsearchPingsAdapter class getPingHistogram returns expected result for no status filter 1`] = `
+exports[`getPingHistogram returns expected result for no status filter 1`] = `
 Object {
   "histogram": Array [
     Object {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/combine_range_with_filters.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/combine_range_with_filters.test.ts
similarity index 96%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/combine_range_with_filters.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/combine_range_with_filters.test.ts
index 2075b3a8fbe0f..31d19dab290da 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/combine_range_with_filters.test.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/combine_range_with_filters.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { combineRangeWithFilters } from '../elasticsearch_monitors_adapter';
+import { combineRangeWithFilters } from '../get_filter_bar';
 
 describe('combineRangeWithFilters', () => {
   it('combines filters that have no filter clause', () => {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/extract_filter_aggs_results.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/extract_filter_aggs_results.test.ts
similarity index 96%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/extract_filter_aggs_results.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/extract_filter_aggs_results.test.ts
index 954cffd4c9522..19fd0fda8d83e 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/extract_filter_aggs_results.test.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/extract_filter_aggs_results.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { extractFilterAggsResults } from '../elasticsearch_monitors_adapter';
+import { extractFilterAggsResults } from '../get_filter_bar';
 
 describe('extractFilterAggsResults', () => {
   it('extracts the bucket values of the expected filter fields', () => {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/generate_filter_aggs.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/generate_filter_aggs.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/generate_filter_aggs.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/generate_filter_aggs.test.ts
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_doc_count.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_doc_count.test.ts
new file mode 100644
index 0000000000000..7dfb0314fe8dd
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_doc_count.test.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getDocCount } from '../get_doc_count';
+
+describe('getDocCount', () => {
+  let mockHits: any[];
+  let mockEsCountResult: any;
+
+  beforeEach(() => {
+    mockHits = [
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:51:59.792Z',
+        },
+      },
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:53:59.792Z',
+        },
+      },
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:55:59.792Z',
+        },
+      },
+    ];
+    mockEsCountResult = {
+      count: mockHits.length,
+    };
+  });
+
+  it('returns data in appropriate shape', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsCountResult);
+    const { count } = await getDocCount({ callES: mockEsClient });
+    expect(count).toEqual(3);
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_latest_monitor.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_latest_monitor.test.ts
new file mode 100644
index 0000000000000..ad0987a7f6faf
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_latest_monitor.test.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getLatestMonitor } from '../get_latest_monitor';
+
+describe('getLatestMonitor', () => {
+  let expectedGetLatestSearchParams: any;
+  let mockEsSearchResult: any;
+  beforeEach(() => {
+    expectedGetLatestSearchParams = {
+      index: 'heartbeat-8*',
+      body: {
+        query: {
+          bool: {
+            filter: [
+              {
+                range: {
+                  '@timestamp': {
+                    gte: 'now-1h',
+                    lte: 'now',
+                  },
+                },
+              },
+              {
+                term: { 'monitor.id': 'testMonitor' },
+              },
+            ],
+          },
+        },
+        aggs: {
+          by_id: {
+            terms: {
+              field: 'monitor.id',
+              size: 1000,
+            },
+            aggs: {
+              latest: {
+                top_hits: {
+                  size: 1,
+                  sort: {
+                    '@timestamp': { order: 'desc' },
+                  },
+                },
+              },
+            },
+          },
+        },
+        size: 0,
+      },
+    };
+    mockEsSearchResult = {
+      aggregations: {
+        by_id: {
+          buckets: [
+            {
+              latest: {
+                hits: {
+                  hits: [
+                    {
+                      _source: {
+                        '@timestamp': 123456,
+                        monitor: {
+                          id: 'testMonitor',
+                        },
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          ],
+        },
+      },
+    };
+  });
+
+  it('returns data in expected shape', async () => {
+    const mockEsClient = jest.fn(async (_request: any, _params: any) => mockEsSearchResult);
+    const result = await getLatestMonitor({
+      callES: mockEsClient,
+      dateStart: 'now-1h',
+      dateEnd: 'now',
+      monitorId: 'testMonitor',
+    });
+    expect(result.timestamp).toBe(123456);
+    expect(result.monitor).not.toBeFalsy();
+    expect(result?.monitor?.id).toBe('testMonitor');
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetLatestSearchParams);
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/elasticsearch_monitors_adapter.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_monitor_charts.test.ts
similarity index 88%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/elasticsearch_monitors_adapter.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_monitor_charts.test.ts
index e3e81fe360718..205f9cf745db1 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/elasticsearch_monitors_adapter.test.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_monitor_charts.test.ts
@@ -5,17 +5,16 @@
  */
 
 import { get, set } from 'lodash';
-import { elasticsearchMonitorsAdapter as adapter } from '../elasticsearch_monitors_adapter';
 import mockChartsData from './monitor_charts_mock.json';
-import { assertCloseTo } from '../../../helper';
+import { assertCloseTo } from '../../helper';
+import { getMonitorCharts } from '../get_monitor_charts';
 
-// FIXME: there are many untested functions in this adapter. They should be tested.
 describe('ElasticsearchMonitorsAdapter', () => {
   it('getMonitorChartsData will run expected parameters when no location is specified', async () => {
     expect.assertions(3);
     const searchMock = jest.fn();
     const search = searchMock.bind({});
-    await adapter.getMonitorChartsData({
+    await getMonitorCharts({
       callES: search,
       monitorId: 'fooID',
       dateRangeStart: 'now-15m',
@@ -50,7 +49,7 @@ describe('ElasticsearchMonitorsAdapter', () => {
     expect.assertions(3);
     const searchMock = jest.fn();
     const search = searchMock.bind({});
-    await adapter.getMonitorChartsData({
+    await getMonitorCharts({
       callES: search,
       monitorId: 'fooID',
       dateRangeStart: 'now-15m',
@@ -87,7 +86,7 @@ describe('ElasticsearchMonitorsAdapter', () => {
     searchMock.mockReturnValue(mockChartsData);
     const search = searchMock.bind({});
     expect(
-      await adapter.getMonitorChartsData({
+      await getMonitorCharts({
         callES: search,
         monitorId: 'id',
         dateRangeStart: 'now-15m',
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_ping_histogram.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_ping_histogram.test.ts
new file mode 100644
index 0000000000000..7d98b77069264
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_ping_histogram.test.ts
@@ -0,0 +1,241 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getPingHistogram } from '../get_ping_histogram';
+
+describe('getPingHistogram', () => {
+  const standardMockResponse: any = {
+    aggregations: {
+      timeseries: {
+        buckets: [
+          {
+            key: 1,
+            up: {
+              doc_count: 2,
+            },
+            down: {
+              doc_count: 1,
+            },
+          },
+          {
+            key: 2,
+            up: {
+              doc_count: 2,
+            },
+            down: {
+              bucket_count: 1,
+            },
+          },
+        ],
+      },
+    },
+  };
+
+  it('returns a single bucket if array has 1', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue({
+      aggregations: {
+        timeseries: {
+          buckets: [
+            {
+              key: 1,
+              up: {
+                doc_count: 2,
+              },
+              down: {
+                doc_count: 1,
+              },
+            },
+          ],
+          interval: '10s',
+        },
+      },
+    });
+
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: 'now-15m',
+      to: 'now',
+      filters: null,
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+
+  it('returns expected result for no status filter', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+
+    standardMockResponse.aggregations.timeseries.interval = '1m';
+    mockEsClient.mockReturnValue(standardMockResponse);
+
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: 'now-15m',
+      to: 'now',
+      filters: null,
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+
+  it('handles status + additional user queries', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+
+    mockEsClient.mockReturnValue({
+      aggregations: {
+        timeseries: {
+          buckets: [
+            {
+              key: 1,
+              up: {
+                doc_count: 2,
+              },
+              down: {
+                doc_count: 1,
+              },
+            },
+            {
+              key: 2,
+              up: {
+                doc_count: 2,
+              },
+              down: {
+                doc_count: 2,
+              },
+            },
+            {
+              key: 3,
+              up: {
+                doc_count: 3,
+              },
+              down: {
+                doc_count: 1,
+              },
+            },
+          ],
+          interval: '1h',
+        },
+      },
+    });
+
+    const searchFilter = {
+      bool: {
+        must: [
+          { match: { 'monitor.id': { query: 'auto-http-0X89BB0F9A6C81D178', operator: 'and' } } },
+          { match: { 'monitor.name': { query: 'my-new-test-site-name', operator: 'and' } } },
+        ],
+      },
+    };
+
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: '1234',
+      to: '5678',
+      filters: JSON.stringify(searchFilter),
+      monitorId: undefined,
+      statusFilter: 'down',
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+
+  it('handles simple_text_query without issues', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+
+    mockEsClient.mockReturnValue({
+      aggregations: {
+        timeseries: {
+          buckets: [
+            {
+              key: 1,
+              up: {
+                doc_count: 2,
+              },
+              down: {
+                doc_count: 1,
+              },
+            },
+            {
+              key: 2,
+              up: {
+                doc_count: 1,
+              },
+              down: {
+                doc_count: 2,
+              },
+            },
+            {
+              key: 3,
+              up: {
+                doc_count: 3,
+              },
+              down: {
+                doc_count: 1,
+              },
+            },
+          ],
+          interval: '1m',
+        },
+      },
+    });
+
+    const filters = `{"bool":{"must":[{"simple_query_string":{"query":"http"}}]}}`;
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: 'now-15m',
+      to: 'now',
+      filters,
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+
+  it('returns a down-filtered array for when filtered by down status', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+    standardMockResponse.aggregations.timeseries.interval = '1d';
+    mockEsClient.mockReturnValue(standardMockResponse);
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: '1234',
+      to: '5678',
+      filters: '',
+      monitorId: undefined,
+      statusFilter: 'down',
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+
+  it('returns a down-filtered array for when filtered by up status', async () => {
+    expect.assertions(2);
+    const mockEsClient = jest.fn();
+
+    standardMockResponse.aggregations.timeseries.interval = '1s';
+    mockEsClient.mockReturnValue(standardMockResponse);
+
+    const result = await getPingHistogram({
+      callES: mockEsClient,
+      from: '1234',
+      to: '5678',
+      filters: '',
+      monitorId: undefined,
+      statusFilter: 'up',
+    });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(result).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_pings.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_pings.test.ts
new file mode 100644
index 0000000000000..ab20a958f3d97
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/get_pings.test.ts
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getPings } from '../get_pings';
+import { set } from 'lodash';
+
+describe('getAll', () => {
+  let mockEsSearchResult: any;
+  let mockHits: any;
+  let expectedGetAllParams: any;
+  beforeEach(() => {
+    mockHits = [
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:51:59.792Z',
+        },
+      },
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:53:59.792Z',
+        },
+      },
+      {
+        _source: {
+          '@timestamp': '2018-10-30T18:55:59.792Z',
+        },
+      },
+    ];
+    mockEsSearchResult = {
+      hits: {
+        total: {
+          value: mockHits.length,
+        },
+        hits: mockHits,
+      },
+      aggregations: {
+        locations: {
+          buckets: [{ key: 'foo' }],
+        },
+      },
+    };
+    expectedGetAllParams = {
+      index: 'heartbeat-8*',
+      body: {
+        query: {
+          bool: {
+            filter: [{ range: { '@timestamp': { gte: 'now-1h', lte: 'now' } } }],
+          },
+        },
+        aggregations: {
+          locations: {
+            terms: {
+              field: 'observer.geo.name',
+              missing: 'N/A',
+              size: 1000,
+            },
+          },
+        },
+        sort: [{ '@timestamp': { order: 'desc' } }],
+        size: 12,
+      },
+    };
+  });
+
+  it('returns data in the appropriate shape', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    const result = await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      sort: 'asc',
+      size: 12,
+    });
+    const count = 3;
+
+    expect(result.total).toBe(count);
+
+    const pings = result.pings!;
+    expect(pings).toHaveLength(count);
+    expect(pings[0].timestamp).toBe('2018-10-30T18:51:59.792Z');
+    expect(pings[1].timestamp).toBe('2018-10-30T18:53:59.792Z');
+    expect(pings[2].timestamp).toBe('2018-10-30T18:55:59.792Z');
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+  });
+
+  it('creates appropriate sort and size parameters', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      sort: 'asc',
+      size: 12,
+    });
+    set(expectedGetAllParams, 'body.sort[0]', { '@timestamp': { order: 'asc' } });
+
+    expect(mockEsClient).toHaveBeenCalledTimes(1);
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
+  });
+
+  it('omits the sort param when no sort passed', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      size: 12,
+    });
+
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
+  });
+
+  it('omits the size param when no size passed', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      sort: 'desc',
+    });
+    delete expectedGetAllParams.body.size;
+    set(expectedGetAllParams, 'body.sort[0].@timestamp.order', 'desc');
+
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
+  });
+
+  it('adds a filter for monitor ID', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      monitorId: 'testmonitorid',
+    });
+    delete expectedGetAllParams.body.size;
+    expectedGetAllParams.body.query.bool.filter.push({ term: { 'monitor.id': 'testmonitorid' } });
+
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
+  });
+
+  it('adds a filter for monitor status', async () => {
+    const mockEsClient = jest.fn();
+    mockEsClient.mockReturnValue(mockEsSearchResult);
+    await getPings({
+      callES: mockEsClient,
+      dateRangeStart: 'now-1h',
+      dateRangeEnd: 'now',
+      status: 'down',
+    });
+    delete expectedGetAllParams.body.size;
+    expectedGetAllParams.body.query.bool.filter.push({ term: { 'monitor.status': 'down' } });
+
+    expect(mockEsClient).toHaveBeenCalledWith('search', expectedGetAllParams);
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/monitor_charts_mock.json b/x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/monitor_charts_mock.json
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/__tests__/monitor_charts_mock.json
rename to x-pack/legacy/plugins/uptime/server/lib/requests/__tests__/monitor_charts_mock.json
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/generate_filter_aggs.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/generate_filter_aggs.ts
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitors/generate_filter_aggs.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/generate_filter_aggs.ts
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_doc_count.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_doc_count.ts
new file mode 100644
index 0000000000000..68c122aaaa9fb
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_doc_count.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DocCount } from '../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../common/constants';
+import { UMElasticsearchQueryFn } from '../adapters';
+
+export const getDocCount: UMElasticsearchQueryFn<{}, DocCount> = async ({ callES }) => {
+  const { count } = await callES('count', { index: INDEX_NAMES.HEARTBEAT });
+
+  return { count };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_filter_bar.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_filter_bar.ts
new file mode 100644
index 0000000000000..79259afe2b9eb
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_filter_bar.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { OverviewFilters } from '../../../common/runtime_types';
+import { generateFilterAggs } from './generate_filter_aggs';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export interface GetFilterBarParams {
+  /** @param dateRangeStart timestamp bounds */
+  dateRangeStart: string;
+  /** @member dateRangeEnd timestamp bounds */
+  dateRangeEnd: string;
+  /** @member search this value should correspond to Elasticsearch DSL
+   *  generated from KQL text the user provided.
+   */
+  search?: Record<string, any>;
+  filterOptions: Record<string, string[] | number[]>;
+}
+
+export const combineRangeWithFilters = (
+  dateRangeStart: string,
+  dateRangeEnd: string,
+  filters?: Record<string, any>
+) => {
+  const range = {
+    range: {
+      '@timestamp': {
+        gte: dateRangeStart,
+        lte: dateRangeEnd,
+      },
+    },
+  };
+  if (!filters) return range;
+  const clientFiltersList = Array.isArray(filters?.bool?.filter ?? {})
+    ? // i.e. {"bool":{"filter":{ ...some nested filter objects }}}
+      filters.bool.filter
+    : // i.e. {"bool":{"filter":[ ...some listed filter objects ]}}
+      Object.keys(filters?.bool?.filter ?? {}).map(key => ({
+        ...filters?.bool?.filter?.[key],
+      }));
+  filters.bool.filter = [...clientFiltersList, range];
+  return filters;
+};
+
+type SupportedFields = 'locations' | 'ports' | 'schemes' | 'tags';
+
+export const extractFilterAggsResults = (
+  responseAggregations: Record<string, any>,
+  keys: SupportedFields[]
+): OverviewFilters => {
+  const values: OverviewFilters = {
+    locations: [],
+    ports: [],
+    schemes: [],
+    tags: [],
+  };
+  keys.forEach(key => {
+    const buckets = responseAggregations[key]?.term?.buckets ?? [];
+    values[key] = buckets.map((item: { key: string | number }) => item.key);
+  });
+  return values;
+};
+
+export const getFilterBar: UMElasticsearchQueryFn<GetFilterBarParams, OverviewFilters> = async ({
+  callES,
+  dateRangeStart,
+  dateRangeEnd,
+  search,
+  filterOptions,
+}) => {
+  const aggs = generateFilterAggs(
+    [
+      { aggName: 'locations', filterName: 'locations', field: 'observer.geo.name' },
+      { aggName: 'ports', filterName: 'ports', field: 'url.port' },
+      { aggName: 'schemes', filterName: 'schemes', field: 'monitor.type' },
+      { aggName: 'tags', filterName: 'tags', field: 'tags' },
+    ],
+    filterOptions
+  );
+  const filters = combineRangeWithFilters(dateRangeStart, dateRangeEnd, search);
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      size: 0,
+      query: {
+        ...filters,
+      },
+      aggs,
+    },
+  };
+
+  const { aggregations } = await callES('search', params);
+  return extractFilterAggsResults(aggregations, ['tags', 'locations', 'ports', 'schemes']);
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_index_pattern.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_index_pattern.ts
new file mode 100644
index 0000000000000..4b40f800b6779
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_index_pattern.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { APICaller } from 'src/core/server';
+import { UMElasticsearchQueryFn } from '../adapters';
+import { IndexPatternsFetcher, IIndexPattern } from '../../../../../../../src/plugins/data/server';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export const getUptimeIndexPattern: UMElasticsearchQueryFn<any, {}> = async callES => {
+  const indexPatternsFetcher = new IndexPatternsFetcher((...rest: Parameters<APICaller>) =>
+    callES(...rest)
+  );
+
+  // Since `getDynamicIndexPattern` is called in setup_request (and thus by every endpoint)
+  // and since `getFieldsForWildcard` will throw if the specified indices don't exist,
+  // we have to catch errors here to avoid all endpoints returning 500 for users without APM data
+  // (would be a bad first time experience)
+  try {
+    const fields = await indexPatternsFetcher.getFieldsForWildcard({
+      pattern: INDEX_NAMES.HEARTBEAT,
+    });
+
+    const indexPattern: IIndexPattern = {
+      fields,
+      title: INDEX_NAMES.HEARTBEAT,
+    };
+
+    return indexPattern;
+  } catch (e) {
+    const notExists = e.output?.statusCode === 404;
+    if (notExists) {
+      // eslint-disable-next-line no-console
+      console.error(
+        `Could not get dynamic index pattern because indices "${INDEX_NAMES.HEARTBEAT}" don't exist`
+      );
+      return;
+    }
+
+    // re-throw
+    throw e;
+  }
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_latest_monitor.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_latest_monitor.ts
new file mode 100644
index 0000000000000..bfaee3f2bf7ee
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_latest_monitor.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { Ping } from '../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export interface GetLatestMonitorParams {
+  /** @member dateRangeStart timestamp bounds */
+  dateStart: string;
+
+  /** @member dateRangeEnd timestamp bounds */
+  dateEnd: string;
+
+  /** @member monitorId optional limit to monitorId */
+  monitorId?: string | null;
+}
+
+// Get The monitor latest state sorted by timestamp with date range
+export const getLatestMonitor: UMElasticsearchQueryFn<GetLatestMonitorParams, Ping> = async ({
+  callES,
+  dateStart,
+  dateEnd,
+  monitorId,
+}) => {
+  // TODO: Write tests for this function
+
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      query: {
+        bool: {
+          filter: [
+            {
+              range: {
+                '@timestamp': {
+                  gte: dateStart,
+                  lte: dateEnd,
+                },
+              },
+            },
+            ...(monitorId ? [{ term: { 'monitor.id': monitorId } }] : []),
+          ],
+        },
+      },
+      size: 0,
+      aggs: {
+        by_id: {
+          terms: {
+            field: 'monitor.id',
+            size: 1000,
+          },
+          aggs: {
+            latest: {
+              top_hits: {
+                size: 1,
+                sort: {
+                  '@timestamp': { order: 'desc' },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  const result = await callES('search', params);
+  const ping: any = result.aggregations.by_id.buckets?.[0]?.latest.hits?.hits?.[0] ?? {};
+
+  return {
+    ...ping?._source,
+    timestamp: ping?._source?.['@timestamp'],
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor.ts
new file mode 100644
index 0000000000000..94175616f374e
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { Ping } from '../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export interface GetMonitorParams {
+  /** @member monitorId optional limit to monitorId */
+  monitorId?: string | null;
+}
+
+// Get the monitor meta info regardless of timestamp
+export const getMonitor: UMElasticsearchQueryFn<GetMonitorParams, Ping> = async ({
+  callES,
+  monitorId,
+}) => {
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      size: 1,
+      _source: ['url', 'monitor', 'observer'],
+      query: {
+        bool: {
+          filter: [
+            {
+              term: {
+                'monitor.id': monitorId,
+              },
+            },
+          ],
+        },
+      },
+      sort: [
+        {
+          '@timestamp': {
+            order: 'desc',
+          },
+        },
+      ],
+    },
+  };
+
+  const result = await callES('search', params);
+
+  return result.hits.hits[0]?._source;
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_charts.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_charts.ts
new file mode 100644
index 0000000000000..b97cc7287e921
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_charts.ts
@@ -0,0 +1,176 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { INDEX_NAMES } from '../../../common/constants';
+import { getHistogramIntervalFormatted } from '../helper';
+import { MonitorChart, LocationDurationLine } from '../../../common/graphql/types';
+
+export interface GetMonitorChartsParams {
+  /** @member monitorId ID value for the selected monitor */
+  monitorId: string;
+  /** @member dateRangeStart timestamp bounds */
+  dateRangeStart: string;
+  /** @member dateRangeEnd timestamp bounds */
+  dateRangeEnd: string;
+  /** @member location optional location value for use in filtering*/
+  location?: string | null;
+}
+
+const formatStatusBuckets = (time: any, buckets: any, docCount: any) => {
+  let up = null;
+  let down = null;
+
+  buckets.forEach((bucket: any) => {
+    if (bucket.key === 'up') {
+      up = bucket.doc_count;
+    } else if (bucket.key === 'down') {
+      down = bucket.doc_count;
+    }
+  });
+
+  return {
+    x: time,
+    up,
+    down,
+    total: docCount,
+  };
+};
+
+/**
+ * Fetches data used to populate monitor charts
+ */
+export const getMonitorCharts: UMElasticsearchQueryFn<
+  GetMonitorChartsParams,
+  MonitorChart
+> = async ({ callES, dateRangeStart, dateRangeEnd, monitorId, location }) => {
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      query: {
+        bool: {
+          filter: [
+            { range: { '@timestamp': { gte: dateRangeStart, lte: dateRangeEnd } } },
+            { term: { 'monitor.id': monitorId } },
+            { term: { 'monitor.status': 'up' } },
+            // if location is truthy, add it as a filter. otherwise add nothing
+            ...(!!location ? [{ term: { 'observer.geo.name': location } }] : []),
+          ],
+        },
+      },
+      size: 0,
+      aggs: {
+        timeseries: {
+          date_histogram: {
+            field: '@timestamp',
+            fixed_interval: getHistogramIntervalFormatted(dateRangeStart, dateRangeEnd),
+            min_doc_count: 0,
+          },
+          aggs: {
+            location: {
+              terms: {
+                field: 'observer.geo.name',
+                missing: 'N/A',
+              },
+              aggs: {
+                status: { terms: { field: 'monitor.status', size: 2, shard_size: 2 } },
+                duration: { stats: { field: 'monitor.duration.us' } },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  const result = await callES('search', params);
+
+  const dateHistogramBuckets: any[] = result?.aggregations?.timeseries?.buckets ?? [];
+
+  /**
+   * The code below is responsible for formatting the aggregation data we fetched above in a way
+   * that the chart components used by the client understands.
+   * There are five required values. Two are lists of points that conform to a simple (x,y) structure.
+   *
+   * The third list is for an area chart expressing a range, and it requires an (x,y,y0) structure,
+   * where y0 is the min value for the point and y is the max.
+   *
+   * Additionally, we supply the maximum value for duration and status, so the corresponding charts know
+   * what the domain size should be.
+   */
+  const monitorChartsData: MonitorChart = {
+    locationDurationLines: [],
+    status: [],
+    durationMaxValue: 0,
+    statusMaxCount: 0,
+  };
+
+  /**
+   * The following section of code enables us to provide buckets per location
+   * that have a `null` value if there is no data at the given timestamp.
+   *
+   * We maintain two `Set`s. One is per bucket, the other is persisted for the
+   * entire collection. At the end of a bucket's evaluation, if there was no object
+   * parsed for a given location line that was already started, we insert an element
+   * to the given line with a null value. Without this, our charts on the client will
+   * display a continuous line for each of the points they are provided.
+   */
+
+  // a set of all the locations found for this result
+  const resultLocations = new Set<string>();
+  const linesByLocation: { [key: string]: LocationDurationLine } = {};
+  dateHistogramBuckets.forEach(dateHistogramBucket => {
+    const x = dateHistogramBucket.key;
+    const docCount = dateHistogramBucket?.doc_count ?? 0;
+    // a set of all the locations for the current bucket
+    const bucketLocations = new Set<string>();
+
+    dateHistogramBucket.location.buckets.forEach(
+      (locationBucket: { key: string; duration: { avg: number } }) => {
+        const locationName = locationBucket.key;
+        // store the location name in each set
+        bucketLocations.add(locationName);
+        resultLocations.add(locationName);
+
+        // create a new line for this location if it doesn't exist
+        let currentLine: LocationDurationLine = linesByLocation?.[locationName] ?? undefined;
+        if (!currentLine) {
+          currentLine = { name: locationName, line: [] };
+          linesByLocation[locationName] = currentLine;
+          monitorChartsData.locationDurationLines.push(currentLine);
+        }
+        // add the entry for the current location's duration average
+        currentLine.line.push({ x, y: locationBucket?.duration?.avg ?? null });
+      }
+    );
+
+    // if there are more lines in the result than are represented in the current bucket,
+    // we must add null entries
+    if (dateHistogramBucket.location.buckets.length < resultLocations.size) {
+      resultLocations.forEach(resultLocation => {
+        // the current bucket has a value for this location, do nothing
+        if (location && location !== resultLocation) return;
+        // the current bucket had no value for this location, insert a null value
+        if (!bucketLocations.has(resultLocation)) {
+          const locationLine = monitorChartsData.locationDurationLines.find(
+            ({ name }) => name === resultLocation
+          );
+          // in practice, there should always be a line present, but `find` can return `undefined`
+          if (locationLine) {
+            // this will create a gap in the line like we desire
+            locationLine.line.push({ x, y: null });
+          }
+        }
+      });
+    }
+
+    monitorChartsData.status.push(
+      formatStatusBuckets(x, dateHistogramBucket?.status?.buckets ?? [], docCount)
+    );
+  });
+
+  return monitorChartsData;
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_details.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_details.ts
new file mode 100644
index 0000000000000..b516fde1ce844
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_details.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { MonitorDetails, MonitorError } from '../../../common/runtime_types';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export interface GetMonitorDetailsParams {
+  monitorId: string;
+  dateStart: string;
+  dateEnd: string;
+}
+
+export const getMonitorDetails: UMElasticsearchQueryFn<
+  GetMonitorDetailsParams,
+  MonitorDetails
+> = async ({ callES, monitorId, dateStart, dateEnd }) => {
+  const queryFilters: any = [
+    {
+      range: {
+        '@timestamp': {
+          gte: dateStart,
+          lte: dateEnd,
+        },
+      },
+    },
+    {
+      term: {
+        'monitor.id': monitorId,
+      },
+    },
+  ];
+
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      size: 1,
+      _source: ['error', '@timestamp'],
+      query: {
+        bool: {
+          must: [
+            {
+              exists: {
+                field: 'error',
+              },
+            },
+          ],
+          filter: queryFilters,
+        },
+      },
+      sort: [
+        {
+          '@timestamp': {
+            order: 'desc',
+          },
+        },
+      ],
+    },
+  };
+
+  const result = await callES('search', params);
+
+  const data = result.hits.hits[0]?._source;
+
+  const monitorError: MonitorError | undefined = data?.error;
+  const errorTimeStamp: string | undefined = data?.['@timestamp'];
+
+  return {
+    monitorId,
+    error: monitorError,
+    timestamp: errorTimeStamp,
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_locations.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_locations.ts
new file mode 100644
index 0000000000000..e1a0e14fe951d
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_locations.ts
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { INDEX_NAMES, UNNAMED_LOCATION } from '../../../common/constants';
+import { MonitorLocations, MonitorLocation } from '../../../common/runtime_types';
+
+/**
+ * Fetch data for the monitor page title.
+ */
+export interface GetMonitorLocationsParams {
+  /**
+   * @member monitorId the ID to query
+   */
+  monitorId: string;
+  dateStart: string;
+  dateEnd: string;
+}
+
+export const getMonitorLocations: UMElasticsearchQueryFn<
+  GetMonitorLocationsParams,
+  MonitorLocations
+> = async ({ callES, monitorId, dateStart, dateEnd }) => {
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      size: 0,
+      query: {
+        bool: {
+          filter: [
+            {
+              match: {
+                'monitor.id': monitorId,
+              },
+            },
+            {
+              exists: {
+                field: 'summary',
+              },
+            },
+            {
+              range: {
+                '@timestamp': {
+                  gte: dateStart,
+                  lte: dateEnd,
+                },
+              },
+            },
+          ],
+        },
+      },
+      aggs: {
+        location: {
+          terms: {
+            field: 'observer.geo.name',
+            missing: '__location_missing__',
+          },
+          aggs: {
+            most_recent: {
+              top_hits: {
+                size: 1,
+                sort: {
+                  '@timestamp': {
+                    order: 'desc',
+                  },
+                },
+                _source: ['monitor', 'summary', 'observer', '@timestamp'],
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+
+  const result = await callES('search', params);
+  const locations = result?.aggregations?.location?.buckets ?? [];
+
+  const getGeo = (locGeo: { name: string; location?: string }) => {
+    if (locGeo) {
+      const { name, location } = locGeo;
+      const latLon = location?.trim().split(',');
+      return {
+        name,
+        location: latLon
+          ? {
+              lat: latLon[0],
+              lon: latLon[1],
+            }
+          : undefined,
+      };
+    } else {
+      return {
+        name: UNNAMED_LOCATION,
+      };
+    }
+  };
+
+  const monLocs: MonitorLocation[] = [];
+  locations.forEach((loc: any) => {
+    const mostRecentLocation = loc.most_recent.hits.hits[0]._source;
+    const location: MonitorLocation = {
+      summary: mostRecentLocation?.summary,
+      geo: getGeo(mostRecentLocation?.observer?.geo),
+      timestamp: mostRecentLocation['@timestamp'],
+    };
+    monLocs.push(location);
+  });
+
+  return {
+    monitorId,
+    locations: monLocs,
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_states.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_states.ts
new file mode 100644
index 0000000000000..32c82b1fa2098
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_monitor_states.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CONTEXT_DEFAULTS } from '../../../common/constants';
+import { fetchPage } from './search';
+import { UMElasticsearchQueryFn } from '../adapters';
+import { MonitorSummary, SortOrder, CursorDirection } from '../../../common/graphql/types';
+import { QueryContext } from './search';
+
+export interface CursorPagination {
+  cursorKey?: any;
+  cursorDirection: CursorDirection;
+  sortOrder: SortOrder;
+}
+
+export interface GetMonitorStatesParams {
+  dateRangeStart: string;
+  dateRangeEnd: string;
+  pagination?: CursorPagination;
+  filters?: string | null;
+  statusFilter?: string;
+}
+
+export interface GetMonitorStatesResult {
+  summaries: MonitorSummary[];
+  nextPagePagination: string | null;
+  prevPagePagination: string | null;
+}
+
+// To simplify the handling of the group of pagination vars they're passed back to the client as a string
+const jsonifyPagination = (p: any): string | null => {
+  if (!p) {
+    return null;
+  }
+
+  return JSON.stringify(p);
+};
+
+// Gets a page of monitor states.
+export const getMonitorStates: UMElasticsearchQueryFn<
+  GetMonitorStatesParams,
+  GetMonitorStatesResult
+> = async ({ callES, dateRangeStart, dateRangeEnd, pagination, filters, statusFilter }) => {
+  pagination = pagination || CONTEXT_DEFAULTS.CURSOR_PAGINATION;
+  statusFilter = statusFilter === null ? undefined : statusFilter;
+  const size = 10;
+
+  const queryContext = new QueryContext(
+    callES,
+    dateRangeStart,
+    dateRangeEnd,
+    pagination,
+    filters && filters !== '' ? JSON.parse(filters) : null,
+    size,
+    statusFilter
+  );
+
+  const page = await fetchPage(queryContext);
+
+  return {
+    summaries: page.items,
+    nextPagePagination: jsonifyPagination(page.nextPagePagination),
+    prevPagePagination: jsonifyPagination(page.prevPagePagination),
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_get_ping_historgram.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_ping_histogram.ts
similarity index 60%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_get_ping_historgram.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/get_ping_histogram.ts
index 66cae497eb081..3b448dc31659b 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/es_get_ping_historgram.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_ping_histogram.ts
@@ -4,17 +4,29 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { get } from 'lodash';
-import { INDEX_NAMES, QUERY } from '../../../../common/constants';
-import { parseFilterQuery, getFilterClause } from '../../helper';
-import { UMElasticsearchQueryFn } from '../framework';
-import { GetPingHistogramParams, HistogramResult } from '../../../../common/types';
+import { UMElasticsearchQueryFn } from '../adapters';
+import { parseFilterQuery, getFilterClause } from '../helper';
+import { INDEX_NAMES, QUERY } from '../../../common/constants';
 import { HistogramQueryResult } from './types';
+import { HistogramResult } from '../../../common/types';
 
-export const esGetPingHistogram: UMElasticsearchQueryFn<
+export interface GetPingHistogramParams {
+  /** @member dateRangeStart timestamp bounds */
+  from: string;
+  /** @member dateRangeEnd timestamp bounds */
+  to: string;
+  /** @member filters user-defined filters */
+  filters?: string | null;
+  /** @member monitorId optional limit to monitorId */
+  monitorId?: string | null;
+  /** @member statusFilter special filter targeting the latest status of each monitor */
+  statusFilter?: string | null;
+}
+
+export const getPingHistogram: UMElasticsearchQueryFn<
   GetPingHistogramParams,
   HistogramResult
-> = async ({ callES, dateStart, dateEnd, filters, monitorId, statusFilter }) => {
+> = async ({ callES, from, to, filters, monitorId, statusFilter }) => {
   const boolFilters = parseFilterQuery(filters);
   const additionalFilters = [];
   if (monitorId) {
@@ -23,7 +35,7 @@ export const esGetPingHistogram: UMElasticsearchQueryFn<
   if (boolFilters) {
     additionalFilters.push(boolFilters);
   }
-  const filter = getFilterClause(dateStart, dateEnd, additionalFilters);
+  const filter = getFilterClause(from, to, additionalFilters);
 
   const params = {
     index: INDEX_NAMES.HEARTBEAT,
@@ -63,11 +75,11 @@ export const esGetPingHistogram: UMElasticsearchQueryFn<
 
   const result = await callES('search', params);
   const interval = result.aggregations.timeseries?.interval;
-  const buckets: HistogramQueryResult[] = get(result, 'aggregations.timeseries.buckets', []);
+  const buckets: HistogramQueryResult[] = result?.aggregations?.timeseries?.buckets ?? [];
   const histogram = buckets.map(bucket => {
-    const x: number = get(bucket, 'key');
-    const downCount: number = get(bucket, 'down.doc_count');
-    const upCount: number = get(bucket, 'up.doc_count');
+    const x: number = bucket.key;
+    const downCount: number = bucket.down.doc_count;
+    const upCount: number = bucket.up.doc_count;
     return {
       x,
       downCount: statusFilter && statusFilter !== 'down' ? 0 : downCount,
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_pings.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_pings.ts
new file mode 100644
index 0000000000000..381aca720dc1d
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_pings.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters/framework';
+import { PingResults, Ping, HttpBody } from '../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export interface GetPingsParams {
+  /** @member dateRangeStart timestamp bounds */
+  dateRangeStart: string;
+
+  /** @member dateRangeEnd timestamp bounds */
+  dateRangeEnd: string;
+
+  /** @member monitorId optional limit by monitorId */
+  monitorId?: string | null;
+
+  /** @member status optional limit by check statuses */
+  status?: string | null;
+
+  /** @member sort optional sort by timestamp */
+  sort?: string | null;
+
+  /** @member size optional limit query size */
+  size?: number | null;
+
+  /** @member location optional location value for use in filtering*/
+  location?: string | null;
+}
+
+export const getPings: UMElasticsearchQueryFn<GetPingsParams, PingResults> = async ({
+  callES,
+  dateRangeStart,
+  dateRangeEnd,
+  monitorId,
+  status,
+  sort,
+  size,
+  location,
+}) => {
+  const sortParam = { sort: [{ '@timestamp': { order: sort ?? 'desc' } }] };
+  const sizeParam = size ? { size } : undefined;
+  const filter: any[] = [{ range: { '@timestamp': { gte: dateRangeStart, lte: dateRangeEnd } } }];
+  if (monitorId) {
+    filter.push({ term: { 'monitor.id': monitorId } });
+  }
+  if (status) {
+    filter.push({ term: { 'monitor.status': status } });
+  }
+
+  let postFilterClause = {};
+  if (location) {
+    postFilterClause = { post_filter: { term: { 'observer.geo.name': location } } };
+  }
+  const queryContext = { bool: { filter } };
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      query: {
+        ...queryContext,
+      },
+      ...sortParam,
+      ...sizeParam,
+      aggregations: {
+        locations: {
+          terms: {
+            field: 'observer.geo.name',
+            missing: 'N/A',
+            size: 1000,
+          },
+        },
+      },
+      ...postFilterClause,
+    },
+  };
+
+  const {
+    hits: { hits, total },
+    aggregations: aggs,
+  } = await callES('search', params);
+
+  const locations = aggs?.locations ?? { buckets: [{ key: 'N/A', doc_count: 0 }] };
+
+  const pings: Ping[] = hits.map(({ _id, _source }: any) => {
+    const timestamp = _source['@timestamp'];
+
+    // Calculate here the length of the content string in bytes, this is easier than in client JS, where
+    // we don't have access to Buffer.byteLength. There are some hacky ways to do this in the
+    // client but this is cleaner.
+    const httpBody: HttpBody | undefined = _source?.http?.response?.body;
+    if (httpBody && httpBody.content) {
+      httpBody.content_bytes = Buffer.byteLength(httpBody.content);
+    }
+
+    return { id: _id, timestamp, ..._source };
+  });
+
+  const results: PingResults = {
+    total: total.value,
+    locations: locations.buckets.map((bucket: { key: string }) => bucket.key),
+    pings,
+  };
+
+  return results;
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_snapshot_counts.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_snapshot_counts.ts
new file mode 100644
index 0000000000000..6236971146015
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_snapshot_counts.ts
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { Snapshot } from '../../../common/runtime_types';
+import { QueryContext, MonitorGroupIterator } from './search';
+import { CONTEXT_DEFAULTS, INDEX_NAMES } from '../../../common/constants';
+
+export interface GetSnapshotCountParams {
+  dateRangeStart: string;
+  dateRangeEnd: string;
+  filters?: string | null;
+  statusFilter?: string;
+}
+
+const fastStatusCount = async (context: QueryContext): Promise<Snapshot> => {
+  const params = {
+    index: INDEX_NAMES.HEARTBEAT,
+    body: {
+      size: 0,
+      query: { bool: { filter: await context.dateAndCustomFilters() } },
+      aggs: {
+        unique: {
+          // We set the precision threshold to 40k which is the max precision supported by cardinality
+          cardinality: { field: 'monitor.id', precision_threshold: 40000 },
+        },
+        down: {
+          filter: { range: { 'summary.down': { gt: 0 } } },
+          aggs: {
+            unique: { cardinality: { field: 'monitor.id', precision_threshold: 40000 } },
+          },
+        },
+      },
+    },
+  };
+
+  const statistics = await context.search(params);
+  const total = statistics.aggregations.unique.value;
+  const down = statistics.aggregations.down.unique.value;
+
+  return {
+    total,
+    down,
+    up: total - down,
+  };
+};
+
+const slowStatusCount = async (context: QueryContext, status: string): Promise<number> => {
+  const downContext = context.clone();
+  downContext.statusFilter = status;
+  const iterator = new MonitorGroupIterator(downContext);
+  let count = 0;
+  while (await iterator.next()) {
+    count++;
+  }
+  return count;
+};
+
+export const getSnapshotCount: UMElasticsearchQueryFn<GetSnapshotCountParams, Snapshot> = async ({
+  callES,
+  dateRangeStart,
+  dateRangeEnd,
+  filters,
+  statusFilter,
+}): Promise<Snapshot> => {
+  if (!(statusFilter === 'up' || statusFilter === 'down' || statusFilter === undefined)) {
+    throw new Error(`Invalid status filter value '${statusFilter}'`);
+  }
+
+  const context = new QueryContext(
+    callES,
+    dateRangeStart,
+    dateRangeEnd,
+    CONTEXT_DEFAULTS.CURSOR_PAGINATION,
+    filters && filters !== '' ? JSON.parse(filters) : null,
+    Infinity,
+    statusFilter
+  );
+
+  // Calculate the total, up, and down counts.
+  const counts = await fastStatusCount(context);
+
+  // Check if the last count was accurate, if not, we need to perform a slower count with the
+  // MonitorGroupsIterator.
+  if (!(await context.hasTimespan())) {
+    // Figure out whether 'up' or 'down' is more common. It's faster to count the lower cardinality
+    // one then use subtraction to figure out its opposite.
+    const [leastCommonStatus, mostCommonStatus]: Array<'up' | 'down'> =
+      counts.up > counts.down ? ['down', 'up'] : ['up', 'down'];
+    counts[leastCommonStatus] = await slowStatusCount(context, leastCommonStatus);
+    counts[mostCommonStatus] = counts.total - counts[leastCommonStatus];
+  }
+
+  return {
+    total: statusFilter ? counts[statusFilter] : counts.total,
+    up: statusFilter === 'down' ? 0 : counts.up,
+    down: statusFilter === 'up' ? 0 : counts.down,
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/get_states_index_status.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/get_states_index_status.ts
new file mode 100644
index 0000000000000..5044b9a6932cf
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/get_states_index_status.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import { StatesIndexStatus } from '../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../common/constants';
+
+export const getStatesIndexStatus: UMElasticsearchQueryFn<{}, StatesIndexStatus> = async ({
+  callES,
+}) => {
+  const {
+    _shards: { total },
+    count,
+  } = await callES('count', { index: INDEX_NAMES.HEARTBEAT });
+  return {
+    indexExists: total > 0,
+    docCount: {
+      count,
+    },
+  };
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/index.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/index.ts
new file mode 100644
index 0000000000000..f41b7257524fd
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/index.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { getDocCount } from './get_doc_count';
+export { getFilterBar, GetFilterBarParams } from './get_filter_bar';
+export { getUptimeIndexPattern as getIndexPattern } from './get_index_pattern';
+export { getLatestMonitor, GetLatestMonitorParams } from './get_latest_monitor';
+export { getMonitor, GetMonitorParams } from './get_monitor';
+export { getMonitorCharts, GetMonitorChartsParams } from './get_monitor_charts';
+export { getMonitorDetails, GetMonitorDetailsParams } from './get_monitor_details';
+export { getMonitorLocations, GetMonitorLocationsParams } from './get_monitor_locations';
+export { getMonitorStates, GetMonitorStatesParams } from './get_monitor_states';
+export { getPings, GetPingsParams } from './get_pings';
+export { getPingHistogram, GetPingHistogramParams } from './get_ping_histogram';
+export { UptimeRequests } from './uptime_requests';
+export { getSnapshotCount, GetSnapshotCountParams } from './get_snapshot_counts';
+export { getStatesIndexStatus } from './get_states_index_status';
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/fetch_page.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/fetch_page.test.ts
similarity index 97%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/fetch_page.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/fetch_page.test.ts
index 0bbdaa87a5e66..d519a4e75463f 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/fetch_page.test.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/fetch_page.test.ts
@@ -12,7 +12,7 @@ import {
   MonitorGroupsPage,
 } from '../fetch_page';
 import { QueryContext } from '../query_context';
-import { MonitorSummary } from '../../../../../../common/graphql/types';
+import { MonitorSummary } from '../../../../../common/graphql/types';
 import { nextPagination, prevPagination, simpleQueryContext } from './test_helpers';
 
 const simpleFixture: MonitorGroups[] = [
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/find_potential_matches_test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/find_potential_matches_test.ts
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/find_potential_matches_test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/find_potential_matches_test.ts
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/monitor_group_iterator.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/monitor_group_iterator.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/monitor_group_iterator.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/monitor_group_iterator.test.ts
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/query_context.test.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/query_context.test.ts
similarity index 94%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/query_context.test.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/query_context.test.ts
index 8924d07ac0c4d..86506c2c4c044 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/query_context.test.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/query_context.test.ts
@@ -5,8 +5,8 @@
  */
 
 import { QueryContext } from '../query_context';
-import { CursorPagination } from '../..';
-import { CursorDirection, SortOrder } from '../../../../../../common/graphql/types';
+import { CursorPagination } from '../types';
+import { CursorDirection, SortOrder } from '../../../../../common/graphql/types';
 
 describe(QueryContext, () => {
   // 10 minute range
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/test_helpers.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/test_helpers.ts
similarity index 85%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/test_helpers.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/test_helpers.ts
index bb3f3da3e289d..98b192d14f91a 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/__tests__/test_helpers.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/__tests__/test_helpers.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CursorPagination } from '../../adapter_types';
-import { CursorDirection, SortOrder } from '../../../../../../common/graphql/types';
+import { CursorPagination } from '../types';
+import { CursorDirection, SortOrder } from '../../../../../common/graphql/types';
 import { QueryContext } from '../query_context';
 
 export const prevPagination = (key: any): CursorPagination => {
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/enrich_monitor_groups.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/enrich_monitor_groups.ts
similarity index 98%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/enrich_monitor_groups.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/enrich_monitor_groups.ts
index b64015424ff40..e37c749e63566 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/enrich_monitor_groups.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/enrich_monitor_groups.ts
@@ -6,15 +6,15 @@
 
 import { get, sortBy } from 'lodash';
 import { QueryContext } from './query_context';
-import { getHistogramIntervalFormatted } from '../../../helper';
-import { INDEX_NAMES, STATES } from '../../../../../common/constants';
+import { getHistogramIntervalFormatted } from '../../helper';
+import { INDEX_NAMES, STATES } from '../../../../common/constants';
 import {
   MonitorSummary,
   SummaryHistogram,
   Check,
   CursorDirection,
   SortOrder,
-} from '../../../../../common/graphql/types';
+} from '../../../../common/graphql/types';
 import { MonitorEnricher } from './fetch_page';
 
 export const enrichMonitorGroups: MonitorEnricher = async (
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/fetch_chunk.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/fetch_chunk.ts
similarity index 100%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/fetch_chunk.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/fetch_chunk.ts
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/fetch_page.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/fetch_page.ts
similarity index 97%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/fetch_page.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/fetch_page.ts
index 046bdc8a8d07d..6440850dc0ffc 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/fetch_page.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/fetch_page.ts
@@ -5,10 +5,10 @@
  */
 
 import { flatten } from 'lodash';
-import { CursorPagination } from '../adapter_types';
+import { CursorPagination } from './types';
 import { QueryContext } from './query_context';
-import { QUERY } from '../../../../../common/constants';
-import { CursorDirection, MonitorSummary, SortOrder } from '../../../../../common/graphql/types';
+import { QUERY } from '../../../../common/constants';
+import { CursorDirection, MonitorSummary, SortOrder } from '../../../../common/graphql/types';
 import { enrichMonitorGroups } from './enrich_monitor_groups';
 import { MonitorGroupIterator } from './monitor_group_iterator';
 
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/find_potential_matches.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/find_potential_matches.ts
similarity index 96%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/find_potential_matches.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/find_potential_matches.ts
index 634d6369531d8..fc0e35b279e0b 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/find_potential_matches.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/find_potential_matches.ts
@@ -5,8 +5,8 @@
  */
 
 import { get, set } from 'lodash';
-import { CursorDirection } from '../../../../../common/graphql/types';
-import { INDEX_NAMES } from '../../../../../common/constants';
+import { CursorDirection } from '../../../../common/graphql/types';
+import { INDEX_NAMES } from '../../../../common/constants';
 import { QueryContext } from './query_context';
 
 // This is the first phase of the query. In it, we find the most recent check groups that matched the given query.
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/index.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/index.ts
similarity index 89%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/index.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/index.ts
index 040c256935692..8de5687808d61 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/index.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/index.ts
@@ -6,3 +6,4 @@
 
 export { fetchPage, MonitorGroups, MonitorLocCheckGroup, MonitorGroupsPage } from './fetch_page';
 export { MonitorGroupIterator } from './monitor_group_iterator';
+export { QueryContext } from './query_context';
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/monitor_group_iterator.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/monitor_group_iterator.ts
similarity index 98%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/monitor_group_iterator.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/monitor_group_iterator.ts
index 27c16863a37ab..ced557dbf62e0 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/monitor_group_iterator.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/monitor_group_iterator.ts
@@ -5,10 +5,10 @@
  */
 
 import { QueryContext } from './query_context';
-import { CursorPagination } from '../adapter_types';
 import { fetchChunk } from './fetch_chunk';
-import { CursorDirection } from '../../../../../common/graphql/types';
+import { CursorDirection } from '../../../../common/graphql/types';
 import { MonitorGroups } from './fetch_page';
+import { CursorPagination } from './types';
 
 // Hardcoded chunk size for how many monitors to fetch at a time when querying
 export const CHUNK_SIZE = 1000;
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/query_context.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/query_context.ts
similarity index 94%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/query_context.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/query_context.ts
index a51931ba11630..f5b13c165d87d 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/query_context.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/query_context.ts
@@ -5,10 +5,10 @@
  */
 
 import moment from 'moment';
-import { APICaller } from 'kibana/server';
-import { CursorPagination } from '../adapter_types';
-import { INDEX_NAMES } from '../../../../../common/constants';
-import { parseRelativeDate } from '../../../helper/get_histogram_interval';
+import { APICaller } from 'src/core/server';
+import { INDEX_NAMES } from '../../../../common/constants';
+import { CursorPagination } from './types';
+import { parseRelativeDate } from '../../helper';
 
 export class QueryContext {
   callES: APICaller;
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/refine_potential_matches.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/refine_potential_matches.ts
similarity index 97%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/refine_potential_matches.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/search/refine_potential_matches.ts
index f8347d0737521..a55301555c8bf 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/search/refine_potential_matches.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/refine_potential_matches.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { INDEX_NAMES } from '../../../../../common/constants';
+import { INDEX_NAMES } from '../../../../common/constants';
 import { QueryContext } from './query_context';
-import { CursorDirection } from '../../../../../common/graphql/types';
+import { CursorDirection } from '../../../../common/graphql/types';
 import { MonitorGroups, MonitorLocCheckGroup } from './fetch_page';
 
 /**
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/search/types.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/search/types.ts
new file mode 100644
index 0000000000000..dc6021a91146a
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/search/types.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CursorDirection, SortOrder } from '../../../../common/graphql/types';
+
+export interface CursorPagination {
+  cursorKey?: any;
+  cursorDirection: CursorDirection;
+  sortOrder: SortOrder;
+}
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/types.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/types.ts
similarity index 88%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/pings/types.ts
rename to x-pack/legacy/plugins/uptime/server/lib/requests/types.ts
index b1b1589af2ca7..7f65e80113d8f 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/types.ts
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/types.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DocCount, Ping, PingResults } from '../../../../common/graphql/types';
-import { UMElasticsearchQueryFn } from '../framework';
-import { GetPingHistogramParams, HistogramResult } from '../../../../common/types';
+import { DocCount, Ping, PingResults } from '../../../common/graphql/types';
+import { UMElasticsearchQueryFn } from '../adapters';
+import { GetPingHistogramParams, HistogramResult } from '../../../common/types';
 
 export interface GetAllParams {
   /** @member dateRangeStart timestamp bounds */
@@ -63,13 +63,12 @@ export interface UMPingsAdapter {
 
 export interface HistogramQueryResult {
   key: number;
+  key_as_string: string;
   doc_count: number;
-  bucket_total: {
-    value: number;
-  };
   down: {
-    bucket_count: {
-      value: number;
-    };
+    doc_count: number;
+  };
+  up: {
+    doc_count: number;
   };
 }
diff --git a/x-pack/legacy/plugins/uptime/server/lib/requests/uptime_requests.ts b/x-pack/legacy/plugins/uptime/server/lib/requests/uptime_requests.ts
new file mode 100644
index 0000000000000..182c944e8388a
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/server/lib/requests/uptime_requests.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { UMElasticsearchQueryFn } from '../adapters';
+import {
+  DocCount,
+  Ping,
+  MonitorChart,
+  PingResults,
+  StatesIndexStatus,
+} from '../../../common/graphql/types';
+import {
+  GetFilterBarParams,
+  GetLatestMonitorParams,
+  GetMonitorParams,
+  GetMonitorChartsParams,
+  GetMonitorDetailsParams,
+  GetMonitorLocationsParams,
+  GetMonitorStatesParams,
+  GetPingsParams,
+  GetPingHistogramParams,
+} from '.';
+import {
+  OverviewFilters,
+  MonitorDetails,
+  MonitorLocations,
+  Snapshot,
+} from '../../../common/runtime_types';
+import { GetMonitorStatesResult } from './get_monitor_states';
+import { GetSnapshotCountParams } from './get_snapshot_counts';
+import { HistogramResult } from '../../../common/types';
+
+type ESQ<P, R> = UMElasticsearchQueryFn<P, R>;
+
+export interface UptimeRequests {
+  getDocCount: ESQ<{}, DocCount>;
+  getFilterBar: ESQ<GetFilterBarParams, OverviewFilters>;
+  getIndexPattern: ESQ<any, {}>;
+  getLatestMonitor: ESQ<GetLatestMonitorParams, Ping>;
+  getMonitor: ESQ<GetMonitorParams, Ping>;
+  getMonitorCharts: ESQ<GetMonitorChartsParams, MonitorChart>;
+  getMonitorDetails: ESQ<GetMonitorDetailsParams, MonitorDetails>;
+  getMonitorLocations: ESQ<GetMonitorLocationsParams, MonitorLocations>;
+  getMonitorStates: ESQ<GetMonitorStatesParams, GetMonitorStatesResult>;
+  getPings: ESQ<GetPingsParams, PingResults>;
+  getPingHistogram: ESQ<GetPingHistogramParams, HistogramResult>;
+  getSnapshotCount: ESQ<GetSnapshotCountParams, Snapshot>;
+  getStatesIndexStatus: ESQ<{}, StatesIndexStatus>;
+}
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/index.ts b/x-pack/legacy/plugins/uptime/server/rest_api/index.ts
index 91936b499d8e6..aa3b36ec7d919 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/index.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/index.ts
@@ -5,7 +5,7 @@
  */
 
 import { createGetOverviewFilters } from './overview_filters';
-import { createGetAllRoute } from './pings';
+import { createGetPingsRoute } from './pings';
 import { createGetIndexPatternRoute } from './index_pattern';
 import { createLogMonitorPageRoute, createLogOverviewPageRoute } from './telemetry';
 import { createGetSnapshotCount } from './snapshot';
@@ -23,7 +23,7 @@ export { createRouteWithAuth } from './create_route_with_auth';
 export { uptimeRouteWrapper } from './uptime_route_wrapper';
 export const restApiRoutes: UMRestApiRouteFactory[] = [
   createGetOverviewFilters,
-  createGetAllRoute,
+  createGetPingsRoute,
   createGetIndexPatternRoute,
   createGetMonitorRoute,
   createGetMonitorDetailsRoute,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/index_pattern/get_index_pattern.ts b/x-pack/legacy/plugins/uptime/server/rest_api/index_pattern/get_index_pattern.ts
index cee8eaf3f9cae..cc65749153c1d 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/index_pattern/get_index_pattern.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/index_pattern/get_index_pattern.ts
@@ -18,7 +18,7 @@ export const createGetIndexPatternRoute: UMRestApiRouteFactory = (libs: UMServer
     try {
       return response.ok({
         body: {
-          ...(await libs.stubIndexPattern.getUptimeIndexPattern(callES)),
+          ...(await libs.requests.getIndexPattern(callES)),
         },
       });
     } catch (e) {
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitor_locations.ts b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitor_locations.ts
index b2356ae0a88bf..f8c7666f53f7d 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitor_locations.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitor_locations.ts
@@ -26,7 +26,7 @@ export const createGetMonitorLocationsRoute: UMRestApiRouteFactory = (libs: UMSe
 
     return response.ok({
       body: {
-        ...(await libs.monitors.getMonitorLocations({
+        ...(await libs.requests.getMonitorLocations({
           callES,
           monitorId,
           dateStart,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitors_details.ts b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitors_details.ts
index 9e1bc6f0d6a96..ca88dd965c1ad 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitors_details.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/monitors_details.ts
@@ -25,7 +25,7 @@ export const createGetMonitorDetailsRoute: UMRestApiRouteFactory = (libs: UMServ
     const { monitorId, dateStart, dateEnd } = request.query;
     return response.ok({
       body: {
-        ...(await libs.monitors.getMonitorDetails({
+        ...(await libs.requests.getMonitorDetails({
           callES,
           monitorId,
           dateStart,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/status.ts b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/status.ts
index 8b1bc04b45110..8dac50c9f5905 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/monitors/status.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/monitors/status.ts
@@ -24,7 +24,7 @@ export const createGetMonitorRoute: UMRestApiRouteFactory = (libs: UMServerLibs)
 
     return response.ok({
       body: {
-        ...(await libs.pings.getMonitor({ callES, monitorId })),
+        ...(await libs.requests.getMonitor({ callES, monitorId })),
       },
     });
   },
@@ -45,7 +45,7 @@ export const createGetStatusBarRoute: UMRestApiRouteFactory = (libs: UMServerLib
   },
   handler: async ({ callES }, _context, request, response): Promise<any> => {
     const { monitorId, dateStart, dateEnd } = request.query;
-    const result = await libs.pings.getLatestMonitorStatus({
+    const result = await libs.requests.getLatestMonitor({
       callES,
       monitorId,
       dateStart,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/overview_filters/get_overview_filters.ts b/x-pack/legacy/plugins/uptime/server/rest_api/overview_filters/get_overview_filters.ts
index ef93253bb5b70..02e54cb441838 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/overview_filters/get_overview_filters.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/overview_filters/get_overview_filters.ts
@@ -43,7 +43,7 @@ export const createGetOverviewFilters: UMRestApiRouteFactory = (libs: UMServerLi
       }
     }
 
-    const filtersResponse = await libs.monitors.getFilterBar({
+    const filtersResponse = await libs.requests.getFilterBar({
       callES,
       dateRangeStart,
       dateRangeEnd,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_ping_histogram.ts b/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_ping_histogram.ts
index c8eb2a1e40ad4..93ba4490fa31f 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_ping_histogram.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_ping_histogram.ts
@@ -26,10 +26,10 @@ export const createGetPingHistogramRoute: UMRestApiRouteFactory = (libs: UMServe
   handler: async ({ callES }, _context, request, response): Promise<any> => {
     const { dateStart, dateEnd, statusFilter, monitorId, filters } = request.query;
 
-    const result = await libs.pings.getPingHistogram({
+    const result = await libs.requests.getPingHistogram({
       callES,
-      dateStart,
-      dateEnd,
+      from: dateStart,
+      to: dateEnd,
       monitorId,
       statusFilter,
       filters,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_all.ts b/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_pings.ts
similarity index 90%
rename from x-pack/legacy/plugins/uptime/server/rest_api/pings/get_all.ts
rename to x-pack/legacy/plugins/uptime/server/rest_api/pings/get_pings.ts
index 824035954ea28..e57951c98b6fc 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_all.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/pings/get_pings.ts
@@ -8,7 +8,7 @@ import { schema } from '@kbn/config-schema';
 import { UMServerLibs } from '../../lib/lib';
 import { UMRestApiRouteFactory } from '../types';
 
-export const createGetAllRoute: UMRestApiRouteFactory = (libs: UMServerLibs) => ({
+export const createGetPingsRoute: UMRestApiRouteFactory = (libs: UMServerLibs) => ({
   method: 'GET',
   path: '/api/uptime/pings',
   validate: {
@@ -28,7 +28,7 @@ export const createGetAllRoute: UMRestApiRouteFactory = (libs: UMServerLibs) =>
   handler: async ({ callES }, _context, request, response): Promise<any> => {
     const { dateRangeStart, dateRangeEnd, location, monitorId, size, sort, status } = request.query;
 
-    const result = await libs.pings.getAll({
+    const result = await libs.requests.getPings({
       callES,
       dateRangeStart,
       dateRangeEnd,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/pings/index.ts b/x-pack/legacy/plugins/uptime/server/rest_api/pings/index.ts
index 43acf5410c8ed..abb7da26f994f 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/pings/index.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/pings/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { createGetAllRoute } from './get_all';
+export { createGetPingsRoute } from './get_pings';
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/snapshot/get_snapshot_count.ts b/x-pack/legacy/plugins/uptime/server/rest_api/snapshot/get_snapshot_count.ts
index 986ac797d63b6..c51806e323307 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/snapshot/get_snapshot_count.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/snapshot/get_snapshot_count.ts
@@ -24,7 +24,7 @@ export const createGetSnapshotCount: UMRestApiRouteFactory = (libs: UMServerLibs
   },
   handler: async ({ callES }, _context, request, response): Promise<any> => {
     const { dateRangeStart, dateRangeEnd, filters, statusFilter } = request.query;
-    const result = await libs.monitorStates.getSnapshotCount({
+    const result = await libs.requests.getSnapshotCount({
       callES,
       dateRangeStart,
       dateRangeEnd,
diff --git a/x-pack/legacy/plugins/uptime/server/rest_api/types.ts b/x-pack/legacy/plugins/uptime/server/rest_api/types.ts
index e0c8ba4a286cf..a0566c225eae7 100644
--- a/x-pack/legacy/plugins/uptime/server/rest_api/types.ts
+++ b/x-pack/legacy/plugins/uptime/server/rest_api/types.ts
@@ -15,7 +15,7 @@ import {
   KibanaRequest,
   KibanaResponseFactory,
   IKibanaResponse,
-} from 'kibana/server';
+} from 'src/core/server';
 import { UMServerLibs } from '../lib/lib';
 
 /**
diff --git a/x-pack/package.json b/x-pack/package.json
index 99e2a32bf3372..921f6ad991188 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -161,7 +161,7 @@
     "supertest": "^3.1.0",
     "supertest-as-promised": "^4.0.2",
     "tmp": "0.1.0",
-    "tree-kill": "^1.2.1",
+    "tree-kill": "^1.2.2",
     "ts-loader": "^6.0.4",
     "typescript": "3.7.2",
     "vinyl-fs": "^3.0.3",
@@ -193,8 +193,8 @@
     "@slack/webhook": "^5.0.0",
     "@turf/boolean-contains": "6.0.1",
     "angular": "^1.7.9",
-    "angular-resource": "1.7.8",
-    "angular-sanitize": "1.7.8",
+    "angular-resource": "1.7.9",
+    "angular-sanitize": "1.7.9",
     "angular-ui-ace": "0.2.3",
     "apollo-cache-inmemory": "1.6.2",
     "apollo-client": "^2.3.8",
diff --git a/x-pack/plugins/actions/server/mocks.ts b/x-pack/plugins/actions/server/mocks.ts
index 4e000160aa477..1f68d8d4a3a69 100644
--- a/x-pack/plugins/actions/server/mocks.ts
+++ b/x-pack/plugins/actions/server/mocks.ts
@@ -4,4 +4,27 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { actionsClientMock } from './actions_client.mock';
+import { actionsClientMock } from './actions_client.mock';
+import { PluginSetupContract, PluginStartContract } from './plugin';
+
+export { actionsClientMock };
+
+const createSetupMock = () => {
+  const mock: jest.Mocked<PluginSetupContract> = {
+    registerType: jest.fn(),
+  };
+  return mock;
+};
+
+const createStartMock = () => {
+  const mock: jest.Mocked<PluginStartContract> = {
+    execute: jest.fn(),
+    getActionsClientWithRequest: jest.fn().mockResolvedValue(actionsClientMock.create()),
+  };
+  return mock;
+};
+
+export const actionsMock = {
+  createSetup: createSetupMock,
+  createStart: createStartMock,
+};
diff --git a/x-pack/plugins/advanced_ui_actions/public/custom_time_range_action.tsx b/x-pack/plugins/advanced_ui_actions/public/custom_time_range_action.tsx
index ca11fe91abdbf..aa31b035cda58 100644
--- a/x-pack/plugins/advanced_ui_actions/public/custom_time_range_action.tsx
+++ b/x-pack/plugins/advanced_ui_actions/public/custom_time_range_action.tsx
@@ -7,7 +7,7 @@
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { IEmbeddable, Embeddable, EmbeddableInput } from 'src/plugins/embeddable/public';
-import { IAction, IncompatibleActionError } from '../../../../src/plugins/ui_actions/public';
+import { Action, IncompatibleActionError } from '../../../../src/plugins/ui_actions/public';
 import { TimeRange } from '../../../../src/plugins/data/public';
 import { CustomizeTimeRangeModal } from './customize_time_range_modal';
 import { OpenModal, CommonlyUsedRange } from './types';
@@ -38,7 +38,7 @@ interface ActionContext {
   embeddable: Embeddable<TimeRangeInput>;
 }
 
-export class CustomTimeRangeAction implements IAction<ActionContext> {
+export class CustomTimeRangeAction implements Action<ActionContext> {
   public readonly type = CUSTOM_TIME_RANGE;
   private openModal: OpenModal;
   private dateFormat?: string;
diff --git a/x-pack/plugins/advanced_ui_actions/public/custom_time_range_badge.tsx b/x-pack/plugins/advanced_ui_actions/public/custom_time_range_badge.tsx
index 78fe8e01e599e..4ee8c91ff2a32 100644
--- a/x-pack/plugins/advanced_ui_actions/public/custom_time_range_badge.tsx
+++ b/x-pack/plugins/advanced_ui_actions/public/custom_time_range_badge.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { prettyDuration, commonDurationRanges } from '@elastic/eui';
 import { IEmbeddable, Embeddable, EmbeddableInput } from 'src/plugins/embeddable/public';
-import { IAction, IncompatibleActionError } from '../../../../src/plugins/ui_actions/public';
+import { Action, IncompatibleActionError } from '../../../../src/plugins/ui_actions/public';
 import { TimeRange } from '../../../../src/plugins/data/public';
 import { CustomizeTimeRangeModal } from './customize_time_range_modal';
 import { doesInheritTimeRange } from './does_inherit_time_range';
@@ -29,7 +29,7 @@ interface ActionContext {
   embeddable: Embeddable<TimeRangeInput>;
 }
 
-export class CustomTimeRangeBadge implements IAction<ActionContext> {
+export class CustomTimeRangeBadge implements Action<ActionContext> {
   public readonly type = CUSTOM_TIME_RANGE_BADGE;
   public readonly id = CUSTOM_TIME_RANGE_BADGE;
   public order = 7;
diff --git a/x-pack/plugins/advanced_ui_actions/public/plugin.ts b/x-pack/plugins/advanced_ui_actions/public/plugin.ts
index cc4a7c90de513..5c5d2d38da15e 100644
--- a/x-pack/plugins/advanced_ui_actions/public/plugin.ts
+++ b/x-pack/plugins/advanced_ui_actions/public/plugin.ts
@@ -11,7 +11,7 @@ import {
   Plugin,
 } from '../../../../src/core/public';
 import { createReactOverlays } from '../../../../src/plugins/kibana_react/public';
-import { IUiActionsStart, IUiActionsSetup } from '../../../../src/plugins/ui_actions/public';
+import { UiActionsStart, UiActionsSetup } from '../../../../src/plugins/ui_actions/public';
 import {
   CONTEXT_MENU_TRIGGER,
   PANEL_BADGE_TRIGGER,
@@ -25,12 +25,12 @@ import { CommonlyUsedRange } from './types';
 
 interface SetupDependencies {
   embeddable: IEmbeddableSetup; // Embeddable are needed because they register basic triggers/actions.
-  uiActions: IUiActionsSetup;
+  uiActions: UiActionsSetup;
 }
 
 interface StartDependencies {
   embeddable: IEmbeddableStart;
-  uiActions: IUiActionsStart;
+  uiActions: UiActionsStart;
 }
 
 export type Setup = void;
diff --git a/x-pack/legacy/plugins/apm/typings/elasticsearch/aggregations.ts b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
similarity index 91%
rename from x-pack/legacy/plugins/apm/typings/elasticsearch/aggregations.ts
rename to x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
index 6d3620f11a87b..2ee8df7b5d1e1 100644
--- a/x-pack/legacy/plugins/apm/typings/elasticsearch/aggregations.ts
+++ b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
@@ -147,19 +147,13 @@ type BucketSubAggregationResponse<
   ? AggregationResponseMap<TAggregationInputMap, TDocument>
   : {};
 
-interface AggregationResponsePart<
-  TAggregationOptionsMap extends AggregationOptionsMap,
-  TDocument
-> {
+interface AggregationResponsePart<TAggregationOptionsMap extends AggregationOptionsMap, TDocument> {
   terms: {
     buckets: Array<
       {
         doc_count: number;
         key: string | number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & BucketSubAggregationResponse<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   histogram: {
@@ -167,10 +161,7 @@ interface AggregationResponsePart<
       {
         doc_count: number;
         key: number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & BucketSubAggregationResponse<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   date_histogram: {
@@ -179,10 +170,7 @@ interface AggregationResponsePart<
         doc_count: number;
         key: number;
         key_as_string: string;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & BucketSubAggregationResponse<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   avg: MetricsAggregationResponsePart;
@@ -227,10 +215,7 @@ interface AggregationResponsePart<
   } & AggregationResponseMap<TAggregationOptionsMap['aggs'], TDocument>;
   filters: TAggregationOptionsMap extends { filters: { filters: any[] } }
     ? Array<
-        { doc_count: number } & AggregationResponseMap<
-          TAggregationOptionsMap['aggs'],
-          TDocument
-        >
+        { doc_count: number } & AggregationResponseMap<TAggregationOptionsMap['aggs'], TDocument>
       >
     : TAggregationOptionsMap extends {
         filters: {
@@ -264,10 +249,7 @@ interface AggregationResponsePart<
       {
         key: Record<GetCompositeKeys<TAggregationOptionsMap>, number>;
         doc_count: number;
-      } & BucketSubAggregationResponse<
-        TAggregationOptionsMap['aggs'],
-        TDocument
-      >
+      } & BucketSubAggregationResponse<TAggregationOptionsMap['aggs'], TDocument>
     >;
   };
   diversified_sampler: {
diff --git a/x-pack/legacy/plugins/apm/typings/elasticsearch/index.ts b/x-pack/plugins/apm/typings/elasticsearch/index.ts
similarity index 84%
rename from x-pack/legacy/plugins/apm/typings/elasticsearch/index.ts
rename to x-pack/plugins/apm/typings/elasticsearch/index.ts
index 064b684cf9aa6..e1d4aaeb597e2 100644
--- a/x-pack/legacy/plugins/apm/typings/elasticsearch/index.ts
+++ b/x-pack/plugins/apm/typings/elasticsearch/index.ts
@@ -31,10 +31,7 @@ export type ESSearchResponse<
 > = Omit<SearchResponse<TDocument>, 'aggregations' | 'hits'> &
   (TSearchRequest extends { body: { aggs: AggregationInputMap } }
     ? {
-        aggregations?: AggregationResponseMap<
-          TSearchRequest['body']['aggs'],
-          TDocument
-        >;
+        aggregations?: AggregationResponseMap<TSearchRequest['body']['aggs'], TDocument>;
       }
     : {}) & {
     hits: Omit<SearchResponse<TDocument>['hits'], 'total'> &
@@ -52,12 +49,6 @@ export type ESSearchResponse<
 
 export interface ESFilter {
   [key: string]: {
-    [key: string]:
-      | string
-      | string[]
-      | number
-      | boolean
-      | Record<string, unknown>
-      | ESFilter[];
+    [key: string]: string | string[] | number | boolean | Record<string, unknown> | ESFilter[];
   };
 }
diff --git a/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.test.ts b/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.test.ts
index a731de341435c..7ec3888e4e1e4 100644
--- a/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.test.ts
+++ b/x-pack/plugins/cloud/server/collectors/cloud_usage_collector.test.ts
@@ -21,12 +21,13 @@ describe('createCloudUsageCollector', () => {
   });
 
   describe('Fetched Usage data', () => {
-    it('return isCloudEnabled boolean', () => {
+    it('return isCloudEnabled boolean', async () => {
       const mockConfigs = getMockConfigs(true);
       const usageCollection = mockUsageCollection() as any;
       const collector = createCloudUsageCollector(usageCollection, mockConfigs);
+      const callCluster = {} as any; // Sending any as the callCluster client because it's not needed in this collector but TS requires it when calling it.
 
-      expect(collector.fetch().isCloudEnabled).toBe(true);
+      expect((await collector.fetch(callCluster)).isCloudEnabled).toBe(true); // Adding the await because the fetch can be a Promise or a synchronous method and TS complains in the test if not awaited
     });
   });
 });
diff --git a/x-pack/plugins/data_enhanced/kibana.json b/x-pack/plugins/data_enhanced/kibana.json
new file mode 100644
index 0000000000000..4dbfe958eff68
--- /dev/null
+++ b/x-pack/plugins/data_enhanced/kibana.json
@@ -0,0 +1,13 @@
+{
+  "id": "data_enhanced",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "configPath": [
+    "xpack"
+  ],
+  "requiredPlugins": [
+    "data"
+  ],
+  "server": false,
+  "ui": true
+}
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/get_date_format.js b/x-pack/plugins/data_enhanced/public/autocomplete/index.ts
similarity index 68%
rename from x-pack/legacy/plugins/monitoring/server/lib/get_date_format.js
rename to x-pack/plugins/data_enhanced/public/autocomplete/index.ts
index 89cbf20d9b56f..59670a89d2caf 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/get_date_format.js
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/index.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export async function getDateFormat(req) {
-  return await req.getUiSettingsService().get('dateFormat');
-}
+export {
+  setupKqlQuerySuggestionProvider,
+  KUERY_LANGUAGE_NAME,
+} from './providers/kql_query_suggestion';
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/__fixtures__/index_pattern_response.json b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/__fixtures__/index_pattern_response.json
similarity index 100%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/__fixtures__/index_pattern_response.json
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/__fixtures__/index_pattern_response.json
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.test.ts
similarity index 93%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.test.ts
index e8aec0deec6d7..d993c3d8ad51d 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.test.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.test.ts
@@ -5,8 +5,8 @@
  */
 
 import { setupGetConjunctionSuggestions } from './conjunction';
-import { autocomplete, esKuery } from '../../../../../../src/plugins/data/public';
-import { coreMock } from '../../../../../../src/core/public/mocks';
+import { autocomplete, esKuery } from '../../../../../../../src/plugins/data/public';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 
 const mockKueryNode = (kueryNode: Partial<esKuery.KueryNode>) =>
   (kueryNode as unknown) as esKuery.KueryNode;
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.tsx b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.tsx
similarity index 69%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.tsx
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.tsx
index f570586274fdd..fa655562134cc 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/conjunction.tsx
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/conjunction.tsx
@@ -7,21 +7,21 @@ import React from 'react';
 import { $Keys } from 'utility-types';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { KqlQuerySuggestionProvider } from './types';
-import { autocomplete } from '../../../../../../src/plugins/data/public';
+import { autocomplete } from '../../../../../../../src/plugins/data/public';
 
 const bothArgumentsText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.andOperatorDescription.bothArgumentsText"
+    id="xpack.data.kueryAutocomplete.andOperatorDescription.bothArgumentsText"
     defaultMessage="both arguments"
-    description="Part of xpack.kueryAutocomplete.andOperatorDescription. Full text: 'Requires both arguments to be true'"
+    description="Part of xpack.data.kueryAutocomplete.andOperatorDescription. Full text: 'Requires both arguments to be true'"
   />
 );
 
 const oneOrMoreArgumentsText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText"
+    id="xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText"
     defaultMessage="one or more arguments"
-    description="Part of xpack.kueryAutocomplete.orOperatorDescription. Full text: 'Requires one or more arguments to be true'"
+    description="Part of xpack.data.kueryAutocomplete.orOperatorDescription. Full text: 'Requires one or more arguments to be true'"
   />
 );
 
@@ -29,20 +29,20 @@ const conjunctions: Record<string, JSX.Element> = {
   and: (
     <p>
       <FormattedMessage
-        id="xpack.kueryAutocomplete.andOperatorDescription"
+        id="xpack.data.kueryAutocomplete.andOperatorDescription"
         defaultMessage="Requires {bothArguments} to be true"
         values={{
           bothArguments: <span className="kbnSuggestionItem__callout">{bothArgumentsText}</span>,
         }}
         description="Full text: ' Requires both arguments to be true'. See
-          'xpack.kueryAutocomplete.andOperatorDescription.bothArgumentsText' for 'both arguments' part."
+          'xpack.data.kueryAutocomplete.andOperatorDescription.bothArgumentsText' for 'both arguments' part."
       />
     </p>
   ),
   or: (
     <p>
       <FormattedMessage
-        id="xpack.kueryAutocomplete.orOperatorDescription"
+        id="xpack.data.kueryAutocomplete.orOperatorDescription"
         defaultMessage="Requires {oneOrMoreArguments} to be true"
         values={{
           oneOrMoreArguments: (
@@ -50,7 +50,7 @@ const conjunctions: Record<string, JSX.Element> = {
           ),
         }}
         description="Full text: 'Requires one or more arguments to be true'. See
-          'xpack.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText' for 'one or more arguments' part."
+          'xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText' for 'one or more arguments' part."
       />
     </p>
   ),
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.test.ts
similarity index 98%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.test.ts
index 2fd5cfd17eb69..d05fd49d266f2 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.test.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.test.ts
@@ -6,8 +6,8 @@
 import indexPatternResponse from './__fixtures__/index_pattern_response.json';
 
 import { setupGetFieldSuggestions } from './field';
-import { isFilterable, autocomplete, esKuery } from '../../../../../../src/plugins/data/public';
-import { coreMock } from '../../../../../../src/core/public/mocks';
+import { isFilterable, autocomplete, esKuery } from '../../../../../../../src/plugins/data/public';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 
 const mockKueryNode = (kueryNode: Partial<esKuery.KueryNode>) =>
   (kueryNode as unknown) as esKuery.KueryNode;
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.tsx b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.tsx
similarity index 94%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.tsx
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.tsx
index a8af884c24fc3..f04312b925436 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/field.tsx
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/field.tsx
@@ -8,14 +8,18 @@ import { flatten } from 'lodash';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { escapeKuery } from './lib/escape_kuery';
 import { sortPrefixFirst } from './sort_prefix_first';
-import { IFieldType, isFilterable, autocomplete } from '../../../../../../src/plugins/data/public';
+import {
+  IFieldType,
+  isFilterable,
+  autocomplete,
+} from '../../../../../../../src/plugins/data/public';
 import { KqlQuerySuggestionProvider } from './types';
 
 const getDescription = (field: IFieldType) => {
   return (
     <p>
       <FormattedMessage
-        id="xpack.kueryAutocomplete.filterResultsDescription"
+        id="xpack.data.kueryAutocomplete.filterResultsDescription"
         defaultMessage="Filter results that contain {fieldName}"
         values={{ fieldName: <span className="kbnSuggestionItem__callout">{field.name}</span> }}
       />
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/index.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/index.ts
similarity index 94%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/index.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/index.ts
index 2cc15fe4c9280..6168ab8fc3462 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/index.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/index.ts
@@ -11,13 +11,15 @@ import { setupGetFieldSuggestions } from './field';
 import { setupGetValueSuggestions } from './value';
 import { setupGetOperatorSuggestions } from './operator';
 import { setupGetConjunctionSuggestions } from './conjunction';
-import { esKuery, autocomplete } from '../../../../../../src/plugins/data/public';
+import { esKuery, autocomplete } from '../../../../../../../src/plugins/data/public';
 
 const cursorSymbol = '@kuery-cursor@';
 
 const dedup = (suggestions: autocomplete.QuerySuggestion[]): autocomplete.QuerySuggestion[] =>
   uniq(suggestions, ({ type, text, start, end }) => [type, text, start, end].join('|'));
 
+export const KUERY_LANGUAGE_NAME = 'kuery';
+
 export const setupKqlQuerySuggestionProvider = (
   core: CoreSetup
 ): autocomplete.QuerySuggestionsGetFn => {
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/lib/escape_kuery.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/lib/escape_kuery.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/lib/escape_kuery.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/lib/escape_kuery.test.ts
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/lib/escape_kuery.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/lib/escape_kuery.ts
similarity index 100%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/lib/escape_kuery.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/lib/escape_kuery.ts
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.test.ts
similarity index 94%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.test.ts
index acafc4e169c8f..7e564b96064ef 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.test.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.test.ts
@@ -6,8 +6,8 @@
 import indexPatternResponse from './__fixtures__/index_pattern_response.json';
 
 import { setupGetOperatorSuggestions } from './operator';
-import { autocomplete, esKuery } from '../../../../../../src/plugins/data/public';
-import { coreMock } from '../../../../../../src/core/public/mocks';
+import { autocomplete, esKuery } from '../../../../../../../src/plugins/data/public';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 
 const mockKueryNode = (kueryNode: Partial<esKuery.KueryNode>) =>
   (kueryNode as unknown) as esKuery.KueryNode;
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.tsx b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.tsx
similarity index 64%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.tsx
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.tsx
index 6e9010c4310fb..af90e7bfe1172 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/operator.tsx
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/operator.tsx
@@ -10,48 +10,48 @@ import { $Keys } from 'utility-types';
 import { flatten } from 'lodash';
 
 import { KqlQuerySuggestionProvider } from './types';
-import { autocomplete } from '../../../../../../src/plugins/data/public';
+import { autocomplete } from '../../../../../../../src/plugins/data/public';
 
 const equalsText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.equalOperatorDescription.equalsText"
+    id="xpack.data.kueryAutocomplete.equalOperatorDescription.equalsText"
     defaultMessage="equals"
-    description="Part of xpack.kueryAutocomplete.equalOperatorDescription. Full text: 'equals some value'"
+    description="Part of xpack.data.kueryAutocomplete.equalOperatorDescription. Full text: 'equals some value'"
   />
 );
 const lessThanOrEqualToText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText"
+    id="xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText"
     defaultMessage="less than or equal to"
-    description="Part of xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription. Full text: 'is less than or equal to some value'"
+    description="Part of xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription. Full text: 'is less than or equal to some value'"
   />
 );
 const greaterThanOrEqualToText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText"
+    id="xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText"
     defaultMessage="greater than or equal to"
-    description="Part of xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription. Full text: 'is greater than or equal to some value'"
+    description="Part of xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription. Full text: 'is greater than or equal to some value'"
   />
 );
 const lessThanText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.lessThanOperatorDescription.lessThanText"
+    id="xpack.data.kueryAutocomplete.lessThanOperatorDescription.lessThanText"
     defaultMessage="less than"
-    description="Part of xpack.kueryAutocomplete.lessThanOperatorDescription. Full text: 'is less than some value'"
+    description="Part of xpack.data.kueryAutocomplete.lessThanOperatorDescription. Full text: 'is less than some value'"
   />
 );
 const greaterThanText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText"
+    id="xpack.data.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText"
     defaultMessage="greater than"
-    description="Part of xpack.kueryAutocomplete.greaterThanOperatorDescription. Full text: 'is greater than some value'"
+    description="Part of xpack.data.kueryAutocomplete.greaterThanOperatorDescription. Full text: 'is greater than some value'"
   />
 );
 const existsText = (
   <FormattedMessage
-    id="xpack.kueryAutocomplete.existOperatorDescription.existsText"
+    id="xpack.data.kueryAutocomplete.existOperatorDescription.existsText"
     defaultMessage="exists"
-    description="Part of xpack.kueryAutocomplete.existOperatorDescription. Full text: 'exists in any form'"
+    description="Part of xpack.data.kueryAutocomplete.existOperatorDescription. Full text: 'exists in any form'"
   />
 );
 
@@ -59,11 +59,11 @@ const operators = {
   ':': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.equalOperatorDescription"
+        id="xpack.data.kueryAutocomplete.equalOperatorDescription"
         defaultMessage="{equals} some value"
         values={{ equals: <span className="kbnSuggestionItem__callout">{equalsText}</span> }}
         description="Full text: 'equals some value'. See
-        'xpack.kueryAutocomplete.equalOperatorDescription.equalsText' for 'equals' part."
+        'xpack.data.kueryAutocomplete.equalOperatorDescription.equalsText' for 'equals' part."
       />
     ),
     fieldTypes: ['string', 'number', 'date', 'ip', 'geo_point', 'geo_shape', 'boolean'],
@@ -71,7 +71,7 @@ const operators = {
   '<=': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription"
+        id="xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription"
         defaultMessage="is {lessThanOrEqualTo} some value"
         values={{
           lessThanOrEqualTo: (
@@ -79,7 +79,7 @@ const operators = {
           ),
         }}
         description="Full text: 'is less than or equal to some value'. See
-        'xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText' for 'less than or equal to' part."
+        'xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText' for 'less than or equal to' part."
       />
     ),
     fieldTypes: ['number', 'date', 'ip'],
@@ -87,7 +87,7 @@ const operators = {
   '>=': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription"
+        id="xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription"
         defaultMessage="is {greaterThanOrEqualTo} some value"
         values={{
           greaterThanOrEqualTo: (
@@ -95,7 +95,7 @@ const operators = {
           ),
         }}
         description="Full text: 'is greater than or equal to some value'. See
-        'xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText' for 'greater than or equal to' part."
+        'xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText' for 'greater than or equal to' part."
       />
     ),
     fieldTypes: ['number', 'date', 'ip'],
@@ -103,11 +103,11 @@ const operators = {
   '<': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.lessThanOperatorDescription"
+        id="xpack.data.kueryAutocomplete.lessThanOperatorDescription"
         defaultMessage="is {lessThan} some value"
         values={{ lessThan: <span className="kbnSuggestionItem__callout">{lessThanText}</span> }}
         description="Full text: 'is less than some value'. See
-        'xpack.kueryAutocomplete.lessThanOperatorDescription.lessThanText' for 'less than' part."
+        'xpack.data.kueryAutocomplete.lessThanOperatorDescription.lessThanText' for 'less than' part."
       />
     ),
     fieldTypes: ['number', 'date', 'ip'],
@@ -115,13 +115,13 @@ const operators = {
   '>': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.greaterThanOperatorDescription"
+        id="xpack.data.kueryAutocomplete.greaterThanOperatorDescription"
         defaultMessage="is {greaterThan} some value"
         values={{
           greaterThan: <span className="kbnSuggestionItem__callout">{greaterThanText}</span>,
         }}
         description="Full text: 'is greater than some value'. See
-        'xpack.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText' for 'greater than' part."
+        'xpack.data.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText' for 'greater than' part."
       />
     ),
     fieldTypes: ['number', 'date', 'ip'],
@@ -129,11 +129,11 @@ const operators = {
   ': *': {
     description: (
       <FormattedMessage
-        id="xpack.kueryAutocomplete.existOperatorDescription"
+        id="xpack.data.kueryAutocomplete.existOperatorDescription"
         defaultMessage="{exists} in any form"
         values={{ exists: <span className="kbnSuggestionItem__callout">{existsText}</span> }}
         description="Full text: 'exists in any form'. See
-        'xpack.kueryAutocomplete.existOperatorDescription.existsText' for 'exists' part."
+        'xpack.data.kueryAutocomplete.existOperatorDescription.existsText' for 'exists' part."
       />
     ),
     fieldTypes: undefined,
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/sort_prefix_first.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/sort_prefix_first.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/sort_prefix_first.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/sort_prefix_first.test.ts
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/sort_prefix_first.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/sort_prefix_first.ts
similarity index 100%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/sort_prefix_first.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/sort_prefix_first.ts
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/types.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/types.ts
similarity index 85%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/types.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/types.ts
index c51b75e001b9f..8e3146ab09848 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/types.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/types.ts
@@ -5,7 +5,7 @@
  */
 
 import { CoreSetup } from 'kibana/public';
-import { esKuery, autocomplete } from '../../../../../../src/plugins/data/public';
+import { esKuery, autocomplete } from '../../../../../../../src/plugins/data/public';
 
 export type KqlQuerySuggestionProvider<T = autocomplete.BasicQuerySuggestion> = (
   core: CoreSetup
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.test.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.test.ts
similarity index 96%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.test.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.test.ts
index 5ffe30c877868..14eeabda97d1a 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.test.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.test.ts
@@ -5,9 +5,9 @@
  */
 import { setupGetValueSuggestions } from './value';
 import indexPatternResponse from './__fixtures__/index_pattern_response.json';
-import { coreMock } from '../../../../../../src/core/public/mocks';
-import { autocomplete, esKuery } from '../../../../../../src/plugins/data/public';
-import { setAutocompleteService } from '../services';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { autocomplete, esKuery } from '../../../../../../../src/plugins/data/public';
+import { setAutocompleteService } from '../../../services';
 
 const mockKueryNode = (kueryNode: Partial<esKuery.KueryNode>) =>
   (kueryNode as unknown) as esKuery.KueryNode;
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.ts b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.ts
similarity index 93%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.ts
rename to x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.ts
index 242b9ccba3508..83b8024d8314d 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/kql_query_suggestion/value.ts
+++ b/x-pack/plugins/data_enhanced/public/autocomplete/providers/kql_query_suggestion/value.ts
@@ -7,8 +7,8 @@
 import { flatten } from 'lodash';
 import { escapeQuotes } from './lib/escape_kuery';
 import { KqlQuerySuggestionProvider } from './types';
-import { getAutocompleteService } from '../services';
-import { autocomplete } from '../../../../../../src/plugins/data/public';
+import { getAutocompleteService } from '../../../services';
+import { autocomplete } from '../../../../../../../src/plugins/data/public';
 
 const wrapAsSuggestions = (start: number, end: number, query: string, values: string[]) =>
   values
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/index.ts b/x-pack/plugins/data_enhanced/public/index.ts
similarity index 56%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/index.ts
rename to x-pack/plugins/data_enhanced/public/index.ts
index a3fc71ad48cb3..93b6b7a957182 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/monitor_states/index.ts
+++ b/x-pack/plugins/data_enhanced/public/index.ts
@@ -4,5 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './adapter_types';
-export { elasticsearchMonitorStatesAdapter } from './elasticsearch_monitor_states_adapter';
+import { DataEnhancedPlugin, DataEnhancedSetup, DataEnhancedStart } from './plugin';
+
+export const plugin = () => new DataEnhancedPlugin();
+
+export { DataEnhancedSetup, DataEnhancedStart };
diff --git a/x-pack/plugins/data_enhanced/public/plugin.ts b/x-pack/plugins/data_enhanced/public/plugin.ts
new file mode 100644
index 0000000000000..14b5382bc85aa
--- /dev/null
+++ b/x-pack/plugins/data_enhanced/public/plugin.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup, CoreStart, Plugin } from 'src/core/public';
+import { DataPublicPluginSetup, DataPublicPluginStart } from '../../../../src/plugins/data/public';
+import { setAutocompleteService } from './services';
+import { setupKqlQuerySuggestionProvider, KUERY_LANGUAGE_NAME } from './autocomplete';
+
+export interface DataEnhancedSetupDependencies {
+  data: DataPublicPluginSetup;
+}
+export interface DataEnhancedStartDependencies {
+  data: DataPublicPluginStart;
+}
+
+export type DataEnhancedSetup = ReturnType<DataEnhancedPlugin['setup']>;
+export type DataEnhancedStart = ReturnType<DataEnhancedPlugin['start']>;
+
+export class DataEnhancedPlugin implements Plugin {
+  public setup(core: CoreSetup, plugins: DataEnhancedSetupDependencies) {
+    plugins.data.autocomplete.addQuerySuggestionProvider(
+      KUERY_LANGUAGE_NAME,
+      setupKqlQuerySuggestionProvider(core)
+    );
+  }
+
+  public start(core: CoreStart, plugins: DataEnhancedStartDependencies) {
+    setAutocompleteService(plugins.data.autocomplete);
+  }
+}
diff --git a/x-pack/legacy/plugins/kuery_autocomplete/public/services.ts b/x-pack/plugins/data_enhanced/public/services.ts
similarity index 70%
rename from x-pack/legacy/plugins/kuery_autocomplete/public/services.ts
rename to x-pack/plugins/data_enhanced/public/services.ts
index 1ec48e597f636..847b4c783fd7f 100644
--- a/x-pack/legacy/plugins/kuery_autocomplete/public/services.ts
+++ b/x-pack/plugins/data_enhanced/public/services.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { createGetterSetter } from '../../../../../src/plugins/kibana_utils/public';
-import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
+import { createGetterSetter } from '../../../../src/plugins/kibana_utils/public';
+import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
 
 export const [getAutocompleteService, setAutocompleteService] = createGetterSetter<
   DataPublicPluginStart['autocomplete']
diff --git a/x-pack/plugins/endpoint/common/types.ts b/x-pack/plugins/endpoint/common/types.ts
index 5e69aa0d18b68..0128cd3dd6df7 100644
--- a/x-pack/plugins/endpoint/common/types.ts
+++ b/x-pack/plugins/endpoint/common/types.ts
@@ -23,20 +23,72 @@ export type ImmutableSet<T> = ReadonlySet<Immutable<T>>;
 export type ImmutableObject<T> = { readonly [K in keyof T]: Immutable<T[K]> };
 
 export class EndpointAppConstants {
+  static ALERT_INDEX_NAME = 'my-index';
   static ENDPOINT_INDEX_NAME = 'endpoint-agent*';
 }
 
+export interface AlertResultList {
+  /**
+   * The alerts restricted by page size.
+   */
+  alerts: AlertData[];
+
+  /**
+   * The total number of alerts on the page.
+   */
+  total: number;
+
+  /**
+   * The size of the requested page.
+   */
+  request_page_size: number;
+
+  /**
+   * The index of the requested page, starting at 0.
+   */
+  request_page_index: number;
+
+  /**
+   * The offset of the requested page, starting at 0.
+   */
+  result_from_index: number;
+}
+
 export interface EndpointResultList {
-  // the endpoint restricted by the page size
+  /* the endpoints restricted by the page size */
   endpoints: EndpointMetadata[];
-  // the total number of unique endpoints in the index
+  /* the total number of unique endpoints in the index */
   total: number;
-  // the page size requested
+  /* the page size requested */
   request_page_size: number;
-  // the index requested
+  /* the page index requested */
   request_page_index: number;
 }
 
+export interface AlertData {
+  '@timestamp': Date;
+  agent: {
+    id: string;
+    version: string;
+  };
+  event: {
+    action: string;
+  };
+  file_classification: {
+    malware_classification: {
+      score: number;
+    };
+  };
+  host: {
+    hostname: string;
+    ip: string;
+    os: {
+      name: string;
+    };
+  };
+  thread: {};
+}
+
 export interface EndpointMetadata {
   event: {
     created: Date;
@@ -63,35 +115,6 @@ export interface EndpointMetadata {
   };
 }
 
-export interface AlertData {
-  value: {
-    source: {
-      endgame: {
-        data: {
-          file_operation: string;
-          malware_classification: {
-            score: number;
-          };
-        };
-        metadata: {
-          key: string;
-        };
-        timestamp_utc: Date;
-      };
-      labels: {
-        endpoint_id: string;
-      };
-      host: {
-        hostname: string;
-        ip: string;
-        os: {
-          name: string;
-        };
-      };
-    };
-  };
-}
-
 /**
  * The PageId type is used for the payload when firing userNavigatedToPage actions
  */
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/action.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/action.ts
index 431b0d8d6fcf8..464a04eff5ebd 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/action.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/action.ts
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertData, Immutable } from '../../../../../common/types';
+import { AlertListData } from '../../types';
 
-type ServerReturnedAlertsData = Immutable<{
+interface ServerReturnedAlertsData {
   type: 'serverReturnedAlertsData';
-  payload: AlertData[];
-}>;
+  payload: AlertListData;
+}
 
 export type AlertAction = ServerReturnedAlertsData;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/index.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/index.ts
index 5545218d9abd6..f63910a1c305e 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/index.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/index.ts
@@ -6,3 +6,4 @@
 
 export { alertListReducer } from './reducer';
 export { AlertAction } from './action';
+export * from '../../types';
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
index 00ba8eddf9e67..aede95ceb3759 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
@@ -4,15 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertData, ImmutableArray } from '../../../../../common/types';
+import qs from 'querystring';
+import { HttpFetchQuery } from 'src/core/public';
 import { AppAction } from '../action';
 import { MiddlewareFactory } from '../../types';
 
 export const alertMiddlewareFactory: MiddlewareFactory = coreStart => {
+  const qp = qs.parse(window.location.search.slice(1));
+
   return api => next => async (action: AppAction) => {
     next(action);
     if (action.type === 'userNavigatedToPage' && action.payload === 'alertsPage') {
-      const response: ImmutableArray<AlertData> = await coreStart.http.get('/api/endpoint/alerts');
+      const response = await coreStart.http.get('/api/endpoint/alerts', {
+        query: qp as HttpFetchQuery,
+      });
       api.dispatch({ type: 'serverReturnedAlertsData', payload: response });
     }
   };
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/reducer.ts
index 4ad815ee10b23..fd74abe9e3432 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/reducer.ts
@@ -11,6 +11,10 @@ import { AppAction } from '../action';
 const initialState = (): AlertListState => {
   return {
     alerts: [],
+    request_page_size: 10,
+    request_page_index: 0,
+    result_from_index: 0,
+    total: 0,
   };
 };
 
@@ -21,7 +25,7 @@ export const alertListReducer: Reducer<AlertListState, AppAction> = (
   if (action.type === 'serverReturnedAlertsData') {
     return {
       ...state,
-      alerts: action.payload,
+      alerts: action.payload.alerts,
     };
   }
 
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
index 525983c9f8523..5f02d36308053 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
@@ -6,9 +6,9 @@
 
 import { Dispatch, MiddlewareAPI } from 'redux';
 import { CoreStart } from 'kibana/public';
-import { Immutable, AlertData } from '../../../common/types';
 import { EndpointListState } from './store/endpoint_list';
 import { AppAction } from './store/action';
+import { AlertResultList } from '../../../common/types';
 
 export type MiddlewareFactory = (
   coreStart: CoreStart
@@ -16,11 +16,10 @@ export type MiddlewareFactory = (
   api: MiddlewareAPI<Dispatch<AppAction>, GlobalState>
 ) => (next: Dispatch<AppAction>) => (action: AppAction) => unknown;
 
-export type AlertListState = Immutable<{
-  alerts: AlertData[];
-}>;
-
 export interface GlobalState {
   readonly endpointList: EndpointListState;
   readonly alertList: AlertListState;
 }
+
+export type AlertListData = AlertResultList;
+export type AlertListState = AlertResultList;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/index.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/index.tsx
index dcb324e3597c2..8c32426dcc868 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/index.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/alerts/index.tsx
@@ -8,6 +8,7 @@ import { memo, useState, useMemo } from 'react';
 import React from 'react';
 import { EuiDataGrid } from '@elastic/eui';
 import { useSelector } from 'react-redux';
+import { i18n } from '@kbn/i18n';
 import * as selectors from '../../store/selectors';
 import { usePageId } from '../use_page_id';
 
@@ -40,21 +41,26 @@ export const AlertIndex = memo(() => {
       const row = json[rowIndex];
 
       if (columnId === 'alert_type') {
-        return row.value.source.endgame.metadata.key;
+        return i18n.translate(
+          'xpack.endpoint.application.endpoint.alerts.alertType.maliciousFileDescription',
+          {
+            defaultMessage: 'Malicious File',
+          }
+        );
       } else if (columnId === 'event_type') {
-        return row.value.source.endgame.data.file_operation;
+        return row.event.action;
       } else if (columnId === 'os') {
-        return row.value.source.host.os.name;
+        return row.host.os.name;
       } else if (columnId === 'ip_address') {
-        return row.value.source.host.ip;
+        return row.host.ip;
       } else if (columnId === 'host_name') {
-        return row.value.source.host.hostname;
+        return row.host.hostname;
       } else if (columnId === 'timestamp') {
-        return row.value.source.endgame.timestamp_utc;
+        return row['@timestamp'];
       } else if (columnId === 'archived') {
         return null;
       } else if (columnId === 'malware_score') {
-        return row.value.source.endgame.data.malware_classification.score;
+        return row.file_classification.malware_classification.score;
       }
       return null;
     };
diff --git a/x-pack/plugins/endpoint/server/config.ts b/x-pack/plugins/endpoint/server/config.ts
index 3f9a8a5508dd8..7ce5ebcf4eba9 100644
--- a/x-pack/plugins/endpoint/server/config.ts
+++ b/x-pack/plugins/endpoint/server/config.ts
@@ -15,6 +15,8 @@ export const EndpointConfigSchema = schema.object({
   enabled: schema.boolean({ defaultValue: false }),
   endpointResultListDefaultFirstPageIndex: schema.number({ defaultValue: 0 }),
   endpointResultListDefaultPageSize: schema.number({ defaultValue: 10 }),
+  alertResultListDefaultFirstPageIndex: schema.number({ defaultValue: 0 }),
+  alertResultListDefaultPageSize: schema.number({ defaultValue: 10 }),
 });
 
 export function createConfig$(context: PluginInitializerContext) {
diff --git a/x-pack/plugins/endpoint/server/plugin.ts b/x-pack/plugins/endpoint/server/plugin.ts
index 1f34ba1d36d97..3fed4ca480b85 100644
--- a/x-pack/plugins/endpoint/server/plugin.ts
+++ b/x-pack/plugins/endpoint/server/plugin.ts
@@ -69,7 +69,7 @@ export class EndpointPlugin
     const router = core.http.createRouter();
     addRoutes(router);
     registerEndpointRoutes(router, endpointContext);
-    registerAlertRoutes(router);
+    registerAlertRoutes(router, endpointContext);
   }
 
   public start() {
diff --git a/x-pack/plugins/endpoint/server/routes/alerts.test.ts b/x-pack/plugins/endpoint/server/routes/alerts.test.ts
new file mode 100644
index 0000000000000..e6bd9b8888ef7
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/routes/alerts.test.ts
@@ -0,0 +1,191 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  IClusterClient,
+  IRouter,
+  IScopedClusterClient,
+  KibanaResponseFactory,
+  RequestHandler,
+  RequestHandlerContext,
+  RouteConfig,
+} from 'kibana/server';
+import {
+  elasticsearchServiceMock,
+  httpServerMock,
+  httpServiceMock,
+  loggingServiceMock,
+} from '../../../../../src/core/server/mocks';
+import { AlertData, AlertResultList } from '../../common/types';
+import { SearchResponse } from 'elasticsearch';
+import { reqSchema, registerAlertRoutes } from './alerts';
+import { EndpointConfigSchema } from '../config';
+import * as data from '../test_data/all_alerts_data.json';
+import * as dataLegacy from '../test_data/all_alerts_data_legacy.json';
+
+describe('test alerts route', () => {
+  let routerMock: jest.Mocked<IRouter>;
+  let mockResponse: jest.Mocked<KibanaResponseFactory>;
+  let mockClusterClient: jest.Mocked<IClusterClient>;
+  let mockScopedClient: jest.Mocked<IScopedClusterClient>;
+  let routeHandler: RequestHandler<any, any, any>;
+  let routeConfig: RouteConfig<any, any, any, any>;
+
+  beforeEach(() => {
+    mockClusterClient = elasticsearchServiceMock.createClusterClient();
+    mockScopedClient = elasticsearchServiceMock.createScopedClusterClient();
+    mockClusterClient.asScoped.mockReturnValue(mockScopedClient);
+    routerMock = httpServiceMock.createRouter();
+    mockResponse = httpServerMock.createResponseFactory();
+    registerAlertRoutes(routerMock, {
+      logFactory: loggingServiceMock.create(),
+      config: () => Promise.resolve(EndpointConfigSchema.validate({})),
+    });
+  });
+
+  it('should correctly calculate legacy alert total', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({});
+
+    const response: SearchResponse<AlertData> = (dataLegacy as unknown) as SearchResponse<
+      AlertData
+    >;
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith('/api/endpoint/alerts')
+    )!;
+
+    await routeHandler(
+      ({
+        core: {
+          elasticsearch: {
+            dataClient: mockScopedClient,
+          },
+        },
+      } as unknown) as RequestHandlerContext,
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(routeConfig.options).toEqual({ authRequired: true });
+    expect(mockResponse.ok).toBeCalled();
+    const alertResultList = mockResponse.ok.mock.calls[0][0]?.body as AlertResultList;
+    expect(alertResultList.total).toEqual(21);
+    expect(alertResultList.request_page_index).toEqual(0);
+    expect(alertResultList.result_from_index).toEqual(0);
+    expect(alertResultList.request_page_size).toEqual(10);
+  });
+
+  it('should return the latest of all alerts', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({});
+
+    const response: SearchResponse<AlertData> = (data as unknown) as SearchResponse<AlertData>;
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith('/api/endpoint/alerts')
+    )!;
+
+    await routeHandler(
+      ({
+        core: {
+          elasticsearch: {
+            dataClient: mockScopedClient,
+          },
+        },
+      } as unknown) as RequestHandlerContext,
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(routeConfig.options).toEqual({ authRequired: true });
+    expect(mockResponse.ok).toBeCalled();
+    const alertResultList = mockResponse.ok.mock.calls[0][0]?.body as AlertResultList;
+    expect(alertResultList.total).toEqual(21);
+    expect(alertResultList.request_page_index).toEqual(0);
+    expect(alertResultList.result_from_index).toEqual(0);
+    expect(alertResultList.request_page_size).toEqual(10);
+  });
+
+  it('should return alert results according to pagination params -- POST', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({
+      method: 'post',
+      body: {
+        page_size: 6,
+        page_index: 3,
+      },
+    });
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(data));
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith('/api/endpoint/alerts')
+    )!;
+
+    await routeHandler(
+      ({
+        core: {
+          elasticsearch: {
+            dataClient: mockScopedClient,
+          },
+        },
+      } as unknown) as RequestHandlerContext,
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(routeConfig.options).toEqual({ authRequired: true });
+    expect(mockResponse.ok).toBeCalled();
+    const alertResultList = mockResponse.ok.mock.calls[0][0]?.body as AlertResultList;
+    expect(alertResultList.total).toEqual(21);
+    expect(alertResultList.request_page_index).toEqual(3);
+    expect(alertResultList.result_from_index).toEqual(18);
+    expect(alertResultList.request_page_size).toEqual(6);
+  });
+
+  it('should return alert results according to pagination params -- GET', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({
+      path: '/api/endpoint/alerts',
+      query: {
+        page_size: 3,
+        page_index: 2,
+      },
+    });
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(data));
+    [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
+      path.startsWith('/api/endpoint/alerts')
+    )!;
+
+    await routeHandler(
+      ({
+        core: {
+          elasticsearch: {
+            dataClient: mockScopedClient,
+          },
+        },
+      } as unknown) as RequestHandlerContext,
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(routeConfig.options).toEqual({ authRequired: true });
+    expect(mockResponse.ok).toBeCalled();
+    const alertResultList = mockResponse.ok.mock.calls[0][0]?.body as AlertResultList;
+    expect(alertResultList.total).toEqual(21);
+    expect(alertResultList.request_page_index).toEqual(2);
+    expect(alertResultList.result_from_index).toEqual(6);
+    expect(alertResultList.request_page_size).toEqual(3);
+  });
+
+  it('should correctly validate params', async () => {
+    const validate = () => {
+      reqSchema.validate({
+        page_size: 'abc',
+        page_index: 0,
+      });
+    };
+    expect(validate).toThrow();
+  });
+});
diff --git a/x-pack/plugins/endpoint/server/routes/alerts.ts b/x-pack/plugins/endpoint/server/routes/alerts.ts
index 68992b5890928..541cf4af52769 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts.ts
@@ -4,28 +4,100 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { IRouter } from 'kibana/server';
+import { IRouter, KibanaRequest, RequestHandler } from 'kibana/server';
+import { SearchResponse } from 'elasticsearch';
+import { schema } from '@kbn/config-schema';
 
-import json from './sampledata.json';
+import {
+  getPagingProperties,
+  buildAlertListESQuery,
+} from '../services/endpoint/alert_query_builders';
+
+import { AlertData, AlertResultList } from '../../common/types';
+import { AlertRequestParams, EndpointAppContext } from '../types';
+
+const ALERTS_ROUTE = '/api/endpoint/alerts';
+
+export const reqSchema = schema.object({
+  page_size: schema.number({ defaultValue: 10, min: 1, max: 10000 }),
+  page_index: schema.number({ defaultValue: 0, min: 0 }),
+});
+
+export function registerAlertRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
+  const alertsHandler: RequestHandler<unknown, AlertRequestParams> = async (ctx, req, res) => {
+    try {
+      const queryParams = await getPagingProperties(
+        req as KibanaRequest<unknown, AlertRequestParams, AlertRequestParams, any>,
+        endpointAppContext
+      );
+      const reqBody = await buildAlertListESQuery(queryParams);
+      const response = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser(
+        'search',
+        reqBody
+      )) as SearchResponse<AlertData>;
+      return res.ok({ body: mapToAlertResultList(endpointAppContext, queryParams, response) });
+    } catch (err) {
+      return res.internalError({ body: err });
+    }
+  };
 
-export function registerAlertRoutes(router: IRouter) {
   router.get(
     {
-      path: '/api/endpoint/alerts',
-      validate: false,
+      path: ALERTS_ROUTE,
+      validate: {
+        query: reqSchema,
+      },
       options: { authRequired: true },
     },
-    async (context, req, res) => {
-      try {
-        return res.ok({
-          body: json,
-          headers: {
-            'Content-Type': 'application/json',
-          },
-        });
-      } catch (err) {
-        return res.internalError({ body: err });
-      }
-    }
+    alertsHandler
   );
+
+  router.post(
+    {
+      path: ALERTS_ROUTE,
+      validate: {
+        body: reqSchema,
+      },
+      options: { authRequired: true },
+    },
+    alertsHandler
+  );
+}
+
+function mapToAlertResultList(
+  endpointAppContext: EndpointAppContext,
+  queryParams: Record<string, any>,
+  searchResponse: SearchResponse<AlertData>
+): AlertResultList {
+  interface Total {
+    value: number;
+    relation: string;
+  }
+
+  let totalNumberOfAlerts: number = 0;
+  let totalIsLowerBound: boolean = false;
+
+  // We handle 2 separate schemas for the response below, due to: https://github.com/elastic/kibana/issues/56694
+  if (typeof searchResponse?.hits?.total === 'object') {
+    const total: Total = searchResponse?.hits?.total as Total;
+    totalNumberOfAlerts = total?.value || 0;
+    totalIsLowerBound = total?.relation === 'gte' || false;
+  } else {
+    totalNumberOfAlerts = searchResponse?.hits?.total || 0;
+  }
+
+  if (totalIsLowerBound) {
+    // This shouldn't happen, as we always try to fetch enough hits to satisfy the current request and the next page.
+    endpointAppContext.logFactory
+      .get('endpoint')
+      .warn('Total hits not counted accurately. Pagination numbers may be inaccurate.');
+  }
+
+  return {
+    request_page_size: queryParams.pageSize,
+    request_page_index: queryParams.pageIndex,
+    result_from_index: queryParams.fromIndex,
+    alerts: searchResponse?.hits?.hits?.map(entry => entry._source),
+    total: totalNumberOfAlerts,
+  };
 }
diff --git a/x-pack/plugins/endpoint/server/routes/endpoints.test.ts b/x-pack/plugins/endpoint/server/routes/endpoints.test.ts
index be14554f128c3..25c4225495a41 100644
--- a/x-pack/plugins/endpoint/server/routes/endpoints.test.ts
+++ b/x-pack/plugins/endpoint/server/routes/endpoints.test.ts
@@ -79,7 +79,7 @@ describe('test endpoint route', () => {
     expect(endpointResultList.request_page_size).toEqual(10);
   });
 
-  it('test find the latest of all endpoints with params', async () => {
+  it('test find the latest of all endpoints with paging properties', async () => {
     const mockRequest = httpServerMock.createKibanaRequest({
       body: {
         paging_properties: [
@@ -112,6 +112,69 @@ describe('test endpoint route', () => {
     );
 
     expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+      match_all: {},
+    });
+    expect(routeConfig.options).toEqual({ authRequired: true });
+    expect(mockResponse.ok).toBeCalled();
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as EndpointResultList;
+    expect(endpointResultList.endpoints.length).toEqual(2);
+    expect(endpointResultList.total).toEqual(2);
+    expect(endpointResultList.request_page_index).toEqual(10);
+    expect(endpointResultList.request_page_size).toEqual(10);
+  });
+
+  it('test find the latest of all endpoints with paging and filters properties', async () => {
+    const mockRequest = httpServerMock.createKibanaRequest({
+      body: {
+        paging_properties: [
+          {
+            page_size: 10,
+          },
+          {
+            page_index: 1,
+          },
+        ],
+
+        filter: 'not host.ip:10.140.73.246',
+      },
+    });
+    mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
+      Promise.resolve((data as unknown) as SearchResponse<EndpointMetadata>)
+    );
+    [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
+      path.startsWith('/api/endpoint/endpoints')
+    )!;
+
+    await routeHandler(
+      ({
+        core: {
+          elasticsearch: {
+            dataClient: mockScopedClient,
+          },
+        },
+      } as unknown) as RequestHandlerContext,
+      mockRequest,
+      mockResponse
+    );
+
+    expect(mockScopedClient.callAsCurrentUser).toBeCalled();
+    expect(mockScopedClient.callAsCurrentUser.mock.calls[0][1]?.body?.query).toEqual({
+      bool: {
+        must_not: {
+          bool: {
+            minimum_should_match: 1,
+            should: [
+              {
+                match: {
+                  'host.ip': '10.140.73.246',
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
     expect(routeConfig.options).toEqual({ authRequired: true });
     expect(mockResponse.ok).toBeCalled();
     const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as EndpointResultList;
diff --git a/x-pack/plugins/endpoint/server/routes/endpoints.ts b/x-pack/plugins/endpoint/server/routes/endpoints.ts
index 24ad8e3941f5e..054172a7f258a 100644
--- a/x-pack/plugins/endpoint/server/routes/endpoints.ts
+++ b/x-pack/plugins/endpoint/server/routes/endpoints.ts
@@ -26,16 +26,26 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
       validate: {
         body: schema.nullable(
           schema.object({
-            paging_properties: schema.arrayOf(
-              schema.oneOf([
-                // the number of results to return for this request per page
-                schema.object({
-                  page_size: schema.number({ defaultValue: 10, min: 1, max: 10000 }),
-                }),
-                // the index of the page to return
-                schema.object({ page_index: schema.number({ defaultValue: 0, min: 0 }) }),
-              ])
+            paging_properties: schema.nullable(
+              schema.arrayOf(
+                schema.oneOf([
+                  /**
+                   * the number of results to return for this request per page
+                   */
+                  schema.object({
+                    page_size: schema.number({ defaultValue: 10, min: 1, max: 10000 }),
+                  }),
+                  /**
+                   * the zero based page index of the the total number of pages of page size
+                   */
+                  schema.object({ page_index: schema.number({ defaultValue: 0, min: 0 }) }),
+                ])
+              )
             ),
+            /**
+             * filter to be applied, it could be a kql expression or discrete filter to be implemented
+             */
+            filter: schema.nullable(schema.oneOf([schema.string()])),
           })
         ),
       },
diff --git a/x-pack/plugins/endpoint/server/routes/sampledata.json b/x-pack/plugins/endpoint/server/routes/sampledata.json
deleted file mode 100644
index b0d6ae02f9f92..0000000000000
--- a/x-pack/plugins/endpoint/server/routes/sampledata.json
+++ /dev/null
@@ -1,11350 +0,0 @@
-[
-    {
-      "type": "doc",
-      "value": {
-        "id": "huVEc20BW148Je-rzxwQ",
-        "index": "test_alert_data",
-        "source": {
-          "@timestamp": 1542789433000,
-          "agent": {
-            "id": "5085268f-7443-4f15-85d2-bf14b2a69c60",
-            "type": "endgame",
-            "version": "3.0.0"
-          },
-          "ecs": {
-            "version": "1.1.0"
-          },
-          "endgame": {
-            "data": {
-              "alert_details": {
-                "acting_process": {
-                  "authenticode": {
-                    "cert_signer": {
-                      "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                      "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                      "subject_name": "Cybereason Inc"
-                    },
-                    "cert_timestamp": {
-                      "issuer_name": "",
-                      "serial_number": "",
-                      "subject_name": "",
-                      "timestamp_string": ""
-                    },
-                    "more_info_link": "",
-                    "program_name": "",
-                    "publisher_link": ""
-                  },
-                  "cmdline": "\"C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe\"",
-                  "create_time": 1542788400,
-                  "domain": "NT AUTHORITY",
-                  "exe": "C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe",
-                  "hashes": {
-                    "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                    "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                    "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2"
-                  },
-                  "imphash": "c30d230b81c734e82e86e2e2fe01cd01",
-                  "is_sensor": false,
-                  "malware_classification": {
-                    "identifier": "Whitelisted",
-                    "score": 0,
-                    "threshold": 0,
-                    "version": "3.0.0"
-                  },
-                  "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                  "modules": [
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424710,
-                      "hashes": {
-                        "imphash": "c30d230b81c734e82e86e2e2fe01cd01",
-                        "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                        "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                        "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 5362483200,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 05:28"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258681,
-                      "hashes": {
-                        "imphash": "d41d8cd98f00b204e9800998ecf8427e",
-                        "md5": "3556d5a8bf2cc508bdab51dec38d7c61",
-                        "sha1": "92015f7bbdb9dad35e41c533d2c5b85f1cd63d85",
-                        "sha256": "91e3d98ad3119e8addf8d2aa1dd6795162842fff7101e4c70c5137e847b4ff50"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2006056960,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\ntdll.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258315,
-                      "hashes": {
-                        "imphash": "9165b02c931d76a9b666d8d42128111b",
-                        "md5": "7a6326d96d53048fdec542df23d875a0",
-                        "sha1": "5c02af0206c299f5bcab8da4237cfc92e3e93495",
-                        "sha256": "182351570856cd6eedd9df7e2fb8ab76bd4d8fc70be11ad5de6484cfd70c21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2004877312,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\kernel32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258316,
-                      "hashes": {
-                        "imphash": "3f7fb1504bb73a54888bf1c3650fe4cf",
-                        "md5": "da68c291b4ef2dec9c5963266bcae454",
-                        "sha1": "5696e8c68fcf64104499e20e7cd5452b58b4f4ba",
-                        "sha256": "21aa4779fc21e762178517268c95467238c92851ad9160bffc36b2379c58337f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760109568,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\KERNELBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258929,
-                      "hashes": {
-                        "imphash": "2cb501375ed127591bf5cfee7f1e52fe",
-                        "md5": "fe70103391a64039a921dbfff9c7ab1b",
-                        "sha1": "e0019d9442aeebd3bb42a24c38aa2fae4c6bd4f5",
-                        "sha256": "f7d219d75037bc98f6c69143b00ab6000a31f8b5e211e0af514f4f4b681522a0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2003828736,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USER32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258001,
-                      "hashes": {
-                        "imphash": "51945fdf9aaf56aeb9d6fa1f21b638ce",
-                        "md5": "1084aa52ccc324ea54c7121fa24c2221",
-                        "sha1": "b13ef924708fa88577931ed0337000e90adcdf5b",
-                        "sha256": "6e972cf624f7c0de8190434b3b30279a01c551713109f97b9ebb77fac9364754"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791780163584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\GDI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534943,
-                      "hashes": {
-                        "imphash": "919110853c18aa198ad129945337b1dd",
-                        "md5": "d202223587518b13d72d68937b7e3f70",
-                        "sha1": "916a3ce858f074f57dd9dac01be5cd4649f19887",
-                        "sha256": "9db971b866d058adbb518dd99b87c5db8dd1e7c9073755b989ae7e9fb62901e8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791780622336,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\LPK.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258933,
-                      "hashes": {
-                        "imphash": "17bf46cf6bf6c8cae48be5b75615a353",
-                        "md5": "2f8b1e3ee3545d3b5a8d56fa1ae07b65",
-                        "sha1": "66310680ee38904b2852717af13028e53b4e8b8e",
-                        "sha256": "2a3ec01f3bafe7d7d656886437f7ffecce440c0d3f3467804769ab4bf1ff7a99"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791788552192,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USP10.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535038,
-                      "hashes": {
-                        "imphash": "8c99b1c0f6cf68b07336751f460f1dba",
-                        "md5": "7319bb10fa1f86e49e3dcf4136f6c957",
-                        "sha1": "3eea5ee8bafb2b9975b236c5c5655df6f4b42aa1",
-                        "sha256": "60de43ab267fd41c9804369b569139add30ed4e295c425f44fc04d3fcc95fca2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791775444992,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\msvcrt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534699,
-                      "hashes": {
-                        "imphash": "e1ee2d71958d21e0e1bf887dfe76af7f",
-                        "md5": "6df46d2bd74e3da1b45f08f10d172732",
-                        "sha1": "3491f8f9a73c00b158e43a530210d67a4f0598ae",
-                        "sha256": "2dc945f6f2c4a82189bc7da2fcbb7d9a0e2588a909539249e55ba82468e0c677"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791781736448,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ADVAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535198,
-                      "hashes": {
-                        "imphash": "b8ba136689cdc8d8b25fc04902f39a22",
-                        "md5": "83404dcbce4925b6a5a77c5170f46d86",
-                        "sha1": "22bda6b9da4fcf492b4dd16554b0c0e27e1b8667",
-                        "sha256": "d669614d0b4461db244ad99fbe1ba92ceb9b4ed5ec8e987e23764e77d9ac7074"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791777214464,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\sechost.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258798,
-                      "hashes": {
-                        "imphash": "46876e4adb924a616ddbbb1992d61257",
-                        "md5": "0611473c1ad9e2d991cd9482068417f7",
-                        "sha1": "c4a3fa902dedad5d448e1d8b2d113cae1dcf2f7a",
-                        "sha256": "90afcc2a60350ece27e75e76459132ef0fa28ef283ce88fced4b82735a93ecda"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791787307008,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\RPCRT4.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424472,
-                      "hashes": {
-                        "imphash": "a24cfb84e3006f3634d5b09aed45c264",
-                        "md5": "56e6aa240cf6503265fbe5cf4d5889e8",
-                        "sha1": "2678a3c08b2f82598527bd0c064eb1be5877e277",
-                        "sha256": "4e7e127e2818eeb2de34a9369dcaca233443f085e53706c969592a9907df2ae8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791710957568,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\AP.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424450,
-                      "hashes": {
-                        "imphash": "f12460104bb4725d7964cf569f727f61",
-                        "md5": "58017789505c114426b63c775debc12b",
-                        "sha1": "0a348ca38bbcf851083578b77a8263765bd9b5e7",
-                        "sha256": "1bd7d7b7b69e15adb6fcf0b520a7107eb5270163935e1f50fcee85ed65440b46"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791706894336,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\Protobuf.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1438071093,
-                      "hashes": {
-                        "imphash": "341d1190606326748a708433d5d0cc36",
-                        "md5": "0a2be3ed5a71082e5f9296f79323a639",
-                        "sha1": "6acb15e8191b5530297c807d3066b1a71f4326d4",
-                        "sha256": "8847013e01db09adab6a1dc338803df3696730577a0dda847847540529048aae"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791705714688,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\libprotobuf.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Code Signing PCA",
-                          "serial_number": "33 00 00 00 b0 11 af 0a 8b d0 3b 9f dd 00 01 00 00 00 b0 ",
-                          "subject_name": "Microsoft Corporation"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "33 00 00 00 2b 39 32 48 c1 b2 c9 48 f3 00 00 00 00 00 2b ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "10/04/2013 22:49"
-                        },
-                        "more_info_link": "http://microsoft.com",
-                        "program_name": "msvcp120.dll",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1380942867,
-                      "hashes": {
-                        "imphash": "d0a59246eab41d54812cd63c2326e1f1",
-                        "md5": "46060c35f697281bc5e7337aee3722b1",
-                        "sha1": "d0164c041707f297a73abb9ea854111953e99cf1",
-                        "sha256": "2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791704993792,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSVCP120.dll",
-                      "signature_signer": "Microsoft Corporation",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Code Signing PCA",
-                          "serial_number": "33 00 00 00 b0 11 af 0a 8b d0 3b 9f dd 00 01 00 00 00 b0 ",
-                          "subject_name": "Microsoft Corporation"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "33 00 00 00 2b 39 32 48 c1 b2 c9 48 f3 00 00 00 00 00 2b ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "10/04/2013 22:49"
-                        },
-                        "more_info_link": "http://microsoft.com",
-                        "program_name": "msvcr120.dll",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1380942847,
-                      "hashes": {
-                        "imphash": "8f18e22935ef8b336e246ee763fbec97",
-                        "md5": "9c861c079dd81762b6c54e37597b7712",
-                        "sha1": "62cb65a1d79e2c5ada0c7bfc04c18693567c90d0",
-                        "sha256": "ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791704010752,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSVCR120.dll",
-                      "signature_signer": "Microsoft Corporation",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258732,
-                      "hashes": {
-                        "imphash": "faad2d5bf5c0ca9639e07a49e8c5d8ae",
-                        "md5": "6c60b5aca7442efb794082cdacfc001c",
-                        "sha1": "aae17944782b25f41f7b3a756532b4923f4ae817",
-                        "sha256": "fc1d9124856a70ff232ef3057d66bee803295847624ce23b4d0217f23af52c75"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791791894528,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ole32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258736,
-                      "hashes": {
-                        "imphash": "774fed8966de60d3af2dd9070df5be6f",
-                        "md5": "42f05f980f164e084db65b2e8cd8430f",
-                        "sha1": "86498b3c5bbc240b9de0a10f2cb4185e754de6d7",
-                        "sha256": "0813749847b08f6577791d18ad9eca6dff5b41c2f727ab5ee9e5bf9602ed50cb"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791783899136,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\OLEAUT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258981,
-                      "hashes": {
-                        "imphash": "1ec347d133df2fe4da3e5f8944caeae8",
-                        "md5": "4bbfa57f594f7e8a8edc8f377184c3f0",
-                        "sha1": "d48aafa576b40a5e386e609bba1010472551154a",
-                        "sha256": "9f3ac5dea5a6250c3dbb97af79c81c0a48429486521f807355a1d7d3d861b75f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791779835904,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WS2_32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535145,
-                      "hashes": {
-                        "imphash": "579f52f57e43aa6ff0d07e88af5d0ff5",
-                        "md5": "044fe45ffd6ad40e3bbbe60b7f41babe",
-                        "sha1": "94233c0d4169c02c85514adb1f05cd3298c87f43",
-                        "sha256": "a1688a5e6e0f7037c850699462c2655006a7d873c97f9ab406c59d81749b6f09"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791791828992,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NSI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258859,
-                      "hashes": {
-                        "imphash": "4b37cbf60127ea0550ec30e0b1c52984",
-                        "md5": "eaf32cb8c1f810e4715b4dfbe785c7ff",
-                        "sha1": "3b099b193abb9064e6937101d0c309f04d713882",
-                        "sha256": "db6ad07fded42433e669508ab73faff6daff04575d6f1d016fe3eb6ecec4dd5d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791784816640,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SHLWAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257495,
-                      "hashes": {
-                        "imphash": "fd8a6a2046d9572b7f8f4288ae251c61",
-                        "md5": "497bfeddaf3950dd909c3b0c5558a25d",
-                        "sha1": "5d55bdc156372f51eb126f7bc2a8af161a1ef254",
-                        "sha256": "980ea189929d95eb36e35980fff0c81f7b78de9422771fde8f4ac7a779f5bd89"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791730683904,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258138,
-                      "hashes": {
-                        "imphash": "0bc508389b6b5577cf3cca214ca523a7",
-                        "md5": "2b81776da02017a37fe26c662827470e",
-                        "sha1": "8c85389640bea73a009d83079f8b4c963697035f",
-                        "sha256": "a656353c50ee08422145d00db9cfd9f6d3e664753b3c454b171e2a56a8aa94dc"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791725375488,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IPHLPAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535281,
-                      "hashes": {
-                        "imphash": "e710d6d30f2346e7cd91c89ec3b602d9",
-                        "md5": "4c9210e8f4e052f6a4eb87716da0c24c",
-                        "sha1": "d4fa50aded12eb162478d7606f1270b78dd1a44b",
-                        "sha256": "460f7990bdadb7d58d6dc95b094d30a2efdc4ceed444b18a2f36e8d9076fb8b9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791725113344,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINNSI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247527581,
-                      "hashes": {
-                        "imphash": "be693a67b5b884d7609eaf574ba00955",
-                        "md5": "d87e1e59c73c1f98d5ded5b3850c40f5",
-                        "sha1": "141c0ebecdd2733b90431f18b188ee0b64456268",
-                        "sha256": "536419bff9f877d4314b5d0c045d9a6e729489c389863fadf07e382050bc84fd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2007957504,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\PSAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1472978395,
-                      "hashes": {
-                        "imphash": "3a8c832bddbba9333df28c1da212318e",
-                        "md5": "e1c637922e34d868ebcd6ef199cf1394",
-                        "sha1": "01c19a0137082a03ecace613506af5fe9a66a12b",
-                        "sha256": "0c0c7b4c9926413c285fa2345f08b895888887156277e535851a1f1d774e6c6c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791703158784,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\SQLite2015.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534912,
-                      "hashes": {
-                        "imphash": "d76d7be0b8ac9aafe17d2cc7deb32b29",
-                        "md5": "aa2c08ce85653b1a0d2e4ab407fa176c",
-                        "sha1": "0119c23d88292a0e4fec04d5cf8629005a44e37c",
-                        "sha256": "83dfd0c119b20aedb07114c9d1cf9ce2dfa938d0f1070256b0591a9e2c3997fa"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791790977024,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IMM32.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535018,
-                      "hashes": {
-                        "imphash": "b523fff180cb22465ccf191b827e9923",
-                        "md5": "c431eaf5caa1c82cac2534a2eab348a3",
-                        "sha1": "e425577ccfc9b92efbbcb760d21fcaa478d3e51a",
-                        "sha256": "addf850128dc675e67faba9a3d0d27e684f01f733962ca22927bb94503549e44"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791776100352,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSCTF.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534874,
-                      "hashes": {
-                        "imphash": "621a31b25a9ef1d128ea281b3eab572b",
-                        "md5": "0040c486584a8e582c861cfb57ab5387",
-                        "sha1": "bcf326e3f79b3db028c2ef1cc1a47d9697e867e7",
-                        "sha256": "5ee17b55cb702d14ae75b19226de21cd2498bda6c6ef5872fdb8a718f401fed1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791724654592,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\fwpuclnt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258848,
-                      "hashes": {
-                        "imphash": "cc4d63ca30fdbb90048e549782d2116a",
-                        "md5": "858df0795cb5b4bace0f33708925a414",
-                        "sha1": "e629ed78e6e1829263890974760dad8a431edf69",
-                        "sha256": "a9063af8d5c73a722bd269d144d8a65c98db4cfdd9f626e3a8283754e22c8c9c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791753031680,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\Secur32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258854,
-                      "hashes": {
-                        "imphash": "9c631776d86c9b15258c3cc2a6a7891d",
-                        "md5": "26e716ed95dc48cf6e5ac046089366af",
-                        "sha1": "2bd96b8ae5ae3ad14c16d2a98a91a9a9f26d179d",
-                        "sha256": "f686d557b7ac1688efc7cb48311290d713d3db2e9e61e947098a7c80e3a1b9e9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791761092608,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\shell32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "11/29/2016 03:22"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1480418473,
-                      "hashes": {
-                        "imphash": "f89e0a919d52e2b37d82d27f521530cf",
-                        "md5": "f1a6e89598aa63a2efcfd1e31b44fe7c",
-                        "sha1": "cd3a39758e72f42ef077c0ad9dd700509a032da6",
-                        "sha256": "1ee6540520a7a84bc22036be42052303b5aed9911c9e8a04184a0688c63576f8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791699816448,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\BDUpdateServiceCom.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258594,
-                      "hashes": {
-                        "imphash": "2bd8f9f72a13c2803ac3d34b805130b9",
-                        "md5": "764908fe1fa96f93c95b1b67a0fced29",
-                        "sha1": "88d0027e5d10158e3678d9eb2326779fef8a64d1",
-                        "sha256": "26ef25ab307903c5e806a8cc3b750a491049e5d1225ceddfce64dd51aa6f592b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791720656896,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NETAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258588,
-                      "hashes": {
-                        "imphash": "96f28fef38c977afbf3f6e8f39c0d6b9",
-                        "md5": "6ceca4c6a489c9b2e6073afdaae3f607",
-                        "sha1": "b228f6208642cb99e5bcdf2d3ebda2b8bc4fb020",
-                        "sha256": "127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791720198144,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\netutils.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258920,
-                      "hashes": {
-                        "imphash": "2d37f2d4b3c246f361ca150fc7ebf8d4",
-                        "md5": "3a9c9baf610b0dd4967086040b3b62a9",
-                        "sha1": "3207ac7f895eab34623d994548d7810e54be3e79",
-                        "sha256": "e8e9a0f42b1ee7806edceed08aa024d037215d06ca317e3678bd5364ad513d23"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791751524352,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\srvcli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259010,
-                      "hashes": {
-                        "imphash": "6ad99a405bde55d6a18debafd3f5e5c5",
-                        "md5": "3c91392d448f6e5d525a85b7550d8ba9",
-                        "sha1": "b62eaf7d80617e136a8f3c9161c23464e6f2a171",
-                        "sha256": "6fd0dc73dbe7519e2c643554c2a7f8fbe4f9a678c4241bb54b3c6e65d2abcf3a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791720067072,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wkscli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535234,
-                      "hashes": {
-                        "imphash": "13ecfa3a285149680a7a4b174c8b8f5b",
-                        "md5": "94e026870a55aaeaff7853c1754091e9",
-                        "sha1": "a4f845318e095d841b05e1400747ee4c28e1f28e",
-                        "sha256": "b2f5d5629d12bdfa98dbed3898368f37d9009c7531b6909c7285a2c11c9a0f93"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791741169664,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\VERSION.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/18/2017 09:26"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484760175,
-                      "hashes": {
-                        "imphash": "b33f679b12d9d05d922e720c0e21818c",
-                        "md5": "1e5ea729f6dc5a8aff675a45706d389d",
-                        "sha1": "f5a70ab4772325946a93c9eaf48ebe1dd1e7d3a3",
-                        "sha256": "35da922b25ec8389a733f46a6c0d37c2c6b05463a123cde9fee48402c473e1ef"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791699161088,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\scan.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "11/22/2016 08:08"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1479830743,
-                      "hashes": {
-                        "imphash": "513a166377e008d25aa2e22983dd13ff",
-                        "md5": "3450d998edec5cdbd03b0df09c17e02d",
-                        "sha1": "558979fb1a9368acdf2dc1e3d1afd94e7343f914",
-                        "sha256": "c1f24493e4fc2a9c5d17e077455c3a610ad1e5fa46590f0f9598e680e5a07556"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791698702336,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\gzfltum.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/16/2017 05:34"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484573247,
-                      "hashes": {
-                        "imphash": "d6d5dc292fe4d710905e9f280360309d",
-                        "md5": "9f1bcf84eaa34afbdfcf19f22fc1d6f5",
-                        "sha1": "e15e023d46738f4848f64ce853ada6a3083f8b7f",
-                        "sha256": "d1c30b1a7fc63c4f52b00628c3e73f571db52ff2b87718bcb5a6322923f58987"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791696343040,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\bdquar.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/16/2017 05:34"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484573248,
-                      "hashes": {
-                        "imphash": "4e1a791e94ac955105ddfaac387de22f",
-                        "md5": "874d6017f89a2ef255a16280ed4b1bf7",
-                        "sha1": "8951c3ab1c9ea0c312206b98d22a9779c8a89c8c",
-                        "sha256": "00512202b78037c17a77b095fcb3458381002dbd20de8dee0c99ff7701343cda"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791693721600,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\BDSmartDB.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257756,
-                      "hashes": {
-                        "imphash": "5cd9d6761799e2ff681533ef1ffbb31d",
-                        "md5": "2477a28081bdaee622cf045acf8ee124",
-                        "sha1": "304c5f29fa847fbd994ad7a0471214198b928c14",
-                        "sha256": "00a09caf9129e84feea98fa03ce9012c9f961b64fee15c4f268822c0f82acc3c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791757291520,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CFGMGR32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "DigiCert Assured ID Code Signing CA-1",
-                          "serial_number": "0f b5 4c 96 fd 63 93 fd 7b b9 9c d1 d0 d5 16 ed ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "09/12/2018 01:20"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1512623776,
-                      "hashes": {
-                        "imphash": "e2dab13fa4a67b25d3fbae65a189c521",
-                        "md5": "627d7f1de23e6b01d6251b4c6962e765",
-                        "sha1": "5e1d1854861016198ce4a1dbdea883f257de9463",
-                        "sha256": "82bdf513b5f5b55ff740482ee839b14455b2296e2a911cb9a1ae622969412ed5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791688937472,
-                      "mapped_size": 0,
-                      "path": "C:\\ProgramData\\apv2\\bd_db\\1\\bdcore.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "09/13/2017 23:13"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1505278115,
-                      "hashes": {
-                        "imphash": "c2979e6e570392ed85b4e15810f2e90f",
-                        "md5": "3b4c71b64bc20b0c6578a091a031c0fb",
-                        "sha1": "00cb578e723555e929e4ad8e820772b56ce29475",
-                        "sha256": "52db08c10a5f1482dda8527d592f71b33c1cfecfa5a5a2d0be5a78325c41dd7b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791679827968,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\bdnc.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257999,
-                      "hashes": {
-                        "imphash": "04534d8dae5ab230b9bee9b1b0b2829d",
-                        "md5": "3f9f2afa135f0663946a006dd5ffd897",
-                        "sha1": "ea6456859b04b68af8dcd453381dd168af53fc5e",
-                        "sha256": "276d1c9c78c529625c2ef3d77079324628686ea184767971901a1de93681c133"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791758209024,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258373,
-                      "hashes": {
-                        "imphash": "2e50bc5d9fe777770c8a6b2cfaf6b2e9",
-                        "md5": "884415bd4269c02eaf8e2613bf85500d",
-                        "sha1": "c3a64f05c210b38c69d8f1fc1d74a71b56ada30c",
-                        "sha256": "efe771709ec942694fd206ac8d0a48ed7dcd35036f074268e4aecd68ac982cea"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791757225984,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSASN1.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535280,
-                      "hashes": {
-                        "imphash": "af1203c1d6d810c97729856780869b12",
-                        "md5": "ef2ae43bcd46abb13fc3e5b2b1935c73",
-                        "sha1": "c53e005cd04d99331ce3114ac119256133202313",
-                        "sha256": "81fc06f306f620845d7dd8d06e706309e70bc89b589c81f3478302a3f5f73431"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791679172608,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINMM.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258927,
-                      "hashes": {
-                        "imphash": "b32250da0d30f7782b5b900d4d9c519a",
-                        "md5": "2a86e54b441ad41557f75dc5609b9793",
-                        "sha1": "83ddcf8a1a0ca423bf8417f5e59b5c431bf50c43",
-                        "sha256": "8fede6909413c0fa5b63d58d39affd0f6c3beeaf19b7b2f8674913abfd79a912"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791754866688,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SSPICLI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258493,
-                      "hashes": {
-                        "imphash": "466f15f36f10655b30e9347e7dfc2b52",
-                        "md5": "1d5185a4c7e6695431ae4b55c3d7d333",
-                        "sha1": "5e9f739d46e20541ffc0a6421dc6be416ca8f261",
-                        "sha256": "16f3906c54f1d71559836fdfcf4e83e7c9f454463d78fd577ad2d7022e0bcb51"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791748378624,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\mswsock.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535287,
-                      "hashes": {
-                        "imphash": "f967c6b35a5d1b7765016056a842e331",
-                        "md5": "31559f3244c6bc00a52030caa83b6b91",
-                        "sha1": "7943540153c7b7878101a4901d7935e05e7cfd32",
-                        "sha256": "b2025742b5f0025ace9821d5722de3f997eeeab21d2f381c9e307882df422579"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791742021632,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wshtcpip.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534998,
-                      "hashes": {
-                        "imphash": "77870f98ca4d25a823c74d7404a64bfd",
-                        "md5": "d0c2fbb6d97416b0166478fc7ae2b212",
-                        "sha1": "e290bdf2312ac30a4e9f2a96d7c84714eee84899",
-                        "sha256": "7eab6c37f0a845e645ca44cc060ac6c56e386c7ef7a64716c6786c9602ad8c9d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791748771840,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTSP.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 17:43"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535161,
-                      "hashes": {
-                        "imphash": "b8c20a01e4d94df61ee21f5350389f9c",
-                        "md5": "5d8874a8c11dddde29e12de0e2013493",
-                        "sha1": "a1c8e3e6ee44dcb68752d44b3b6f4ecce89c388d",
-                        "sha256": "3e9a57137bf622af83e3e4d58971e2c0200559cca7545d16cf263aa03ee9c7d2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791745626112,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\rsaenh.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534993,
-                      "hashes": {
-                        "imphash": "f0c6fd6831905d958b05645b680db89f",
-                        "md5": "784fa3df338e2e8f5f0389d6fac428af",
-                        "sha1": "6d32c67c91c6d374854e907c6719db2538540867",
-                        "sha256": "9c8aa0cfdeb9e38aaf8eb08626070e0f0364f4f8a793cfe3532ec6c007980c34"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791755456512,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257906,
-                      "hashes": {
-                        "imphash": "ff74e3ff0a015c2023b747f613061e42",
-                        "md5": "a52b6cc24063cc83c78c0e6f24deec01",
-                        "sha1": "a5384efac7d1f9213aaf0423ed0b021bc986b9df",
-                        "sha256": "77e0d2b2356e71f9be52fa479c9dde17c453c198bb49cd4a97f2309628d82e3b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791746805760,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DNSAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534791,
-                      "hashes": {
-                        "imphash": "59b31e42f8fae7b5809ba7fcae732e0c",
-                        "md5": "4cbcc37856ea2039c27a2fb661dda0e5",
-                        "sha1": "cc666108d34168420a1d1942dda1e090154c7296",
-                        "sha256": "74cbfab3092a9564bddfcb84db3e3f8bcfd1492938adf187423d3355d73d21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722557440,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc6.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534790,
-                      "hashes": {
-                        "imphash": "f17020f0f66b64fbdf51c75b43f3729d",
-                        "md5": "f568f7c08458d69e4fcd8675bbb107e4",
-                        "sha1": "c1e05f0255a6f386711044b11e2d04dfd328b26a",
-                        "sha256": "a5fa25ecf248999a68ccecfbb508bfa1add18a23e20a9a9081a87c41caaa36c0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722426368,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534847,
-                      "hashes": {
-                        "imphash": "dda6776607f283829d85b996f5e46d03",
-                        "md5": "f3d202f53a222d5f6944d459b73cf967",
-                        "sha1": "c9db224ce8ec34aa2f341b6766ea67aa12f8b4a7",
-                        "sha256": "e9f1d48eb333d32331bcfd0348fe07bee7d5352292e6020571da395f596affe7"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791675961344,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\FLTLIB.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535135,
-                      "hashes": {
-                        "imphash": "ff720e05e534d67b814b8562265058f5",
-                        "md5": "2c942733a5983dd4502219ff37c7ebc7",
-                        "sha1": "263e8fbf77c0ceead0c9bca56394bffa4a664361",
-                        "sha256": "34b20b6b0d7274e4b5b783f1d2345bc3dd9888964d5c2c65712f041a00cf5b45"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791756308480,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\profapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259008,
-                      "hashes": {
-                        "imphash": "b2ecd39ae0055d9e1b8aa5bc78942cba",
-                        "md5": "eb3f9c2de1236b5d46b2291d82970e43",
-                        "sha1": "0ce9ddc1063256ab571b916389321fd7f572ddc0",
-                        "sha256": "8a43d335f3d573bed98af54bb51e82546c2acc025da8a48d801213eb14e9d5d4"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791759847424,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINTRUST.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534778,
-                      "hashes": {
-                        "imphash": "37afbae3e0f359c3718e379261f7ccfc",
-                        "md5": "25983de69b57142039ac8d95e71cd9c9",
-                        "sha1": "01691e3b0bfa569e64bdb7dc3d637a867ed2dc08",
-                        "sha256": "a677da7ebcbcb6073d27e8a38809f51e971e83ed379bc599aaad6ef4216348da"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791791173632,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CLBCatQ.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258799,
-                      "hashes": {
-                        "imphash": "a198edd0f73abd7cdbb54eef82ab1fc6",
-                        "md5": "c2a8cb1275ecb85d246a9ecc02a728e3",
-                        "sha1": "4417207821fc8f5c72ff531683f183caef297882",
-                        "sha256": "3603fadca0060bd201148f9d59e4e2627f024609a6463ab525b5d1ad17bdcd10"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791756177408,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\RpcRtRemote.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258979,
-                      "hashes": {
-                        "imphash": "207b35260128e01bb777acc1377dc241",
-                        "md5": "58f4493bf748a3a89689997b7bd00e95",
-                        "sha1": "9974ba41e8215f6669deb765988cfe34e9c1b56e",
-                        "sha256": "ec5deec73e357c7c87b001275c4e635011a9cf39419f2b86e2c2b8d7e388c551"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791697915904,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\winhttp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258934,
-                      "hashes": {
-                        "imphash": "01ecfbe4437ca8d85dd9400611c1b90e",
-                        "md5": "bc9489df517c426d4044d99f14449134",
-                        "sha1": "814f9c8c59ee59f2ff3fc1b5e21d5e270babb506",
-                        "sha256": "cabd014ba29a548252bb8d5bd46d047dbfc445489492d9df75b29cede0ac9f8b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791697457152,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\webio.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257996,
-                      "hashes": {
-                        "imphash": "eb1c8dd21e1f92a8be35a76b165ce8da",
-                        "md5": "52d3d5e3586988d4d9e34acaac33105c",
-                        "sha1": "2c20246d2c45fb6e8976b37ad62465f5f4255f2b",
-                        "sha256": "c61b60ba962b25b8334f0941c3535ea4aca1cc060b8a196e396ca3e11ceef8a1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791744577536,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\credssp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535281,
-                      "hashes": {
-                        "imphash": "9e65c315ab3a48dda5ab558165a5002b",
-                        "md5": "ec7cbff96b05ecf3d366355b3c64adcf",
-                        "sha1": "fa74a61ea56a7bc3149860b5344c51fa9b6555bb",
-                        "sha256": "f69ed45ebedca9cf000ac03281f0ec2c351f98513fba90e63394e4e561d6c7a2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791748313088,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wship6.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535149,
-                      "hashes": {
-                        "imphash": "c2a02641f5327bf07de486ae7ec62117",
-                        "md5": "88351b29b622b30962d2feb6ca8d860b",
-                        "sha1": "3338d73b6c86fce85b07236ac230e5e2f4601818",
-                        "sha256": "a16cad7d94c1c9807083bb36e9b4c3c14e6482c4ca2bdfacbcc86e737ddce42e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791678255104,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\rasadhlp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258810,
-                      "hashes": {
-                        "imphash": "34991d52051c8576ed061e7a2c5a4ae0",
-                        "md5": "a199de544bf5c61c134b22c7592226fc",
-                        "sha1": "03d97c806e4a28bb37d8c8384deddd6ac28acc9d",
-                        "sha256": "af0cc2da847036f5fe6dd9fbeda7c3d05af291873d4eae121676dc6e8841a78f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791746215936,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\schannel.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535060,
-                      "hashes": {
-                        "imphash": "6a351d0e14283da2cd897563f0062c5b",
-                        "md5": "2e8c52a0ec788d90fa35d9507d828771",
-                        "sha1": "0725085c62d3a5a9a0d50256c2a56161aaca0a07",
-                        "sha256": "dd5aaa10e075f209d9827c7a192ad5645d1156c149db9b5ac1ef7b5e0b5f11de"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791750344704,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ncrypt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534713,
-                      "hashes": {
-                        "imphash": "9f3aab7eb2ffeeba57cb67496b05f365",
-                        "md5": "b9a95365e52f421a20e1501935fadda5",
-                        "sha1": "958a7ba90043f8e3b94da849a2da8bb139fc39c9",
-                        "sha256": "ddb4cb575139233efaf2c59b7e9b04af36bbccc63190181f3b2a7e6bfc86e77e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791750148096,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\bcrypt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 34 64 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 05:28"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257648,
-                      "hashes": {
-                        "imphash": "738644d200eea1ceb5661b1ac09aa146",
-                        "md5": "d6c7780a364c6bbacfa796bab9f1b374",
-                        "sha1": "15236c349be131790d21a63550d725cc62b1bf13",
-                        "sha256": "3b5ed1a030bfd0bb73d4ffcd67a6a0b8501ef70293f223efaa12f430adf270f9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791744839680,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\bcryptprimitives.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258932,
-                      "hashes": {
-                        "imphash": "0e8a67fa12ce3d22a9e1d18bda5c3260",
-                        "md5": "7a17485dc7d8a7ac81321a42cd034519",
-                        "sha1": "83d1722a35eb16b010d8c9f72c627e97d4642101",
-                        "sha256": "88d8705fa901793fc8c1cfd0175e49a6502bf0fc94a066ba573d2fd13aa5f04a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791743201280,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USERENV.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534853,
-                      "hashes": {
-                        "imphash": "1bcae470249f30c5f912c1293a2d3470",
-                        "md5": "9c9307c95671ac962f3d6eb3a4a89bae",
-                        "sha1": "6190ce7b101c5946b1d773245d286a1e592f5181",
-                        "sha256": "d1433791c9b8bceead8937ec18d33e89e4e2012b5975228a8500fd141bc30078"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791743070208,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\GPAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    }
-                  ],
-                  "name": "AmSvc.exe",
-                  "parent_exe": "C:\\Windows\\System32\\services.exe",
-                  "parent_name": "services.exe",
-                  "pid": 1076,
-                  "ppid": 432,
-                  "primary_token": {
-                    "domain": "NT AUTHORITY",
-                    "integrity_level": 16384,
-                    "integrity_level_name": "system",
-                    "privileges": [
-                      {
-                        "description": "Replace a process level token",
-                        "enabled": false,
-                        "name": "SeAssignPrimaryTokenPrivilege"
-                      },
-                      {
-                        "description": "Lock pages in memory",
-                        "enabled": true,
-                        "name": "SeLockMemoryPrivilege"
-                      },
-                      {
-                        "description": "Adjust memory quotas for a process",
-                        "enabled": false,
-                        "name": "SeIncreaseQuotaPrivilege"
-                      },
-                      {
-                        "description": "Act as part of the operating system",
-                        "enabled": true,
-                        "name": "SeTcbPrivilege"
-                      },
-                      {
-                        "description": "Manage auditing and security log",
-                        "enabled": false,
-                        "name": "SeSecurityPrivilege"
-                      },
-                      {
-                        "description": "Take ownership of files or other objects",
-                        "enabled": false,
-                        "name": "SeTakeOwnershipPrivilege"
-                      },
-                      {
-                        "description": "Load and unload device drivers",
-                        "enabled": true,
-                        "name": "SeLoadDriverPrivilege"
-                      },
-                      {
-                        "description": "Profile system performance",
-                        "enabled": true,
-                        "name": "SeSystemProfilePrivilege"
-                      },
-                      {
-                        "description": "Change the system time",
-                        "enabled": false,
-                        "name": "SeSystemtimePrivilege"
-                      },
-                      {
-                        "description": "Profile single process",
-                        "enabled": true,
-                        "name": "SeProfileSingleProcessPrivilege"
-                      },
-                      {
-                        "description": "Increase scheduling priority",
-                        "enabled": true,
-                        "name": "SeIncreaseBasePriorityPrivilege"
-                      },
-                      {
-                        "description": "Create a pagefile",
-                        "enabled": true,
-                        "name": "SeCreatePagefilePrivilege"
-                      },
-                      {
-                        "description": "Create permanent shared objects",
-                        "enabled": true,
-                        "name": "SeCreatePermanentPrivilege"
-                      },
-                      {
-                        "description": "Back up files and directories",
-                        "enabled": true,
-                        "name": "SeBackupPrivilege"
-                      },
-                      {
-                        "description": "Restore files and directories",
-                        "enabled": true,
-                        "name": "SeRestorePrivilege"
-                      },
-                      {
-                        "description": "Shut down the system",
-                        "enabled": false,
-                        "name": "SeShutdownPrivilege"
-                      },
-                      {
-                        "description": "Debug programs",
-                        "enabled": true,
-                        "name": "SeDebugPrivilege"
-                      },
-                      {
-                        "description": "Generate security audits",
-                        "enabled": true,
-                        "name": "SeAuditPrivilege"
-                      },
-                      {
-                        "description": "Modify firmware environment values",
-                        "enabled": false,
-                        "name": "SeSystemEnvironmentPrivilege"
-                      },
-                      {
-                        "description": "Bypass traverse checking",
-                        "enabled": true,
-                        "name": "SeChangeNotifyPrivilege"
-                      },
-                      {
-                        "description": "Remove computer from docking station",
-                        "enabled": false,
-                        "name": "SeUndockPrivilege"
-                      },
-                      {
-                        "description": "Perform volume maintenance tasks",
-                        "enabled": false,
-                        "name": "SeManageVolumePrivilege"
-                      },
-                      {
-                        "description": "Impersonate a client after authentication",
-                        "enabled": true,
-                        "name": "SeImpersonatePrivilege"
-                      },
-                      {
-                        "description": "Create global objects",
-                        "enabled": true,
-                        "name": "SeCreateGlobalPrivilege"
-                      },
-                      {
-                        "description": "Increase a process working set",
-                        "enabled": true,
-                        "name": "SeIncreaseWorkingSetPrivilege"
-                      },
-                      {
-                        "description": "Change the time zone",
-                        "enabled": true,
-                        "name": "SeTimeZonePrivilege"
-                      },
-                      {
-                        "description": "Create symbolic links",
-                        "enabled": true,
-                        "name": "SeCreateSymbolicLinkPrivilege"
-                      }
-                    ],
-                    "sid": "S-1-5-18",
-                    "type": "tokenPrimary",
-                    "user": "SYSTEM"
-                  },
-                  "services": [
-                    {
-                      "name": "CybereasonAntiMalware"
-                    }
-                  ],
-                  "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                  "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2",
-                  "sid": "S-1-5-18",
-                  "signature_signer": "Cybereason Inc",
-                  "signature_status": "trusted",
-                  "threads": [
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 5362733988,
-                      "thread_id": 1080,
-                      "up_time": 1084
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 2006167232,
-                      "thread_id": 1108,
-                      "up_time": 1083
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791693804752,
-                      "thread_id": 1232,
-                      "up_time": 1080
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791693762672,
-                      "thread_id": 1244,
-                      "up_time": 1080
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791679862464,
-                      "thread_id": 1392,
-                      "up_time": 1070
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791679862464,
-                      "thread_id": 1396,
-                      "up_time": 1070
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791679865776,
-                      "thread_id": 1400,
-                      "up_time": 1070
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791679929872,
-                      "thread_id": 1404,
-                      "up_time": 1070
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 2006186944,
-                      "thread_id": 1480,
-                      "up_time": 1067
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791704162340,
-                      "thread_id": 1632,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698721056,
-                      "thread_id": 1640,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698721056,
-                      "thread_id": 1644,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698721056,
-                      "thread_id": 1648,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698721056,
-                      "thread_id": 1652,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698721392,
-                      "thread_id": 1656,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698720112,
-                      "thread_id": 1660,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698720736,
-                      "thread_id": 1664,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 8791698722160,
-                      "thread_id": 1668,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 5362651040,
-                      "thread_id": 1672,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788400,
-                      "entrypoint": 5362651040,
-                      "thread_id": 1680,
-                      "up_time": 1033
-                    },
-                    {
-                      "create_time": 1542788900,
-                      "entrypoint": 8791680004352,
-                      "thread_id": 1808,
-                      "up_time": 587
-                    },
-                    {
-                      "create_time": 1542789000,
-                      "entrypoint": 2006186944,
-                      "thread_id": 2284,
-                      "up_time": 432
-                    },
-                    {
-                      "create_time": 1542789100,
-                      "entrypoint": 2006186944,
-                      "thread_id": 1780,
-                      "up_time": 364
-                    },
-                    {
-                      "create_time": 1542789100,
-                      "entrypoint": 2006186944,
-                      "thread_id": 12,
-                      "up_time": 343
-                    },
-                    {
-                      "create_time": 1542789200,
-                      "entrypoint": 8791748438592,
-                      "thread_id": 2476,
-                      "up_time": 168
-                    }
-                  ],
-                  "unique_pid": 22,
-                  "unique_ppid": 8,
-                  "up_time": 1084,
-                  "user": "SYSTEM"
-                },
-                "acting_thread": {
-                  "create_time": 1542788400,
-                  "service_name": "CybereasonAntiMalware",
-                  "thread_id": 1648,
-                  "thread_start_address": 8791698721056,
-                  "thread_start_address_module": "C:\\Program Files\\Cybereason ActiveProbe\\gzfltum.dll"
-                }
-              },
-              "captured_file": false,
-              "file_name": "C:\\Windows\\TEMP\\tmp0000008f\\tmp00001c75",
-              "file_operation": "creation",
-              "file_owner": "Administrators",
-              "file_size": 188416,
-              "hashes": {
-                "imphash": "835d619dfdf3cc727cebd91300ab3462",
-                "md5": "4ace3baaa509d08510405e1b169e325b",
-                "sha1": "27fb21cf5db95ffca43b234affa99becc4023b9d",
-                "sha256": "6ed1c836dbf099be7845bdab7671def2c157643761b52251e04e9b6ee109ec75"
-              },
-              "is_signature_trusted": false,
-              "malware_classification": {
-                "compressed_malware_features": {
-                  "data_buffer": "eAHtnU1oHHUUwHsQ7MGDiIIUD4sH8WBBxJtopiLoUY0pYo2ZTbJJ0yQ17m4+ms/NRzeVWpuUWCL4sWlEYvFQ8KJQ6NCTEA8eRD30sIo3PdSriLi7837Pko3LbHZ2M5m+XObHm/d/X////83O7jCZvzacHBpPplNdfalkdjSdyty674Ft59dN71Dpb9v5eKh8LMEHjsCF2wIfVlRKsHROYPGkQO5+gY2vBSYYdWZFYGwEO/cITHMqkxPYnBBY+07gtCuQ9gSGigJ5lPPYGXcE+jA4z3Ad1ZtAUiDUyrEEPYzqRnIKgxd/Rgc7gygPo5wn95PouN7OeEYJ1UXiJgRmvscgp/LOziIkkSyT+xRVnXhZ4DKh5goCkzidRHkGO4uvCyw9LDDtCay8ILCAzrJOJaGuZwUuvSewivJVIPsklq8JbL4qMJsTSCcExrGs83WKU295ZFo5lr2TaZbcUw5FeJy8tgTeLpCy2iGeS67ABXzlgbEi1UC5FxcZnA4y/CLK82Qxi847FGGZRTLsCUxR1aWEwOp1AmOjDRYYzgwusL9WfqBiGJxnVAanixTq7Dp22LBdlWMJzlOx8wmBK2Rx5WmBLJIRwtAijOQE+ooCb2B5xBOYRtlfNeXpLpA7oyZRTqHzGenkmIJPnhBIMrzTwSA6H93CO5l+c1NA99f6IwLH8fUKdjTmDpTbgS50+gGVnECnE4PpooC2guPoaPADSHrcncNHmEHtAFkq3+EI+A37zsrrTvH3WTkvJLoOTyBp10wx2JcgVCRahA4NrICE4a+hrMXsA3qAHItW188E8ejO7XV3eh/KCYwxlamEwCgL8lN2wTntfrhY/U0g/5KAdvUpT+AszWqBdqH7VLeeZrExK9Cv1UgIDKA8g/cx7QAEP+AhAfRaMKB2HOJh+BSFSqKjSytNGBlc6PrpxvK7lCVDxbSG3Z7AhCMwx6gelwgLAltXBXJUTH29j+U1LHdipx/QprfKfGnF0sBpdBYxmEQyTzW0h6/0khcuhhJYRufym+i4VKMocJMs/KvfoW3/UJb4PeZOSZVONThZz4djP/75TAXa/CVfOvX3RgVLIDreLPN1pP1osW7lGmHsEhjBOzf+EPBE4vndvWz5xb/cChxGcv1LAb+tluALKnZ47isf1MXvz1ZMlsCXbXtPceqhrcp1ps6YHwQeBXLEPCf7q23tl9uJui0bGBgYRAccv7uXr/g5Af+2oNTrpgTa/vnpjBvpLAwM4gRBPvIZGBgYGBgYGBgYGBgYGBgYGBgYGBgYNAOc9oMXs4GBgYFBcNBnww5QzDXgRtPSaZ5lg/itsRaslgZ3bnWEEVnhMetIBwiiVnlbCbWrEftrt11zdwWnseFW1QO63w1is3ptD1pV9xG0t+zvfUrzrvh380qwXWAVCw6h78GIfG7ZlzltXu6hd+y92fECRFhjuH3bXG8N43oXEHperdzvUbteaDxhVTUeq25fqhG1X6Ai8mtF6BDXz2wR+dzSgg4Qsxls5T11XMG+82y8GkG+b7kL69xg7mF1SFvhBgYGsYH/Xi7HE+PVkiB2jt1bNZxT+k4558jR53ydz5//1m1KOgYGBgYGBgYGEQfnsYaG2z1sdPJS79XQSu91ndobOAHCaN5vNzUk1bceQVzUpbw3iOuT+UFmR18bHrp3gyhDC56lCd1y85w2+HSNUwVhhdGC7blLf+bV/fqtvhMg1NDjCcugB1QXswbs8ekj/v1BgzFHBIIsyP+HfwFdMpzu",
-                  "decompressed_size": 27831,
-                  "encoding": "zlib"
-                },
-                "identifier": "endpointpe",
-                "prevention_threshold": 0.66,
-                "score": 1,
-                "threshold": 0.66,
-                "version": "3.0.33"
-              },
-              "pid": 1076,
-              "ppid": 432,
-              "signature_signer": "",
-              "temp_file_path": "C:\\Windows\\TEMP\\27fef9a8-bd80-4784-934c-76b383147d3f",
-              "timestamp": {
-                "accessed": 1542789400,
-                "created": 1542789400,
-                "modified": 1542789400
-              },
-              "user_blacklisted": false
-            },
-            "event_subtype_full": "file_classification_event",
-            "event_type_full": "alert_event",
-            "metadata": {
-              "beta_alert": false,
-              "chunk_id": 0,
-              "collection_time": 1542789400,
-              "correlation_id": "3aab8e43-2cdb-4d32-b46b-b8382ff11939",
-              "destination_plugin": "send",
-              "final": true,
-              "is_alert": true,
-              "key": "fileClassificationEventResponse",
-              "message_id": "31b54c77-fdbb-4550-9259-0dce12b98ec2",
-              "origination_task_id": "7aa040c3-7751-4b8f-9629-9ed4d84c1507",
-              "os_type": "windows",
-              "priority": 80,
-              "result": {
-                "local_code": 0,
-                "local_msg": "Success"
-              },
-              "semantic_version": "3.50.0",
-              "sensor_version": "3.50.0",
-              "task_id": "7aa040c3-7751-4b8f-9629-9ed4d84c1507",
-              "type": "detection"
-            },
-            "opcode": 8,
-            "serial_event_id": 167011,
-            "timestamp": 132140242101035230,
-            "timestamp_utc": "2019-09-27 02:16:50Z"
-          },
-          "event": {
-            "action": "file_classification_event",
-            "dataset": "esensor",
-            "kind": "alert",
-            "module": "endgame"
-          },
-          "host": {
-            "hostname": "HD-ssm-0b0d26ad",
-            "ip": "10.81.164.74",
-            "name": "HD-ssm-0b0d26ad",
-            "os": {
-              "name": "Windows",
-              "platform": "windows",
-              "version": "6.1"
-            }
-          },
-          "labels": {
-            "account_id": "8c48070b-4b61-4ded-86d5-1b9a7a78229c",
-            "endpoint_id": "5085268f-7443-4f15-85d2-bf14b2a69c60"
-          },
-          "user": {
-            "group": {
-            }
-          }
-        },
-        "type": "_doc"
-      }
-    },
-    {
-      "type": "doc",
-      "value": {
-        "id": "kuNEc20BW148Je-rmp1N",
-        "index": "test_alert_data",
-        "source": {
-          "@timestamp": 1542341895000,
-          "agent": {
-            "id": "ced9c68e-b94a-4d66-bb4c-6106514f0a2f",
-            "type": "endgame",
-            "version": "3.0.0"
-          },
-          "ecs": {
-            "version": "1.1.0"
-          },
-          "endgame": {
-            "data": {
-              "alert_details": {
-                "acting_process": {
-                  "authenticode": {
-                    "cert_signer": {
-                      "issuer_name": "Microsoft Windows Verification PCA",
-                      "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                      "subject_name": "Microsoft Windows"
-                    },
-                    "cert_timestamp": {
-                      "issuer_name": "Microsoft Time-Stamp PCA",
-                      "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                      "subject_name": "Microsoft Time-Stamp Service",
-                      "timestamp_string": "11/20/2010 11:37"
-                    },
-                    "more_info_link": "http://www.microsoft.com",
-                    "program_name": "Microsoft Windows",
-                    "publisher_link": ""
-                  },
-                  "cmdline": "C:\\Windows\\Explorer.EXE",
-                  "create_time": 1542341500,
-                  "domain": "WIN-Q3DOP1UKA81",
-                  "exe": "C:\\Windows\\explorer.exe",
-                  "hashes": {
-                    "md5": "ac4c51eb24aa95b77f705ab159189e24",
-                    "sha1": "4583daf9442880204730fb2c8a060430640494b1",
-                    "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a"
-                  },
-                  "imphash": "6422e341c67ba0880e012f8c7c634c21",
-                  "is_sensor": false,
-                  "malware_classification": {
-                    "identifier": "Whitelisted",
-                    "score": 0,
-                    "threshold": 0,
-                    "version": "3.0.0"
-                  },
-                  "md5": "ac4c51eb24aa95b77f705ab159189e24",
-                  "modules": [
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290248516,
-                      "hashes": {
-                        "imphash": "6422e341c67ba0880e012f8c7c634c21",
-                        "md5": "ac4c51eb24aa95b77f705ab159189e24",
-                        "sha1": "4583daf9442880204730fb2c8a060430640494b1",
-                        "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 4278845440,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\Explorer.EXE",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 05:28"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258681,
-                      "hashes": {
-                        "imphash": "d41d8cd98f00b204e9800998ecf8427e",
-                        "md5": "3556d5a8bf2cc508bdab51dec38d7c61",
-                        "sha1": "92015f7bbdb9dad35e41c533d2c5b85f1cd63d85",
-                        "sha256": "91e3d98ad3119e8addf8d2aa1dd6795162842fff7101e4c70c5137e847b4ff50"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2007891968,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\ntdll.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258315,
-                      "hashes": {
-                        "imphash": "9165b02c931d76a9b666d8d42128111b",
-                        "md5": "7a6326d96d53048fdec542df23d875a0",
-                        "sha1": "5c02af0206c299f5bcab8da4237cfc92e3e93495",
-                        "sha256": "182351570856cd6eedd9df7e2fb8ab76bd4d8fc70be11ad5de6484cfd70c21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2006712320,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\kernel32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258316,
-                      "hashes": {
-                        "imphash": "3f7fb1504bb73a54888bf1c3650fe4cf",
-                        "md5": "da68c291b4ef2dec9c5963266bcae454",
-                        "sha1": "5696e8c68fcf64104499e20e7cd5452b58b4f4ba",
-                        "sha256": "21aa4779fc21e762178517268c95467238c92851ad9160bffc36b2379c58337f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760175104,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\KERNELBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534699,
-                      "hashes": {
-                        "imphash": "e1ee2d71958d21e0e1bf887dfe76af7f",
-                        "md5": "6df46d2bd74e3da1b45f08f10d172732",
-                        "sha1": "3491f8f9a73c00b158e43a530210d67a4f0598ae",
-                        "sha256": "2dc945f6f2c4a82189bc7da2fcbb7d9a0e2588a909539249e55ba82468e0c677"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791763779584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ADVAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535038,
-                      "hashes": {
-                        "imphash": "8c99b1c0f6cf68b07336751f460f1dba",
-                        "md5": "7319bb10fa1f86e49e3dcf4136f6c957",
-                        "sha1": "3eea5ee8bafb2b9975b236c5c5655df6f4b42aa1",
-                        "sha256": "60de43ab267fd41c9804369b569139add30ed4e295c425f44fc04d3fcc95fca2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791790780416,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\msvcrt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535198,
-                      "hashes": {
-                        "imphash": "b8ba136689cdc8d8b25fc04902f39a22",
-                        "md5": "83404dcbce4925b6a5a77c5170f46d86",
-                        "sha1": "22bda6b9da4fcf492b4dd16554b0c0e27e1b8667",
-                        "sha256": "d669614d0b4461db244ad99fbe1ba92ceb9b4ed5ec8e987e23764e77d9ac7074"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791793074176,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\sechost.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258798,
-                      "hashes": {
-                        "imphash": "46876e4adb924a616ddbbb1992d61257",
-                        "md5": "0611473c1ad9e2d991cd9482068417f7",
-                        "sha1": "c4a3fa902dedad5d448e1d8b2d113cae1dcf2f7a",
-                        "sha256": "90afcc2a60350ece27e75e76459132ef0fa28ef283ce88fced4b82735a93ecda"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791762403328,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\RPCRT4.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258001,
-                      "hashes": {
-                        "imphash": "51945fdf9aaf56aeb9d6fa1f21b638ce",
-                        "md5": "1084aa52ccc324ea54c7121fa24c2221",
-                        "sha1": "b13ef924708fa88577931ed0337000e90adcdf5b",
-                        "sha256": "6e972cf624f7c0de8190434b3b30279a01c551713109f97b9ebb77fac9364754"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791792615424,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\GDI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258929,
-                      "hashes": {
-                        "imphash": "2cb501375ed127591bf5cfee7f1e52fe",
-                        "md5": "fe70103391a64039a921dbfff9c7ab1b",
-                        "sha1": "e0019d9442aeebd3bb42a24c38aa2fae4c6bd4f5",
-                        "sha256": "f7d219d75037bc98f6c69143b00ab6000a31f8b5e211e0af514f4f4b681522a0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2005663744,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USER32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534943,
-                      "hashes": {
-                        "imphash": "919110853c18aa198ad129945337b1dd",
-                        "md5": "d202223587518b13d72d68937b7e3f70",
-                        "sha1": "916a3ce858f074f57dd9dac01be5cd4649f19887",
-                        "sha256": "9db971b866d058adbb518dd99b87c5db8dd1e7c9073755b989ae7e9fb62901e8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791763714048,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\LPK.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258933,
-                      "hashes": {
-                        "imphash": "17bf46cf6bf6c8cae48be5b75615a353",
-                        "md5": "2f8b1e3ee3545d3b5a8d56fa1ae07b65",
-                        "sha1": "66310680ee38904b2852717af13028e53b4e8b8e",
-                        "sha256": "2a3ec01f3bafe7d7d656886437f7ffecce440c0d3f3467804769ab4bf1ff7a99"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791782522880,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USP10.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258859,
-                      "hashes": {
-                        "imphash": "4b37cbf60127ea0550ec30e0b1c52984",
-                        "md5": "eaf32cb8c1f810e4715b4dfbe785c7ff",
-                        "sha1": "3b099b193abb9064e6937101d0c309f04d713882",
-                        "sha256": "db6ad07fded42433e669508ab73faff6daff04575d6f1d016fe3eb6ecec4dd5d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791792091136,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SHLWAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258854,
-                      "hashes": {
-                        "imphash": "9c631776d86c9b15258c3cc2a6a7891d",
-                        "md5": "26e716ed95dc48cf6e5ac046089366af",
-                        "sha1": "2bd96b8ae5ae3ad14c16d2a98a91a9a9f26d179d",
-                        "sha256": "f686d557b7ac1688efc7cb48311290d713d3db2e9e61e947098a7c80e3a1b9e9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791765811200,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SHELL32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258732,
-                      "hashes": {
-                        "imphash": "faad2d5bf5c0ca9639e07a49e8c5d8ae",
-                        "md5": "6c60b5aca7442efb794082cdacfc001c",
-                        "sha1": "aae17944782b25f41f7b3a756532b4923f4ae817",
-                        "sha256": "fc1d9124856a70ff232ef3057d66bee803295847624ce23b4d0217f23af52c75"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791783374848,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ole32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258736,
-                      "hashes": {
-                        "imphash": "774fed8966de60d3af2dd9070df5be6f",
-                        "md5": "42f05f980f164e084db65b2e8cd8430f",
-                        "sha1": "86498b3c5bbc240b9de0a10f2cb4185e754de6d7",
-                        "sha256": "0813749847b08f6577791d18ad9eca6dff5b41c2f727ab5ee9e5bf9602ed50cb"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791785537536,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\OLEAUT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258088,
-                      "hashes": {
-                        "imphash": "ec96d3f694248151f968633563d10a36",
-                        "md5": "eed05d42d91835064703e2318552ed25",
-                        "sha1": "aa7e817ccad26070bce1161894f97e10aaa56fb9",
-                        "sha256": "e9ee1e2253445b207b76f5d3073c612ed979a982522c1515e0fe8fa9641ae568"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791634935808,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\EXPLORERFRAME.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534886,
-                      "hashes": {
-                        "imphash": "c0e1a4a34891e5dd2a6cbaa0895a8d38",
-                        "md5": "8ccde014a4cdf84564e03ace064ca753",
-                        "sha1": "957e29e029fe60b8ff43ff732463c39230b78226",
-                        "sha256": "dd663029b2eb7b12fdb00fce403d8326141e540e3b9ce84cd5871473d3e2e2cf"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791735599104,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DUser.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534885,
-                      "hashes": {
-                        "imphash": "9353143c2b77b94cc82ab55c5fecf99c",
-                        "md5": "3cb6a7286422c72c34dab54a5dff1a34",
-                        "sha1": "5b93896a6abb36c2b8957973e3ce1860c1059367",
-                        "sha256": "98d21efff511e407336a226420701e82554da01fa05661303836b6860d63749d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791721181184,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DUI70.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534912,
-                      "hashes": {
-                        "imphash": "d76d7be0b8ac9aafe17d2cc7deb32b29",
-                        "md5": "aa2c08ce85653b1a0d2e4ab407fa176c",
-                        "sha1": "0119c23d88292a0e4fec04d5cf8629005a44e37c",
-                        "sha256": "83dfd0c119b20aedb07114c9d1cf9ce2dfa938d0f1070256b0591a9e2c3997fa"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791793205248,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IMM32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535018,
-                      "hashes": {
-                        "imphash": "b523fff180cb22465ccf191b827e9923",
-                        "md5": "c431eaf5caa1c82cac2534a2eab348a3",
-                        "sha1": "e425577ccfc9b92efbbcb760d21fcaa478d3e51a",
-                        "sha256": "addf850128dc675e67faba9a3d0d27e684f01f733962ca22927bb94503549e44"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791764697088,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSCTF.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535251,
-                      "hashes": {
-                        "imphash": "56e651a119cdb899aadd2df3832bbcd1",
-                        "md5": "d29e998e8277666982b4f0303bf4e7af",
-                        "sha1": "e803b0af61ea2ddcd58b5a63b1cfbb73266318ea",
-                        "sha256": "4f19ab5dc173e278ebe45832f6ceaa40e2df6a2eddc81b2828122442fe5d376c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791742480384,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\UxTheme.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535202,
-                      "hashes": {
-                        "imphash": "1c419f7cfacebfcd8e903e6be290407e",
-                        "md5": "716175021bda290504ce434273f666bc",
-                        "sha1": "4f00fbf4e9a88fae9e6682989032831b3d2eba86",
-                        "sha256": "fa18ca2d8a5f4335e051e2933147d3c1e7308f7d446e2aeb6596cdef6e2afc88"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791718690816,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\POWRPROF.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258850,
-                      "hashes": {
-                        "imphash": "a7a25e8b145e75fdeb21026d3895033a",
-                        "md5": "5d8e6c95156ed1f79a63d1eade6f9ed5",
-                        "sha1": "cadd211d74385550c5e055d3312303f4d64fdebc",
-                        "sha256": "12130837d7f89a2c7e9d25747a8e5b9001e0a38d545178b49b450c23ae62664a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791788814336,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SETUPAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257756,
-                      "hashes": {
-                        "imphash": "5cd9d6761799e2ff681533ef1ffbb31d",
-                        "md5": "2477a28081bdaee622cf045acf8ee124",
-                        "sha1": "304c5f29fa847fbd994ad7a0471214198b928c14",
-                        "sha256": "00a09caf9129e84feea98fa03ce9012c9f961b64fee15c4f268822c0f82acc3c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760633856,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CFGMGR32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534817,
-                      "hashes": {
-                        "imphash": "2dbdaadf7e151289a49662379e253dfd",
-                        "md5": "06fec9e8117103bb1141a560e98077da",
-                        "sha1": "a8922793a930d602409b62be5ff01d5baec60000",
-                        "sha256": "c5e61b11ddbbbbba3d9488970524f0975ea5fbdf16e2fa31f579f8bfa48353b1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760044032,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DEVOBJ.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534887,
-                      "hashes": {
-                        "imphash": "e7f2585307f1db90e7e5e48c40dc7134",
-                        "md5": "da1b7075260f3872585bfcdd668c648b",
-                        "sha1": "f2bd334006d728422721b7c639145a6ec59a459b",
-                        "sha256": "3e10ef6e1a5c341b478322cb78a0ab7bfc70ad8023779b8b4542a7cb4ca756ab"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791742873600,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dwmapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535203,
-                      "hashes": {
-                        "imphash": "6a5a31c99a1562b9e5e10f4b4445be95",
-                        "md5": "be097f5bb10f9079fceb2dc4e7e20f02",
-                        "sha1": "dd572bac50bc4718126389c628d56a83d5c4d88a",
-                        "sha256": "90a88986c8c5f30fb153ec803feda6572b2c2630a6c9578fcc017800692694d5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791732256768,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\slc.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257495,
-                      "hashes": {
-                        "imphash": "fd8a6a2046d9572b7f8f4288ae251c61",
-                        "md5": "497bfeddaf3950dd909c3b0c5558a25d",
-                        "sha1": "5d55bdc156372f51eb126f7bc2a8af161a1ef254",
-                        "sha256": "980ea189929d95eb36e35980fff0c81f7b78de9422771fde8f4ac7a779f5bd89"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791732453376,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258848,
-                      "hashes": {
-                        "imphash": "cc4d63ca30fdbb90048e549782d2116a",
-                        "md5": "858df0795cb5b4bace0f33708925a414",
-                        "sha1": "e629ed78e6e1829263890974760dad8a431edf69",
-                        "sha256": "a9063af8d5c73a722bd269d144d8a65c98db4cfdd9f626e3a8283754e22c8c9c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791754801152,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\Secur32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258927,
-                      "hashes": {
-                        "imphash": "b32250da0d30f7782b5b900d4d9c519a",
-                        "md5": "2a86e54b441ad41557f75dc5609b9793",
-                        "sha1": "83ddcf8a1a0ca423bf8417f5e59b5c431bf50c43",
-                        "sha256": "8fede6909413c0fa5b63d58d39affd0f6c3beeaf19b7b2f8674913abfd79a912"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791756701696,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SSPICLI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258762,
-                      "hashes": {
-                        "imphash": "26c2856b9813d8990c01c5a711b5063a",
-                        "md5": "f06bb4e336ea57511fdbafafcc47de62",
-                        "sha1": "bfee1b9d2269d26d99c8e462825ee8399c8bd4ec",
-                        "sha256": "be43ec62548e9ff89a9495a1722e22dbb76eec3764f86e64057b636f27d15765"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791728259072,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\PROPSYS.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534993,
-                      "hashes": {
-                        "imphash": "f0c6fd6831905d958b05645b680db89f",
-                        "md5": "784fa3df338e2e8f5f0389d6fac428af",
-                        "sha1": "6d32c67c91c6d374854e907c6719db2538540867",
-                        "sha256": "9c8aa0cfdeb9e38aaf8eb08626070e0f0364f4f8a793cfe3532ec6c007980c34"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791757291520,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257499,
-                      "hashes": {
-                        "imphash": "cd11f800bc54ae45ead9d98c96048145",
-                        "md5": "7fa8fdc2c2a27817fd0f624e78d3b50c",
-                        "sha1": "b4aa8e16396b1882eb75c28dfbec9949608afdde",
-                        "sha256": "7b63f6aa2cd6d4d07ea3c595b868b1a0749bb11620027a2bd9b935e3055481e4"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791736123392,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258974,
-                      "hashes": {
-                        "imphash": "b03f7d8315f3384d06c11e961e6fee07",
-                        "md5": "26b73a85855681500bcc25c7cd9ff5b1",
-                        "sha1": "393ed9ebbe380c77935df6d0eda2047cdd2224fe",
-                        "sha256": "94d134a6af53ad629a4505b8b0ea37f61bb43af4db71874e7e87853163a9282a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791724851200,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WindowsCodecs.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535135,
-                      "hashes": {
-                        "imphash": "ff720e05e534d67b814b8562265058f5",
-                        "md5": "2c942733a5983dd4502219ff37c7ebc7",
-                        "sha1": "263e8fbf77c0ceead0c9bca56394bffa4a664361",
-                        "sha256": "34b20b6b0d7274e4b5b783f1d2345bc3dd9888964d5c2c65712f041a00cf5b45"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791758143488,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\profapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257558,
-                      "hashes": {
-                        "imphash": "6af6d846a78a6532fcb989d0d8aeb17d",
-                        "md5": "90499f3163a9f815cf196a205ea3cd5d",
-                        "sha1": "f97ff54dc4b132756fcf7041e55d645163f19851",
-                        "sha256": "29b4ed3795cec1177eb367132914ce21c194cdec5db9dc923fd928c85e94d821"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791756898304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\apphelp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534778,
-                      "hashes": {
-                        "imphash": "37afbae3e0f359c3718e379261f7ccfc",
-                        "md5": "25983de69b57142039ac8d95e71cd9c9",
-                        "sha1": "01691e3b0bfa569e64bdb7dc3d637a867ed2dc08",
-                        "sha256": "a677da7ebcbcb6073d27e8a38809f51e971e83ed379bc599aaad6ef4216348da"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791787700224,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CLBCatQ.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534842,
-                      "hashes": {
-                        "imphash": "cbda3eb1c9c46a2121362e9775f60b47",
-                        "md5": "024352feec9042260bb4cfb4d79a206b",
-                        "sha1": "79c23ce566219f87ade8e55a292aaaabe4a639ec",
-                        "sha256": "60cb39086e10c5b66ebc15e4df219620b344b4358d2918ab6bb3448a0ac8be36"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791731994624,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\EhStorShell.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258701,
-                      "hashes": {
-                        "imphash": "37dad3873d5388f07576532bc042f677",
-                        "md5": "7bbf670114373ce6a203fa155a9e0d0a",
-                        "sha1": "104d89dde030b661d05c4c63a03fae1f46ab52d2",
-                        "sha256": "36ef0a36c679e53b1b169289bd3c05d7c2839dc20c8c87bf520b633911fde198"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791647518720,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ntshrui.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258920,
-                      "hashes": {
-                        "imphash": "2d37f2d4b3c246f361ca150fc7ebf8d4",
-                        "md5": "3a9c9baf610b0dd4967086040b3b62a9",
-                        "sha1": "3207ac7f895eab34623d994548d7810e54be3e79",
-                        "sha256": "e8e9a0f42b1ee7806edceed08aa024d037215d06ca317e3678bd5364ad513d23"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791753228288,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\srvcli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258010,
-                      "hashes": {
-                        "imphash": "2ba777561101c3b07566cc50db3a564c",
-                        "md5": "1bf0cb861a48feb1638228760750f3cb",
-                        "sha1": "fbc77224c1b444a6ec25e99f995f2f355e4d1d26",
-                        "sha256": "37c781a8c546ead8b4d28bd7d730b9ac78eb799599ad69dad9054b6f9f1dd6bd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791649091584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\cscapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:35"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534897,
-                      "hashes": {
-                        "imphash": "5bf52e420b6d5991bdcce16ada0828dc",
-                        "md5": "1d63f4366288b8a7595397e27010fd44",
-                        "sha1": "e459e1227083e4eabd19ee20e13754560fc7e02d",
-                        "sha256": "99ea4ddd88d9c4a4cc9b238f533cb4d2c062d46239173997e8594d8a75811a01"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791735533568,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IconCodecService.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534998,
-                      "hashes": {
-                        "imphash": "77870f98ca4d25a823c74d7404a64bfd",
-                        "md5": "d0c2fbb6d97416b0166478fc7ae2b212",
-                        "sha1": "e290bdf2312ac30a4e9f2a96d7c84714eee84899",
-                        "sha256": "7eab6c37f0a845e645ca44cc060ac6c56e386c7ef7a64716c6786c9602ad8c9d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791750606848,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTSP.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 17:43"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535161,
-                      "hashes": {
-                        "imphash": "b8c20a01e4d94df61ee21f5350389f9c",
-                        "md5": "5d8874a8c11dddde29e12de0e2013493",
-                        "sha1": "a1c8e3e6ee44dcb68752d44b3b6f4ecce89c388d",
-                        "sha256": "3e9a57137bf622af83e3e4d58971e2c0200559cca7545d16cf263aa03ee9c7d2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791747461120,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\rsaenh.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258799,
-                      "hashes": {
-                        "imphash": "a198edd0f73abd7cdbb54eef82ab1fc6",
-                        "md5": "c2a8cb1275ecb85d246a9ecc02a728e3",
-                        "sha1": "4417207821fc8f5c72ff531683f183caef297882",
-                        "sha256": "3603fadca0060bd201148f9d59e4e2627f024609a6463ab525b5d1ad17bdcd10"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791758012416,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\RpcRtRemote.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258895,
-                      "hashes": {
-                        "imphash": "4fe9beaa9bd4aa01f5063a7352325c89",
-                        "md5": "d7f1ef374a90709b31591823b002f918",
-                        "sha1": "336ac44b8ee88a6af3f3eaf461b8bdf94fa657ff",
-                        "sha256": "05fd2837c9b03d14bb2a969c1ad77caef047d93dc5d0f6c2acbf0888e8f7b359"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791730683904,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SndVolSSO.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534873,
-                      "hashes": {
-                        "imphash": "0a90384377303e2a2625725018566a89",
-                        "md5": "896f15a6434d93edb42519d5e18e6b50",
-                        "sha1": "b91a3512a80c4201c3fcfaf62abace894fbba328",
-                        "sha256": "9263f0cec58d45ebe3fb9c3061fb9392c55a7933b84b4592e6ee13cfc86d5a50"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791731929088,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\HID.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534952,
-                      "hashes": {
-                        "imphash": "98a24f570dbcd3a092d95b3bd4e51a53",
-                        "md5": "227e2c382a1e02f8d4965e664d3bbe43",
-                        "sha1": "c4971ba9c1e4fdf0106c7cfab626a3d8737bbd07",
-                        "sha256": "1cff20a8bf87ace4fa4935ebeed72bfb1a1fe902a754899e2f50798d67df5642"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791729504256,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\MMDevApi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258898,
-                      "hashes": {
-                        "imphash": "e99757a4c1beee1b5bf8b7b33b444dcc",
-                        "md5": "1fcb1a72bf5c784f7358e6bef38e4571",
-                        "sha1": "ef944a320de79bf05f0e30f54f3f8b2ba2e82c4a",
-                        "sha256": "12da4240f8c964eda6223257bd9723fd9372e63ae86f00509163b1de12a5f6c5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791637426176,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\timedate.cpl",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534704,
-                      "hashes": {
-                        "imphash": "d6de6fde05f96ac848accdb1aef473e4",
-                        "md5": "58775492ffd419248b08325e583c527f",
-                        "sha1": "b0e9ca05d46cb53049c4ca33fe04bd08989a78f9",
-                        "sha256": "dbb013971f5894f25c222c2d4d50a29db6df3c413792ee9ccc1a9e6d85469093"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791732322304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ATL.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535266,
-                      "hashes": {
-                        "imphash": "fa1e670045065ff088a4ac664f9ac3d7",
-                        "md5": "9f2bacd5e1776a4bb7cc0ec3c3a4f96d",
-                        "sha1": "ad8c7ec85d532e5725b8535830f27c1abcf139b4",
-                        "sha256": "19959d18601712901f03b83150d15e34ebcab355bb4692c9a28511a72f57fc66"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791730618368,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINBRAND.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257498,
-                      "hashes": {
-                        "imphash": "53f2c3eaeaa6e619e0ccd6e671e96145",
-                        "md5": "e6f0f82788e8bd0f7a616350efa0761c",
-                        "sha1": "9aa4aafda89325853ffa66169e697529164a23a2",
-                        "sha256": "13091dcb3e3f4f52c3ff210e93aaf1dce142cfc09f671aeac5b922393b23e67b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791633952768,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\actxprxy.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535165,
-                      "hashes": {
-                        "imphash": "ae5e5f76641aadaf99f0ca29d2e1cadd",
-                        "md5": "1f4492fe41767cdb8b89d17655847cdd",
-                        "sha1": "c836a5e65d56900b6658fdaa3df8579bdd07ec69",
-                        "sha256": "184547fac0c3d7148faa3f601929a7089de393bd19929a137dad743331dd3f77"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791719739392,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ntmarta.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259030,
-                      "hashes": {
-                        "imphash": "f792b6ec2e11bc79d8eb1bb1bcb79a91",
-                        "md5": "4e4ffb09d895aa000dd56d1404f69a7e",
-                        "sha1": "40f5c1890f6de5284f6c897255e6907b0272349a",
-                        "sha256": "d999e04bb35780088480eab322176570591a21e311d204bdcab010a63b34d24c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791794974720,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WLDAP32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258853,
-                      "hashes": {
-                        "imphash": "2507624727988c72eb2a628a990000fd",
-                        "md5": "c4f40f6cacd796a8e16671d0e9a2f319",
-                        "sha1": "0881ae2a2fd3c5f03654410c474e5a25317942b2",
-                        "sha256": "44853c645915d910ed0cc6d38f68b6c222528ec5fcbe990e238010f41204e682"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791729897472,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\shdocvw.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534923,
-                      "hashes": {
-                        "imphash": "e52a872655c57d1b906101b6d5449bbf",
-                        "md5": "a0a65d306a5490d2eb8e7de66898ecfd",
-                        "sha1": "880ac520eb1d38ebb591707a26e6dd300df40643",
-                        "sha256": "ce5da408f4edd5e81ce0925867f03c9a35172cf1571fe4c4c052e45ab69822bb"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791729831936,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\LINKINFO.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258932,
-                      "hashes": {
-                        "imphash": "0e8a67fa12ce3d22a9e1d18bda5c3260",
-                        "md5": "7a17485dc7d8a7ac81321a42cd034519",
-                        "sha1": "83d1722a35eb16b010d8c9f72c627e97d4642101",
-                        "sha256": "88d8705fa901793fc8c1cfd0175e49a6502bf0fc94a066ba573d2fd13aa5f04a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791745036288,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USERENV.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258852,
-                      "hashes": {
-                        "imphash": "8b5c65294bec1cf89e97325a24b8cfc5",
-                        "md5": "4e9c2db10f7e6ae91bf761139d4b745b",
-                        "sha1": "6e8e6a53269ca8acc8c2456c80cd3a56d8deb98d",
-                        "sha256": "8f63f78294f5585d599a114af449dcc447ccb239d0f0b490bfe6b34a2146e730"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791704207360,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\shacct.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535152,
-                      "hashes": {
-                        "imphash": "44b39e98ae2946f304f4dbadcfffa307",
-                        "md5": "5b3ebfc3da142324b388ddcc4465e1ff",
-                        "sha1": "86e20ebf70fd35723eb635c4f3684891a2547a7b",
-                        "sha256": "5d58642305311f9bc9b779c9598bfc4e7433b3ea58404bf1ff9466838a2328c7"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791716069376,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SAMLIB.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258793,
-                      "hashes": {
-                        "imphash": "7fec5787890bfedd3b3aa4082f53a08e",
-                        "md5": "fc51229c7d4afa0d6f186133728b95ab",
-                        "sha1": "f7a2f224356e68b612ecce4512c99f5b9c264d7d",
-                        "sha256": "37e58c8e1c8437d1981725a5dcdaca7316cefbb570370cefc8d122f523b96ac0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791714168832,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\samcli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258588,
-                      "hashes": {
-                        "imphash": "96f28fef38c977afbf3f6e8f39c0d6b9",
-                        "md5": "6ceca4c6a489c9b2e6073afdaae3f607",
-                        "sha1": "b228f6208642cb99e5bcdf2d3ebda2b8bc4fb020",
-                        "sha256": "127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722426368,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\netutils.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535084,
-                      "hashes": {
-                        "imphash": "14bd8d9a93b98b2479e1f6cd57b7c790",
-                        "md5": "7cb3acb163de051169095dc6507b8977",
-                        "sha1": "b891ebebb25655157f7c612d5763e995c86009a2",
-                        "sha256": "45d4deb0695440d8b5e959945b3f7a773e02e2ab305e316123a1064fc1905402"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791703945216,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\msls31.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257535,
-                      "hashes": {
-                        "imphash": "bf738a2fc0ab0601eea36f35e4cbcd27",
-                        "md5": "0bee002c68e28ce6da161dcf1376d7d7",
-                        "sha1": "d5cc3bec12c801e11217acc6927e1e6e401fe208",
-                        "sha256": "1d4ee0b9ce22d139478008d5591b8c9f027c235cba601f95a96547cf98159d4b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791631134720,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\authui.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258007,
-                      "hashes": {
-                        "imphash": "76801e47683b36a4115dbe046717edbe",
-                        "md5": "b3bfbd758506ecb50c5804aaa76318f9",
-                        "sha1": "bf6c922467347a6690eb19c5e82be09b3295778b",
-                        "sha256": "34e079a6ab2d41d1e0b3887b6ae31c43941061b7176fff2801c3f465c2c89578"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791630020608,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTUI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257999,
-                      "hashes": {
-                        "imphash": "04534d8dae5ab230b9bee9b1b0b2829d",
-                        "md5": "3f9f2afa135f0663946a006dd5ffd897",
-                        "sha1": "ea6456859b04b68af8dcd453381dd168af53fc5e",
-                        "sha256": "276d1c9c78c529625c2ef3d77079324628686ea184767971901a1de93681c133"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760896000,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258373,
-                      "hashes": {
-                        "imphash": "2e50bc5d9fe777770c8a6b2cfaf6b2e9",
-                        "md5": "884415bd4269c02eaf8e2613bf85500d",
-                        "sha1": "c3a64f05c210b38c69d8f1fc1d74a71b56ada30c",
-                        "sha256": "efe771709ec942694fd206ac8d0a48ed7dcd35036f074268e4aecd68ac982cea"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791759060992,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSASN1.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258922,
-                      "hashes": {
-                        "imphash": "75124ca243f494ff6127697f3ebc418a",
-                        "md5": "5fada8b707318e1bd63a7e2b81e6c8cb",
-                        "sha1": "c5ad1c9bbc2f565237a144b9cf44711dfcf65ea5",
-                        "sha256": "2590e88cab52fcc1b24cb262d293131c6280a5f234e0c130e77aa8697efa3b5f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791793401856,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\urlmon.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258980,
-                      "hashes": {
-                        "imphash": "248b27a31ddf696c2e3bfe6aed9c3eba",
-                        "md5": "f6c5302e1f4813d552f41a0ac82455e5",
-                        "sha1": "f0ec3ad7e90f559d1bc9b8849cf5668cafba2031",
-                        "sha256": "e3ebf44621efc6381baae0f0efc13c356dcb6ee31bb258137edb3cc3e18549b5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791786455040,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WININET.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258097,
-                      "hashes": {
-                        "imphash": "f6db6123d8a383f58cf318d00d2e7d1d",
-                        "md5": "5180380d353277d395d3b36d790aa93e",
-                        "sha1": "d5622ec5d922233867422d1e143969e226bb9a1c",
-                        "sha256": "89b894eccf65704d00d30ea3bd45b184bfab8345b779f9ae2be66b9fc7226f72"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791780032512,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\iertutil.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535234,
-                      "hashes": {
-                        "imphash": "13ecfa3a285149680a7a4b174c8b8f5b",
-                        "md5": "94e026870a55aaeaff7853c1754091e9",
-                        "sha1": "a4f845318e095d841b05e1400747ee4c28e1f28e",
-                        "sha256": "b2f5d5629d12bdfa98dbed3898368f37d9009c7531b6909c7285a2c11c9a0f93"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791743004672,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\VERSION.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259004,
-                      "hashes": {
-                        "imphash": "da0bcac0c5f9dc653d00eecd5fb1c801",
-                        "md5": "0d9764d58c5efd672b7184854b152e5e",
-                        "sha1": "99d78db040987c69b6a70a42af86641ba0413956",
-                        "sha256": "9827b43dabbec39ab2e2294408d9c5304ef27a684903c5234c6070387723d49e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791758209024,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINSTA.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535280,
-                      "hashes": {
-                        "imphash": "af1203c1d6d810c97729856780869b12",
-                        "md5": "ef2ae43bcd46abb13fc3e5b2b1935c73",
-                        "sha1": "c53e005cd04d99331ce3114ac119256133202313",
-                        "sha256": "81fc06f306f620845d7dd8d06e706309e70bc89b589c81f3478302a3f5f73431"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791683301376,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINMM.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258936,
-                      "hashes": {
-                        "imphash": "7e9874f9ecf2191b91f9a4dfa37f2ba1",
-                        "md5": "1473768973453de50dc738c2955fc4dd",
-                        "sha1": "7b046f6070844e3bc7deae115a1dfe5825030513",
-                        "sha256": "14bc5da2442cb726acc1f277ddbeccf5d61e3a0a3e083a55a0bb610191e35220"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791648239616,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wdmaud.drv",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535081,
-                      "hashes": {
-                        "imphash": "086996ef0b01a463f114deb5244861b9",
-                        "md5": "8560fffc8eb3a806dcd4f82252cfc8c6",
-                        "sha1": "7562bbb63b0db6e4986ebdb86495c4fe284a1eaa",
-                        "sha256": "cc27bc092369a89d6147b16568fedeb68b584d5738cd686c31f7fae22ed17b3b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 1968373760,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ksuser.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534742,
-                      "hashes": {
-                        "imphash": "690cce63d22e22d9aa225c4a9290b2c4",
-                        "md5": "78a1e65207484b7f8d3217507745f47c",
-                        "sha1": "3542a591e9c97b48739f69e2a193dff461ea097c",
-                        "sha256": "35f413adb9d157f3666dd15dd58104d629cd9143198a1ab914b73a4a3c9903dd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791718625280,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\AVRT.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257517,
-                      "hashes": {
-                        "imphash": "64661addcde8896487dcc7cd32a4eda9",
-                        "md5": "dc220ae6f64819099f7ebd6f137e32e7",
-                        "sha1": "5707f15b666c7d3b07dfce9dac665a2e45c39113",
-                        "sha256": "b8fe13b859fa83500dd95637fa6d4a5b8392c2a363e41d014d3b5374f636e1de"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791659118592,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\AUDIOSES.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534992,
-                      "hashes": {
-                        "imphash": "3bf8d3fd03f9d07b7821df4b1da2be9d",
-                        "md5": "1b7c3a37362c7b2890168c5fc61c8d9b",
-                        "sha1": "78ba8d596c0ac4c38acb498416957891570a2a1d",
-                        "sha256": "03727930e5bb5f9d91bab901fc9a2e3b795d68e2aee6a2cc3477f356c45a9c54"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791728062464,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\msacm32.drv",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534991,
-                      "hashes": {
-                        "imphash": "9611d7fd4fe3c571fbf1db3d718ba82c",
-                        "md5": "10ac5ce9f78dc281a1bbd9b8cc587b8a",
-                        "sha1": "207582f9d9bec00a932fba886d575ee5b6502d42",
-                        "sha256": "72288c0a88916d3c3828dbd948dbdb0928f26106319f8e60102d6c9004514d60"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791716659200,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSACM32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535038,
-                      "hashes": {
-                        "imphash": "5a8ee2f48e79ef6ac4b33366d6642b50",
-                        "md5": "ca2a0750ed830678997695ff61b04c30",
-                        "sha1": "a27df990dde73e72bb02105f8af689a1ac324e59",
-                        "sha256": "e84860cd97aa3c4565abb2d5d406a5c42b1ad2d8ba1b8cf81fe564d91f15f976"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791727996928,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\midimap.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 07:10"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535256,
-                      "hashes": {
-                        "imphash": "04a5e982c134477b1914ebcd7b6436d0",
-                        "md5": "d6f630c1fd7f436316093ae500363b19",
-                        "sha1": "197897b74f411040ba7df41a5bd3c1030661b904",
-                        "sha256": "73a94b4938430396ea4240b1a6676b4e6c19cfaf8c52efb9a69b4b2175a86307"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791727734784,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\XmlLite.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258889,
-                      "hashes": {
-                        "imphash": "8181b1ef70ff3d29984db497f92a2662",
-                        "md5": "c3761661c17c2248a9379a8fb89e3de1",
-                        "sha1": "d2ea41e02bbaa77f8b93b09277596a34cdae8853",
-                        "sha256": "ce3477fa2b4058eb80739e0161fe957545f13cf86d313f6422732901d35f75f2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791617568768,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\stobject.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257641,
-                      "hashes": {
-                        "imphash": "fbe995ff97475c5aa2777a4bc493d4b1",
-                        "md5": "f832eeea97cdda1af577e721f652a0d1",
-                        "sha1": "48f227a1e10d49edf56e3559e05c871bc285c199",
-                        "sha256": "ebbb7ca199ba4df231123922bd310d43de0104c6185b70fe0281b938d5336f2e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791616782336,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\BatMeter.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535260,
-                      "hashes": {
-                        "imphash": "5d8fff13bf206e589cae241fc7f4d464",
-                        "md5": "bd3674be7fc9d8d3732c83e8499576ed",
-                        "sha1": "cb96190d6366e11dd6e6b48f4cdc4332015cfa67",
-                        "sha256": "e6716a5895d629263a4d21959f48840429ab6f4b55a5fa2663ee5e86c9ca2bf1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791727538176,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WTSAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259008,
-                      "hashes": {
-                        "imphash": "b2ecd39ae0055d9e1b8aa5bc78942cba",
-                        "md5": "eb3f9c2de1236b5d46b2291d82970e43",
-                        "sha1": "0ce9ddc1063256ab571b916389321fd7f572ddc0",
-                        "sha256": "8a43d335f3d573bed98af54bb51e82546c2acc025da8a48d801213eb14e9d5d4"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791759781888,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINTRUST.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534970,
-                      "hashes": {
-                        "imphash": "8accd78cb7feca81ac448f0485be30dc",
-                        "md5": "4166f82be4d24938977dd1746be9b8a0",
-                        "sha1": "5174036d781677f5444d9a23079baf18f4bbda44",
-                        "sha256": "24121751b7306225ad1c808442d7b030def377e9316aa0a3c5c7460e87317881"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791730159616,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\es.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257970,
-                      "hashes": {
-                        "imphash": "8c20d7b93902b8c193a7fc1b4b58e9aa",
-                        "md5": "42a9cb6906d9a8bedc83b57163e62924",
-                        "sha1": "50e5592460d91205e912d55f60a2dd3cc4da4329",
-                        "sha256": "e18522d3137653140757829efbfce624a5baa5842e2bba10b9e5ab6c84be49e1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791614619648,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dxp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258826,
-                      "hashes": {
-                        "imphash": "1df61af51096e9bbbdc1834405984e4c",
-                        "md5": "2d2a6ec8ead30ec3ace2fd6fb1b3e122",
-                        "sha1": "1e77948378474e155307d290b998994f720206bf",
-                        "sha256": "e7ea375a3bde8fc764cb09524344370b9ee25f98ad6c83e6f37a569eb8d277d6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791614160896,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\prnfldr.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259000,
-                      "hashes": {
-                        "imphash": "2f59265cb3df847423b60921203365be",
-                        "md5": "0015acfbbdd164a8a730009908868ca7",
-                        "sha1": "671c084513461900550bd49d3dccb58bdbe05adf",
-                        "sha256": "e1ff243ad2cf959fab81efe701592414991c03416ff296adc93906e76b707c4d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791654924288,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINSPOOL.DRV",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535225,
-                      "hashes": {
-                        "imphash": "3d49b728c9125f451e7f2f215e9d3bbb",
-                        "md5": "2bc7c9fd0a9f2c9afc373f3ad1ee3891",
-                        "sha1": "1b7c6960a72509d1f408022d791c6a65acb2a75d",
-                        "sha256": "0a82a475301202791a7c10f978f952eab7db146a702d4ea67e24e2c98bc19638"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791648108544,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\Syncreg.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258789,
-                      "hashes": {
-                        "imphash": "c5c69e7d20ca382ddbc49947d651a8e7",
-                        "md5": "10f815be90a66aafc6c713d1bd626064",
-                        "sha1": "3e21f173a6bcdf629c442d89abadc48137c61bb2",
-                        "sha256": "01139fc04bc53594296f6a0e16b8d20b940f64bc8119fe7705c03c4947958f39"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791612325888,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\pnidui.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258791,
-                      "hashes": {
-                        "imphash": "6437e4761b1278fdecf142a679216f7b",
-                        "md5": "b9f0a4020aa98b7a20287bf7fe99a1fd",
-                        "sha1": "1f28ac7493ce972b45de191780a190504d1d0c44",
-                        "sha256": "21138f161eeea46198890c7a2d073f2c82829e15676131bdad9f237edc7477cd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791612194816,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\QUtil.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535239,
-                      "hashes": {
-                        "imphash": "deeb658dae29d8df1c8dbb08f06801b0",
-                        "md5": "3c073b0c596a0af84933e7406766b040",
-                        "sha1": "06185554c38353211430f5f075c490558e46fb3d",
-                        "sha256": "4698bba678f553e15ad4b07ad7fb236281f872defee97bfd637114476c8f97b3"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791752769536,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wevtapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258586,
-                      "hashes": {
-                        "imphash": "97bb6eee9e1ea3e5751077b655b54de5",
-                        "md5": "a42f2c1eb3b66c54fb3c7b79d30c1a6d",
-                        "sha1": "cee705de8d3dfcc9e2a14e0249d6be61fcd54a18",
-                        "sha256": "a63836db3b01835dc1311526a95198d6ebccb1dc9ddafbc38ec36c128cdb98b9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791609507840,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\netshell.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258138,
-                      "hashes": {
-                        "imphash": "0bc508389b6b5577cf3cca214ca523a7",
-                        "md5": "2b81776da02017a37fe26c662827470e",
-                        "sha1": "8c85389640bea73a009d83079f8b4c963697035f",
-                        "sha256": "a656353c50ee08422145d00db9cfd9f6d3e664753b3c454b171e2a56a8aa94dc"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791727210496,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\IPHLPAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535145,
-                      "hashes": {
-                        "imphash": "579f52f57e43aa6ff0d07e88af5d0ff5",
-                        "md5": "044fe45ffd6ad40e3bbbe60b7f41babe",
-                        "sha1": "94233c0d4169c02c85514adb1f05cd3298c87f43",
-                        "sha256": "a1688a5e6e0f7037c850699462c2655006a7d873c97f9ab406c59d81749b6f09"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791763648512,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NSI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535281,
-                      "hashes": {
-                        "imphash": "e710d6d30f2346e7cd91c89ec3b602d9",
-                        "md5": "4c9210e8f4e052f6a4eb87716da0c24c",
-                        "sha1": "d4fa50aded12eb162478d7606f1270b78dd1a44b",
-                        "sha256": "460f7990bdadb7d58d6dc95b094d30a2efdc4ceed444b18a2f36e8d9076fb8b9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791726948352,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\WINNSI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258583,
-                      "hashes": {
-                        "imphash": "7e01da4b2a8806d2944a3ff2e271958f",
-                        "md5": "2df36f15b2bc1571a6a542a3c2107920",
-                        "sha1": "660a44b660d8e57ef7d7efbbc006ac390a7901fa",
-                        "sha256": "a918f1ee95269df973421af2f5713deeaf15ef0f77baa7e8c515ffb69896fb7a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791735992320,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\nlaapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534791,
-                      "hashes": {
-                        "imphash": "59b31e42f8fae7b5809ba7fcae732e0c",
-                        "md5": "4cbcc37856ea2039c27a2fb661dda0e5",
-                        "sha1": "cc666108d34168420a1d1942dda1e090154c7296",
-                        "sha256": "74cbfab3092a9564bddfcb84db3e3f8bcfd1492938adf187423d3355d73d21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791723999232,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc6.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258981,
-                      "hashes": {
-                        "imphash": "1ec347d133df2fe4da3e5f8944caeae8",
-                        "md5": "4bbfa57f594f7e8a8edc8f377184c3f0",
-                        "sha1": "d48aafa576b40a5e386e609bba1010472551154a",
-                        "sha256": "9f3ac5dea5a6250c3dbb97af79c81c0a48429486521f807355a1d7d3d861b75f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791788486656,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WS2_32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:35"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257492,
-                      "hashes": {
-                        "imphash": "f5d0254c5435291634c8b7357aa536bd",
-                        "md5": "92dbf0a4c9239169010fc6e07859c82e",
-                        "sha1": "634d8c12de82c422dfeba8f9a5fa84d03b7bcd35",
-                        "sha256": "00fb2cf4420f0ffef519afe732a708cf249640121e2a891caa164313abd7f804"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791608655872,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\Actioncenter.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534790,
-                      "hashes": {
-                        "imphash": "f17020f0f66b64fbdf51c75b43f3729d",
-                        "md5": "f568f7c08458d69e4fcd8675bbb107e4",
-                        "sha1": "c1e05f0255a6f386711044b11e2d04dfd328b26a",
-                        "sha256": "a5fa25ecf248999a68ccecfbb508bfa1add18a23e20a9a9081a87c41caaa36c0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791723868160,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257996,
-                      "hashes": {
-                        "imphash": "eb1c8dd21e1f92a8be35a76b165ce8da",
-                        "md5": "52d3d5e3586988d4d9e34acaac33105c",
-                        "sha1": "2c20246d2c45fb6e8976b37ad62465f5f4255f2b",
-                        "sha256": "c61b60ba962b25b8334f0941c3535ea4aca1cc060b8a196e396ca3e11ceef8a1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791746412544,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\credssp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258110,
-                      "hashes": {
-                        "imphash": "9ba63732839305b29ebe539451171b45",
-                        "md5": "8130391f82d52d36c0441f714136957f",
-                        "sha1": "e2bb102565986a42d0a43bd3f337f94dbe54eead",
-                        "sha256": "1fd4fee7caf63e450f27729e07ea2a2f09288629fd872dbb6e8710b16d8dbd5d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791608131584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\imapi2.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258038,
-                      "hashes": {
-                        "imphash": "e070eff3751fea77ccd424469a9a07e6",
-                        "md5": "6a5c1a8ac0b572679361026d0e900420",
-                        "sha1": "fd9241fdda4b9d08ff1e205f9d5f78923ab884d8",
-                        "sha256": "b5e693b48b462e97738a3d4e58b60846159649eb15f4d11074b4bc107cc88562"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791607345152,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\hgcpl.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535139,
-                      "hashes": {
-                        "imphash": "1e00eab90042e5099339cb82841b434a",
-                        "md5": "f7073c962c4fb7c415565dde109de49f",
-                        "sha1": "671c2e910ff954700b3a1f80608423697895c0a9",
-                        "sha256": "781e7088dcefbc34a808c3e7da41a56112b3f23abe9f54b5ef4d5cd9cd016b1d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791680090112,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\npmproxy.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258777,
-                      "hashes": {
-                        "imphash": "d402ebf00a5cffa66b6682780c262457",
-                        "md5": "6b851e682a36453e1b1ee297ffb6e2ab",
-                        "sha1": "3dc85ba13d1f720e8039865817bcc65dc0f1d35b",
-                        "sha256": "a641d3fd9463c4788b45b8b5584ea4489c1f63a71b4b595ae85ff3482cd5eda6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791606099968,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\QAgent.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534818,
-                      "hashes": {
-                        "imphash": "09bf801b36364c598a2a8fdff079932c",
-                        "md5": "cd1b5ad07e5f7fef30e055dcc9e96180",
-                        "sha1": "4e835fdadd0c67fde44e385f69a1014d6ad11f4f",
-                        "sha256": "63c58551f32b0b09377f64a6ae1fa81af93b8a707a57a8c18722086906ad3046"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791745167360,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DEVRTL.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258413,
-                      "hashes": {
-                        "imphash": "08a9b8e4e42e5520be662b4663289747",
-                        "md5": "1eac1a8ca6874bf5b15e2efb9a9a7b86",
-                        "sha1": "30cff16f17833aa042d8b6cc32d86c4a39c77c67",
-                        "sha256": "e15ed4fefc3010c213694331ddfdc03767682325c898d773ab243e2dc8b08461"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791633100800,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MsftEdit.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258939,
-                      "hashes": {
-                        "imphash": "6ac24d44010fe2db4d5e9e0651b7a3cf",
-                        "md5": "f9959237f106f2b2609e61a290c0652e",
-                        "sha1": "7f7c92c4fe8244a7deac7fed4d5576042bfba29e",
-                        "sha256": "fccc12e5aae1773bf87b1c4bce71d017db1a5a7ac189559058ea1ecc72075a82"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791628709888,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\werconcpl.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535233,
-                      "hashes": {
-                        "imphash": "cce75846cdf9d74f85e44fc728ee8440",
-                        "md5": "9689a9c7f7c2a1a423cda2c3b43fff65",
-                        "sha1": "ebe6b3066634239a4f62780a8a6e27f33b0afc87",
-                        "sha256": "914ad22d98975578bc14d821f72e8dfce24f2092f9c299d24ebbaf5408fe8b8b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791646994432,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wer.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257998,
-                      "hashes": {
-                        "imphash": "6e52c6bdbfd3d257064382284bd4f59c",
-                        "md5": "1484b9ebf567346582de571b0e164ae0",
-                        "sha1": "6b87eb7005fe659f976732307fe12b96747dfc8d",
-                        "sha256": "9862bf22b2e32dabe7a82acee5b4ea1f0a93bdc3c71b20a6a4e568cccd76a7a6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791628382208,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\framedynos.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535235,
-                      "hashes": {
-                        "imphash": "64b92457c7762d63f903189058d583ca",
-                        "md5": "7e591867422dc788b9e5bd337a669a08",
-                        "sha1": "3bd1b2a2271d6756351d9b4876193efd8a845da0",
-                        "sha256": "484e6bccdf7adce9a1aacad1bc7c7d7694b9e40fa90d94b14d80c607784f6c75"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791628251136,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wercplsupport.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258497,
-                      "hashes": {
-                        "imphash": "2814c7c81c59e8a913c288a8c72a9c1c",
-                        "md5": "5c29199c9f0ede64f17f268084ec4392",
-                        "sha1": "a767e893427f9b24fe06cbb3a155dd54162a402a",
-                        "sha256": "ea9fd588a8c89399dd287399a912b356a4234cfe418239b227d255749f5ddde2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791652564992,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\msxml6.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:35"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534858,
-                      "hashes": {
-                        "imphash": "2ab209fb6a68c8e15483324a442c1c4c",
-                        "md5": "809ae7d4ace06bbcf621e5c504bf6fc8",
-                        "sha1": "c0e2202d99db67a9efa6c67226410ad3c7b657a6",
-                        "sha256": "0baab89fb57468f27446947d75cbd6ddfc92d9b8f040144a12656803b2f7bf65"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722491904,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\hcproviders.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:36"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258095,
-                      "hashes": {
-                        "imphash": "328b1cd6b239c7c01904019379bede4b",
-                        "md5": "77a8a1791145710c7efe76ea82bf0763",
-                        "sha1": "e421318d7b6d66c9214722c736f5b3d4207acf74",
-                        "sha256": "9488b96e065299d273f9dcc82aa1203b48f0038d4f27324da19e9bfd925ca737"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791627726848,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Internet Explorer\\ieproxy.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258892,
-                      "hashes": {
-                        "imphash": "ec50511b4e46da8b1a467667a84f8047",
-                        "md5": "9cead32e79a62150fe9f8557e58e008b",
-                        "sha1": "4cbd17b96209b5e2da683382e05cef55f48d6107",
-                        "sha256": "afe4c1725ee94d7de0749ae1495a4e5cc33c369f29b2a589da66ffe27ff9777e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791757357056,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SXS.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258896,
-                      "hashes": {
-                        "imphash": "d75a096a9c47b1fd385a268e9c6f2f68",
-                        "md5": "24f4b480f335a6c724af352253c5d98b",
-                        "sha1": "a388cc90338cec7b5eec66e921599de0cc275a2b",
-                        "sha256": "011413b236cad7b78ce0a0eec3e3085d48c7576a3205d025ba6ebfdf590538e4"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791660232704,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\thumbcache.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247527581,
-                      "hashes": {
-                        "imphash": "be693a67b5b884d7609eaf574ba00955",
-                        "md5": "d87e1e59c73c1f98d5ded5b3850c40f5",
-                        "sha1": "141c0ebecdd2733b90431f18b188ee0b64456268",
-                        "sha256": "536419bff9f877d4314b5d0c045d9a6e729489c389863fadf07e382050bc84fd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2009726976,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\PSAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:36"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258093,
-                      "hashes": {
-                        "imphash": "39d5c5468a8e87803234025334b9dc09",
-                        "md5": "f1115299b9f4c983bc4523b33e3a506c",
-                        "sha1": "639946c23b630798284a92117882990ea31d702e",
-                        "sha256": "01a1d8b3e5cf727f92f4a43d5c5f81022127d58a850d29d3f084ad411efbc9dd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791578836992,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ieframe.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535131,
-                      "hashes": {
-                        "imphash": "84786d42c8a896b9a971b3c9eb8feb4c",
-                        "md5": "9869a4a10b90546dbd56947839fb4b87",
-                        "sha1": "5d9642f314d62dc5834cbd7950230bad3f85d982",
-                        "sha256": "66c84dcf39d9f6896d55b1623184a028891a0a98abe6044de1d4bad60c3c8d72"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791591157760,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\OLEACC.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258887,
-                      "hashes": {
-                        "imphash": "e6c083bfcedd032db2c66cd04f74c620",
-                        "md5": "4e81439902079c348b61d7ff027fe147",
-                        "sha1": "4386a5580b459aa4a0701addb753c3f9bf3da6f7",
-                        "sha256": "e652c9ec77745504689532b3c394959f9b5bc29e9c008cb9ee09cda818514fa9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791658594304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\StructuredQuery.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258589,
-                      "hashes": {
-                        "imphash": "45badcf3f18f69f9f72af5245898d1cb",
-                        "md5": "405f4d32d2185f1f1bd753d8eeaffb3a",
-                        "sha1": "68bc45bac1e1584c789a6b3134bee5a2540f3e56",
-                        "sha256": "cac42c3e09c43be96592b670d70821386014db22d8239a9cfb9e33e54fb5c3d5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791656890368,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NetworkExplorer.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258495,
-                      "hashes": {
-                        "imphash": "cdb39fb77293fb1bb86c2d5980ea8e88",
-                        "md5": "022b05cee68d7826a93aedb4f1eb369e",
-                        "sha1": "e7055d6cacb8c3fae06dc10ad480c8e6b8b7b592",
-                        "sha256": "3b864d1471ed0949b02f1fa251b987185abeaddcbecd44efdbb6a7b7f03ca8bc"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791625760768,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\msxml3.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258914,
-                      "hashes": {
-                        "imphash": "6b6c83729fa36b04c301494d1eb07752",
-                        "md5": "bb074f35b49eb2ea416962b596281e1e",
-                        "sha1": "355fdb9e66ffad42144b1b6ec4d8eb357ed05d52",
-                        "sha256": "e07208204b9616027e5144e2f3ef1ba81168365b7d2a761210b0fbc65b97871e"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791623598080,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\systemcpl.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258594,
-                      "hashes": {
-                        "imphash": "2bd8f9f72a13c2803ac3d34b805130b9",
-                        "md5": "764908fe1fa96f93c95b1b67a0fced29",
-                        "sha1": "88d0027e5d10158e3678d9eb2326779fef8a64d1",
-                        "sha256": "26ef25ab307903c5e806a8cc3b750a491049e5d1225ceddfce64dd51aa6f592b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722557440,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\NETAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259010,
-                      "hashes": {
-                        "imphash": "6ad99a405bde55d6a18debafd3f5e5c5",
-                        "md5": "3c91392d448f6e5d525a85b7550d8ba9",
-                        "sha1": "b62eaf7d80617e136a8f3c9161c23464e6f2a171",
-                        "sha256": "6fd0dc73dbe7519e2c643554c2a7f8fbe4f9a678c4241bb54b3c6e65d2abcf3a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791722295296,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wkscli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534877,
-                      "hashes": {
-                        "imphash": "3e340766bf7f54e3e9746a945d4dcb71",
-                        "md5": "a77be7cb3222b4fb0ac6c71d1c2698d4",
-                        "sha1": "e68b4e0058fb130c765e5aa98af36e26563809db",
-                        "sha256": "73566223914bf670df6b5931fa213e546713531b10391ed65b5256bbd7abde7f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791735926784,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\DSROLE.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258758,
-                      "hashes": {
-                        "imphash": "c888173aa662e52d4b6194ed15819a13",
-                        "md5": "db76db15efc6e4d1153a6c5bc895948d",
-                        "sha1": "00dc6172c4507def32e4a269c08e76ab09abc3fe",
-                        "sha256": "71ddf02c7ee2df66a08f1a2a08da39802c354624880a2be93a706ea7476422a3"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791690641408,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SPPC.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 07:10"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535243,
-                      "hashes": {
-                        "imphash": "9484a9d0a0e3ef20592c9f66412400a6",
-                        "md5": "666a60f6f5e719856ff6254e0966eff7",
-                        "sha1": "10258e708443bd21997e7a977b5ee36bd758e368",
-                        "sha256": "58c072e7e215991e19c1ca062c476081982f7b9f039714539ae7feb4981c200f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791716200448,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wbem\\wbemprox.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 07:10"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258938,
-                      "hashes": {
-                        "imphash": "03a62984ba62616e18740e69949df533",
-                        "md5": "7db5aa22a8a8e5c2d335f44853c1f6de",
-                        "sha1": "add6f6e2b6df5f571d06db724de5c7badad4e775",
-                        "sha256": "a734a20357026c42950394682a52cbc3af956d09f1949e1b4e95467e999bc428"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791690051584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wbemcomn.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535244,
-                      "hashes": {
-                        "imphash": "6178a249d43f815225b0a9205f1f4f70",
-                        "md5": "718b6f51ab7f6fe2988a36868f9ad3ab",
-                        "sha1": "7cc84a20d6597f58eebabea5489d72239c6e746b",
-                        "sha256": "76141b4e94c2766e2c34cef523092948771a7893212efadbe88d2171b85ff012"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791683170304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wbem\\wbemsvc.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 07:10"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534846,
-                      "hashes": {
-                        "imphash": "c93ca8ec08e734d1b95c2a2d28884c47",
-                        "md5": "a3f5e8ec1316c3e2562b82694a251c9e",
-                        "sha1": "f0cdc2b44e609950ee97d9967c7459055a2af1a8",
-                        "sha256": "f3dc6aa6a9d3b5bbc730668fc52c1d4bb5d515d404578bddd3d4869a7ed58822"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791688675328,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wbem\\fastprox.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535150,
-                      "hashes": {
-                        "imphash": "29f9ce11d25836037034b49be93790c6",
-                        "md5": "ee26d130808d16c0e417bbbed0451b34",
-                        "sha1": "962d52fb4d8f9965c5fc11a98f2f9048a2a5d918",
-                        "sha256": "4886dce4faef146a40babd492a8000a2022fea542a6135a9bafd4cd09297b4e5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791688478720,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NTDSAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258103,
-                      "hashes": {
-                        "imphash": "ba45ab39c8fb40e4076d27cf8e0f4180",
-                        "md5": "b8509dcfcfd577f568be4026bfd982c0",
-                        "sha1": "1923c5995faf94d9b1767aca04e3134a5cedc07a",
-                        "sha256": "e3608e6de15c400fa437349e7295fef10a1a0213ca3b532a58964b8c89749110"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791788355584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\imagehlp.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    }
-                  ],
-                  "name": "explorer.exe",
-                  "parent_exe": "",
-                  "parent_name": "",
-                  "pid": 784,
-                  "ppid": 704,
-                  "primary_token": {
-                    "domain": "WIN-Q3DOP1UKA81",
-                    "integrity_level": 12288,
-                    "integrity_level_name": "high",
-                    "privileges": [
-                      {
-                        "description": "Adjust memory quotas for a process",
-                        "enabled": false,
-                        "name": "SeIncreaseQuotaPrivilege"
-                      },
-                      {
-                        "description": "Manage auditing and security log",
-                        "enabled": false,
-                        "name": "SeSecurityPrivilege"
-                      },
-                      {
-                        "description": "Take ownership of files or other objects",
-                        "enabled": false,
-                        "name": "SeTakeOwnershipPrivilege"
-                      },
-                      {
-                        "description": "Load and unload device drivers",
-                        "enabled": false,
-                        "name": "SeLoadDriverPrivilege"
-                      },
-                      {
-                        "description": "Profile system performance",
-                        "enabled": false,
-                        "name": "SeSystemProfilePrivilege"
-                      },
-                      {
-                        "description": "Change the system time",
-                        "enabled": false,
-                        "name": "SeSystemtimePrivilege"
-                      },
-                      {
-                        "description": "Profile single process",
-                        "enabled": false,
-                        "name": "SeProfileSingleProcessPrivilege"
-                      },
-                      {
-                        "description": "Increase scheduling priority",
-                        "enabled": false,
-                        "name": "SeIncreaseBasePriorityPrivilege"
-                      },
-                      {
-                        "description": "Create a pagefile",
-                        "enabled": false,
-                        "name": "SeCreatePagefilePrivilege"
-                      },
-                      {
-                        "description": "Back up files and directories",
-                        "enabled": false,
-                        "name": "SeBackupPrivilege"
-                      },
-                      {
-                        "description": "Restore files and directories",
-                        "enabled": false,
-                        "name": "SeRestorePrivilege"
-                      },
-                      {
-                        "description": "Shut down the system",
-                        "enabled": false,
-                        "name": "SeShutdownPrivilege"
-                      },
-                      {
-                        "description": "Debug programs",
-                        "enabled": false,
-                        "name": "SeDebugPrivilege"
-                      },
-                      {
-                        "description": "Modify firmware environment values",
-                        "enabled": false,
-                        "name": "SeSystemEnvironmentPrivilege"
-                      },
-                      {
-                        "description": "Bypass traverse checking",
-                        "enabled": true,
-                        "name": "SeChangeNotifyPrivilege"
-                      },
-                      {
-                        "description": "Force shutdown from a remote system",
-                        "enabled": false,
-                        "name": "SeRemoteShutdownPrivilege"
-                      },
-                      {
-                        "description": "Remove computer from docking station",
-                        "enabled": false,
-                        "name": "SeUndockPrivilege"
-                      },
-                      {
-                        "description": "Perform volume maintenance tasks",
-                        "enabled": false,
-                        "name": "SeManageVolumePrivilege"
-                      },
-                      {
-                        "description": "Impersonate a client after authentication",
-                        "enabled": true,
-                        "name": "SeImpersonatePrivilege"
-                      },
-                      {
-                        "description": "Create global objects",
-                        "enabled": true,
-                        "name": "SeCreateGlobalPrivilege"
-                      },
-                      {
-                        "description": "Increase a process working set",
-                        "enabled": false,
-                        "name": "SeIncreaseWorkingSetPrivilege"
-                      },
-                      {
-                        "description": "Change the time zone",
-                        "enabled": false,
-                        "name": "SeTimeZonePrivilege"
-                      },
-                      {
-                        "description": "Create symbolic links",
-                        "enabled": false,
-                        "name": "SeCreateSymbolicLinkPrivilege"
-                      }
-                    ],
-                    "sid": "S-1-5-21-2016385190-3414718578-1263322444-500",
-                    "type": "tokenPrimary",
-                    "user": "Administrator"
-                  },
-                  "sha1": "4583daf9442880204730fb2c8a060430640494b1",
-                  "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a",
-                  "sid": "S-1-5-21-2016385190-3414718578-1263322444-500",
-                  "signature_signer": "Microsoft Windows",
-                  "signature_status": "trusted",
-                  "threads": [
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 4279023504,
-                      "thread_id": 1920,
-                      "up_time": 437
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 2008002240,
-                      "thread_id": 1812,
-                      "up_time": 437
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791783440744,
-                      "thread_id": 2472,
-                      "up_time": 436
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2468,
-                      "up_time": 436
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791790810108,
-                      "thread_id": 2464,
-                      "up_time": 436
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2476,
-                      "up_time": 435
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 2008021952,
-                      "thread_id": 1800,
-                      "up_time": 434
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 2008021952,
-                      "thread_id": 2516,
-                      "up_time": 433
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2500,
-                      "up_time": 433
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 1068,
-                      "up_time": 432
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2676,
-                      "up_time": 428
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2660,
-                      "up_time": 428
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2748,
-                      "up_time": 428
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791729529348,
-                      "thread_id": 2636,
-                      "up_time": 428
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2732,
-                      "up_time": 424
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 8791783440744,
-                      "thread_id": 1472,
-                      "up_time": 419
-                    },
-                    {
-                      "create_time": 1542341500,
-                      "entrypoint": 2008021952,
-                      "thread_id": 2220,
-                      "up_time": 415
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 2332,
-                      "up_time": 104
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 3712,
-                      "up_time": 99
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 2080,
-                      "up_time": 85
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 4012,
-                      "up_time": 81
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 4060,
-                      "up_time": 81
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 520,
-                      "up_time": 77
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 3236,
-                      "up_time": 74
-                    },
-                    {
-                      "create_time": 1542341800,
-                      "entrypoint": 2008021952,
-                      "thread_id": 3260,
-                      "up_time": 72
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 3680,
-                      "up_time": 56
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 2008021952,
-                      "thread_id": 3708,
-                      "up_time": 55
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 2008021952,
-                      "thread_id": 2512,
-                      "up_time": 55
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 3748,
-                      "up_time": 54
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791690668104,
-                      "thread_id": 3872,
-                      "up_time": 51
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791683305488,
-                      "thread_id": 1016,
-                      "up_time": 26
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 2008021952,
-                      "thread_id": 3520,
-                      "up_time": 26
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791792141832,
-                      "thread_id": 3992,
-                      "up_time": 13
-                    },
-                    {
-                      "create_time": 1542341900,
-                      "entrypoint": 8791760904360,
-                      "thread_id": 3604,
-                      "up_time": 12
-                    }
-                  ],
-                  "unique_pid": 35,
-                  "unique_ppid": 0,
-                  "up_time": 437,
-                  "user": "Administrator"
-                }
-              },
-              "captured_file": false,
-              "file_name": "C:\\Users\\Administrator\\Downloads\\endpointpe-blacklist-test.exe",
-              "file_operation": "open",
-              "file_owner": "Administrators",
-              "file_size": 188416,
-              "hashes": {
-                "imphash": "835d619dfdf3cc727cebd91300ab3462",
-                "md5": "4ace3baaa509d08510405e1b169e325b",
-                "sha1": "27fb21cf5db95ffca43b234affa99becc4023b9d",
-                "sha256": "6ed1c836dbf099be7845bdab7671def2c157643761b52251e04e9b6ee109ec75"
-              },
-              "is_signature_trusted": false,
-              "malware_classification": {
-                "compressed_malware_features": {
-                  "data_buffer": "eAHtnU1oHHUUwHsQ7MGDiIIUD4sH8WBBxJtopiLoUY0pYo2ZTbJJ0yQ17m4+ms/NRzeVWpuUWCL4sWlEYvFQ8KJQ6NCTEA8eRD30sIo3PdSriLi7837Pko3LbHZ2M5m+XObHm/d/X////83O7jCZvzacHBpPplNdfalkdjSdyty674Ft59dN71Dpb9v5eKh8LMEHjsCF2wIfVlRKsHROYPGkQO5+gY2vBSYYdWZFYGwEO/cITHMqkxPYnBBY+07gtCuQ9gSGigJ5lPPYGXcE+jA4z3Ad1ZtAUiDUyrEEPYzqRnIKgxd/Rgc7gygPo5wn95PouN7OeEYJ1UXiJgRmvscgp/LOziIkkSyT+xRVnXhZ4DKh5goCkzidRHkGO4uvCyw9LDDtCay8ILCAzrJOJaGuZwUuvSewivJVIPsklq8JbL4qMJsTSCcExrGs83WKU295ZFo5lr2TaZbcUw5FeJy8tgTeLpCy2iGeS67ABXzlgbEi1UC5FxcZnA4y/CLK82Qxi847FGGZRTLsCUxR1aWEwOp1AmOjDRYYzgwusL9WfqBiGJxnVAanixTq7Dp22LBdlWMJzlOx8wmBK2Rx5WmBLJIRwtAijOQE+ooCb2B5xBOYRtlfNeXpLpA7oyZRTqHzGenkmIJPnhBIMrzTwSA6H93CO5l+c1NA99f6IwLH8fUKdjTmDpTbgS50+gGVnECnE4PpooC2guPoaPADSHrcncNHmEHtAFkq3+EI+A37zsrrTvH3WTkvJLoOTyBp10wx2JcgVCRahA4NrICE4a+hrMXsA3qAHItW188E8ejO7XV3eh/KCYwxlamEwCgL8lN2wTntfrhY/U0g/5KAdvUpT+AszWqBdqH7VLeeZrExK9Cv1UgIDKA8g/cx7QAEP+AhAfRaMKB2HOJh+BSFSqKjSytNGBlc6PrpxvK7lCVDxbSG3Z7AhCMwx6gelwgLAltXBXJUTH29j+U1LHdipx/QprfKfGnF0sBpdBYxmEQyTzW0h6/0khcuhhJYRufym+i4VKMocJMs/KvfoW3/UJb4PeZOSZVONThZz4djP/75TAXa/CVfOvX3RgVLIDreLPN1pP1osW7lGmHsEhjBOzf+EPBE4vndvWz5xb/cChxGcv1LAb+tluALKnZ47isf1MXvz1ZMlsCXbXtPceqhrcp1ps6YHwQeBXLEPCf7q23tl9uJui0bGBgYRAccv7uXr/g5Af+2oNTrpgTa/vnpjBvpLAwM4gRBPvIZGBgYGBgYGBgYGBgYGBgYGBgYGBgYNAOc9oMXs4GBgYFBcNBnww5QzDXgRtPSaZ5lg/itsRaslgZ3bnWEEVnhMetIBwiiVnlbCbWrEftrt11zdwWnseFW1QO63w1is3ptD1pV9xG0t+zvfUrzrvh380qwXWAVCw6h78GIfG7ZlzltXu6hd+y92fECRFhjuH3bXG8N43oXEHperdzvUbteaDxhVTUeq25fqhG1X6Ai8mtF6BDXz2wR+dzSgg4Qsxls5T11XMG+82y8GkG+b7kL69xg7mF1SFvhBgYGsYH/Xi7HE+PVkiB2jt1bNZxT+k4558jR53ydz5//1m1KOgYGBgYGBgYGEQfnsYaG2z1sdPJS79XQSu91ndobOAHCaN5vNzUk1bceQVzUpbw3iOuT+UFmR18bHrp3gyhDC56lCd1y85w2+HSNUwVhhdGC7blLf+bV/fqtvhMg1NDjCcugB1QXswbs8ekj/v1BgzFHBIIsyP+HfwFdMpzu",
-                  "decompressed_size": 27831,
-                  "encoding": "zlib"
-                },
-                "identifier": "endpointpe",
-                "prevention_threshold": 0.66,
-                "score": 1,
-                "threshold": 0.66,
-                "version": "3.0.33"
-              },
-              "pid": 784,
-              "ppid": 704,
-              "signature_signer": "",
-              "temp_file_path": "C:\\Windows\\TEMP\\581ac9e2-e9ea-499e-8ec6-d7eed985b6c3",
-              "timestamp": {
-                "accessed": 1542341100,
-                "created": 1542341100,
-                "modified": 1542341100
-              },
-              "user_blacklisted": false
-            },
-            "event_subtype_full": "file_classification_event",
-            "event_type_full": "alert_event",
-            "metadata": {
-              "beta_alert": false,
-              "chunk_id": 0,
-              "collection_time": 1542341900,
-              "correlation_id": "9a754fa1-f526-4390-9adf-640cae174f66",
-              "destination_plugin": "send",
-              "final": true,
-              "is_alert": true,
-              "key": "fileClassificationEventResponse",
-              "message_id": "7b97295f-3aae-4dc8-944f-039f1064c55b",
-              "origination_task_id": "010d9a4e-dd34-4dfa-b283-a492a5785e90",
-              "os_type": "windows",
-              "priority": 80,
-              "result": {
-                "local_code": 0,
-                "local_msg": "Success"
-              },
-              "semantic_version": "3.50.0",
-              "sensor_version": "3.50.0",
-              "task_id": "010d9a4e-dd34-4dfa-b283-a492a5785e90",
-              "type": "prevention"
-            },
-            "opcode": 8,
-            "serial_event_id": 141336,
-            "timestamp": 132140205750594450,
-            "timestamp_utc": "2019-09-27 01:16:15Z"
-          },
-          "event": {
-            "action": "file_classification_event",
-            "dataset": "esensor",
-            "kind": "alert",
-            "module": "endgame"
-          },
-          "host": {
-            "hostname": "HD-c15-bc09190a",
-            "ip": "10.179.244.14",
-            "name": "HD-c15-bc09190a",
-            "os": {
-              "name": "Windows",
-              "platform": "windows",
-              "version": "6.1"
-            }
-          },
-          "labels": {
-            "account_id": "8c48070b-4b61-4ded-86d5-1b9a7a78229c",
-            "endpoint_id": "ced9c68e-b94a-4d66-bb4c-6106514f0a2f"
-          },
-          "user": {
-            "group": {
-            }
-          }
-        },
-        "type": "_doc"
-      }
-    },
-    {
-      "type": "doc",
-      "value": {
-        "id": "9ONEc20BW148Je-ro712",
-        "index": "test_alert_data",
-        "source": {
-          "@timestamp": 1542346435000,
-          "agent": {
-            "id": "c89dc040-2350-4d59-baea-9ff2e369136f",
-            "type": "endgame",
-            "version": "3.0.0"
-          },
-          "ecs": {
-            "version": "1.1.0"
-          },
-          "endgame": {
-            "data": {
-              "alert_details": {
-                "acting_process": {
-                  "authenticode": {
-                    "cert_signer": {
-                      "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                      "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                      "subject_name": "Cybereason Inc"
-                    },
-                    "cert_timestamp": {
-                      "issuer_name": "",
-                      "serial_number": "",
-                      "subject_name": "",
-                      "timestamp_string": ""
-                    },
-                    "more_info_link": "",
-                    "program_name": "",
-                    "publisher_link": ""
-                  },
-                  "cmdline": "\"C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe\"",
-                  "create_time": 1542345900,
-                  "domain": "NT AUTHORITY",
-                  "exe": "C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe",
-                  "hashes": {
-                    "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                    "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                    "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2"
-                  },
-                  "imphash": "c30d230b81c734e82e86e2e2fe01cd01",
-                  "is_sensor": false,
-                  "malware_classification": {
-                    "identifier": "Whitelisted",
-                    "score": 0,
-                    "threshold": 0,
-                    "version": "3.0.0"
-                  },
-                  "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                  "modules": [
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424710,
-                      "hashes": {
-                        "imphash": "c30d230b81c734e82e86e2e2fe01cd01",
-                        "md5": "1f2d082566b0fc5f2c238a5180db7451",
-                        "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                        "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 5354225664,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 05:28"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258681,
-                      "hashes": {
-                        "imphash": "d41d8cd98f00b204e9800998ecf8427e",
-                        "md5": "3556d5a8bf2cc508bdab51dec38d7c61",
-                        "sha1": "92015f7bbdb9dad35e41c533d2c5b85f1cd63d85",
-                        "sha256": "91e3d98ad3119e8addf8d2aa1dd6795162842fff7101e4c70c5137e847b4ff50"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2001141760,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\ntdll.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258315,
-                      "hashes": {
-                        "imphash": "9165b02c931d76a9b666d8d42128111b",
-                        "md5": "7a6326d96d53048fdec542df23d875a0",
-                        "sha1": "5c02af0206c299f5bcab8da4237cfc92e3e93495",
-                        "sha256": "182351570856cd6eedd9df7e2fb8ab76bd4d8fc70be11ad5de6484cfd70c21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 1999962112,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\kernel32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258316,
-                      "hashes": {
-                        "imphash": "3f7fb1504bb73a54888bf1c3650fe4cf",
-                        "md5": "da68c291b4ef2dec9c5963266bcae454",
-                        "sha1": "5696e8c68fcf64104499e20e7cd5452b58b4f4ba",
-                        "sha256": "21aa4779fc21e762178517268c95467238c92851ad9160bffc36b2379c58337f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791752769536,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\KERNELBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258929,
-                      "hashes": {
-                        "imphash": "2cb501375ed127591bf5cfee7f1e52fe",
-                        "md5": "fe70103391a64039a921dbfff9c7ab1b",
-                        "sha1": "e0019d9442aeebd3bb42a24c38aa2fae4c6bd4f5",
-                        "sha256": "f7d219d75037bc98f6c69143b00ab6000a31f8b5e211e0af514f4f4b681522a0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 1998913536,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USER32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258001,
-                      "hashes": {
-                        "imphash": "51945fdf9aaf56aeb9d6fa1f21b638ce",
-                        "md5": "1084aa52ccc324ea54c7121fa24c2221",
-                        "sha1": "b13ef924708fa88577931ed0337000e90adcdf5b",
-                        "sha256": "6e972cf624f7c0de8190434b3b30279a01c551713109f97b9ebb77fac9364754"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791766269952,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\GDI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534943,
-                      "hashes": {
-                        "imphash": "919110853c18aa198ad129945337b1dd",
-                        "md5": "d202223587518b13d72d68937b7e3f70",
-                        "sha1": "916a3ce858f074f57dd9dac01be5cd4649f19887",
-                        "sha256": "9db971b866d058adbb518dd99b87c5db8dd1e7c9073755b989ae7e9fb62901e8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791758929920,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\LPK.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258933,
-                      "hashes": {
-                        "imphash": "17bf46cf6bf6c8cae48be5b75615a353",
-                        "md5": "2f8b1e3ee3545d3b5a8d56fa1ae07b65",
-                        "sha1": "66310680ee38904b2852717af13028e53b4e8b8e",
-                        "sha256": "2a3ec01f3bafe7d7d656886437f7ffecce440c0d3f3467804769ab4bf1ff7a99"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791760175104,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\USP10.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535038,
-                      "hashes": {
-                        "imphash": "8c99b1c0f6cf68b07336751f460f1dba",
-                        "md5": "7319bb10fa1f86e49e3dcf4136f6c957",
-                        "sha1": "3eea5ee8bafb2b9975b236c5c5655df6f4b42aa1",
-                        "sha256": "60de43ab267fd41c9804369b569139add30ed4e295c425f44fc04d3fcc95fca2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791765286912,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\msvcrt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534699,
-                      "hashes": {
-                        "imphash": "e1ee2d71958d21e0e1bf887dfe76af7f",
-                        "md5": "6df46d2bd74e3da1b45f08f10d172732",
-                        "sha1": "3491f8f9a73c00b158e43a530210d67a4f0598ae",
-                        "sha256": "2dc945f6f2c4a82189bc7da2fcbb7d9a0e2588a909539249e55ba82468e0c677"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791761027072,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ADVAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535198,
-                      "hashes": {
-                        "imphash": "b8ba136689cdc8d8b25fc04902f39a22",
-                        "md5": "83404dcbce4925b6a5a77c5170f46d86",
-                        "sha1": "22bda6b9da4fcf492b4dd16554b0c0e27e1b8667",
-                        "sha256": "d669614d0b4461db244ad99fbe1ba92ceb9b4ed5ec8e987e23764e77d9ac7074"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791789010944,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\SYSTEM32\\sechost.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258798,
-                      "hashes": {
-                        "imphash": "46876e4adb924a616ddbbb1992d61257",
-                        "md5": "0611473c1ad9e2d991cd9482068417f7",
-                        "sha1": "c4a3fa902dedad5d448e1d8b2d113cae1dcf2f7a",
-                        "sha256": "90afcc2a60350ece27e75e76459132ef0fa28ef283ce88fced4b82735a93ecda"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791770726400,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\RPCRT4.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424472,
-                      "hashes": {
-                        "imphash": "a24cfb84e3006f3634d5b09aed45c264",
-                        "md5": "56e6aa240cf6503265fbe5cf4d5889e8",
-                        "sha1": "2678a3c08b2f82598527bd0c064eb1be5877e277",
-                        "sha256": "4e7e127e2818eeb2de34a9369dcaca233443f085e53706c969592a9907df2ae8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791706042368,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\AP.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1534424450,
-                      "hashes": {
-                        "imphash": "f12460104bb4725d7964cf569f727f61",
-                        "md5": "58017789505c114426b63c775debc12b",
-                        "sha1": "0a348ca38bbcf851083578b77a8263765bd9b5e7",
-                        "sha256": "1bd7d7b7b69e15adb6fcf0b520a7107eb5270163935e1f50fcee85ed65440b46"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791701979136,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\Protobuf.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1438071093,
-                      "hashes": {
-                        "imphash": "341d1190606326748a708433d5d0cc36",
-                        "md5": "0a2be3ed5a71082e5f9296f79323a639",
-                        "sha1": "6acb15e8191b5530297c807d3066b1a71f4326d4",
-                        "sha256": "8847013e01db09adab6a1dc338803df3696730577a0dda847847540529048aae"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791700799488,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\libprotobuf.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Code Signing PCA",
-                          "serial_number": "33 00 00 00 b0 11 af 0a 8b d0 3b 9f dd 00 01 00 00 00 b0 ",
-                          "subject_name": "Microsoft Corporation"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "33 00 00 00 2b 39 32 48 c1 b2 c9 48 f3 00 00 00 00 00 2b ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "10/04/2013 22:49"
-                        },
-                        "more_info_link": "http://microsoft.com",
-                        "program_name": "msvcp120.dll",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1380942867,
-                      "hashes": {
-                        "imphash": "d0a59246eab41d54812cd63c2326e1f1",
-                        "md5": "46060c35f697281bc5e7337aee3722b1",
-                        "sha1": "d0164c041707f297a73abb9ea854111953e99cf1",
-                        "sha256": "2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791700078592,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSVCP120.dll",
-                      "signature_signer": "Microsoft Corporation",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Code Signing PCA",
-                          "serial_number": "33 00 00 00 b0 11 af 0a 8b d0 3b 9f dd 00 01 00 00 00 b0 ",
-                          "subject_name": "Microsoft Corporation"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "33 00 00 00 2b 39 32 48 c1 b2 c9 48 f3 00 00 00 00 00 2b ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "10/04/2013 22:49"
-                        },
-                        "more_info_link": "http://microsoft.com",
-                        "program_name": "msvcr120.dll",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1380942847,
-                      "hashes": {
-                        "imphash": "8f18e22935ef8b336e246ee763fbec97",
-                        "md5": "9c861c079dd81762b6c54e37597b7712",
-                        "sha1": "62cb65a1d79e2c5ada0c7bfc04c18693567c90d0",
-                        "sha256": "ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791699095552,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSVCR120.dll",
-                      "signature_signer": "Microsoft Corporation",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258732,
-                      "hashes": {
-                        "imphash": "faad2d5bf5c0ca9639e07a49e8c5d8ae",
-                        "md5": "6c60b5aca7442efb794082cdacfc001c",
-                        "sha1": "aae17944782b25f41f7b3a756532b4923f4ae817",
-                        "sha256": "fc1d9124856a70ff232ef3057d66bee803295847624ce23b4d0217f23af52c75"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791767121920,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\ole32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258736,
-                      "hashes": {
-                        "imphash": "774fed8966de60d3af2dd9070df5be6f",
-                        "md5": "42f05f980f164e084db65b2e8cd8430f",
-                        "sha1": "86498b3c5bbc240b9de0a10f2cb4185e754de6d7",
-                        "sha256": "0813749847b08f6577791d18ad9eca6dff5b41c2f727ab5ee9e5bf9602ed50cb"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791769808896,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\OLEAUT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258981,
-                      "hashes": {
-                        "imphash": "1ec347d133df2fe4da3e5f8944caeae8",
-                        "md5": "4bbfa57f594f7e8a8edc8f377184c3f0",
-                        "sha1": "d48aafa576b40a5e386e609bba1010472551154a",
-                        "sha256": "9f3ac5dea5a6250c3dbb97af79c81c0a48429486521f807355a1d7d3d861b75f"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791771971584,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WS2_32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535145,
-                      "hashes": {
-                        "imphash": "579f52f57e43aa6ff0d07e88af5d0ff5",
-                        "md5": "044fe45ffd6ad40e3bbbe60b7f41babe",
-                        "sha1": "94233c0d4169c02c85514adb1f05cd3298c87f43",
-                        "sha256": "a1688a5e6e0f7037c850699462c2655006a7d873c97f9ab406c59d81749b6f09"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791756898304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NSI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258859,
-                      "hashes": {
-                        "imphash": "4b37cbf60127ea0550ec30e0b1c52984",
-                        "md5": "eaf32cb8c1f810e4715b4dfbe785c7ff",
-                        "sha1": "3b099b193abb9064e6937101d0c309f04d713882",
-                        "sha256": "db6ad07fded42433e669508ab73faff6daff04575d6f1d016fe3eb6ecec4dd5d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791759650816,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SHLWAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257495,
-                      "hashes": {
-                        "imphash": "fd8a6a2046d9572b7f8f4288ae251c61",
-                        "md5": "497bfeddaf3950dd909c3b0c5558a25d",
-                        "sha1": "5d55bdc156372f51eb126f7bc2a8af161a1ef254",
-                        "sha256": "980ea189929d95eb36e35980fff0c81f7b78de9422771fde8f4ac7a779f5bd89"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791725768704,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258138,
-                      "hashes": {
-                        "imphash": "0bc508389b6b5577cf3cca214ca523a7",
-                        "md5": "2b81776da02017a37fe26c662827470e",
-                        "sha1": "8c85389640bea73a009d83079f8b4c963697035f",
-                        "sha256": "a656353c50ee08422145d00db9cfd9f6d3e664753b3c454b171e2a56a8aa94dc"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791720460288,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IPHLPAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535281,
-                      "hashes": {
-                        "imphash": "e710d6d30f2346e7cd91c89ec3b602d9",
-                        "md5": "4c9210e8f4e052f6a4eb87716da0c24c",
-                        "sha1": "d4fa50aded12eb162478d7606f1270b78dd1a44b",
-                        "sha256": "460f7990bdadb7d58d6dc95b094d30a2efdc4ceed444b18a2f36e8d9076fb8b9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791720198144,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINNSI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247527581,
-                      "hashes": {
-                        "imphash": "be693a67b5b884d7609eaf574ba00955",
-                        "md5": "d87e1e59c73c1f98d5ded5b3850c40f5",
-                        "sha1": "141c0ebecdd2733b90431f18b188ee0b64456268",
-                        "sha256": "536419bff9f877d4314b5d0c045d9a6e729489c389863fadf07e382050bc84fd"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 2003042304,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\PSAPI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "12 fb c3 65 d3 1e 18 e4 43 7e ed f7 77 5e 0c fb ",
-                          "subject_name": "Cybereason Inc"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "",
-                          "serial_number": "",
-                          "subject_name": "",
-                          "timestamp_string": ""
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1472978395,
-                      "hashes": {
-                        "imphash": "3a8c832bddbba9333df28c1da212318e",
-                        "md5": "e1c637922e34d868ebcd6ef199cf1394",
-                        "sha1": "01c19a0137082a03ecace613506af5fe9a66a12b",
-                        "sha256": "0c0c7b4c9926413c285fa2345f08b895888887156277e535851a1f1d774e6c6c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791698243584,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\SQLite2015.dll",
-                      "signature_signer": "Cybereason Inc",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534912,
-                      "hashes": {
-                        "imphash": "d76d7be0b8ac9aafe17d2cc7deb32b29",
-                        "md5": "aa2c08ce85653b1a0d2e4ab407fa176c",
-                        "sha1": "0119c23d88292a0e4fec04d5cf8629005a44e37c",
-                        "sha256": "83dfd0c119b20aedb07114c9d1cf9ce2dfa938d0f1070256b0591a9e2c3997fa"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791766073344,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\IMM32.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535018,
-                      "hashes": {
-                        "imphash": "b523fff180cb22465ccf191b827e9923",
-                        "md5": "c431eaf5caa1c82cac2534a2eab348a3",
-                        "sha1": "e425577ccfc9b92efbbcb760d21fcaa478d3e51a",
-                        "sha256": "addf850128dc675e67faba9a3d0d27e684f01f733962ca22927bb94503549e44"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791761944576,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSCTF.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534874,
-                      "hashes": {
-                        "imphash": "621a31b25a9ef1d128ea281b3eab572b",
-                        "md5": "0040c486584a8e582c861cfb57ab5387",
-                        "sha1": "bcf326e3f79b3db028c2ef1cc1a47d9697e867e7",
-                        "sha256": "5ee17b55cb702d14ae75b19226de21cd2498bda6c6ef5872fdb8a718f401fed1"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791719346176,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\fwpuclnt.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258848,
-                      "hashes": {
-                        "imphash": "cc4d63ca30fdbb90048e549782d2116a",
-                        "md5": "858df0795cb5b4bace0f33708925a414",
-                        "sha1": "e629ed78e6e1829263890974760dad8a431edf69",
-                        "sha256": "a9063af8d5c73a722bd269d144d8a65c98db4cfdd9f626e3a8283754e22c8c9c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791748050944,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\Secur32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258854,
-                      "hashes": {
-                        "imphash": "9c631776d86c9b15258c3cc2a6a7891d",
-                        "md5": "26e716ed95dc48cf6e5ac046089366af",
-                        "sha1": "2bd96b8ae5ae3ad14c16d2a98a91a9a9f26d179d",
-                        "sha256": "f686d557b7ac1688efc7cb48311290d713d3db2e9e61e947098a7c80e3a1b9e9"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791772299264,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\shell32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "11/29/2016 03:22"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1480418473,
-                      "hashes": {
-                        "imphash": "f89e0a919d52e2b37d82d27f521530cf",
-                        "md5": "f1a6e89598aa63a2efcfd1e31b44fe7c",
-                        "sha1": "cd3a39758e72f42ef077c0ad9dd700509a032da6",
-                        "sha256": "1ee6540520a7a84bc22036be42052303b5aed9911c9e8a04184a0688c63576f8"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791694901248,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\BDUpdateServiceCom.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258594,
-                      "hashes": {
-                        "imphash": "2bd8f9f72a13c2803ac3d34b805130b9",
-                        "md5": "764908fe1fa96f93c95b1b67a0fced29",
-                        "sha1": "88d0027e5d10158e3678d9eb2326779fef8a64d1",
-                        "sha256": "26ef25ab307903c5e806a8cc3b750a491049e5d1225ceddfce64dd51aa6f592b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791715807232,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\NETAPI32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258588,
-                      "hashes": {
-                        "imphash": "96f28fef38c977afbf3f6e8f39c0d6b9",
-                        "md5": "6ceca4c6a489c9b2e6073afdaae3f607",
-                        "sha1": "b228f6208642cb99e5bcdf2d3ebda2b8bc4fb020",
-                        "sha256": "127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791715676160,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\netutils.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258920,
-                      "hashes": {
-                        "imphash": "2d37f2d4b3c246f361ca150fc7ebf8d4",
-                        "md5": "3a9c9baf610b0dd4967086040b3b62a9",
-                        "sha1": "3207ac7f895eab34623d994548d7810e54be3e79",
-                        "sha256": "e8e9a0f42b1ee7806edceed08aa024d037215d06ca317e3678bd5364ad513d23"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791746609152,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\srvcli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259010,
-                      "hashes": {
-                        "imphash": "6ad99a405bde55d6a18debafd3f5e5c5",
-                        "md5": "3c91392d448f6e5d525a85b7550d8ba9",
-                        "sha1": "b62eaf7d80617e136a8f3c9161c23464e6f2a171",
-                        "sha256": "6fd0dc73dbe7519e2c643554c2a7f8fbe4f9a678c4241bb54b3c6e65d2abcf3a"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791715545088,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\wkscli.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535234,
-                      "hashes": {
-                        "imphash": "13ecfa3a285149680a7a4b174c8b8f5b",
-                        "md5": "94e026870a55aaeaff7853c1754091e9",
-                        "sha1": "a4f845318e095d841b05e1400747ee4c28e1f28e",
-                        "sha256": "b2f5d5629d12bdfa98dbed3898368f37d9009c7531b6909c7285a2c11c9a0f93"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791736254464,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\VERSION.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/18/2017 09:26"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484760175,
-                      "hashes": {
-                        "imphash": "b33f679b12d9d05d922e720c0e21818c",
-                        "md5": "1e5ea729f6dc5a8aff675a45706d389d",
-                        "sha1": "f5a70ab4772325946a93c9eaf48ebe1dd1e7d3a3",
-                        "sha256": "35da922b25ec8389a733f46a6c0d37c2c6b05463a123cde9fee48402c473e1ef"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791694245888,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\scan.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "11/22/2016 08:08"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1479830743,
-                      "hashes": {
-                        "imphash": "513a166377e008d25aa2e22983dd13ff",
-                        "md5": "3450d998edec5cdbd03b0df09c17e02d",
-                        "sha1": "558979fb1a9368acdf2dc1e3d1afd94e7343f914",
-                        "sha256": "c1f24493e4fc2a9c5d17e077455c3a610ad1e5fa46590f0f9598e680e5a07556"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791694114816,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\gzfltum.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/16/2017 05:34"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484573247,
-                      "hashes": {
-                        "imphash": "d6d5dc292fe4d710905e9f280360309d",
-                        "md5": "9f1bcf84eaa34afbdfcf19f22fc1d6f5",
-                        "sha1": "e15e023d46738f4848f64ce853ada6a3083f8b7f",
-                        "sha256": "d1c30b1a7fc63c4f52b00628c3e73f571db52ff2b87718bcb5a6322923f58987"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791693000704,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\bdquar.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "01/16/2017 05:34"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1484573248,
-                      "hashes": {
-                        "imphash": "4e1a791e94ac955105ddfaac387de22f",
-                        "md5": "874d6017f89a2ef255a16280ed4b1bf7",
-                        "sha1": "8951c3ab1c9ea0c312206b98d22a9779c8a89c8c",
-                        "sha256": "00512202b78037c17a77b095fcb3458381002dbd20de8dee0c99ff7701343cda"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791691427840,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\BDSmartDB.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257756,
-                      "hashes": {
-                        "imphash": "5cd9d6761799e2ff681533ef1ffbb31d",
-                        "md5": "2477a28081bdaee622cf045acf8ee124",
-                        "sha1": "304c5f29fa847fbd994ad7a0471214198b928c14",
-                        "sha256": "00a09caf9129e84feea98fa03ce9012c9f961b64fee15c4f268822c0f82acc3c"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791752376320,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CFGMGR32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "DigiCert Assured ID Code Signing CA-1",
-                          "serial_number": "0f b5 4c 96 fd 63 93 fd 7b b9 9c d1 d0 d5 16 ed ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "09/12/2018 01:20"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1512623776,
-                      "hashes": {
-                        "imphash": "e2dab13fa4a67b25d3fbae65a189c521",
-                        "md5": "627d7f1de23e6b01d6251b4c6962e765",
-                        "sha1": "5e1d1854861016198ce4a1dbdea883f257de9463",
-                        "sha256": "82bdf513b5f5b55ff740482ee839b14455b2296e2a911cb9a1ae622969412ed5"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791684612096,
-                      "mapped_size": 0,
-                      "path": "C:\\ProgramData\\apv2\\bd_db\\1\\bdcore.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "VeriSign Class 3 Code Signing 2010 CA",
-                          "serial_number": "3d b2 9a 36 51 f3 f5 e4 9c e0 79 d2 83 95 76 30 ",
-                          "subject_name": "Bitdefender SRL"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Symantec Time Stamping Services CA - G2",
-                          "serial_number": "0e cf f4 38 c8 fe bf 35 6e 04 d8 6a 98 1b 1a 50 ",
-                          "subject_name": "Symantec Time Stamping Services Signer - G4",
-                          "timestamp_string": "09/13/2017 23:13"
-                        },
-                        "more_info_link": "",
-                        "program_name": "",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1505278115,
-                      "hashes": {
-                        "imphash": "c2979e6e570392ed85b4e15810f2e90f",
-                        "md5": "3b4c71b64bc20b0c6578a091a031c0fb",
-                        "sha1": "00cb578e723555e929e4ad8e820772b56ce29475",
-                        "sha256": "52db08c10a5f1482dda8527d592f71b33c1cfecfa5a5a2d0be5a78325c41dd7b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791673536512,
-                      "mapped_size": 0,
-                      "path": "C:\\Program Files\\Cybereason ActiveProbe\\bdnc.dll",
-                      "signature_signer": "Bitdefender SRL",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257999,
-                      "hashes": {
-                        "imphash": "04534d8dae5ab230b9bee9b1b0b2829d",
-                        "md5": "3f9f2afa135f0663946a006dd5ffd897",
-                        "sha1": "ea6456859b04b68af8dcd453381dd168af53fc5e",
-                        "sha256": "276d1c9c78c529625c2ef3d77079324628686ea184767971901a1de93681c133"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791753490432,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPT32.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258373,
-                      "hashes": {
-                        "imphash": "2e50bc5d9fe777770c8a6b2cfaf6b2e9",
-                        "md5": "884415bd4269c02eaf8e2613bf85500d",
-                        "sha1": "c3a64f05c210b38c69d8f1fc1d74a71b56ada30c",
-                        "sha256": "efe771709ec942694fd206ac8d0a48ed7dcd35036f074268e4aecd68ac982cea"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791752310784,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\MSASN1.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535280,
-                      "hashes": {
-                        "imphash": "af1203c1d6d810c97729856780869b12",
-                        "md5": "ef2ae43bcd46abb13fc3e5b2b1935c73",
-                        "sha1": "c53e005cd04d99331ce3114ac119256133202313",
-                        "sha256": "81fc06f306f620845d7dd8d06e706309e70bc89b589c81f3478302a3f5f73431"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791680024576,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINMM.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258927,
-                      "hashes": {
-                        "imphash": "b32250da0d30f7782b5b900d4d9c519a",
-                        "md5": "2a86e54b441ad41557f75dc5609b9793",
-                        "sha1": "83ddcf8a1a0ca423bf8417f5e59b5c431bf50c43",
-                        "sha256": "8fede6909413c0fa5b63d58d39affd0f6c3beeaf19b7b2f8674913abfd79a912"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791749951488,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\SSPICLI.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290258493,
-                      "hashes": {
-                        "imphash": "466f15f36f10655b30e9347e7dfc2b52",
-                        "md5": "1d5185a4c7e6695431ae4b55c3d7d333",
-                        "sha1": "5e9f739d46e20541ffc0a6421dc6be416ca8f261",
-                        "sha256": "16f3906c54f1d71559836fdfcf4e83e7c9f454463d78fd577ad2d7022e0bcb51"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791743463424,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\mswsock.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535287,
-                      "hashes": {
-                        "imphash": "f967c6b35a5d1b7765016056a842e331",
-                        "md5": "31559f3244c6bc00a52030caa83b6b91",
-                        "sha1": "7943540153c7b7878101a4901d7935e05e7cfd32",
-                        "sha256": "b2025742b5f0025ace9821d5722de3f997eeeab21d2f381c9e307882df422579"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791737106432,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\System32\\wshtcpip.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534998,
-                      "hashes": {
-                        "imphash": "77870f98ca4d25a823c74d7404a64bfd",
-                        "md5": "d0c2fbb6d97416b0166478fc7ae2b212",
-                        "sha1": "e290bdf2312ac30a4e9f2a96d7c84714eee84899",
-                        "sha256": "7eab6c37f0a845e645ca44cc060ac6c56e386c7ef7a64716c6786c9602ad8c9d"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791743856640,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTSP.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 17:43"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535161,
-                      "hashes": {
-                        "imphash": "b8c20a01e4d94df61ee21f5350389f9c",
-                        "md5": "5d8874a8c11dddde29e12de0e2013493",
-                        "sha1": "a1c8e3e6ee44dcb68752d44b3b6f4ecce89c388d",
-                        "sha256": "3e9a57137bf622af83e3e4d58971e2c0200559cca7545d16cf263aa03ee9c7d2"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791740710912,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\rsaenh.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534993,
-                      "hashes": {
-                        "imphash": "f0c6fd6831905d958b05645b680db89f",
-                        "md5": "784fa3df338e2e8f5f0389d6fac428af",
-                        "sha1": "6d32c67c91c6d374854e907c6719db2538540867",
-                        "sha256": "9c8aa0cfdeb9e38aaf8eb08626070e0f0364f4f8a793cfe3532ec6c007980c34"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791750541312,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\CRYPTBASE.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290257906,
-                      "hashes": {
-                        "imphash": "ff74e3ff0a015c2023b747f613061e42",
-                        "md5": "a52b6cc24063cc83c78c0e6f24deec01",
-                        "sha1": "a5384efac7d1f9213aaf0423ed0b021bc986b9df",
-                        "sha256": "77e0d2b2356e71f9be52fa479c9dde17c453c198bb49cd4a97f2309628d82e3b"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791741890560,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\DNSAPI.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534791,
-                      "hashes": {
-                        "imphash": "59b31e42f8fae7b5809ba7fcae732e0c",
-                        "md5": "4cbcc37856ea2039c27a2fb661dda0e5",
-                        "sha1": "cc666108d34168420a1d1942dda1e090154c7296",
-                        "sha256": "74cbfab3092a9564bddfcb84db3e3f8bcfd1492938adf187423d3355d73d21c6"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791717642240,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc6.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534790,
-                      "hashes": {
-                        "imphash": "f17020f0f66b64fbdf51c75b43f3729d",
-                        "md5": "f568f7c08458d69e4fcd8675bbb107e4",
-                        "sha1": "c1e05f0255a6f386711044b11e2d04dfd328b26a",
-                        "sha256": "a5fa25ecf248999a68ccecfbb508bfa1add18a23e20a9a9081a87c41caaa36c0"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791717117952,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\dhcpcsvc.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247534847,
-                      "hashes": {
-                        "imphash": "dda6776607f283829d85b996f5e46d03",
-                        "md5": "f3d202f53a222d5f6944d459b73cf967",
-                        "sha1": "c9db224ce8ec34aa2f341b6766ea67aa12f8b4a7",
-                        "sha256": "e9f1d48eb333d32331bcfd0348fe07bee7d5352292e6020571da395f596affe7"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791668686848,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\FLTLIB.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "07/13/2009 19:17"
-                        },
-                        "more_info_link": "http://www.microsoft.com/windows",
-                        "program_name": "Windows System Catalog",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1247535135,
-                      "hashes": {
-                        "imphash": "ff720e05e534d67b814b8562265058f5",
-                        "md5": "2c942733a5983dd4502219ff37c7ebc7",
-                        "sha1": "263e8fbf77c0ceead0c9bca56394bffa4a664361",
-                        "sha256": "34b20b6b0d7274e4b5b783f1d2345bc3dd9888964d5c2c65712f041a00cf5b45"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791751393280,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\profapi.dll",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    },
-                    {
-                      "architecture": "x64",
-                      "authenticode": {
-                        "cert_signer": {
-                          "issuer_name": "Microsoft Windows Verification PCA",
-                          "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
-                          "subject_name": "Microsoft Windows"
-                        },
-                        "cert_timestamp": {
-                          "issuer_name": "Microsoft Time-Stamp PCA",
-                          "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
-                          "subject_name": "Microsoft Time-Stamp Service",
-                          "timestamp_string": "11/20/2010 11:37"
-                        },
-                        "more_info_link": "http://www.microsoft.com",
-                        "program_name": "Microsoft Windows",
-                        "publisher_link": ""
-                      },
-                      "compile_time": 1290259008,
-                      "hashes": {
-                        "imphash": "b2ecd39ae0055d9e1b8aa5bc78942cba",
-                        "md5": "eb3f9c2de1236b5d46b2291d82970e43",
-                        "sha1": "0ce9ddc1063256ab571b916389321fd7f572ddc0",
-                        "sha256": "8a43d335f3d573bed98af54bb51e82546c2acc025da8a48d801213eb14e9d5d4"
-                      },
-                      "malware_classification": {
-                        "identifier": "Whitelisted",
-                        "score": 0,
-                        "threshold": 0,
-                        "version": "3.0.0"
-                      },
-                      "mapped_address": 8791753228288,
-                      "mapped_size": 0,
-                      "path": "C:\\Windows\\system32\\WINTRUST.DLL",
-                      "signature_signer": "Microsoft Windows",
-                      "signature_status": "trusted"
-                    }
-                  ],
-                  "name": "AmSvc.exe",
-                  "parent_exe": "C:\\Windows\\System32\\services.exe",
-                  "parent_name": "services.exe",
-                  "pid": 1084,
-                  "ppid": 436,
-                  "primary_token": {
-                    "domain": "NT AUTHORITY",
-                    "integrity_level": 16384,
-                    "integrity_level_name": "system",
-                    "privileges": [
-                      {
-                        "description": "Replace a process level token",
-                        "enabled": false,
-                        "name": "SeAssignPrimaryTokenPrivilege"
-                      },
-                      {
-                        "description": "Lock pages in memory",
-                        "enabled": true,
-                        "name": "SeLockMemoryPrivilege"
-                      },
-                      {
-                        "description": "Adjust memory quotas for a process",
-                        "enabled": false,
-                        "name": "SeIncreaseQuotaPrivilege"
-                      },
-                      {
-                        "description": "Act as part of the operating system",
-                        "enabled": true,
-                        "name": "SeTcbPrivilege"
-                      },
-                      {
-                        "description": "Manage auditing and security log",
-                        "enabled": false,
-                        "name": "SeSecurityPrivilege"
-                      },
-                      {
-                        "description": "Take ownership of files or other objects",
-                        "enabled": false,
-                        "name": "SeTakeOwnershipPrivilege"
-                      },
-                      {
-                        "description": "Load and unload device drivers",
-                        "enabled": true,
-                        "name": "SeLoadDriverPrivilege"
-                      },
-                      {
-                        "description": "Profile system performance",
-                        "enabled": true,
-                        "name": "SeSystemProfilePrivilege"
-                      },
-                      {
-                        "description": "Change the system time",
-                        "enabled": false,
-                        "name": "SeSystemtimePrivilege"
-                      },
-                      {
-                        "description": "Profile single process",
-                        "enabled": true,
-                        "name": "SeProfileSingleProcessPrivilege"
-                      },
-                      {
-                        "description": "Increase scheduling priority",
-                        "enabled": true,
-                        "name": "SeIncreaseBasePriorityPrivilege"
-                      },
-                      {
-                        "description": "Create a pagefile",
-                        "enabled": true,
-                        "name": "SeCreatePagefilePrivilege"
-                      },
-                      {
-                        "description": "Create permanent shared objects",
-                        "enabled": true,
-                        "name": "SeCreatePermanentPrivilege"
-                      },
-                      {
-                        "description": "Back up files and directories",
-                        "enabled": true,
-                        "name": "SeBackupPrivilege"
-                      },
-                      {
-                        "description": "Restore files and directories",
-                        "enabled": true,
-                        "name": "SeRestorePrivilege"
-                      },
-                      {
-                        "description": "Shut down the system",
-                        "enabled": false,
-                        "name": "SeShutdownPrivilege"
-                      },
-                      {
-                        "description": "Debug programs",
-                        "enabled": true,
-                        "name": "SeDebugPrivilege"
-                      },
-                      {
-                        "description": "Generate security audits",
-                        "enabled": true,
-                        "name": "SeAuditPrivilege"
-                      },
-                      {
-                        "description": "Modify firmware environment values",
-                        "enabled": false,
-                        "name": "SeSystemEnvironmentPrivilege"
-                      },
-                      {
-                        "description": "Bypass traverse checking",
-                        "enabled": true,
-                        "name": "SeChangeNotifyPrivilege"
-                      },
-                      {
-                        "description": "Remove computer from docking station",
-                        "enabled": false,
-                        "name": "SeUndockPrivilege"
-                      },
-                      {
-                        "description": "Perform volume maintenance tasks",
-                        "enabled": false,
-                        "name": "SeManageVolumePrivilege"
-                      },
-                      {
-                        "description": "Impersonate a client after authentication",
-                        "enabled": true,
-                        "name": "SeImpersonatePrivilege"
-                      },
-                      {
-                        "description": "Create global objects",
-                        "enabled": true,
-                        "name": "SeCreateGlobalPrivilege"
-                      },
-                      {
-                        "description": "Increase a process working set",
-                        "enabled": true,
-                        "name": "SeIncreaseWorkingSetPrivilege"
-                      },
-                      {
-                        "description": "Change the time zone",
-                        "enabled": true,
-                        "name": "SeTimeZonePrivilege"
-                      },
-                      {
-                        "description": "Create symbolic links",
-                        "enabled": true,
-                        "name": "SeCreateSymbolicLinkPrivilege"
-                      }
-                    ],
-                    "sid": "S-1-5-18",
-                    "type": "tokenPrimary",
-                    "user": "SYSTEM"
-                  },
-                  "services": [
-                    {
-                      "name": "CybereasonAntiMalware"
-                    }
-                  ],
-                  "sha1": "ca85243c0af6a6471bdaa560685c51eefd6dbc0d",
-                  "sha256": "8ad40c90a611d36eb8f9eb24fa04f7dbca713db383ff55a03aa0f382e92061a2",
-                  "sid": "S-1-5-18",
-                  "signature_signer": "Cybereason Inc",
-                  "signature_status": "trusted",
-                  "threads": [
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 5354476452,
-                      "thread_id": 1088,
-                      "up_time": 601
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 2001252032,
-                      "thread_id": 1116,
-                      "up_time": 600
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791691510992,
-                      "thread_id": 1204,
-                      "up_time": 598
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791691468912,
-                      "thread_id": 1220,
-                      "up_time": 598
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791673571008,
-                      "thread_id": 1392,
-                      "up_time": 586
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791673571008,
-                      "thread_id": 1396,
-                      "up_time": 586
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791673574320,
-                      "thread_id": 1400,
-                      "up_time": 586
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791673638416,
-                      "thread_id": 1404,
-                      "up_time": 586
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 2001271744,
-                      "thread_id": 1520,
-                      "up_time": 584
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791699247140,
-                      "thread_id": 1888,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133536,
-                      "thread_id": 1904,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133536,
-                      "thread_id": 1908,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133536,
-                      "thread_id": 1912,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133536,
-                      "thread_id": 1916,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133872,
-                      "thread_id": 1920,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694132592,
-                      "thread_id": 1924,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694133216,
-                      "thread_id": 1928,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 8791694134640,
-                      "thread_id": 1932,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 5354393504,
-                      "thread_id": 1936,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542345900,
-                      "entrypoint": 5354393504,
-                      "thread_id": 1944,
-                      "up_time": 547
-                    },
-                    {
-                      "create_time": 1542346000,
-                      "entrypoint": 2001271744,
-                      "thread_id": 2372,
-                      "up_time": 509
-                    },
-                    {
-                      "create_time": 1542346400,
-                      "entrypoint": 8791743523392,
-                      "thread_id": 4036,
-                      "up_time": 43
-                    },
-                    {
-                      "create_time": 1542346400,
-                      "entrypoint": 8791673712896,
-                      "thread_id": 4040,
-                      "up_time": 43
-                    },
-                    {
-                      "create_time": 1542346400,
-                      "entrypoint": 2002168128,
-                      "thread_id": 3372,
-                      "up_time": 28
-                    }
-                  ],
-                  "unique_pid": 21,
-                  "unique_ppid": 8,
-                  "up_time": 601,
-                  "user": "SYSTEM"
-                },
-                "acting_thread": {
-                  "create_time": 1542345900,
-                  "service_name": "CybereasonAntiMalware",
-                  "thread_id": 1912,
-                  "thread_start_address": 8791694133536,
-                  "thread_start_address_module": "C:\\Program Files\\Cybereason ActiveProbe\\gzfltum.dll"
-                }
-              },
-              "captured_file": false,
-              "file_name": "C:\\Windows\\TEMP\\tmp0000045c\\tmp00001b4a",
-              "file_operation": "creation",
-              "file_owner": "Administrators",
-              "file_size": 188416,
-              "hashes": {
-                "imphash": "835d619dfdf3cc727cebd91300ab3462",
-                "md5": "4ace3baaa509d08510405e1b169e325b",
-                "sha1": "27fb21cf5db95ffca43b234affa99becc4023b9d",
-                "sha256": "6ed1c836dbf099be7845bdab7671def2c157643761b52251e04e9b6ee109ec75"
-              },
-              "is_signature_trusted": false,
-              "malware_classification": {
-                "compressed_malware_features": {
-                  "data_buffer": "eAHtnU1oHHUUwHsQ7MGDiIIUD4sH8WBBxJtopiLoUY0pYo2ZTbJJ0yQ17m4+ms/NRzeVWpuUWCL4sWlEYvFQ8KJQ6NCTEA8eRD30sIo3PdSriLi7837Pko3LbHZ2M5m+XObHm/d/X////83O7jCZvzacHBpPplNdfalkdjSdyty674Ft59dN71Dpb9v5eKh8LMEHjsCF2wIfVlRKsHROYPGkQO5+gY2vBSYYdWZFYGwEO/cITHMqkxPYnBBY+07gtCuQ9gSGigJ5lPPYGXcE+jA4z3Ad1ZtAUiDUyrEEPYzqRnIKgxd/Rgc7gygPo5wn95PouN7OeEYJ1UXiJgRmvscgp/LOziIkkSyT+xRVnXhZ4DKh5goCkzidRHkGO4uvCyw9LDDtCay8ILCAzrJOJaGuZwUuvSewivJVIPsklq8JbL4qMJsTSCcExrGs83WKU295ZFo5lr2TaZbcUw5FeJy8tgTeLpCy2iGeS67ABXzlgbEi1UC5FxcZnA4y/CLK82Qxi847FGGZRTLsCUxR1aWEwOp1AmOjDRYYzgwusL9WfqBiGJxnVAanixTq7Dp22LBdlWMJzlOx8wmBK2Rx5WmBLJIRwtAijOQE+ooCb2B5xBOYRtlfNeXpLpA7oyZRTqHzGenkmIJPnhBIMrzTwSA6H93CO5l+c1NA99f6IwLH8fUKdjTmDpTbgS50+gGVnECnE4PpooC2guPoaPADSHrcncNHmEHtAFkq3+EI+A37zsrrTvH3WTkvJLoOTyBp10wx2JcgVCRahA4NrICE4a+hrMXsA3qAHItW188E8ejO7XV3eh/KCYwxlamEwCgL8lN2wTntfrhY/U0g/5KAdvUpT+AszWqBdqH7VLeeZrExK9Cv1UgIDKA8g/cx7QAEP+AhAfRaMKB2HOJh+BSFSqKjSytNGBlc6PrpxvK7lCVDxbSG3Z7AhCMwx6gelwgLAltXBXJUTH29j+U1LHdipx/QprfKfGnF0sBpdBYxmEQyTzW0h6/0khcuhhJYRufym+i4VKMocJMs/KvfoW3/UJb4PeZOSZVONThZz4djP/75TAXa/CVfOvX3RgVLIDreLPN1pP1osW7lGmHsEhjBOzf+EPBE4vndvWz5xb/cChxGcv1LAb+tluALKnZ47isf1MXvz1ZMlsCXbXtPceqhrcp1ps6YHwQeBXLEPCf7q23tl9uJui0bGBgYRAccv7uXr/g5Af+2oNTrpgTa/vnpjBvpLAwM4gRBPvIZGBgYGBgYGBgYGBgYGBgYGBgYGBgYNAOc9oMXs4GBgYFBcNBnww5QzDXgRtPSaZ5lg/itsRaslgZ3bnWEEVnhMetIBwiiVnlbCbWrEftrt11zdwWnseFW1QO63w1is3ptD1pV9xG0t+zvfUrzrvh380qwXWAVCw6h78GIfG7ZlzltXu6hd+y92fECRFhjuH3bXG8N43oXEHperdzvUbteaDxhVTUeq25fqhG1X6Ai8mtF6BDXz2wR+dzSgg4Qsxls5T11XMG+82y8GkG+b7kL69xg7mF1SFvhBgYGsYH/Xi7HE+PVkiB2jt1bNZxT+k4558jR53ydz5//1m1KOgYGBgYGBgYGEQfnsYaG2z1sdPJS79XQSu91ndobOAHCaN5vNzUk1bceQVzUpbw3iOuT+UFmR18bHrp3gyhDC56lCd1y85w2+HSNUwVhhdGC7blLf+bV/fqtvhMg1NDjCcugB1QXswbs8ekj/v1BgzFHBIIsyP+HfwFdMpzu",
-                  "decompressed_size": 27831,
-                  "encoding": "zlib"
-                },
-                "identifier": "endpointpe",
-                "prevention_threshold": 0.66,
-                "score": 1,
-                "threshold": 0.66,
-                "version": "3.0.33"
-              },
-              "pid": 1084,
-              "ppid": 436,
-              "signature_signer": "",
-              "temp_file_path": "C:\\Windows\\TEMP\\37c97b4b-6ee8-476c-bfdd-c0cd6783b86d",
-              "timestamp": {
-                "accessed": 1542346400,
-                "created": 1542346400,
-                "modified": 1542346500
-              },
-              "user_blacklisted": false
-            },
-            "event_subtype_full": "file_classification_event",
-            "event_type_full": "alert_event",
-            "metadata": {
-              "beta_alert": false,
-              "chunk_id": 0,
-              "collection_time": 1542346500,
-              "correlation_id": "2c827da1-f977-42a7-994b-ab7e5cc50329",
-              "destination_plugin": "send",
-              "final": true,
-              "is_alert": true,
-              "key": "fileClassificationEventResponse",
-              "message_id": "2280efbc-8bdf-49bf-a712-bc44acdf3eaa",
-              "origination_task_id": "4d9d9e7e-4ea1-4373-954c-e8cdbb85c61d",
-              "os_type": "windows",
-              "priority": 80,
-              "result": {
-                "local_code": 0,
-                "local_msg": "Success"
-              },
-              "semantic_version": "3.50.0",
-              "sensor_version": "3.50.0",
-              "task_id": "4d9d9e7e-4ea1-4373-954c-e8cdbb85c61d",
-              "type": "detection"
-            },
-            "opcode": 8,
-            "serial_event_id": 144711,
-            "timestamp": 132140207402716480,
-            "timestamp_utc": "2019-09-27 01:19:00Z"
-          },
-          "event": {
-            "action": "file_classification_event",
-            "dataset": "esensor",
-            "kind": "alert",
-            "module": "endgame"
-          },
-          "host": {
-            "hostname": "HD-m3z-4c803698",
-            "ip": "10.176.220.187",
-            "name": "HD-m3z-4c803698",
-            "os": {
-              "name": "Windows",
-              "platform": "windows",
-              "version": "10.0"
-            }
-          },
-          "labels": {
-            "account_id": "8c48070b-4b61-4ded-86d5-1b9a7a78229c",
-            "endpoint_id": "c89dc040-2350-4d59-baea-9ff2e369136f"
-          },
-          "user": {
-            "group": {
-            }
-          }
-        },
-        "type": "_doc"
-      }
-    }
-  ]
\ No newline at end of file
diff --git a/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.test.ts b/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.test.ts
new file mode 100644
index 0000000000000..a4d7de8fdcfdb
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.test.ts
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { httpServerMock, loggingServiceMock } from 'src/core/server/mocks';
+import { EndpointConfigSchema } from '../../config';
+import { getPagingProperties, buildAlertListESQuery } from './alert_query_builders';
+
+describe('test query builder', () => {
+  describe('test query builder request processing', () => {
+    it('should execute the correct Elasticsearch query for a default request', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({});
+      const mockCtx = {
+        logFactory: loggingServiceMock.create(),
+        config: () => Promise.resolve(EndpointConfigSchema.validate({})),
+      };
+      const queryParams = await getPagingProperties(mockRequest, mockCtx);
+      const query = await buildAlertListESQuery(queryParams);
+
+      expect(query).toEqual({
+        body: {
+          query: {
+            match_all: {},
+          },
+          sort: [
+            {
+              '@timestamp': {
+                order: 'desc',
+              },
+            },
+          ],
+          track_total_hits: 10000,
+        },
+        from: 0,
+        size: 10,
+        index: 'my-index',
+      } as Record<string, any>);
+    });
+    it('should adjust track_total_hits for deep pagination', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({
+        query: {
+          page_index: 10,
+          page_size: 1000,
+        },
+      });
+      const mockCtx = {
+        logFactory: loggingServiceMock.create(),
+        config: () => Promise.resolve(EndpointConfigSchema.validate({})),
+      };
+      const queryParams = await getPagingProperties(mockRequest, mockCtx);
+      const query = await buildAlertListESQuery(queryParams);
+
+      expect(query).toEqual({
+        body: {
+          query: {
+            match_all: {},
+          },
+          sort: [
+            {
+              '@timestamp': {
+                order: 'desc',
+              },
+            },
+          ],
+          track_total_hits: 12000,
+        },
+        from: 10000,
+        size: 1000,
+        index: 'my-index',
+      } as Record<string, any>);
+    });
+  });
+});
diff --git a/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.ts b/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.ts
new file mode 100644
index 0000000000000..a20f2ae1cdecd
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/services/endpoint/alert_query_builders.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { KibanaRequest } from 'kibana/server';
+import { EndpointAppConstants } from '../../../common/types';
+import { EndpointAppContext, AlertRequestParams, JSONish } from '../../types';
+
+export const buildAlertListESQuery = async (
+  pagingProperties: Record<string, number>
+): Promise<JSONish> => {
+  const DEFAULT_TOTAL_HITS = 10000;
+
+  // Calculate minimum total hits set to indicate there's a next page
+  const totalHitsMin = Math.max(
+    pagingProperties.fromIndex + pagingProperties.pageSize * 2,
+    DEFAULT_TOTAL_HITS
+  );
+
+  return {
+    body: {
+      track_total_hits: totalHitsMin,
+      query: {
+        match_all: {},
+      },
+      sort: [
+        {
+          '@timestamp': {
+            order: 'desc',
+          },
+        },
+      ],
+    },
+    from: pagingProperties.fromIndex,
+    size: pagingProperties.pageSize,
+    index: EndpointAppConstants.ALERT_INDEX_NAME,
+  };
+};
+
+export const getPagingProperties = async (
+  request: KibanaRequest<unknown, AlertRequestParams, AlertRequestParams>,
+  endpointAppContext: EndpointAppContext
+): Promise<Record<string, number>> => {
+  const config = await endpointAppContext.config();
+  const pagingProperties: { page_size?: number; page_index?: number } = {};
+
+  if (request?.route?.method === 'get') {
+    pagingProperties.page_index = request.query?.page_index;
+    pagingProperties.page_size = request.query?.page_size;
+  } else {
+    pagingProperties.page_index = request.body?.page_index;
+    pagingProperties.page_size = request.body?.page_size;
+  }
+
+  const pageSize = pagingProperties.page_size || config.alertResultListDefaultPageSize;
+  const pageIndex = pagingProperties.page_index || config.alertResultListDefaultFirstPageIndex;
+  const fromIndex = pageIndex * pageSize;
+
+  return { pageSize, pageIndex, fromIndex };
+};
diff --git a/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.test.ts b/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.test.ts
index e453f777fbd50..bd9986ecf1f97 100644
--- a/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.test.ts
+++ b/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.test.ts
@@ -55,6 +55,65 @@ describe('query builder', () => {
     });
   });
 
+  describe('test query builder with kql filter', () => {
+    it('test default query params for all endpoints when no params or body is provided', async () => {
+      const mockRequest = httpServerMock.createKibanaRequest({
+        body: {
+          filter: 'not host.ip:10.140.73.246',
+        },
+      });
+      const query = await kibanaRequestToEndpointListQuery(mockRequest, {
+        logFactory: loggingServiceMock.create(),
+        config: () => Promise.resolve(EndpointConfigSchema.validate({})),
+      });
+      expect(query).toEqual({
+        body: {
+          query: {
+            bool: {
+              must_not: {
+                bool: {
+                  minimum_should_match: 1,
+                  should: [
+                    {
+                      match: {
+                        'host.ip': '10.140.73.246',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+          collapse: {
+            field: 'host.id.keyword',
+            inner_hits: {
+              name: 'most_recent',
+              size: 1,
+              sort: [{ 'event.created': 'desc' }],
+            },
+          },
+          aggs: {
+            total: {
+              cardinality: {
+                field: 'host.id.keyword',
+              },
+            },
+          },
+          sort: [
+            {
+              'event.created': {
+                order: 'desc',
+              },
+            },
+          ],
+        },
+        from: 0,
+        size: 10,
+        index: 'endpoint-agent*',
+      } as Record<string, any>);
+    });
+  });
+
   describe('EndpointFetchQuery', () => {
     it('searches for the correct ID', () => {
       const mockID = 'AABBCCDD-0011-2233-AA44-DEADBEEF8899';
diff --git a/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.ts b/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.ts
index b4f295a64b6ea..c143b09ec453c 100644
--- a/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.ts
+++ b/x-pack/plugins/endpoint/server/services/endpoint/endpoint_query_builders.ts
@@ -6,6 +6,7 @@
 import { KibanaRequest } from 'kibana/server';
 import { EndpointAppConstants } from '../../../common/types';
 import { EndpointAppContext } from '../../types';
+import { esKuery } from '../../../../../../src/plugins/data/server';
 
 export const kibanaRequestToEndpointListQuery = async (
   request: KibanaRequest<any, any, any>,
@@ -14,9 +15,7 @@ export const kibanaRequestToEndpointListQuery = async (
   const pagingProperties = await getPagingProperties(request, endpointAppContext);
   return {
     body: {
-      query: {
-        match_all: {},
-      },
+      query: buildQueryBody(request),
       collapse: {
         field: 'host.id.keyword',
         inner_hits: {
@@ -66,6 +65,15 @@ async function getPagingProperties(
   };
 }
 
+function buildQueryBody(request: KibanaRequest<any, any, any>): Record<string, any> {
+  if (typeof request?.body?.filter === 'string') {
+    return esKuery.toElasticsearchQuery(esKuery.fromKueryExpression(request.body.filter));
+  }
+  return {
+    match_all: {},
+  };
+}
+
 export const kibanaRequestToEndpointFetchQuery = (
   request: KibanaRequest<any, any, any>,
   endpointAppContext: EndpointAppContext
diff --git a/x-pack/plugins/endpoint/server/test_data/all_alerts_data.json b/x-pack/plugins/endpoint/server/test_data/all_alerts_data.json
new file mode 100644
index 0000000000000..128592f0f01df
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/test_data/all_alerts_data.json
@@ -0,0 +1,5471 @@
+{
+    "_shards": {
+        "failed": 0,
+        "skipped": 0,
+        "successful": 1,
+        "total": 1
+    },
+    "hits": {
+        "hits": [
+            {
+                "_id": "mguP_G8BsHRXKE0Yiz15",
+                "_index": "my-index",
+                "_score": 1.0,
+                "_source": {
+                    "@timestamp": 1542341895000,
+                    "agent": {
+                        "id": "ced9c68e-b94a-4d66-bb4c-6106514f0a2f",
+                        "type": "endpoint",
+                        "version": "3.0.0"
+                    },
+                    "ecs": {
+                        "version": "1.1.0"
+                    },
+                    "event": {
+                        "action": "open",
+                        "category": "malware",
+                        "dataset": "endpoint",
+                        "kind": "alert",
+                        "module": "endpoint",
+                        "type": "access"
+                    },
+                    "file": {
+                        "accessed": 1542341100,
+                        "created": 1542341100,
+                        "hash": {
+                            "imphash": "835d619dfdf3cc727cebd91300ab3462",
+                            "md5": "4ace3baaa509d08510405e1b169e325b",
+                            "sha1": "27fb21cf5db95ffca43b234affa99becc4023b9d",
+                            "sha256": "6ed1c836dbf099be7845bdab7671def2c157643761b52251e04e9b6ee109ec75"
+                        },
+                        "mtime": 1542341100,
+                        "owner": "Administrators",
+                        "path": "C:\\Users\\Administrator\\Downloads\\endpointpe-blacklist-test.exe",
+                        "size": 188416
+                    },
+                    "file_classification": {
+                        "captured_file": false,
+                        "is_signature_trusted": false,
+                        "malware_classification": {
+                            "compressed_malware_features": {
+                                "data_buffer": "eAHtnU1oHHUUwHsQ7MGDiIIUD4sH8WBBxJtopiLoUY0pYo2ZTbJJ0yQ17m4+ms/NRzeVWpuUWCL4sWlEYvFQ8KJQ6NCTEA8eRD30sIo3PdSriLi7837Pko3LbHZ2M5m+XObHm/d/X////83O7jCZvzacHBpPplNdfalkdjSdyty674Ft59dN71Dpb9v5eKh8LMEHjsCF2wIfVlRKsHROYPGkQO5+gY2vBSYYdWZFYGwEO/cITHMqkxPYnBBY+07gtCuQ9gSGigJ5lPPYGXcE+jA4z3Ad1ZtAUiDUyrEEPYzqRnIKgxd/Rgc7gygPo5wn95PouN7OeEYJ1UXiJgRmvscgp/LOziIkkSyT+xRVnXhZ4DKh5goCkzidRHkGO4uvCyw9LDDtCay8ILCAzrJOJaGuZwUuvSewivJVIPsklq8JbL4qMJsTSCcExrGs83WKU295ZFo5lr2TaZbcUw5FeJy8tgTeLpCy2iGeS67ABXzlgbEi1UC5FxcZnA4y/CLK82Qxi847FGGZRTLsCUxR1aWEwOp1AmOjDRYYzgwusL9WfqBiGJxnVAanixTq7Dp22LBdlWMJzlOx8wmBK2Rx5WmBLJIRwtAijOQE+ooCb2B5xBOYRtlfNeXpLpA7oyZRTqHzGenkmIJPnhBIMrzTwSA6H93CO5l+c1NA99f6IwLH8fUKdjTmDpTbgS50+gGVnECnE4PpooC2guPoaPADSHrcncNHmEHtAFkq3+EI+A37zsrrTvH3WTkvJLoOTyBp10wx2JcgVCRahA4NrICE4a+hrMXsA3qAHItW188E8ejO7XV3eh/KCYwxlamEwCgL8lN2wTntfrhY/U0g/5KAdvUpT+AszWqBdqH7VLeeZrExK9Cv1UgIDKA8g/cx7QAEP+AhAfRaMKB2HOJh+BSFSqKjSytNGBlc6PrpxvK7lCVDxbSG3Z7AhCMwx6gelwgLAltXBXJUTH29j+U1LHdipx/QprfKfGnF0sBpdBYxmEQyTzW0h6/0khcuhhJYRufym+i4VKMocJMs/KvfoW3/UJb4PeZOSZVONThZz4djP/75TAXa/CVfOvX3RgVLIDreLPN1pP1osW7lGmHsEhjBOzf+EPBE4vndvWz5xb/cChxGcv1LAb+tluALKnZ47isf1MXvz1ZMlsCXbXtPceqhrcp1ps6YHwQeBXLEPCf7q23tl9uJui0bGBgYRAccv7uXr/g5Af+2oNTrpgTa/vnpjBvpLAwM4gRBPvIZGBgYGBgYGBgYGBgYGBgYGBgYGBgYNAOc9oMXs4GBgYFBcNBnww5QzDXgRtPSaZ5lg/itsRaslgZ3bnWEEVnhMetIBwiiVnlbCbWrEftrt11zdwWnseFW1QO63w1is3ptD1pV9xG0t+zvfUrzrvh380qwXWAVCw6h78GIfG7ZlzltXu6hd+y92fECRFhjuH3bXG8N43oXEHperdzvUbteaDxhVTUeq25fqhG1X6Ai8mtF6BDXz2wR+dzSgg4Qsxls5T11XMG+82y8GkG+b7kL69xg7mF1SFvhBgYGsYH/Xi7HE+PVkiB2jt1bNZxT+k4558jR53ydz5//1m1KOgYGBgYGBgYGEQfnsYaG2z1sdPJS79XQSu91ndobOAHCaN5vNzUk1bceQVzUpbw3iOuT+UFmR18bHrp3gyhDC56lCd1y85w2+HSNUwVhhdGC7blLf+bV/fqtvhMg1NDjCcugB1QXswbs8ekj/v1BgzFHBIIsyP+HfwFdMpzu",
+                                "decompressed_size": 27831,
+                                "encoding": "zlib"
+                            },
+                            "identifier": "endpointpe",
+                            "prevention_threshold": 0.66,
+                            "score": 1,
+                            "threshold": 0.66,
+                            "version": "3.0.33"
+                        },
+                        "signature_signer": "",
+                        "temp_file_path": "C:\\Windows\\TEMP\\581ac9e2-e9ea-499e-8ec6-d7eed985b6c3",
+                        "user_blacklisted": false
+                    },
+                    "host": {
+                        "hostname": "HD-c15-bc09190a",
+                        "ip": "10.179.244.14",
+                        "name": "HD-c15-bc09190a",
+                        "os": {
+                            "name": "Windows",
+                            "platform": "windows",
+                            "version": "6.1"
+                        }
+                    },
+                    "process": {
+                        "authenticode": {
+                            "cert_signer": {
+                                "issuer_name": "Microsoft Windows Verification PCA",
+                                "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                "subject_name": "Microsoft Windows"
+                            },
+                            "cert_timestamp": {
+                                "issuer_name": "Microsoft Time-Stamp PCA",
+                                "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                "subject_name": "Microsoft Time-Stamp Service",
+                                "timestamp_string": "11/20/2010 11:37"
+                            },
+                            "more_info_link": "http://www.microsoft.com",
+                            "program_name": "Microsoft Windows",
+                            "publisher_link": ""
+                        },
+                        "command_line": "C:\\Windows\\Explorer.EXE",
+                        "domain": "WIN-Q3DOP1UKA81",
+                        "executable": "C:\\Windows\\explorer.exe",
+                        "file_hash": {
+                            "md5": "ac4c51eb24aa95b77f705ab159189e24",
+                            "sha1": "4583daf9442880204730fb2c8a060430640494b1",
+                            "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a"
+                        },
+                        "hash": {
+                            "imphash": "6422e341c67ba0880e012f8c7c634c21",
+                            "md5": "ac4c51eb24aa95b77f705ab159189e24",
+                            "sha1": "4583daf9442880204730fb2c8a060430640494b1",
+                            "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a"
+                        },
+                        "is_endpoint": false,
+                        "malware_classification": {
+                            "identifier": "Whitelisted",
+                            "score": 0,
+                            "threshold": 0,
+                            "version": "3.0.0"
+                        },
+                        "modules": [
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290248516,
+                                "hash": {
+                                    "imphash": "6422e341c67ba0880e012f8c7c634c21",
+                                    "md5": "ac4c51eb24aa95b77f705ab159189e24",
+                                    "sha1": "4583daf9442880204730fb2c8a060430640494b1",
+                                    "sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 4278845440,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\Explorer.EXE",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 05:28"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258681,
+                                "hash": {
+                                    "imphash": "d41d8cd98f00b204e9800998ecf8427e",
+                                    "md5": "3556d5a8bf2cc508bdab51dec38d7c61",
+                                    "sha1": "92015f7bbdb9dad35e41c533d2c5b85f1cd63d85",
+                                    "sha256": "91e3d98ad3119e8addf8d2aa1dd6795162842fff7101e4c70c5137e847b4ff50"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 2007891968,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\SYSTEM32\\ntdll.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258315,
+                                "hash": {
+                                    "imphash": "9165b02c931d76a9b666d8d42128111b",
+                                    "md5": "7a6326d96d53048fdec542df23d875a0",
+                                    "sha1": "5c02af0206c299f5bcab8da4237cfc92e3e93495",
+                                    "sha256": "182351570856cd6eedd9df7e2fb8ab76bd4d8fc70be11ad5de6484cfd70c21c6"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 2006712320,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\kernel32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258316,
+                                "hash": {
+                                    "imphash": "3f7fb1504bb73a54888bf1c3650fe4cf",
+                                    "md5": "da68c291b4ef2dec9c5963266bcae454",
+                                    "sha1": "5696e8c68fcf64104499e20e7cd5452b58b4f4ba",
+                                    "sha256": "21aa4779fc21e762178517268c95467238c92851ad9160bffc36b2379c58337f"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791760175104,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\KERNELBASE.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534699,
+                                "hash": {
+                                    "imphash": "e1ee2d71958d21e0e1bf887dfe76af7f",
+                                    "md5": "6df46d2bd74e3da1b45f08f10d172732",
+                                    "sha1": "3491f8f9a73c00b158e43a530210d67a4f0598ae",
+                                    "sha256": "2dc945f6f2c4a82189bc7da2fcbb7d9a0e2588a909539249e55ba82468e0c677"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791763779584,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ADVAPI32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535038,
+                                "hash": {
+                                    "imphash": "8c99b1c0f6cf68b07336751f460f1dba",
+                                    "md5": "7319bb10fa1f86e49e3dcf4136f6c957",
+                                    "sha1": "3eea5ee8bafb2b9975b236c5c5655df6f4b42aa1",
+                                    "sha256": "60de43ab267fd41c9804369b569139add30ed4e295c425f44fc04d3fcc95fca2"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791790780416,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\msvcrt.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535198,
+                                "hash": {
+                                    "imphash": "b8ba136689cdc8d8b25fc04902f39a22",
+                                    "md5": "83404dcbce4925b6a5a77c5170f46d86",
+                                    "sha1": "22bda6b9da4fcf492b4dd16554b0c0e27e1b8667",
+                                    "sha256": "d669614d0b4461db244ad99fbe1ba92ceb9b4ed5ec8e987e23764e77d9ac7074"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791793074176,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\SYSTEM32\\sechost.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258798,
+                                "hash": {
+                                    "imphash": "46876e4adb924a616ddbbb1992d61257",
+                                    "md5": "0611473c1ad9e2d991cd9482068417f7",
+                                    "sha1": "c4a3fa902dedad5d448e1d8b2d113cae1dcf2f7a",
+                                    "sha256": "90afcc2a60350ece27e75e76459132ef0fa28ef283ce88fced4b82735a93ecda"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791762403328,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\RPCRT4.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258001,
+                                "hash": {
+                                    "imphash": "51945fdf9aaf56aeb9d6fa1f21b638ce",
+                                    "md5": "1084aa52ccc324ea54c7121fa24c2221",
+                                    "sha1": "b13ef924708fa88577931ed0337000e90adcdf5b",
+                                    "sha256": "6e972cf624f7c0de8190434b3b30279a01c551713109f97b9ebb77fac9364754"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791792615424,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\GDI32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258929,
+                                "hash": {
+                                    "imphash": "2cb501375ed127591bf5cfee7f1e52fe",
+                                    "md5": "fe70103391a64039a921dbfff9c7ab1b",
+                                    "sha1": "e0019d9442aeebd3bb42a24c38aa2fae4c6bd4f5",
+                                    "sha256": "f7d219d75037bc98f6c69143b00ab6000a31f8b5e211e0af514f4f4b681522a0"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 2005663744,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\USER32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534943,
+                                "hash": {
+                                    "imphash": "919110853c18aa198ad129945337b1dd",
+                                    "md5": "d202223587518b13d72d68937b7e3f70",
+                                    "sha1": "916a3ce858f074f57dd9dac01be5cd4649f19887",
+                                    "sha256": "9db971b866d058adbb518dd99b87c5db8dd1e7c9073755b989ae7e9fb62901e8"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791763714048,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\LPK.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258933,
+                                "hash": {
+                                    "imphash": "17bf46cf6bf6c8cae48be5b75615a353",
+                                    "md5": "2f8b1e3ee3545d3b5a8d56fa1ae07b65",
+                                    "sha1": "66310680ee38904b2852717af13028e53b4e8b8e",
+                                    "sha256": "2a3ec01f3bafe7d7d656886437f7ffecce440c0d3f3467804769ab4bf1ff7a99"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791782522880,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\USP10.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258859,
+                                "hash": {
+                                    "imphash": "4b37cbf60127ea0550ec30e0b1c52984",
+                                    "md5": "eaf32cb8c1f810e4715b4dfbe785c7ff",
+                                    "sha1": "3b099b193abb9064e6937101d0c309f04d713882",
+                                    "sha256": "db6ad07fded42433e669508ab73faff6daff04575d6f1d016fe3eb6ecec4dd5d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791792091136,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SHLWAPI.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258854,
+                                "hash": {
+                                    "imphash": "9c631776d86c9b15258c3cc2a6a7891d",
+                                    "md5": "26e716ed95dc48cf6e5ac046089366af",
+                                    "sha1": "2bd96b8ae5ae3ad14c16d2a98a91a9a9f26d179d",
+                                    "sha256": "f686d557b7ac1688efc7cb48311290d713d3db2e9e61e947098a7c80e3a1b9e9"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791765811200,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SHELL32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258732,
+                                "hash": {
+                                    "imphash": "faad2d5bf5c0ca9639e07a49e8c5d8ae",
+                                    "md5": "6c60b5aca7442efb794082cdacfc001c",
+                                    "sha1": "aae17944782b25f41f7b3a756532b4923f4ae817",
+                                    "sha256": "fc1d9124856a70ff232ef3057d66bee803295847624ce23b4d0217f23af52c75"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791783374848,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ole32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258736,
+                                "hash": {
+                                    "imphash": "774fed8966de60d3af2dd9070df5be6f",
+                                    "md5": "42f05f980f164e084db65b2e8cd8430f",
+                                    "sha1": "86498b3c5bbc240b9de0a10f2cb4185e754de6d7",
+                                    "sha256": "0813749847b08f6577791d18ad9eca6dff5b41c2f727ab5ee9e5bf9602ed50cb"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791785537536,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\OLEAUT32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258088,
+                                "hash": {
+                                    "imphash": "ec96d3f694248151f968633563d10a36",
+                                    "md5": "eed05d42d91835064703e2318552ed25",
+                                    "sha1": "aa7e817ccad26070bce1161894f97e10aaa56fb9",
+                                    "sha256": "e9ee1e2253445b207b76f5d3073c612ed979a982522c1515e0fe8fa9641ae568"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791634935808,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\EXPLORERFRAME.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534886,
+                                "hash": {
+                                    "imphash": "c0e1a4a34891e5dd2a6cbaa0895a8d38",
+                                    "md5": "8ccde014a4cdf84564e03ace064ca753",
+                                    "sha1": "957e29e029fe60b8ff43ff732463c39230b78226",
+                                    "sha256": "dd663029b2eb7b12fdb00fce403d8326141e540e3b9ce84cd5871473d3e2e2cf"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791735599104,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\DUser.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534885,
+                                "hash": {
+                                    "imphash": "9353143c2b77b94cc82ab55c5fecf99c",
+                                    "md5": "3cb6a7286422c72c34dab54a5dff1a34",
+                                    "sha1": "5b93896a6abb36c2b8957973e3ce1860c1059367",
+                                    "sha256": "98d21efff511e407336a226420701e82554da01fa05661303836b6860d63749d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791721181184,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\DUI70.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534912,
+                                "hash": {
+                                    "imphash": "d76d7be0b8ac9aafe17d2cc7deb32b29",
+                                    "md5": "aa2c08ce85653b1a0d2e4ab407fa176c",
+                                    "sha1": "0119c23d88292a0e4fec04d5cf8629005a44e37c",
+                                    "sha256": "83dfd0c119b20aedb07114c9d1cf9ce2dfa938d0f1070256b0591a9e2c3997fa"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791793205248,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\IMM32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535018,
+                                "hash": {
+                                    "imphash": "b523fff180cb22465ccf191b827e9923",
+                                    "md5": "c431eaf5caa1c82cac2534a2eab348a3",
+                                    "sha1": "e425577ccfc9b92efbbcb760d21fcaa478d3e51a",
+                                    "sha256": "addf850128dc675e67faba9a3d0d27e684f01f733962ca22927bb94503549e44"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791764697088,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\MSCTF.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535251,
+                                "hash": {
+                                    "imphash": "56e651a119cdb899aadd2df3832bbcd1",
+                                    "md5": "d29e998e8277666982b4f0303bf4e7af",
+                                    "sha1": "e803b0af61ea2ddcd58b5a63b1cfbb73266318ea",
+                                    "sha256": "4f19ab5dc173e278ebe45832f6ceaa40e2df6a2eddc81b2828122442fe5d376c"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791742480384,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\UxTheme.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535202,
+                                "hash": {
+                                    "imphash": "1c419f7cfacebfcd8e903e6be290407e",
+                                    "md5": "716175021bda290504ce434273f666bc",
+                                    "sha1": "4f00fbf4e9a88fae9e6682989032831b3d2eba86",
+                                    "sha256": "fa18ca2d8a5f4335e051e2933147d3c1e7308f7d446e2aeb6596cdef6e2afc88"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791718690816,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\POWRPROF.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258850,
+                                "hash": {
+                                    "imphash": "a7a25e8b145e75fdeb21026d3895033a",
+                                    "md5": "5d8e6c95156ed1f79a63d1eade6f9ed5",
+                                    "sha1": "cadd211d74385550c5e055d3312303f4d64fdebc",
+                                    "sha256": "12130837d7f89a2c7e9d25747a8e5b9001e0a38d545178b49b450c23ae62664a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791788814336,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SETUPAPI.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257756,
+                                "hash": {
+                                    "imphash": "5cd9d6761799e2ff681533ef1ffbb31d",
+                                    "md5": "2477a28081bdaee622cf045acf8ee124",
+                                    "sha1": "304c5f29fa847fbd994ad7a0471214198b928c14",
+                                    "sha256": "00a09caf9129e84feea98fa03ce9012c9f961b64fee15c4f268822c0f82acc3c"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791760633856,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CFGMGR32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534817,
+                                "hash": {
+                                    "imphash": "2dbdaadf7e151289a49662379e253dfd",
+                                    "md5": "06fec9e8117103bb1141a560e98077da",
+                                    "sha1": "a8922793a930d602409b62be5ff01d5baec60000",
+                                    "sha256": "c5e61b11ddbbbbba3d9488970524f0975ea5fbdf16e2fa31f579f8bfa48353b1"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791760044032,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\DEVOBJ.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534887,
+                                "hash": {
+                                    "imphash": "e7f2585307f1db90e7e5e48c40dc7134",
+                                    "md5": "da1b7075260f3872585bfcdd668c648b",
+                                    "sha1": "f2bd334006d728422721b7c639145a6ec59a459b",
+                                    "sha256": "3e10ef6e1a5c341b478322cb78a0ab7bfc70ad8023779b8b4542a7cb4ca756ab"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791742873600,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\dwmapi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535203,
+                                "hash": {
+                                    "imphash": "6a5a31c99a1562b9e5e10f4b4445be95",
+                                    "md5": "be097f5bb10f9079fceb2dc4e7e20f02",
+                                    "sha1": "dd572bac50bc4718126389c628d56a83d5c4d88a",
+                                    "sha256": "90a88986c8c5f30fb153ec803feda6572b2c2630a6c9578fcc017800692694d5"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791732256768,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\slc.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257495,
+                                "hash": {
+                                    "imphash": "fd8a6a2046d9572b7f8f4288ae251c61",
+                                    "md5": "497bfeddaf3950dd909c3b0c5558a25d",
+                                    "sha1": "5d55bdc156372f51eb126f7bc2a8af161a1ef254",
+                                    "sha256": "980ea189929d95eb36e35980fff0c81f7b78de9422771fde8f4ac7a779f5bd89"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791732453376,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258848,
+                                "hash": {
+                                    "imphash": "cc4d63ca30fdbb90048e549782d2116a",
+                                    "md5": "858df0795cb5b4bace0f33708925a414",
+                                    "sha1": "e629ed78e6e1829263890974760dad8a431edf69",
+                                    "sha256": "a9063af8d5c73a722bd269d144d8a65c98db4cfdd9f626e3a8283754e22c8c9c"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791754801152,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\Secur32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258927,
+                                "hash": {
+                                    "imphash": "b32250da0d30f7782b5b900d4d9c519a",
+                                    "md5": "2a86e54b441ad41557f75dc5609b9793",
+                                    "sha1": "83ddcf8a1a0ca423bf8417f5e59b5c431bf50c43",
+                                    "sha256": "8fede6909413c0fa5b63d58d39affd0f6c3beeaf19b7b2f8674913abfd79a912"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791756701696,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SSPICLI.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258762,
+                                "hash": {
+                                    "imphash": "26c2856b9813d8990c01c5a711b5063a",
+                                    "md5": "f06bb4e336ea57511fdbafafcc47de62",
+                                    "sha1": "bfee1b9d2269d26d99c8e462825ee8399c8bd4ec",
+                                    "sha256": "be43ec62548e9ff89a9495a1722e22dbb76eec3764f86e64057b636f27d15765"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791728259072,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\PROPSYS.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534993,
+                                "hash": {
+                                    "imphash": "f0c6fd6831905d958b05645b680db89f",
+                                    "md5": "784fa3df338e2e8f5f0389d6fac428af",
+                                    "sha1": "6d32c67c91c6d374854e907c6719db2538540867",
+                                    "sha256": "9c8aa0cfdeb9e38aaf8eb08626070e0f0364f4f8a793cfe3532ec6c007980c34"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791757291520,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CRYPTBASE.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257499,
+                                "hash": {
+                                    "imphash": "cd11f800bc54ae45ead9d98c96048145",
+                                    "md5": "7fa8fdc2c2a27817fd0f624e78d3b50c",
+                                    "sha1": "b4aa8e16396b1882eb75c28dfbec9949608afdde",
+                                    "sha256": "7b63f6aa2cd6d4d07ea3c595b868b1a0749bb11620027a2bd9b935e3055481e4"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791736123392,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258974,
+                                "hash": {
+                                    "imphash": "b03f7d8315f3384d06c11e961e6fee07",
+                                    "md5": "26b73a85855681500bcc25c7cd9ff5b1",
+                                    "sha1": "393ed9ebbe380c77935df6d0eda2047cdd2224fe",
+                                    "sha256": "94d134a6af53ad629a4505b8b0ea37f61bb43af4db71874e7e87853163a9282a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791724851200,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WindowsCodecs.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535135,
+                                "hash": {
+                                    "imphash": "ff720e05e534d67b814b8562265058f5",
+                                    "md5": "2c942733a5983dd4502219ff37c7ebc7",
+                                    "sha1": "263e8fbf77c0ceead0c9bca56394bffa4a664361",
+                                    "sha256": "34b20b6b0d7274e4b5b783f1d2345bc3dd9888964d5c2c65712f041a00cf5b45"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791758143488,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\profapi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257558,
+                                "hash": {
+                                    "imphash": "6af6d846a78a6532fcb989d0d8aeb17d",
+                                    "md5": "90499f3163a9f815cf196a205ea3cd5d",
+                                    "sha1": "f97ff54dc4b132756fcf7041e55d645163f19851",
+                                    "sha256": "29b4ed3795cec1177eb367132914ce21c194cdec5db9dc923fd928c85e94d821"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791756898304,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\apphelp.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534778,
+                                "hash": {
+                                    "imphash": "37afbae3e0f359c3718e379261f7ccfc",
+                                    "md5": "25983de69b57142039ac8d95e71cd9c9",
+                                    "sha1": "01691e3b0bfa569e64bdb7dc3d637a867ed2dc08",
+                                    "sha256": "a677da7ebcbcb6073d27e8a38809f51e971e83ed379bc599aaad6ef4216348da"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791787700224,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CLBCatQ.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534842,
+                                "hash": {
+                                    "imphash": "cbda3eb1c9c46a2121362e9775f60b47",
+                                    "md5": "024352feec9042260bb4cfb4d79a206b",
+                                    "sha1": "79c23ce566219f87ade8e55a292aaaabe4a639ec",
+                                    "sha256": "60cb39086e10c5b66ebc15e4df219620b344b4358d2918ab6bb3448a0ac8be36"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791731994624,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\EhStorShell.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258701,
+                                "hash": {
+                                    "imphash": "37dad3873d5388f07576532bc042f677",
+                                    "md5": "7bbf670114373ce6a203fa155a9e0d0a",
+                                    "sha1": "104d89dde030b661d05c4c63a03fae1f46ab52d2",
+                                    "sha256": "36ef0a36c679e53b1b169289bd3c05d7c2839dc20c8c87bf520b633911fde198"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791647518720,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ntshrui.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258920,
+                                "hash": {
+                                    "imphash": "2d37f2d4b3c246f361ca150fc7ebf8d4",
+                                    "md5": "3a9c9baf610b0dd4967086040b3b62a9",
+                                    "sha1": "3207ac7f895eab34623d994548d7810e54be3e79",
+                                    "sha256": "e8e9a0f42b1ee7806edceed08aa024d037215d06ca317e3678bd5364ad513d23"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791753228288,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\srvcli.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258010,
+                                "hash": {
+                                    "imphash": "2ba777561101c3b07566cc50db3a564c",
+                                    "md5": "1bf0cb861a48feb1638228760750f3cb",
+                                    "sha1": "fbc77224c1b444a6ec25e99f995f2f355e4d1d26",
+                                    "sha256": "37c781a8c546ead8b4d28bd7d730b9ac78eb799599ad69dad9054b6f9f1dd6bd"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791649091584,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\cscapi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:35"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534897,
+                                "hash": {
+                                    "imphash": "5bf52e420b6d5991bdcce16ada0828dc",
+                                    "md5": "1d63f4366288b8a7595397e27010fd44",
+                                    "sha1": "e459e1227083e4eabd19ee20e13754560fc7e02d",
+                                    "sha256": "99ea4ddd88d9c4a4cc9b238f533cb4d2c062d46239173997e8594d8a75811a01"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791735533568,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\IconCodecService.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534998,
+                                "hash": {
+                                    "imphash": "77870f98ca4d25a823c74d7404a64bfd",
+                                    "md5": "d0c2fbb6d97416b0166478fc7ae2b212",
+                                    "sha1": "e290bdf2312ac30a4e9f2a96d7c84714eee84899",
+                                    "sha256": "7eab6c37f0a845e645ca44cc060ac6c56e386c7ef7a64716c6786c9602ad8c9d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791750606848,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CRYPTSP.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 17:43"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535161,
+                                "hash": {
+                                    "imphash": "b8c20a01e4d94df61ee21f5350389f9c",
+                                    "md5": "5d8874a8c11dddde29e12de0e2013493",
+                                    "sha1": "a1c8e3e6ee44dcb68752d44b3b6f4ecce89c388d",
+                                    "sha256": "3e9a57137bf622af83e3e4d58971e2c0200559cca7545d16cf263aa03ee9c7d2"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791747461120,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\rsaenh.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258799,
+                                "hash": {
+                                    "imphash": "a198edd0f73abd7cdbb54eef82ab1fc6",
+                                    "md5": "c2a8cb1275ecb85d246a9ecc02a728e3",
+                                    "sha1": "4417207821fc8f5c72ff531683f183caef297882",
+                                    "sha256": "3603fadca0060bd201148f9d59e4e2627f024609a6463ab525b5d1ad17bdcd10"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791758012416,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\RpcRtRemote.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258895,
+                                "hash": {
+                                    "imphash": "4fe9beaa9bd4aa01f5063a7352325c89",
+                                    "md5": "d7f1ef374a90709b31591823b002f918",
+                                    "sha1": "336ac44b8ee88a6af3f3eaf461b8bdf94fa657ff",
+                                    "sha256": "05fd2837c9b03d14bb2a969c1ad77caef047d93dc5d0f6c2acbf0888e8f7b359"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791730683904,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SndVolSSO.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534873,
+                                "hash": {
+                                    "imphash": "0a90384377303e2a2625725018566a89",
+                                    "md5": "896f15a6434d93edb42519d5e18e6b50",
+                                    "sha1": "b91a3512a80c4201c3fcfaf62abace894fbba328",
+                                    "sha256": "9263f0cec58d45ebe3fb9c3061fb9392c55a7933b84b4592e6ee13cfc86d5a50"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791731929088,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\HID.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534952,
+                                "hash": {
+                                    "imphash": "98a24f570dbcd3a092d95b3bd4e51a53",
+                                    "md5": "227e2c382a1e02f8d4965e664d3bbe43",
+                                    "sha1": "c4971ba9c1e4fdf0106c7cfab626a3d8737bbd07",
+                                    "sha256": "1cff20a8bf87ace4fa4935ebeed72bfb1a1fe902a754899e2f50798d67df5642"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791729504256,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\MMDevApi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258898,
+                                "hash": {
+                                    "imphash": "e99757a4c1beee1b5bf8b7b33b444dcc",
+                                    "md5": "1fcb1a72bf5c784f7358e6bef38e4571",
+                                    "sha1": "ef944a320de79bf05f0e30f54f3f8b2ba2e82c4a",
+                                    "sha256": "12da4240f8c964eda6223257bd9723fd9372e63ae86f00509163b1de12a5f6c5"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791637426176,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\timedate.cpl",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534704,
+                                "hash": {
+                                    "imphash": "d6de6fde05f96ac848accdb1aef473e4",
+                                    "md5": "58775492ffd419248b08325e583c527f",
+                                    "sha1": "b0e9ca05d46cb53049c4ca33fe04bd08989a78f9",
+                                    "sha256": "dbb013971f5894f25c222c2d4d50a29db6df3c413792ee9ccc1a9e6d85469093"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791732322304,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ATL.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535266,
+                                "hash": {
+                                    "imphash": "fa1e670045065ff088a4ac664f9ac3d7",
+                                    "md5": "9f2bacd5e1776a4bb7cc0ec3c3a4f96d",
+                                    "sha1": "ad8c7ec85d532e5725b8535830f27c1abcf139b4",
+                                    "sha256": "19959d18601712901f03b83150d15e34ebcab355bb4692c9a28511a72f57fc66"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791730618368,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WINBRAND.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257498,
+                                "hash": {
+                                    "imphash": "53f2c3eaeaa6e619e0ccd6e671e96145",
+                                    "md5": "e6f0f82788e8bd0f7a616350efa0761c",
+                                    "sha1": "9aa4aafda89325853ffa66169e697529164a23a2",
+                                    "sha256": "13091dcb3e3f4f52c3ff210e93aaf1dce142cfc09f671aeac5b922393b23e67b"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791633952768,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\actxprxy.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535165,
+                                "hash": {
+                                    "imphash": "ae5e5f76641aadaf99f0ca29d2e1cadd",
+                                    "md5": "1f4492fe41767cdb8b89d17655847cdd",
+                                    "sha1": "c836a5e65d56900b6658fdaa3df8579bdd07ec69",
+                                    "sha256": "184547fac0c3d7148faa3f601929a7089de393bd19929a137dad743331dd3f77"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791719739392,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ntmarta.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290259030,
+                                "hash": {
+                                    "imphash": "f792b6ec2e11bc79d8eb1bb1bcb79a91",
+                                    "md5": "4e4ffb09d895aa000dd56d1404f69a7e",
+                                    "sha1": "40f5c1890f6de5284f6c897255e6907b0272349a",
+                                    "sha256": "d999e04bb35780088480eab322176570591a21e311d204bdcab010a63b34d24c"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791794974720,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WLDAP32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258853,
+                                "hash": {
+                                    "imphash": "2507624727988c72eb2a628a990000fd",
+                                    "md5": "c4f40f6cacd796a8e16671d0e9a2f319",
+                                    "sha1": "0881ae2a2fd3c5f03654410c474e5a25317942b2",
+                                    "sha256": "44853c645915d910ed0cc6d38f68b6c222528ec5fcbe990e238010f41204e682"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791729897472,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\shdocvw.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534923,
+                                "hash": {
+                                    "imphash": "e52a872655c57d1b906101b6d5449bbf",
+                                    "md5": "a0a65d306a5490d2eb8e7de66898ecfd",
+                                    "sha1": "880ac520eb1d38ebb591707a26e6dd300df40643",
+                                    "sha256": "ce5da408f4edd5e81ce0925867f03c9a35172cf1571fe4c4c052e45ab69822bb"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791729831936,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\LINKINFO.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258932,
+                                "hash": {
+                                    "imphash": "0e8a67fa12ce3d22a9e1d18bda5c3260",
+                                    "md5": "7a17485dc7d8a7ac81321a42cd034519",
+                                    "sha1": "83d1722a35eb16b010d8c9f72c627e97d4642101",
+                                    "sha256": "88d8705fa901793fc8c1cfd0175e49a6502bf0fc94a066ba573d2fd13aa5f04a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791745036288,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\USERENV.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258852,
+                                "hash": {
+                                    "imphash": "8b5c65294bec1cf89e97325a24b8cfc5",
+                                    "md5": "4e9c2db10f7e6ae91bf761139d4b745b",
+                                    "sha1": "6e8e6a53269ca8acc8c2456c80cd3a56d8deb98d",
+                                    "sha256": "8f63f78294f5585d599a114af449dcc447ccb239d0f0b490bfe6b34a2146e730"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791704207360,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\shacct.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535152,
+                                "hash": {
+                                    "imphash": "44b39e98ae2946f304f4dbadcfffa307",
+                                    "md5": "5b3ebfc3da142324b388ddcc4465e1ff",
+                                    "sha1": "86e20ebf70fd35723eb635c4f3684891a2547a7b",
+                                    "sha256": "5d58642305311f9bc9b779c9598bfc4e7433b3ea58404bf1ff9466838a2328c7"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791716069376,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SAMLIB.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258793,
+                                "hash": {
+                                    "imphash": "7fec5787890bfedd3b3aa4082f53a08e",
+                                    "md5": "fc51229c7d4afa0d6f186133728b95ab",
+                                    "sha1": "f7a2f224356e68b612ecce4512c99f5b9c264d7d",
+                                    "sha256": "37e58c8e1c8437d1981725a5dcdaca7316cefbb570370cefc8d122f523b96ac0"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791714168832,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\samcli.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258588,
+                                "hash": {
+                                    "imphash": "96f28fef38c977afbf3f6e8f39c0d6b9",
+                                    "md5": "6ceca4c6a489c9b2e6073afdaae3f607",
+                                    "sha1": "b228f6208642cb99e5bcdf2d3ebda2b8bc4fb020",
+                                    "sha256": "127506d1db38275614cbeb047c133718ef9d03266ba9c98be55ec7847cfc9c3d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791722426368,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\netutils.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535084,
+                                "hash": {
+                                    "imphash": "14bd8d9a93b98b2479e1f6cd57b7c790",
+                                    "md5": "7cb3acb163de051169095dc6507b8977",
+                                    "sha1": "b891ebebb25655157f7c612d5763e995c86009a2",
+                                    "sha256": "45d4deb0695440d8b5e959945b3f7a773e02e2ab305e316123a1064fc1905402"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791703945216,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\msls31.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257535,
+                                "hash": {
+                                    "imphash": "bf738a2fc0ab0601eea36f35e4cbcd27",
+                                    "md5": "0bee002c68e28ce6da161dcf1376d7d7",
+                                    "sha1": "d5cc3bec12c801e11217acc6927e1e6e401fe208",
+                                    "sha256": "1d4ee0b9ce22d139478008d5591b8c9f027c235cba601f95a96547cf98159d4b"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791631134720,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\authui.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258007,
+                                "hash": {
+                                    "imphash": "76801e47683b36a4115dbe046717edbe",
+                                    "md5": "b3bfbd758506ecb50c5804aaa76318f9",
+                                    "sha1": "bf6c922467347a6690eb19c5e82be09b3295778b",
+                                    "sha256": "34e079a6ab2d41d1e0b3887b6ae31c43941061b7176fff2801c3f465c2c89578"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791630020608,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CRYPTUI.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257999,
+                                "hash": {
+                                    "imphash": "04534d8dae5ab230b9bee9b1b0b2829d",
+                                    "md5": "3f9f2afa135f0663946a006dd5ffd897",
+                                    "sha1": "ea6456859b04b68af8dcd453381dd168af53fc5e",
+                                    "sha256": "276d1c9c78c529625c2ef3d77079324628686ea184767971901a1de93681c133"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791760896000,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\CRYPT32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258373,
+                                "hash": {
+                                    "imphash": "2e50bc5d9fe777770c8a6b2cfaf6b2e9",
+                                    "md5": "884415bd4269c02eaf8e2613bf85500d",
+                                    "sha1": "c3a64f05c210b38c69d8f1fc1d74a71b56ada30c",
+                                    "sha256": "efe771709ec942694fd206ac8d0a48ed7dcd35036f074268e4aecd68ac982cea"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791759060992,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\MSASN1.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258922,
+                                "hash": {
+                                    "imphash": "75124ca243f494ff6127697f3ebc418a",
+                                    "md5": "5fada8b707318e1bd63a7e2b81e6c8cb",
+                                    "sha1": "c5ad1c9bbc2f565237a144b9cf44711dfcf65ea5",
+                                    "sha256": "2590e88cab52fcc1b24cb262d293131c6280a5f234e0c130e77aa8697efa3b5f"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791793401856,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\urlmon.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258980,
+                                "hash": {
+                                    "imphash": "248b27a31ddf696c2e3bfe6aed9c3eba",
+                                    "md5": "f6c5302e1f4813d552f41a0ac82455e5",
+                                    "sha1": "f0ec3ad7e90f559d1bc9b8849cf5668cafba2031",
+                                    "sha256": "e3ebf44621efc6381baae0f0efc13c356dcb6ee31bb258137edb3cc3e18549b5"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791786455040,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WININET.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258097,
+                                "hash": {
+                                    "imphash": "f6db6123d8a383f58cf318d00d2e7d1d",
+                                    "md5": "5180380d353277d395d3b36d790aa93e",
+                                    "sha1": "d5622ec5d922233867422d1e143969e226bb9a1c",
+                                    "sha256": "89b894eccf65704d00d30ea3bd45b184bfab8345b779f9ae2be66b9fc7226f72"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791780032512,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\iertutil.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535234,
+                                "hash": {
+                                    "imphash": "13ecfa3a285149680a7a4b174c8b8f5b",
+                                    "md5": "94e026870a55aaeaff7853c1754091e9",
+                                    "sha1": "a4f845318e095d841b05e1400747ee4c28e1f28e",
+                                    "sha256": "b2f5d5629d12bdfa98dbed3898368f37d9009c7531b6909c7285a2c11c9a0f93"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791743004672,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\VERSION.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290259004,
+                                "hash": {
+                                    "imphash": "da0bcac0c5f9dc653d00eecd5fb1c801",
+                                    "md5": "0d9764d58c5efd672b7184854b152e5e",
+                                    "sha1": "99d78db040987c69b6a70a42af86641ba0413956",
+                                    "sha256": "9827b43dabbec39ab2e2294408d9c5304ef27a684903c5234c6070387723d49e"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791758209024,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WINSTA.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535280,
+                                "hash": {
+                                    "imphash": "af1203c1d6d810c97729856780869b12",
+                                    "md5": "ef2ae43bcd46abb13fc3e5b2b1935c73",
+                                    "sha1": "c53e005cd04d99331ce3114ac119256133202313",
+                                    "sha256": "81fc06f306f620845d7dd8d06e706309e70bc89b589c81f3478302a3f5f73431"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791683301376,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WINMM.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258936,
+                                "hash": {
+                                    "imphash": "7e9874f9ecf2191b91f9a4dfa37f2ba1",
+                                    "md5": "1473768973453de50dc738c2955fc4dd",
+                                    "sha1": "7b046f6070844e3bc7deae115a1dfe5825030513",
+                                    "sha256": "14bc5da2442cb726acc1f277ddbeccf5d61e3a0a3e083a55a0bb610191e35220"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791648239616,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\wdmaud.drv",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535081,
+                                "hash": {
+                                    "imphash": "086996ef0b01a463f114deb5244861b9",
+                                    "md5": "8560fffc8eb3a806dcd4f82252cfc8c6",
+                                    "sha1": "7562bbb63b0db6e4986ebdb86495c4fe284a1eaa",
+                                    "sha256": "cc27bc092369a89d6147b16568fedeb68b584d5738cd686c31f7fae22ed17b3b"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 1968373760,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ksuser.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534742,
+                                "hash": {
+                                    "imphash": "690cce63d22e22d9aa225c4a9290b2c4",
+                                    "md5": "78a1e65207484b7f8d3217507745f47c",
+                                    "sha1": "3542a591e9c97b48739f69e2a193dff461ea097c",
+                                    "sha256": "35f413adb9d157f3666dd15dd58104d629cd9143198a1ab914b73a4a3c9903dd"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791718625280,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\AVRT.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257517,
+                                "hash": {
+                                    "imphash": "64661addcde8896487dcc7cd32a4eda9",
+                                    "md5": "dc220ae6f64819099f7ebd6f137e32e7",
+                                    "sha1": "5707f15b666c7d3b07dfce9dac665a2e45c39113",
+                                    "sha256": "b8fe13b859fa83500dd95637fa6d4a5b8392c2a363e41d014d3b5374f636e1de"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791659118592,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\AUDIOSES.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534992,
+                                "hash": {
+                                    "imphash": "3bf8d3fd03f9d07b7821df4b1da2be9d",
+                                    "md5": "1b7c3a37362c7b2890168c5fc61c8d9b",
+                                    "sha1": "78ba8d596c0ac4c38acb498416957891570a2a1d",
+                                    "sha256": "03727930e5bb5f9d91bab901fc9a2e3b795d68e2aee6a2cc3477f356c45a9c54"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791728062464,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\msacm32.drv",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534991,
+                                "hash": {
+                                    "imphash": "9611d7fd4fe3c571fbf1db3d718ba82c",
+                                    "md5": "10ac5ce9f78dc281a1bbd9b8cc587b8a",
+                                    "sha1": "207582f9d9bec00a932fba886d575ee5b6502d42",
+                                    "sha256": "72288c0a88916d3c3828dbd948dbdb0928f26106319f8e60102d6c9004514d60"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791716659200,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\MSACM32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535038,
+                                "hash": {
+                                    "imphash": "5a8ee2f48e79ef6ac4b33366d6642b50",
+                                    "md5": "ca2a0750ed830678997695ff61b04c30",
+                                    "sha1": "a27df990dde73e72bb02105f8af689a1ac324e59",
+                                    "sha256": "e84860cd97aa3c4565abb2d5d406a5c42b1ad2d8ba1b8cf81fe564d91f15f976"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791727996928,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\midimap.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 07:10"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535256,
+                                "hash": {
+                                    "imphash": "04a5e982c134477b1914ebcd7b6436d0",
+                                    "md5": "d6f630c1fd7f436316093ae500363b19",
+                                    "sha1": "197897b74f411040ba7df41a5bd3c1030661b904",
+                                    "sha256": "73a94b4938430396ea4240b1a6676b4e6c19cfaf8c52efb9a69b4b2175a86307"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791727734784,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\XmlLite.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258889,
+                                "hash": {
+                                    "imphash": "8181b1ef70ff3d29984db497f92a2662",
+                                    "md5": "c3761661c17c2248a9379a8fb89e3de1",
+                                    "sha1": "d2ea41e02bbaa77f8b93b09277596a34cdae8853",
+                                    "sha256": "ce3477fa2b4058eb80739e0161fe957545f13cf86d313f6422732901d35f75f2"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791617568768,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\stobject.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257641,
+                                "hash": {
+                                    "imphash": "fbe995ff97475c5aa2777a4bc493d4b1",
+                                    "md5": "f832eeea97cdda1af577e721f652a0d1",
+                                    "sha1": "48f227a1e10d49edf56e3559e05c871bc285c199",
+                                    "sha256": "ebbb7ca199ba4df231123922bd310d43de0104c6185b70fe0281b938d5336f2e"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791616782336,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\BatMeter.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535260,
+                                "hash": {
+                                    "imphash": "5d8fff13bf206e589cae241fc7f4d464",
+                                    "md5": "bd3674be7fc9d8d3732c83e8499576ed",
+                                    "sha1": "cb96190d6366e11dd6e6b48f4cdc4332015cfa67",
+                                    "sha256": "e6716a5895d629263a4d21959f48840429ab6f4b55a5fa2663ee5e86c9ca2bf1"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791727538176,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WTSAPI32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290259008,
+                                "hash": {
+                                    "imphash": "b2ecd39ae0055d9e1b8aa5bc78942cba",
+                                    "md5": "eb3f9c2de1236b5d46b2291d82970e43",
+                                    "sha1": "0ce9ddc1063256ab571b916389321fd7f572ddc0",
+                                    "sha256": "8a43d335f3d573bed98af54bb51e82546c2acc025da8a48d801213eb14e9d5d4"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791759781888,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WINTRUST.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534970,
+                                "hash": {
+                                    "imphash": "8accd78cb7feca81ac448f0485be30dc",
+                                    "md5": "4166f82be4d24938977dd1746be9b8a0",
+                                    "sha1": "5174036d781677f5444d9a23079baf18f4bbda44",
+                                    "sha256": "24121751b7306225ad1c808442d7b030def377e9316aa0a3c5c7460e87317881"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791730159616,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\es.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257970,
+                                "hash": {
+                                    "imphash": "8c20d7b93902b8c193a7fc1b4b58e9aa",
+                                    "md5": "42a9cb6906d9a8bedc83b57163e62924",
+                                    "sha1": "50e5592460d91205e912d55f60a2dd3cc4da4329",
+                                    "sha256": "e18522d3137653140757829efbfce624a5baa5842e2bba10b9e5ab6c84be49e1"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791614619648,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\dxp.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258826,
+                                "hash": {
+                                    "imphash": "1df61af51096e9bbbdc1834405984e4c",
+                                    "md5": "2d2a6ec8ead30ec3ace2fd6fb1b3e122",
+                                    "sha1": "1e77948378474e155307d290b998994f720206bf",
+                                    "sha256": "e7ea375a3bde8fc764cb09524344370b9ee25f98ad6c83e6f37a569eb8d277d6"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791614160896,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\prnfldr.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290259000,
+                                "hash": {
+                                    "imphash": "2f59265cb3df847423b60921203365be",
+                                    "md5": "0015acfbbdd164a8a730009908868ca7",
+                                    "sha1": "671c084513461900550bd49d3dccb58bdbe05adf",
+                                    "sha256": "e1ff243ad2cf959fab81efe701592414991c03416ff296adc93906e76b707c4d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791654924288,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WINSPOOL.DRV",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535225,
+                                "hash": {
+                                    "imphash": "3d49b728c9125f451e7f2f215e9d3bbb",
+                                    "md5": "2bc7c9fd0a9f2c9afc373f3ad1ee3891",
+                                    "sha1": "1b7c6960a72509d1f408022d791c6a65acb2a75d",
+                                    "sha256": "0a82a475301202791a7c10f978f952eab7db146a702d4ea67e24e2c98bc19638"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791648108544,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\Syncreg.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258789,
+                                "hash": {
+                                    "imphash": "c5c69e7d20ca382ddbc49947d651a8e7",
+                                    "md5": "10f815be90a66aafc6c713d1bd626064",
+                                    "sha1": "3e21f173a6bcdf629c442d89abadc48137c61bb2",
+                                    "sha256": "01139fc04bc53594296f6a0e16b8d20b940f64bc8119fe7705c03c4947958f39"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791612325888,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\pnidui.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258791,
+                                "hash": {
+                                    "imphash": "6437e4761b1278fdecf142a679216f7b",
+                                    "md5": "b9f0a4020aa98b7a20287bf7fe99a1fd",
+                                    "sha1": "1f28ac7493ce972b45de191780a190504d1d0c44",
+                                    "sha256": "21138f161eeea46198890c7a2d073f2c82829e15676131bdad9f237edc7477cd"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791612194816,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\QUtil.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535239,
+                                "hash": {
+                                    "imphash": "deeb658dae29d8df1c8dbb08f06801b0",
+                                    "md5": "3c073b0c596a0af84933e7406766b040",
+                                    "sha1": "06185554c38353211430f5f075c490558e46fb3d",
+                                    "sha256": "4698bba678f553e15ad4b07ad7fb236281f872defee97bfd637114476c8f97b3"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791752769536,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\wevtapi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258586,
+                                "hash": {
+                                    "imphash": "97bb6eee9e1ea3e5751077b655b54de5",
+                                    "md5": "a42f2c1eb3b66c54fb3c7b79d30c1a6d",
+                                    "sha1": "cee705de8d3dfcc9e2a14e0249d6be61fcd54a18",
+                                    "sha256": "a63836db3b01835dc1311526a95198d6ebccb1dc9ddafbc38ec36c128cdb98b9"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791609507840,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\netshell.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258138,
+                                "hash": {
+                                    "imphash": "0bc508389b6b5577cf3cca214ca523a7",
+                                    "md5": "2b81776da02017a37fe26c662827470e",
+                                    "sha1": "8c85389640bea73a009d83079f8b4c963697035f",
+                                    "sha256": "a656353c50ee08422145d00db9cfd9f6d3e664753b3c454b171e2a56a8aa94dc"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791727210496,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\IPHLPAPI.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535145,
+                                "hash": {
+                                    "imphash": "579f52f57e43aa6ff0d07e88af5d0ff5",
+                                    "md5": "044fe45ffd6ad40e3bbbe60b7f41babe",
+                                    "sha1": "94233c0d4169c02c85514adb1f05cd3298c87f43",
+                                    "sha256": "a1688a5e6e0f7037c850699462c2655006a7d873c97f9ab406c59d81749b6f09"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791763648512,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\NSI.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535281,
+                                "hash": {
+                                    "imphash": "e710d6d30f2346e7cd91c89ec3b602d9",
+                                    "md5": "4c9210e8f4e052f6a4eb87716da0c24c",
+                                    "sha1": "d4fa50aded12eb162478d7606f1270b78dd1a44b",
+                                    "sha256": "460f7990bdadb7d58d6dc95b094d30a2efdc4ceed444b18a2f36e8d9076fb8b9"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791726948352,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\WINNSI.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258583,
+                                "hash": {
+                                    "imphash": "7e01da4b2a8806d2944a3ff2e271958f",
+                                    "md5": "2df36f15b2bc1571a6a542a3c2107920",
+                                    "sha1": "660a44b660d8e57ef7d7efbbc006ac390a7901fa",
+                                    "sha256": "a918f1ee95269df973421af2f5713deeaf15ef0f77baa7e8c515ffb69896fb7a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791735992320,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\nlaapi.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534791,
+                                "hash": {
+                                    "imphash": "59b31e42f8fae7b5809ba7fcae732e0c",
+                                    "md5": "4cbcc37856ea2039c27a2fb661dda0e5",
+                                    "sha1": "cc666108d34168420a1d1942dda1e090154c7296",
+                                    "sha256": "74cbfab3092a9564bddfcb84db3e3f8bcfd1492938adf187423d3355d73d21c6"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791723999232,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\dhcpcsvc6.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258981,
+                                "hash": {
+                                    "imphash": "1ec347d133df2fe4da3e5f8944caeae8",
+                                    "md5": "4bbfa57f594f7e8a8edc8f377184c3f0",
+                                    "sha1": "d48aafa576b40a5e386e609bba1010472551154a",
+                                    "sha256": "9f3ac5dea5a6250c3dbb97af79c81c0a48429486521f807355a1d7d3d861b75f"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791788486656,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\WS2_32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:35"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257492,
+                                "hash": {
+                                    "imphash": "f5d0254c5435291634c8b7357aa536bd",
+                                    "md5": "92dbf0a4c9239169010fc6e07859c82e",
+                                    "sha1": "634d8c12de82c422dfeba8f9a5fa84d03b7bcd35",
+                                    "sha256": "00fb2cf4420f0ffef519afe732a708cf249640121e2a891caa164313abd7f804"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791608655872,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\Actioncenter.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534790,
+                                "hash": {
+                                    "imphash": "f17020f0f66b64fbdf51c75b43f3729d",
+                                    "md5": "f568f7c08458d69e4fcd8675bbb107e4",
+                                    "sha1": "c1e05f0255a6f386711044b11e2d04dfd328b26a",
+                                    "sha256": "a5fa25ecf248999a68ccecfbb508bfa1add18a23e20a9a9081a87c41caaa36c0"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791723868160,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\dhcpcsvc.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257996,
+                                "hash": {
+                                    "imphash": "eb1c8dd21e1f92a8be35a76b165ce8da",
+                                    "md5": "52d3d5e3586988d4d9e34acaac33105c",
+                                    "sha1": "2c20246d2c45fb6e8976b37ad62465f5f4255f2b",
+                                    "sha256": "c61b60ba962b25b8334f0941c3535ea4aca1cc060b8a196e396ca3e11ceef8a1"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791746412544,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\credssp.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258110,
+                                "hash": {
+                                    "imphash": "9ba63732839305b29ebe539451171b45",
+                                    "md5": "8130391f82d52d36c0441f714136957f",
+                                    "sha1": "e2bb102565986a42d0a43bd3f337f94dbe54eead",
+                                    "sha256": "1fd4fee7caf63e450f27729e07ea2a2f09288629fd872dbb6e8710b16d8dbd5d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791608131584,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\imapi2.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258038,
+                                "hash": {
+                                    "imphash": "e070eff3751fea77ccd424469a9a07e6",
+                                    "md5": "6a5c1a8ac0b572679361026d0e900420",
+                                    "sha1": "fd9241fdda4b9d08ff1e205f9d5f78923ab884d8",
+                                    "sha256": "b5e693b48b462e97738a3d4e58b60846159649eb15f4d11074b4bc107cc88562"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791607345152,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\hgcpl.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535139,
+                                "hash": {
+                                    "imphash": "1e00eab90042e5099339cb82841b434a",
+                                    "md5": "f7073c962c4fb7c415565dde109de49f",
+                                    "sha1": "671c2e910ff954700b3a1f80608423697895c0a9",
+                                    "sha256": "781e7088dcefbc34a808c3e7da41a56112b3f23abe9f54b5ef4d5cd9cd016b1d"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791680090112,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\npmproxy.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258777,
+                                "hash": {
+                                    "imphash": "d402ebf00a5cffa66b6682780c262457",
+                                    "md5": "6b851e682a36453e1b1ee297ffb6e2ab",
+                                    "sha1": "3dc85ba13d1f720e8039865817bcc65dc0f1d35b",
+                                    "sha256": "a641d3fd9463c4788b45b8b5584ea4489c1f63a71b4b595ae85ff3482cd5eda6"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791606099968,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\QAgent.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534818,
+                                "hash": {
+                                    "imphash": "09bf801b36364c598a2a8fdff079932c",
+                                    "md5": "cd1b5ad07e5f7fef30e055dcc9e96180",
+                                    "sha1": "4e835fdadd0c67fde44e385f69a1014d6ad11f4f",
+                                    "sha256": "63c58551f32b0b09377f64a6ae1fa81af93b8a707a57a8c18722086906ad3046"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791745167360,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\DEVRTL.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258413,
+                                "hash": {
+                                    "imphash": "08a9b8e4e42e5520be662b4663289747",
+                                    "md5": "1eac1a8ca6874bf5b15e2efb9a9a7b86",
+                                    "sha1": "30cff16f17833aa042d8b6cc32d86c4a39c77c67",
+                                    "sha256": "e15ed4fefc3010c213694331ddfdc03767682325c898d773ab243e2dc8b08461"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791633100800,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\MsftEdit.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258939,
+                                "hash": {
+                                    "imphash": "6ac24d44010fe2db4d5e9e0651b7a3cf",
+                                    "md5": "f9959237f106f2b2609e61a290c0652e",
+                                    "sha1": "7f7c92c4fe8244a7deac7fed4d5576042bfba29e",
+                                    "sha256": "fccc12e5aae1773bf87b1c4bce71d017db1a5a7ac189559058ea1ecc72075a82"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791628709888,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\werconcpl.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535233,
+                                "hash": {
+                                    "imphash": "cce75846cdf9d74f85e44fc728ee8440",
+                                    "md5": "9689a9c7f7c2a1a423cda2c3b43fff65",
+                                    "sha1": "ebe6b3066634239a4f62780a8a6e27f33b0afc87",
+                                    "sha256": "914ad22d98975578bc14d821f72e8dfce24f2092f9c299d24ebbaf5408fe8b8b"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791646994432,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\wer.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290257998,
+                                "hash": {
+                                    "imphash": "6e52c6bdbfd3d257064382284bd4f59c",
+                                    "md5": "1484b9ebf567346582de571b0e164ae0",
+                                    "sha1": "6b87eb7005fe659f976732307fe12b96747dfc8d",
+                                    "sha256": "9862bf22b2e32dabe7a82acee5b4ea1f0a93bdc3c71b20a6a4e568cccd76a7a6"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791628382208,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\framedynos.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535235,
+                                "hash": {
+                                    "imphash": "64b92457c7762d63f903189058d583ca",
+                                    "md5": "7e591867422dc788b9e5bd337a669a08",
+                                    "sha1": "3bd1b2a2271d6756351d9b4876193efd8a845da0",
+                                    "sha256": "484e6bccdf7adce9a1aacad1bc7c7d7694b9e40fa90d94b14d80c607784f6c75"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791628251136,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\wercplsupport.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258497,
+                                "hash": {
+                                    "imphash": "2814c7c81c59e8a913c288a8c72a9c1c",
+                                    "md5": "5c29199c9f0ede64f17f268084ec4392",
+                                    "sha1": "a767e893427f9b24fe06cbb3a155dd54162a402a",
+                                    "sha256": "ea9fd588a8c89399dd287399a912b356a4234cfe418239b227d255749f5ddde2"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791652564992,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\msxml6.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:35"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534858,
+                                "hash": {
+                                    "imphash": "2ab209fb6a68c8e15483324a442c1c4c",
+                                    "md5": "809ae7d4ace06bbcf621e5c504bf6fc8",
+                                    "sha1": "c0e2202d99db67a9efa6c67226410ad3c7b657a6",
+                                    "sha256": "0baab89fb57468f27446947d75cbd6ddfc92d9b8f040144a12656803b2f7bf65"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791722491904,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\hcproviders.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:36"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258095,
+                                "hash": {
+                                    "imphash": "328b1cd6b239c7c01904019379bede4b",
+                                    "md5": "77a8a1791145710c7efe76ea82bf0763",
+                                    "sha1": "e421318d7b6d66c9214722c736f5b3d4207acf74",
+                                    "sha256": "9488b96e065299d273f9dcc82aa1203b48f0038d4f27324da19e9bfd925ca737"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791627726848,
+                                "mapped_size": 0,
+                                "path": "C:\\Program Files\\Internet Explorer\\ieproxy.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258892,
+                                "hash": {
+                                    "imphash": "ec50511b4e46da8b1a467667a84f8047",
+                                    "md5": "9cead32e79a62150fe9f8557e58e008b",
+                                    "sha1": "4cbd17b96209b5e2da683382e05cef55f48d6107",
+                                    "sha256": "afe4c1725ee94d7de0749ae1495a4e5cc33c369f29b2a589da66ffe27ff9777e"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791757357056,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SXS.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258896,
+                                "hash": {
+                                    "imphash": "d75a096a9c47b1fd385a268e9c6f2f68",
+                                    "md5": "24f4b480f335a6c724af352253c5d98b",
+                                    "sha1": "a388cc90338cec7b5eec66e921599de0cc275a2b",
+                                    "sha256": "011413b236cad7b78ce0a0eec3e3085d48c7576a3205d025ba6ebfdf590538e4"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791660232704,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\thumbcache.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247527581,
+                                "hash": {
+                                    "imphash": "be693a67b5b884d7609eaf574ba00955",
+                                    "md5": "d87e1e59c73c1f98d5ded5b3850c40f5",
+                                    "sha1": "141c0ebecdd2733b90431f18b188ee0b64456268",
+                                    "sha256": "536419bff9f877d4314b5d0c045d9a6e729489c389863fadf07e382050bc84fd"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 2009726976,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\PSAPI.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:36"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258093,
+                                "hash": {
+                                    "imphash": "39d5c5468a8e87803234025334b9dc09",
+                                    "md5": "f1115299b9f4c983bc4523b33e3a506c",
+                                    "sha1": "639946c23b630798284a92117882990ea31d702e",
+                                    "sha256": "01a1d8b3e5cf727f92f4a43d5c5f81022127d58a850d29d3f084ad411efbc9dd"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791578836992,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\ieframe.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535131,
+                                "hash": {
+                                    "imphash": "84786d42c8a896b9a971b3c9eb8feb4c",
+                                    "md5": "9869a4a10b90546dbd56947839fb4b87",
+                                    "sha1": "5d9642f314d62dc5834cbd7950230bad3f85d982",
+                                    "sha256": "66c84dcf39d9f6896d55b1623184a028891a0a98abe6044de1d4bad60c3c8d72"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791591157760,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\OLEACC.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258887,
+                                "hash": {
+                                    "imphash": "e6c083bfcedd032db2c66cd04f74c620",
+                                    "md5": "4e81439902079c348b61d7ff027fe147",
+                                    "sha1": "4386a5580b459aa4a0701addb753c3f9bf3da6f7",
+                                    "sha256": "e652c9ec77745504689532b3c394959f9b5bc29e9c008cb9ee09cda818514fa9"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791658594304,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\StructuredQuery.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258589,
+                                "hash": {
+                                    "imphash": "45badcf3f18f69f9f72af5245898d1cb",
+                                    "md5": "405f4d32d2185f1f1bd753d8eeaffb3a",
+                                    "sha1": "68bc45bac1e1584c789a6b3134bee5a2540f3e56",
+                                    "sha256": "cac42c3e09c43be96592b670d70821386014db22d8239a9cfb9e33e54fb5c3d5"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791656890368,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\NetworkExplorer.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258495,
+                                "hash": {
+                                    "imphash": "cdb39fb77293fb1bb86c2d5980ea8e88",
+                                    "md5": "022b05cee68d7826a93aedb4f1eb369e",
+                                    "sha1": "e7055d6cacb8c3fae06dc10ad480c8e6b8b7b592",
+                                    "sha256": "3b864d1471ed0949b02f1fa251b987185abeaddcbecd44efdbb6a7b7f03ca8bc"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791625760768,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\msxml3.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258914,
+                                "hash": {
+                                    "imphash": "6b6c83729fa36b04c301494d1eb07752",
+                                    "md5": "bb074f35b49eb2ea416962b596281e1e",
+                                    "sha1": "355fdb9e66ffad42144b1b6ec4d8eb357ed05d52",
+                                    "sha256": "e07208204b9616027e5144e2f3ef1ba81168365b7d2a761210b0fbc65b97871e"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791623598080,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\systemcpl.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258594,
+                                "hash": {
+                                    "imphash": "2bd8f9f72a13c2803ac3d34b805130b9",
+                                    "md5": "764908fe1fa96f93c95b1b67a0fced29",
+                                    "sha1": "88d0027e5d10158e3678d9eb2326779fef8a64d1",
+                                    "sha256": "26ef25ab307903c5e806a8cc3b750a491049e5d1225ceddfce64dd51aa6f592b"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791722557440,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\NETAPI32.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290259010,
+                                "hash": {
+                                    "imphash": "6ad99a405bde55d6a18debafd3f5e5c5",
+                                    "md5": "3c91392d448f6e5d525a85b7550d8ba9",
+                                    "sha1": "b62eaf7d80617e136a8f3c9161c23464e6f2a171",
+                                    "sha256": "6fd0dc73dbe7519e2c643554c2a7f8fbe4f9a678c4241bb54b3c6e65d2abcf3a"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791722295296,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\wkscli.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534877,
+                                "hash": {
+                                    "imphash": "3e340766bf7f54e3e9746a945d4dcb71",
+                                    "md5": "a77be7cb3222b4fb0ac6c71d1c2698d4",
+                                    "sha1": "e68b4e0058fb130c765e5aa98af36e26563809db",
+                                    "sha256": "73566223914bf670df6b5931fa213e546713531b10391ed65b5256bbd7abde7f"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791735926784,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\System32\\DSROLE.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258758,
+                                "hash": {
+                                    "imphash": "c888173aa662e52d4b6194ed15819a13",
+                                    "md5": "db76db15efc6e4d1153a6c5bc895948d",
+                                    "sha1": "00dc6172c4507def32e4a269c08e76ab09abc3fe",
+                                    "sha256": "71ddf02c7ee2df66a08f1a2a08da39802c354624880a2be93a706ea7476422a3"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791690641408,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\SPPC.DLL",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 07:10"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535243,
+                                "hash": {
+                                    "imphash": "9484a9d0a0e3ef20592c9f66412400a6",
+                                    "md5": "666a60f6f5e719856ff6254e0966eff7",
+                                    "sha1": "10258e708443bd21997e7a977b5ee36bd758e368",
+                                    "sha256": "58c072e7e215991e19c1ca062c476081982f7b9f039714539ae7feb4981c200f"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791716200448,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\wbem\\wbemprox.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 07:10"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258938,
+                                "hash": {
+                                    "imphash": "03a62984ba62616e18740e69949df533",
+                                    "md5": "7db5aa22a8a8e5c2d335f44853c1f6de",
+                                    "sha1": "add6f6e2b6df5f571d06db724de5c7badad4e775",
+                                    "sha256": "a734a20357026c42950394682a52cbc3af956d09f1949e1b4e95467e999bc428"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791690051584,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\wbemcomn.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 ca 69 00 00 00 00 00 08 ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535244,
+                                "hash": {
+                                    "imphash": "6178a249d43f815225b0a9205f1f4f70",
+                                    "md5": "718b6f51ab7f6fe2988a36868f9ad3ab",
+                                    "sha1": "7cc84a20d6597f58eebabea5489d72239c6e746b",
+                                    "sha256": "76141b4e94c2766e2c34cef523092948771a7893212efadbe88d2171b85ff012"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791683170304,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\wbem\\wbemsvc.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 04 b3 f5 00 00 00 00 00 0d ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 07:10"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247534846,
+                                "hash": {
+                                    "imphash": "c93ca8ec08e734d1b95c2a2d28884c47",
+                                    "md5": "a3f5e8ec1316c3e2562b82694a251c9e",
+                                    "sha1": "f0cdc2b44e609950ee97d9967c7459055a2af1a8",
+                                    "sha256": "f3dc6aa6a9d3b5bbc730668fc52c1d4bb5d515d404578bddd3d4869a7ed58822"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791688675328,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\wbem\\fastprox.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 01 c6 c1 00 00 00 00 00 07 ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "07/13/2009 19:17"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com/windows",
+                                    "program_name": "Windows System Catalog",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1247535150,
+                                "hash": {
+                                    "imphash": "29f9ce11d25836037034b49be93790c6",
+                                    "md5": "ee26d130808d16c0e417bbbed0451b34",
+                                    "sha1": "962d52fb4d8f9965c5fc11a98f2f9048a2a5d918",
+                                    "sha256": "4886dce4faef146a40babd492a8000a2022fea542a6135a9bafd4cd09297b4e5"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791688478720,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\NTDSAPI.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            },
+                            {
+                                "architecture": "x64",
+                                "authenticode": {
+                                    "cert_signer": {
+                                        "issuer_name": "Microsoft Windows Verification PCA",
+                                        "serial_number": "61 15 23 0f 00 00 00 00 00 0a ",
+                                        "subject_name": "Microsoft Windows"
+                                    },
+                                    "cert_timestamp": {
+                                        "issuer_name": "Microsoft Time-Stamp PCA",
+                                        "serial_number": "61 03 dc f6 00 00 00 00 00 0c ",
+                                        "subject_name": "Microsoft Time-Stamp Service",
+                                        "timestamp_string": "11/20/2010 11:37"
+                                    },
+                                    "more_info_link": "http://www.microsoft.com",
+                                    "program_name": "Microsoft Windows",
+                                    "publisher_link": ""
+                                },
+                                "compile_time": 1290258103,
+                                "hash": {
+                                    "imphash": "ba45ab39c8fb40e4076d27cf8e0f4180",
+                                    "md5": "b8509dcfcfd577f568be4026bfd982c0",
+                                    "sha1": "1923c5995faf94d9b1767aca04e3134a5cedc07a",
+                                    "sha256": "e3608e6de15c400fa437349e7295fef10a1a0213ca3b532a58964b8c89749110"
+                                },
+                                "malware_classification": {
+                                    "identifier": "Whitelisted",
+                                    "score": 0,
+                                    "threshold": 0,
+                                    "version": "3.0.0"
+                                },
+                                "mapped_address": 8791788355584,
+                                "mapped_size": 0,
+                                "path": "C:\\Windows\\system32\\imagehlp.dll",
+                                "signature_signer": "Microsoft Windows",
+                                "signature_status": "trusted"
+                            }
+                        ],
+                        "name": "explorer.exe",
+                        "parent": {
+                            "executable": "",
+                            "name": ""
+                        },
+                        "pid": 784,
+                        "ppid": 704,
+                        "sid": "S-1-5-21-2016385190-3414718578-1263322444-500",
+                        "signature_signer": "Microsoft Windows",
+                        "signature_status": "trusted",
+                        "start": 1542341500,
+                        "threads": [
+                            {
+                                "entrypoint": 4279023504,
+                                "id": 1920,
+                                "start": 1542341500,
+                                "uptime": 437
+                            },
+                            {
+                                "entrypoint": 2008002240,
+                                "id": 1812,
+                                "start": 1542341500,
+                                "uptime": 437
+                            },
+                            {
+                                "entrypoint": 8791783440744,
+                                "id": 2472,
+                                "start": 1542341500,
+                                "uptime": 436
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2468,
+                                "start": 1542341500,
+                                "uptime": 436
+                            },
+                            {
+                                "entrypoint": 8791790810108,
+                                "id": 2464,
+                                "start": 1542341500,
+                                "uptime": 436
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2476,
+                                "start": 1542341500,
+                                "uptime": 435
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 1800,
+                                "start": 1542341500,
+                                "uptime": 434
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 2516,
+                                "start": 1542341500,
+                                "uptime": 433
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2500,
+                                "start": 1542341500,
+                                "uptime": 433
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 1068,
+                                "start": 1542341500,
+                                "uptime": 432
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2676,
+                                "start": 1542341500,
+                                "uptime": 428
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2660,
+                                "start": 1542341500,
+                                "uptime": 428
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2748,
+                                "start": 1542341500,
+                                "uptime": 428
+                            },
+                            {
+                                "entrypoint": 8791729529348,
+                                "id": 2636,
+                                "start": 1542341500,
+                                "uptime": 428
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2732,
+                                "start": 1542341500,
+                                "uptime": 424
+                            },
+                            {
+                                "entrypoint": 8791783440744,
+                                "id": 1472,
+                                "start": 1542341500,
+                                "uptime": 419
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 2220,
+                                "start": 1542341500,
+                                "uptime": 415
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 2332,
+                                "start": 1542341800,
+                                "uptime": 104
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 3712,
+                                "start": 1542341800,
+                                "uptime": 99
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 2080,
+                                "start": 1542341800,
+                                "uptime": 85
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 4012,
+                                "start": 1542341800,
+                                "uptime": 81
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 4060,
+                                "start": 1542341800,
+                                "uptime": 81
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 520,
+                                "start": 1542341800,
+                                "uptime": 77
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 3236,
+                                "start": 1542341800,
+                                "uptime": 74
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 3260,
+                                "start": 1542341800,
+                                "uptime": 72
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 3680,
+                                "start": 1542341900,
+                                "uptime": 56
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 3708,
+                                "start": 1542341900,
+                                "uptime": 55
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 2512,
+                                "start": 1542341900,
+                                "uptime": 55
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 3748,
+                                "start": 1542341900,
+                                "uptime": 54
+                            },
+                            {
+                                "entrypoint": 8791690668104,
+                                "id": 3872,
+                                "start": 1542341900,
+                                "uptime": 51
+                            },
+                            {
+                                "entrypoint": 8791683305488,
+                                "id": 1016,
+                                "start": 1542341900,
+                                "uptime": 26
+                            },
+                            {
+                                "entrypoint": 2008021952,
+                                "id": 3520,
+                                "start": 1542341900,
+                                "uptime": 26
+                            },
+                            {
+                                "entrypoint": 8791792141832,
+                                "id": 3992,
+                                "start": 1542341900,
+                                "uptime": 13
+                            },
+                            {
+                                "entrypoint": 8791760904360,
+                                "id": 3604,
+                                "start": 1542341900,
+                                "uptime": 12
+                            }
+                        ],
+                        "token": {
+                            "domain": "WIN-Q3DOP1UKA81",
+                            "integrity_level": 12288,
+                            "integrity_level_name": "high",
+                            "privileges": [
+                                {
+                                    "description": "Adjust memory quotas for a process",
+                                    "enabled": false,
+                                    "name": "SeIncreaseQuotaPrivilege"
+                                },
+                                {
+                                    "description": "Manage auditing and security log",
+                                    "enabled": false,
+                                    "name": "SeSecurityPrivilege"
+                                },
+                                {
+                                    "description": "Take ownership of files or other objects",
+                                    "enabled": false,
+                                    "name": "SeTakeOwnershipPrivilege"
+                                },
+                                {
+                                    "description": "Load and unload device drivers",
+                                    "enabled": false,
+                                    "name": "SeLoadDriverPrivilege"
+                                },
+                                {
+                                    "description": "Profile system performance",
+                                    "enabled": false,
+                                    "name": "SeSystemProfilePrivilege"
+                                },
+                                {
+                                    "description": "Change the system time",
+                                    "enabled": false,
+                                    "name": "SeSystemtimePrivilege"
+                                },
+                                {
+                                    "description": "Profile single process",
+                                    "enabled": false,
+                                    "name": "SeProfileSingleProcessPrivilege"
+                                },
+                                {
+                                    "description": "Increase scheduling priority",
+                                    "enabled": false,
+                                    "name": "SeIncreaseBasePriorityPrivilege"
+                                },
+                                {
+                                    "description": "Create a pagefile",
+                                    "enabled": false,
+                                    "name": "SeCreatePagefilePrivilege"
+                                },
+                                {
+                                    "description": "Back up files and directories",
+                                    "enabled": false,
+                                    "name": "SeBackupPrivilege"
+                                },
+                                {
+                                    "description": "Restore files and directories",
+                                    "enabled": false,
+                                    "name": "SeRestorePrivilege"
+                                },
+                                {
+                                    "description": "Shut down the system",
+                                    "enabled": false,
+                                    "name": "SeShutdownPrivilege"
+                                },
+                                {
+                                    "description": "Debug programs",
+                                    "enabled": false,
+                                    "name": "SeDebugPrivilege"
+                                },
+                                {
+                                    "description": "Modify firmware environment values",
+                                    "enabled": false,
+                                    "name": "SeSystemEnvironmentPrivilege"
+                                },
+                                {
+                                    "description": "Bypass traverse checking",
+                                    "enabled": true,
+                                    "name": "SeChangeNotifyPrivilege"
+                                },
+                                {
+                                    "description": "Force shutdown from a remote system",
+                                    "enabled": false,
+                                    "name": "SeRemoteShutdownPrivilege"
+                                },
+                                {
+                                    "description": "Remove computer from docking station",
+                                    "enabled": false,
+                                    "name": "SeUndockPrivilege"
+                                },
+                                {
+                                    "description": "Perform volume maintenance tasks",
+                                    "enabled": false,
+                                    "name": "SeManageVolumePrivilege"
+                                },
+                                {
+                                    "description": "Impersonate a client after authentication",
+                                    "enabled": true,
+                                    "name": "SeImpersonatePrivilege"
+                                },
+                                {
+                                    "description": "Create global objects",
+                                    "enabled": true,
+                                    "name": "SeCreateGlobalPrivilege"
+                                },
+                                {
+                                    "description": "Increase a process working set",
+                                    "enabled": false,
+                                    "name": "SeIncreaseWorkingSetPrivilege"
+                                },
+                                {
+                                    "description": "Change the time zone",
+                                    "enabled": false,
+                                    "name": "SeTimeZonePrivilege"
+                                },
+                                {
+                                    "description": "Create symbolic links",
+                                    "enabled": false,
+                                    "name": "SeCreateSymbolicLinkPrivilege"
+                                }
+                            ],
+                            "sid": "S-1-5-21-2016385190-3414718578-1263322444-500",
+                            "type": "tokenPrimary",
+                            "user": "Administrator"
+                        },
+                        "unique_pid": 35,
+                        "unique_ppid": 0,
+                        "uptime": 437,
+                        "user": "Administrator"
+                    },
+                    "user": {
+                        "group": {}
+                    }
+                }
+            }
+        ],
+        "max_score": 1.0,
+        "total": {
+            "relation": "eq",
+            "value": 21
+        }
+    },
+    "timed_out": false,
+    "took": 2
+}
diff --git a/x-pack/plugins/endpoint/server/test_data/all_alerts_data_legacy.json b/x-pack/plugins/endpoint/server/test_data/all_alerts_data_legacy.json
new file mode 100644
index 0000000000000..3863baed387aa
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/test_data/all_alerts_data_legacy.json
@@ -0,0 +1,15 @@
+{
+    "_shards": {
+        "failed": 0,
+        "skipped": 0,
+        "successful": 1,
+        "total": 1
+    },
+    "hits": {
+        "hits": [],
+        "max_score": 1.0,
+        "total": 21
+    },
+    "timed_out": false,
+    "took": 2
+}
diff --git a/x-pack/plugins/endpoint/server/types.ts b/x-pack/plugins/endpoint/server/types.ts
index f06cc10f16709..a0c9cd4b90266 100644
--- a/x-pack/plugins/endpoint/server/types.ts
+++ b/x-pack/plugins/endpoint/server/types.ts
@@ -6,7 +6,25 @@
 import { LoggerFactory } from 'kibana/server';
 import { EndpointConfigType } from './config';
 
+/**
+ * A JSON-like structure.
+ */
+export interface JSONish {
+  [key: string]: number | string | null | undefined | JSONish | JSONish[];
+}
+
+/**
+ * The context for Endpoint apps.
+ */
 export interface EndpointAppContext {
   logFactory: LoggerFactory;
   config(): Promise<EndpointConfigType>;
 }
+
+/**
+ * Request params for alert queries.
+ */
+export interface AlertRequestParams {
+  page_index?: number;
+  page_size?: number;
+}
diff --git a/x-pack/legacy/plugins/lens/common/api.ts b/x-pack/plugins/lens/common/api.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/common/api.ts
rename to x-pack/plugins/lens/common/api.ts
diff --git a/x-pack/legacy/plugins/lens/common/constants.ts b/x-pack/plugins/lens/common/constants.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/common/constants.ts
rename to x-pack/plugins/lens/common/constants.ts
diff --git a/x-pack/legacy/plugins/lens/common/index.ts b/x-pack/plugins/lens/common/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/common/index.ts
rename to x-pack/plugins/lens/common/index.ts
diff --git a/x-pack/legacy/plugins/lens/common/types.ts b/x-pack/plugins/lens/common/types.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/common/types.ts
rename to x-pack/plugins/lens/common/types.ts
diff --git a/x-pack/plugins/lens/kibana.json b/x-pack/plugins/lens/kibana.json
new file mode 100644
index 0000000000000..867a7454f0448
--- /dev/null
+++ b/x-pack/plugins/lens/kibana.json
@@ -0,0 +1,8 @@
+{
+  "id": "lens",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": false,
+  "optionalPlugins": ["usageCollection", "taskManager"]
+}
diff --git a/x-pack/plugins/lens/server/index.ts b/x-pack/plugins/lens/server/index.ts
new file mode 100644
index 0000000000000..3b9e94986d247
--- /dev/null
+++ b/x-pack/plugins/lens/server/index.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializerContext } from 'kibana/server';
+import { LensServerPlugin } from './plugin';
+
+export * from './plugin';
+
+export const plugin = (initializerContext: PluginInitializerContext) =>
+  new LensServerPlugin(initializerContext);
diff --git a/x-pack/plugins/lens/server/plugin.tsx b/x-pack/plugins/lens/server/plugin.tsx
new file mode 100644
index 0000000000000..e805f9f7e0a92
--- /dev/null
+++ b/x-pack/plugins/lens/server/plugin.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin, CoreSetup, CoreStart, PluginInitializerContext, Logger } from 'src/core/server';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { Observable } from 'rxjs';
+import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
+import { setupRoutes } from './routes';
+import {
+  registerLensUsageCollector,
+  initializeLensTelemetry,
+  scheduleLensTelemetry,
+} from './usage';
+
+export interface PluginSetupContract {
+  usageCollection?: UsageCollectionSetup;
+  taskManager?: TaskManagerSetupContract;
+}
+
+export interface PluginStartContract {
+  taskManager?: TaskManagerStartContract;
+}
+
+export class LensServerPlugin implements Plugin<{}, {}, {}, {}> {
+  private readonly kibanaIndexConfig: Observable<{ kibana: { index: string } }>;
+  private readonly telemetryLogger: Logger;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.kibanaIndexConfig = initializerContext.config.legacy.globalConfig$;
+    this.telemetryLogger = initializerContext.logger.get('telemetry');
+  }
+  setup(core: CoreSetup<PluginStartContract>, plugins: PluginSetupContract) {
+    setupRoutes(core);
+    if (plugins.usageCollection && plugins.taskManager) {
+      registerLensUsageCollector(
+        plugins.usageCollection,
+        core
+          .getStartServices()
+          .then(([_, { taskManager }]) => taskManager as TaskManagerStartContract)
+      );
+      initializeLensTelemetry(
+        this.telemetryLogger,
+        core,
+        this.kibanaIndexConfig,
+        plugins.taskManager
+      );
+    }
+    return {};
+  }
+
+  start(core: CoreStart, plugins: PluginStartContract) {
+    if (plugins.taskManager) {
+      scheduleLensTelemetry(this.telemetryLogger, plugins.taskManager);
+    }
+    return {};
+  }
+
+  stop() {}
+}
diff --git a/x-pack/legacy/plugins/lens/server/routes/existing_fields.test.ts b/x-pack/plugins/lens/server/routes/existing_fields.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/server/routes/existing_fields.test.ts
rename to x-pack/plugins/lens/server/routes/existing_fields.test.ts
diff --git a/x-pack/legacy/plugins/lens/server/routes/existing_fields.ts b/x-pack/plugins/lens/server/routes/existing_fields.ts
similarity index 98%
rename from x-pack/legacy/plugins/lens/server/routes/existing_fields.ts
rename to x-pack/plugins/lens/server/routes/existing_fields.ts
index 30ded3572cae7..a059e32585909 100644
--- a/x-pack/legacy/plugins/lens/server/routes/existing_fields.ts
+++ b/x-pack/plugins/lens/server/routes/existing_fields.ts
@@ -6,11 +6,10 @@
 
 import Boom from 'boom';
 import { schema } from '@kbn/config-schema';
-import _ from 'lodash';
 import { IScopedClusterClient, SavedObject, RequestHandlerContext } from 'src/core/server';
 import { CoreSetup } from 'src/core/server';
 import { BASE_API_URL } from '../../common';
-import { IndexPatternsFetcher } from '../../../../../../src/plugins/data/server';
+import { IndexPatternsFetcher } from '../../../../../src/plugins/data/server';
 
 /**
  * The number of docs to sample to determine field empty status.
diff --git a/x-pack/legacy/plugins/lens/server/routes/field_stats.ts b/x-pack/plugins/lens/server/routes/field_stats.ts
similarity index 97%
rename from x-pack/legacy/plugins/lens/server/routes/field_stats.ts
rename to x-pack/plugins/lens/server/routes/field_stats.ts
index ceefb492cdabe..786aba5efe3fb 100644
--- a/x-pack/legacy/plugins/lens/server/routes/field_stats.ts
+++ b/x-pack/plugins/lens/server/routes/field_stats.ts
@@ -27,7 +27,7 @@ export async function initFieldsRoute(setup: CoreSetup) {
             dslQuery: schema.object({}, { allowUnknowns: true }),
             fromDate: schema.string(),
             toDate: schema.string(),
-            timeFieldName: schema.string(),
+            timeFieldName: schema.maybe(schema.string()),
             field: schema.object(
               {
                 name: schema.string(),
@@ -46,9 +46,8 @@ export async function initFieldsRoute(setup: CoreSetup) {
       const { fromDate, toDate, timeFieldName, field, dslQuery } = req.body;
 
       try {
-        const query = {
-          bool: {
-            filter: [
+        const filter = timeFieldName
+          ? [
               {
                 range: {
                   [timeFieldName]: {
@@ -58,7 +57,12 @@ export async function initFieldsRoute(setup: CoreSetup) {
                 },
               },
               dslQuery,
-            ],
+            ]
+          : [dslQuery];
+
+        const query = {
+          bool: {
+            filter,
           },
         };
 
diff --git a/x-pack/legacy/plugins/lens/server/routes/index.ts b/x-pack/plugins/lens/server/routes/index.ts
similarity index 59%
rename from x-pack/legacy/plugins/lens/server/routes/index.ts
rename to x-pack/plugins/lens/server/routes/index.ts
index 79690b40395d6..8bc04a56e16d5 100644
--- a/x-pack/legacy/plugins/lens/server/routes/index.ts
+++ b/x-pack/plugins/lens/server/routes/index.ts
@@ -4,20 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaConfig } from 'src/legacy/server/kbn_server';
-import { CoreSetup, SavedObjectsLegacyService } from 'src/core/server';
+import { CoreSetup } from 'src/core/server';
 import { existingFieldsRoute } from './existing_fields';
 import { initFieldsRoute } from './field_stats';
 import { initLensUsageRoute } from './telemetry';
 
-export function setupRoutes(
-  setup: CoreSetup,
-  plugins: {
-    savedObjects: SavedObjectsLegacyService;
-    config: KibanaConfig;
-  }
-) {
+export function setupRoutes(setup: CoreSetup) {
   existingFieldsRoute(setup);
   initFieldsRoute(setup);
-  initLensUsageRoute(setup, plugins);
+  initLensUsageRoute(setup);
 }
diff --git a/x-pack/legacy/plugins/lens/server/routes/telemetry.ts b/x-pack/plugins/lens/server/routes/telemetry.ts
similarity index 75%
rename from x-pack/legacy/plugins/lens/server/routes/telemetry.ts
rename to x-pack/plugins/lens/server/routes/telemetry.ts
index 895b77cfa8978..7925416ff5df2 100644
--- a/x-pack/legacy/plugins/lens/server/routes/telemetry.ts
+++ b/x-pack/plugins/lens/server/routes/telemetry.ts
@@ -5,29 +5,13 @@
  */
 
 import Boom from 'boom';
-import { KibanaConfig } from 'src/legacy/server/kbn_server';
-import { CoreSetup, SavedObjectsLegacyService } from 'src/core/server';
+import { CoreSetup } from 'src/core/server';
 import { schema } from '@kbn/config-schema';
 import { BASE_API_URL } from '../../common';
 
-export function getSavedObjectsClient(
-  savedObjects: SavedObjectsLegacyService,
-  callAsInternalUser: unknown
-) {
-  const { SavedObjectsClient, getSavedObjectsRepository } = savedObjects;
-  const internalRepository = getSavedObjectsRepository(callAsInternalUser);
-  return new SavedObjectsClient(internalRepository);
-}
-
 // This route is responsible for taking a batch of click events from the browser
 // and writing them to saved objects
-export async function initLensUsageRoute(
-  setup: CoreSetup,
-  plugins: {
-    savedObjects: SavedObjectsLegacyService;
-    config: KibanaConfig;
-  }
-) {
+export async function initLensUsageRoute(setup: CoreSetup) {
   const router = setup.http.createRouter();
   router.post(
     {
@@ -43,12 +27,10 @@ export async function initLensUsageRoute(
       },
     },
     async (context, req, res) => {
-      const { dataClient } = context.core.elasticsearch;
-
       const { events, suggestionEvents } = req.body;
 
       try {
-        const client = getSavedObjectsClient(plugins.savedObjects, dataClient.callAsCurrentUser);
+        const client = context.core.savedObjects.client;
 
         const allEvents: Array<{
           type: 'lens-ui-telemetry';
diff --git a/x-pack/legacy/plugins/lens/server/usage/collectors.ts b/x-pack/plugins/lens/server/usage/collectors.ts
similarity index 97%
rename from x-pack/legacy/plugins/lens/server/usage/collectors.ts
rename to x-pack/plugins/lens/server/usage/collectors.ts
index 666b3718d5125..52de0df6fed13 100644
--- a/x-pack/legacy/plugins/lens/server/usage/collectors.ts
+++ b/x-pack/plugins/lens/server/usage/collectors.ts
@@ -7,7 +7,7 @@
 import moment from 'moment';
 import { get } from 'lodash';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { TaskManagerStartContract } from '../../../../../plugins/task_manager/server';
+import { TaskManagerStartContract } from '../../../task_manager/server';
 
 import { LensUsage, LensTelemetryState } from './types';
 
diff --git a/x-pack/legacy/plugins/lens/server/usage/index.ts b/x-pack/plugins/lens/server/usage/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/server/usage/index.ts
rename to x-pack/plugins/lens/server/usage/index.ts
diff --git a/x-pack/legacy/plugins/lens/server/usage/task.ts b/x-pack/plugins/lens/server/usage/task.ts
similarity index 62%
rename from x-pack/legacy/plugins/lens/server/usage/task.ts
rename to x-pack/plugins/lens/server/usage/task.ts
index 26b44832feaa6..e2462be149745 100644
--- a/x-pack/legacy/plugins/lens/server/usage/task.ts
+++ b/x-pack/plugins/lens/server/usage/task.ts
@@ -4,24 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { APICaller, CoreSetup, Logger } from 'kibana/server';
+import { Observable } from 'rxjs';
 import moment from 'moment';
-import KbnServer, { Server } from 'src/legacy/server/kbn_server';
-import { CallClusterOptions } from 'src/legacy/core_plugins/elasticsearch';
-import {
-  SearchParams,
-  DeleteDocumentByQueryParams,
-  SearchResponse,
-  DeleteDocumentByQueryResponse,
-} from 'elasticsearch';
-import { ESSearchResponse } from '../../../apm/typings/elasticsearch';
-import { XPackMainPlugin } from '../../../xpack_main/server/xpack_main';
 import {
   RunContext,
   TaskManagerSetupContract,
   TaskManagerStartContract,
-} from '../../../../../plugins/task_manager/server';
+} from '../../../task_manager/server';
 
 import { getVisualizationCounts } from './visualization_counts';
+import { ESSearchResponse } from '../../../apm/typings/elasticsearch';
 
 // This task is responsible for running daily and aggregating all the Lens click event objects
 // into daily rolled-up documents, which will be used in reporting click stats
@@ -30,74 +23,53 @@ const TELEMETRY_TASK_TYPE = 'lens_telemetry';
 
 export const TASK_ID = `Lens-${TELEMETRY_TASK_TYPE}`;
 
-type ClusterSearchType = (
-  endpoint: 'search',
-  params: SearchParams & {
-    rest_total_hits_as_int: boolean;
-  },
-  options?: CallClusterOptions
-) => Promise<SearchResponse<unknown>>;
-type ClusterDeleteType = (
-  endpoint: 'deleteByQuery',
-  params: DeleteDocumentByQueryParams,
-  options?: CallClusterOptions
-) => Promise<DeleteDocumentByQueryResponse>;
-
-export function initializeLensTelemetry(server: Server, taskManager?: TaskManagerSetupContract) {
-  if (!taskManager) {
-    server.log(['debug', 'telemetry'], `Task manager is not available`);
-  } else {
-    registerLensTelemetryTask(server, taskManager);
-  }
+export function initializeLensTelemetry(
+  logger: Logger,
+  core: CoreSetup,
+  config: Observable<{ kibana: { index: string } }>,
+  taskManager: TaskManagerSetupContract
+) {
+  registerLensTelemetryTask(logger, core, config, taskManager);
 }
 
-export function scheduleLensTelemetry(server: Server, taskManager?: TaskManagerStartContract) {
+export function scheduleLensTelemetry(logger: Logger, taskManager?: TaskManagerStartContract) {
   if (taskManager) {
-    scheduleTasks(server, taskManager);
+    scheduleTasks(logger, taskManager);
   }
 }
 
-function registerLensTelemetryTask(server: Server, taskManager: TaskManagerSetupContract) {
+function registerLensTelemetryTask(
+  logger: Logger,
+  core: CoreSetup,
+  config: Observable<{ kibana: { index: string } }>,
+  taskManager: TaskManagerSetupContract
+) {
   taskManager.registerTaskDefinitions({
     [TELEMETRY_TASK_TYPE]: {
       title: 'Lens telemetry fetch task',
       type: TELEMETRY_TASK_TYPE,
       timeout: '1m',
-      createTaskRunner: telemetryTaskRunner(server),
+      createTaskRunner: telemetryTaskRunner(logger, core, config),
     },
   });
 }
 
-function scheduleTasks(server: Server, taskManager: TaskManagerStartContract) {
-  const { kbnServer } = (server.plugins.xpack_main as XPackMainPlugin & {
-    status: { plugin: { kbnServer: KbnServer } };
-  }).status.plugin;
-
-  kbnServer.afterPluginsInit(() => {
-    // The code block below can't await directly within "afterPluginsInit"
-    // callback due to circular dependency The server isn't "ready" until
-    // this code block finishes. Migrations wait for server to be ready before
-    // executing. Saved objects repository waits for migrations to finish before
-    // finishing the request. To avoid this, we'll await within a separate
-    // function block.
-    (async () => {
-      try {
-        await taskManager.ensureScheduled({
-          id: TASK_ID,
-          taskType: TELEMETRY_TASK_TYPE,
-          state: { byDate: {}, suggestionsByDate: {}, saved: {}, runs: 0 },
-          params: {},
-        });
-      } catch (e) {
-        server.log(['debug', 'telemetry'], `Error scheduling task, received ${e.message}`);
-      }
-    })();
-  });
+async function scheduleTasks(logger: Logger, taskManager: TaskManagerStartContract) {
+  try {
+    await taskManager.ensureScheduled({
+      id: TASK_ID,
+      taskType: TELEMETRY_TASK_TYPE,
+      state: { byDate: {}, suggestionsByDate: {}, saved: {}, runs: 0 },
+      params: {},
+    });
+  } catch (e) {
+    logger.debug(`Error scheduling task, received ${e.message}`);
+  }
 }
 
 export async function getDailyEvents(
   kibanaIndex: string,
-  callCluster: ClusterSearchType & ClusterDeleteType
+  callCluster: APICaller
 ): Promise<{
   byDate: Record<string, Record<string, number>>;
   suggestionsByDate: Record<string, Record<string, number>>;
@@ -205,18 +177,22 @@ export async function getDailyEvents(
   };
 }
 
-export function telemetryTaskRunner(server: Server) {
+export function telemetryTaskRunner(
+  logger: Logger,
+  core: CoreSetup,
+  config: Observable<{ kibana: { index: string } }>
+) {
   return ({ taskInstance }: RunContext) => {
     const { state } = taskInstance;
-    const callCluster = server.plugins.elasticsearch.getCluster('admin').callWithInternalUser;
+    const callCluster = core.elasticsearch.adminClient.callAsInternalUser;
 
     return {
       async run() {
-        const kibanaIndex = server.config().get<string>('kibana.index');
+        const kibanaIndex = (await config.toPromise()).kibana.index;
 
         return Promise.all([
           getDailyEvents(kibanaIndex, callCluster),
-          getVisualizationCounts(callCluster, server.config()),
+          getVisualizationCounts(callCluster, kibanaIndex),
         ])
           .then(([lensTelemetry, lensVisualizations]) => {
             return {
@@ -229,9 +205,7 @@ export function telemetryTaskRunner(server: Server) {
               runAt: getNextMidnight(),
             };
           })
-          .catch(errMsg =>
-            server.log(['warning'], `Error executing lens telemetry task: ${errMsg}`)
-          );
+          .catch(errMsg => logger.warn(`Error executing lens telemetry task: ${errMsg}`));
       },
     };
   };
diff --git a/x-pack/legacy/plugins/lens/server/usage/types.ts b/x-pack/plugins/lens/server/usage/types.ts
similarity index 100%
rename from x-pack/legacy/plugins/lens/server/usage/types.ts
rename to x-pack/plugins/lens/server/usage/types.ts
diff --git a/x-pack/legacy/plugins/lens/server/usage/visualization_counts.ts b/x-pack/plugins/lens/server/usage/visualization_counts.ts
similarity index 85%
rename from x-pack/legacy/plugins/lens/server/usage/visualization_counts.ts
rename to x-pack/plugins/lens/server/usage/visualization_counts.ts
index 7c1dc5fca6d85..00b84fe100224 100644
--- a/x-pack/legacy/plugins/lens/server/usage/visualization_counts.ts
+++ b/x-pack/plugins/lens/server/usage/visualization_counts.ts
@@ -4,22 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { KibanaConfig } from 'src/legacy/server/kbn_server';
-import { CallClusterOptions } from 'src/legacy/core_plugins/elasticsearch';
-import { SearchParams, SearchResponse } from 'elasticsearch';
+import { APICaller } from 'kibana/server';
 import { LensVisualizationUsage } from './types';
 
-type ClusterSearchType = (
-  endpoint: 'search',
-  params: SearchParams & {
-    rest_total_hits_as_int: boolean;
-  },
-  options?: CallClusterOptions
-) => Promise<SearchResponse<unknown>>;
-
 export async function getVisualizationCounts(
-  callCluster: ClusterSearchType,
-  config: KibanaConfig
+  callCluster: APICaller,
+  kibanaIndex: string
 ): Promise<LensVisualizationUsage> {
   const scriptedMetric = {
     scripted_metric: {
@@ -53,7 +43,7 @@ export async function getVisualizationCounts(
   };
 
   const results = await callCluster('search', {
-    index: config.get('kibana.index'),
+    index: kibanaIndex,
     rest_total_hits_as_int: true,
     body: {
       query: {
diff --git a/x-pack/legacy/plugins/oss_telemetry/constants.ts b/x-pack/plugins/oss_telemetry/constants.ts
similarity index 100%
rename from x-pack/legacy/plugins/oss_telemetry/constants.ts
rename to x-pack/plugins/oss_telemetry/constants.ts
diff --git a/x-pack/plugins/oss_telemetry/kibana.json b/x-pack/plugins/oss_telemetry/kibana.json
new file mode 100644
index 0000000000000..d83894f7c44a3
--- /dev/null
+++ b/x-pack/plugins/oss_telemetry/kibana.json
@@ -0,0 +1,8 @@
+{
+  "id": "ossTelemetry",
+  "server": true,
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "requiredPlugins": ["usageCollection", "taskManager"],
+  "ui": false
+}
diff --git a/x-pack/plugins/oss_telemetry/server/index.ts b/x-pack/plugins/oss_telemetry/server/index.ts
new file mode 100644
index 0000000000000..64527ca6daa7e
--- /dev/null
+++ b/x-pack/plugins/oss_telemetry/server/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializerContext } from 'src/core/server';
+import { OssTelemetryPlugin } from './plugin';
+
+export const plugin = (context: PluginInitializerContext) => new OssTelemetryPlugin(context);
+
+export * from './plugin';
diff --git a/x-pack/plugins/oss_telemetry/server/lib/collectors/index.ts b/x-pack/plugins/oss_telemetry/server/lib/collectors/index.ts
new file mode 100644
index 0000000000000..845e11b80af0e
--- /dev/null
+++ b/x-pack/plugins/oss_telemetry/server/lib/collectors/index.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { registerVisualizationsCollector } from './visualizations/register_usage_collector';
+import { UsageCollectionSetup } from '../../../../../../src/plugins/usage_collection/server';
+import { TaskManagerStartContract } from '../../../../task_manager/server';
+
+export function registerCollectors(
+  usageCollection: UsageCollectionSetup,
+  taskManager: Promise<TaskManagerStartContract>
+) {
+  registerVisualizationsCollector(usageCollection, taskManager);
+}
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
similarity index 63%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
rename to x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
index ce106d1a64fd6..43114787b40e5 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
@@ -8,13 +8,15 @@ import {
   getMockTaskFetch,
   getMockThrowingTaskFetch,
   getMockTaskInstance,
-} from '../../../../test_utils';
-import { taskManagerMock } from '../../../../../../../plugins/task_manager/server/task_manager.mock';
+} from '../../../test_utils';
+import { taskManagerMock } from '../../../../../task_manager/server/task_manager.mock';
 import { getUsageCollector } from './get_usage_collector';
 
 describe('getVisualizationsCollector#fetch', () => {
   test('can return empty stats', async () => {
-    const { type, fetch } = getUsageCollector(taskManagerMock.start(getMockTaskFetch()));
+    const { type, fetch } = getUsageCollector(
+      Promise.resolve(taskManagerMock.start(getMockTaskFetch()))
+    );
     expect(type).toBe('visualization_types');
     const fetchResult = await fetch();
     expect(fetchResult).toEqual({});
@@ -22,17 +24,19 @@ describe('getVisualizationsCollector#fetch', () => {
 
   test('provides known stats', async () => {
     const { type, fetch } = getUsageCollector(
-      taskManagerMock.start(
-        getMockTaskFetch([
-          getMockTaskInstance({
-            state: {
-              runs: 1,
-              stats: { comic_books: { total: 16, max: 12, min: 2, avg: 6 } },
-            },
-            taskType: 'test',
-            params: {},
-          }),
-        ])
+      Promise.resolve(
+        taskManagerMock.start(
+          getMockTaskFetch([
+            getMockTaskInstance({
+              state: {
+                runs: 1,
+                stats: { comic_books: { total: 16, max: 12, min: 2, avg: 6 } },
+              },
+              taskType: 'test',
+              params: {},
+            }),
+          ])
+        )
       )
     );
     expect(type).toBe('visualization_types');
@@ -43,9 +47,11 @@ describe('getVisualizationsCollector#fetch', () => {
   describe('Error handling', () => {
     test('Silently handles Task Manager NotInitialized', async () => {
       const { fetch } = getUsageCollector(
-        taskManagerMock.start(
-          getMockThrowingTaskFetch(
-            new Error('NotInitialized taskManager is still waiting for plugins to load')
+        Promise.resolve(
+          taskManagerMock.start(
+            getMockThrowingTaskFetch(
+              new Error('NotInitialized taskManager is still waiting for plugins to load')
+            )
           )
         )
       );
@@ -55,7 +61,7 @@ describe('getVisualizationsCollector#fetch', () => {
     // In real life, the CollectorSet calls fetch and handles errors
     test('defers the errors', async () => {
       const { fetch } = getUsageCollector(
-        taskManagerMock.start(getMockThrowingTaskFetch(new Error('BOOM')))
+        Promise.resolve(taskManagerMock.start(getMockThrowingTaskFetch(new Error('BOOM'))))
       );
       await expect(fetch()).rejects.toThrowErrorMatchingInlineSnapshot(`"BOOM"`);
     });
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
similarity index 58%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
rename to x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
index bc0d10860a667..9828dea4c9393 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
@@ -6,18 +6,9 @@
 
 import { get } from 'lodash';
 import { PLUGIN_ID, VIS_TELEMETRY_TASK, VIS_USAGE_TYPE } from '../../../../constants';
-import { TaskManagerStartContract } from '../../../../../../../plugins/task_manager/server';
-
-async function isTaskManagerReady(taskManager?: TaskManagerStartContract) {
-  const result = await fetch(taskManager);
-  return result !== null;
-}
-
-async function fetch(taskManager?: TaskManagerStartContract) {
-  if (!taskManager) {
-    return null;
-  }
+import { TaskManagerStartContract } from '../../../../../task_manager/server';
 
+async function fetch(taskManager: TaskManagerStartContract) {
   let docs;
   try {
     ({ docs } = await taskManager.fetch({
@@ -38,27 +29,12 @@ async function fetch(taskManager?: TaskManagerStartContract) {
   return docs;
 }
 
-export function getUsageCollector(taskManager?: TaskManagerStartContract) {
-  let isCollectorReady = false;
-  async function determineIfTaskManagerIsReady() {
-    let isReady = false;
-    try {
-      isReady = await isTaskManagerReady(taskManager);
-    } catch (err) {} // eslint-disable-line
-
-    if (isReady) {
-      isCollectorReady = true;
-    } else {
-      setTimeout(determineIfTaskManagerIsReady, 500);
-    }
-  }
-  determineIfTaskManagerIsReady();
-
+export function getUsageCollector(taskManager: Promise<TaskManagerStartContract>) {
   return {
     type: VIS_USAGE_TYPE,
-    isReady: () => isCollectorReady,
+    isReady: () => true,
     fetch: async () => {
-      const docs = await fetch(taskManager);
+      const docs = await fetch(await taskManager);
       // get the accumulated state from the recurring task
       return get(docs, '[0].state.stats');
     },
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
similarity index 81%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
rename to x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
index 657f1c725f4e0..667e8b9b875fd 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
@@ -5,12 +5,12 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { TaskManagerStartContract } from '../../../../../../../plugins/task_manager/server';
+import { TaskManagerStartContract } from '../../../../../task_manager/server';
 import { getUsageCollector } from './get_usage_collector';
 
 export function registerVisualizationsCollector(
   collectorSet: UsageCollectionSetup,
-  taskManager?: TaskManagerStartContract
+  taskManager: Promise<TaskManagerStartContract>
 ): void {
   const collector = collectorSet.makeUsageCollector(getUsageCollector(taskManager));
   collectorSet.registerCollector(collector);
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/get_next_midnight.test.ts b/x-pack/plugins/oss_telemetry/server/lib/get_next_midnight.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/get_next_midnight.test.ts
rename to x-pack/plugins/oss_telemetry/server/lib/get_next_midnight.test.ts
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/get_next_midnight.ts b/x-pack/plugins/oss_telemetry/server/lib/get_next_midnight.ts
similarity index 100%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/get_next_midnight.ts
rename to x-pack/plugins/oss_telemetry/server/lib/get_next_midnight.ts
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts b/x-pack/plugins/oss_telemetry/server/lib/tasks/index.ts
similarity index 54%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts
rename to x-pack/plugins/oss_telemetry/server/lib/tasks/index.ts
index cf7295f67a231..be08338807dd0 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/tasks/index.ts
@@ -4,16 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Observable } from 'rxjs';
 import { CoreSetup, Logger } from 'kibana/server';
 import { PLUGIN_ID, VIS_TELEMETRY_TASK } from '../../../constants';
 import { visualizationsTaskRunner } from './visualizations/task_runner';
-import KbnServer from '../../../../../../../src/legacy/server/kbn_server';
-import { LegacyConfig } from '../../plugin';
 import {
   TaskInstance,
   TaskManagerStartContract,
   TaskManagerSetupContract,
-} from '../../../../../../plugins/task_manager/server';
+} from '../../../../task_manager/server';
 
 export function registerTasks({
   taskManager,
@@ -24,7 +23,7 @@ export function registerTasks({
   taskManager?: TaskManagerSetupContract;
   logger: Logger;
   elasticsearch: CoreSetup['elasticsearch'];
-  config: LegacyConfig;
+  config: Observable<{ kibana: { index: string } }>;
 }) {
   if (!taskManager) {
     logger.debug('Task manager is not available');
@@ -44,13 +43,11 @@ export function registerTasks({
   });
 }
 
-export function scheduleTasks({
+export async function scheduleTasks({
   taskManager,
-  xpackMainStatus,
   logger,
 }: {
   taskManager?: TaskManagerStartContract;
-  xpackMainStatus: { kbnServer: KbnServer };
   logger: Logger;
 }) {
   if (!taskManager) {
@@ -58,26 +55,14 @@ export function scheduleTasks({
     return;
   }
 
-  const { kbnServer } = xpackMainStatus;
-
-  kbnServer.afterPluginsInit(() => {
-    // The code block below can't await directly within "afterPluginsInit"
-    // callback due to circular dependency. The server isn't "ready" until
-    // this code block finishes. Migrations wait for server to be ready before
-    // executing. Saved objects repository waits for migrations to finish before
-    // finishing the request. To avoid this, we'll await within a separate
-    // function block.
-    (async () => {
-      try {
-        await taskManager.ensureScheduled({
-          id: `${PLUGIN_ID}-${VIS_TELEMETRY_TASK}`,
-          taskType: VIS_TELEMETRY_TASK,
-          state: { stats: {}, runs: 0 },
-          params: {},
-        });
-      } catch (e) {
-        logger.debug(`Error scheduling task, received ${e.message}`);
-      }
-    })();
-  });
+  try {
+    await taskManager.ensureScheduled({
+      id: `${PLUGIN_ID}-${VIS_TELEMETRY_TASK}`,
+      taskType: VIS_TELEMETRY_TASK,
+      state: { stats: {}, runs: 0 },
+      params: {},
+    });
+  } catch (e) {
+    logger.debug(`Error scheduling task, received ${e.message}`);
+  }
 }
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts b/x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
similarity index 97%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
rename to x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
index ef03e857de8ef..dff5e24db3c6e 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
@@ -10,9 +10,9 @@ import {
   getMockConfig,
   getMockEs,
   getMockTaskInstance,
-} from '../../../../test_utils';
+} from '../../../test_utils';
 import { visualizationsTaskRunner } from './task_runner';
-import { TaskInstance } from '../../../../../../../plugins/task_manager/server';
+import { TaskInstance } from '../../../../../task_manager/server';
 
 describe('visualizationsTaskRunner', () => {
   let mockTaskInstance: TaskInstance;
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts b/x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
similarity index 86%
rename from x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
rename to x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
index 0b7b301df12bf..556dc465e562d 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
+++ b/x-pack/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
@@ -4,13 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { Observable } from 'rxjs';
 import _, { countBy, groupBy, mapValues } from 'lodash';
 import { APICaller, CoreSetup } from 'kibana/server';
 import { getNextMidnight } from '../../get_next_midnight';
-import { VisState } from '../../../../../../../../src/legacy/core_plugins/visualizations/public';
-import { TaskInstance } from '../../../../../../../plugins/task_manager/server';
+import { TaskInstance } from '../../../../../task_manager/server';
 import { ESSearchHit } from '../../../../../apm/typings/elasticsearch';
-import { LegacyConfig } from '../../../plugin';
 
 interface VisSummary {
   type: string;
@@ -44,7 +43,7 @@ async function getStats(callCluster: APICaller, index: string) {
       const spacePhrases: string[] = hit._id.split(':');
       const space = spacePhrases.length === 3 ? spacePhrases[0] : 'default'; // if in a custom space, the format of a saved object ID is space:type:id
       const visualization = _.get(hit, '_source.visualization', { visState: '{}' });
-      const visState: VisState = JSON.parse(visualization.visState);
+      const visState: { type?: string } = JSON.parse(visualization.visState);
 
       return {
         type: visState.type || '_na_',
@@ -73,17 +72,17 @@ async function getStats(callCluster: APICaller, index: string) {
 
 export function visualizationsTaskRunner(
   taskInstance: TaskInstance,
-  config: LegacyConfig,
+  config: Observable<{ kibana: { index: string } }>,
   es: CoreSetup['elasticsearch']
 ) {
   const { callAsInternalUser: callCluster } = es.createClient('data');
-  const index = config.get('kibana.index').toString(); // cast to string for TypeScript
 
   return async () => {
     let stats;
     let error;
 
     try {
+      const index = (await config.toPromise()).kibana.index;
       stats = await getStats(callCluster, index);
     } catch (err) {
       if (err.constructor === Error) {
diff --git a/x-pack/plugins/oss_telemetry/server/plugin.ts b/x-pack/plugins/oss_telemetry/server/plugin.ts
new file mode 100644
index 0000000000000..430fca2d39837
--- /dev/null
+++ b/x-pack/plugins/oss_telemetry/server/plugin.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Observable } from 'rxjs';
+import { CoreSetup, CoreStart, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
+import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_manager/server';
+import { registerCollectors } from './lib/collectors';
+import { registerTasks, scheduleTasks } from './lib/tasks';
+import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
+
+export interface OssTelemetrySetupDependencies {
+  usageCollection: UsageCollectionSetup;
+  taskManager: TaskManagerSetupContract;
+}
+export interface OssTelemetryStartDependencies {
+  taskManager: TaskManagerStartContract;
+}
+
+export class OssTelemetryPlugin implements Plugin {
+  private readonly logger: Logger;
+  private readonly config: Observable<{ kibana: { index: string } }>;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get('oss_telemetry');
+    this.config = initializerContext.config.legacy.globalConfig$;
+  }
+
+  public setup(
+    core: CoreSetup<OssTelemetryStartDependencies>,
+    deps: OssTelemetrySetupDependencies
+  ) {
+    registerTasks({
+      taskManager: deps.taskManager,
+      logger: this.logger,
+      elasticsearch: core.elasticsearch,
+      config: this.config,
+    });
+    registerCollectors(
+      deps.usageCollection,
+      core.getStartServices().then(([_, { taskManager }]) => taskManager)
+    );
+  }
+
+  public start(core: CoreStart, deps: OssTelemetryStartDependencies) {
+    scheduleTasks({
+      taskManager: deps.taskManager,
+      logger: this.logger,
+    });
+  }
+}
diff --git a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts b/x-pack/plugins/oss_telemetry/server/test_utils/index.ts
similarity index 95%
rename from x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts
rename to x-pack/plugins/oss_telemetry/server/test_utils/index.ts
index 0695fda3c2c94..fc8c98c164623 100644
--- a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts
+++ b/x-pack/plugins/oss_telemetry/server/test_utils/index.ts
@@ -6,12 +6,13 @@
 
 import { APICaller, CoreSetup } from 'kibana/server';
 
+import { of } from 'rxjs';
 import {
   ConcreteTaskInstance,
   TaskStatus,
   TaskManagerStartContract,
   // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-} from '../../../../plugins/task_manager/server';
+} from '../../../task_manager/server';
 
 export const getMockTaskInstance = (
   overrides: Partial<ConcreteTaskInstance> = {}
@@ -74,9 +75,7 @@ export const getMockThrowingTaskFetch = (
 };
 
 export const getMockConfig = () => {
-  return {
-    get: () => '',
-  };
+  return of({ kibana: { index: '' } });
 };
 
 export const getCluster = () => ({
diff --git a/x-pack/plugins/searchprofiler/kibana.json b/x-pack/plugins/searchprofiler/kibana.json
index af8ee68a9bfa2..1831308212402 100644
--- a/x-pack/plugins/searchprofiler/kibana.json
+++ b/x-pack/plugins/searchprofiler/kibana.json
@@ -2,7 +2,7 @@
   "id": "searchprofiler",
   "version": "8.0.0",
   "kibanaVersion": "kibana",
-  "requiredPlugins": ["dev_tools", "home", "licensing"],
+  "requiredPlugins": ["devTools", "home", "licensing"],
   "server": true,
   "ui": true
 }
diff --git a/x-pack/plugins/searchprofiler/public/plugin.ts b/x-pack/plugins/searchprofiler/public/plugin.ts
index 8f44e65e4546a..7d77b274ec49d 100644
--- a/x-pack/plugins/searchprofiler/public/plugin.ts
+++ b/x-pack/plugins/searchprofiler/public/plugin.ts
@@ -19,7 +19,7 @@ export class SearchProfilerUIPlugin implements Plugin<void, void, AppPublicPlugi
 
   async setup(
     { http, getStartServices }: CoreSetup,
-    { dev_tools, home, licensing }: AppPublicPluginDependencies
+    { devTools, home, licensing }: AppPublicPluginDependencies
   ) {
     home.featureCatalogue.register({
       id: PLUGIN.id,
@@ -35,7 +35,7 @@ export class SearchProfilerUIPlugin implements Plugin<void, void, AppPublicPlugi
       category: FeatureCatalogueCategory.ADMIN,
     });
 
-    dev_tools.register({
+    devTools.register({
       id: 'searchprofiler',
       title: i18n.translate('xpack.searchProfiler.pageDisplayName', {
         defaultMessage: 'Search Profiler',
diff --git a/x-pack/plugins/searchprofiler/public/types.ts b/x-pack/plugins/searchprofiler/public/types.ts
index 697761669dd2f..72b3cb53c1fbe 100644
--- a/x-pack/plugins/searchprofiler/public/types.ts
+++ b/x-pack/plugins/searchprofiler/public/types.ts
@@ -11,5 +11,5 @@ import { LicensingPluginSetup } from '../../licensing/public';
 export interface AppPublicPluginDependencies {
   licensing: LicensingPluginSetup;
   home: HomePublicPluginSetup;
-  dev_tools: DevToolsSetup;
+  devTools: DevToolsSetup;
 }
diff --git a/x-pack/plugins/security/common/model/authenticated_user.mock.ts b/x-pack/plugins/security/common/model/authenticated_user.mock.ts
index 3a93efc57b5f6..220b284e76591 100644
--- a/x-pack/plugins/security/common/model/authenticated_user.mock.ts
+++ b/x-pack/plugins/security/common/model/authenticated_user.mock.ts
@@ -15,6 +15,7 @@ export function mockAuthenticatedUser(user: Partial<AuthenticatedUser> = {}) {
     enabled: true,
     authentication_realm: { name: 'native1', type: 'native' },
     lookup_realm: { name: 'native1', type: 'native' },
+    authentication_provider: 'basic',
     ...user,
   };
 }
diff --git a/x-pack/plugins/security/common/model/authenticated_user.ts b/x-pack/plugins/security/common/model/authenticated_user.ts
index 1b660ae919c09..6465b4a23eb48 100644
--- a/x-pack/plugins/security/common/model/authenticated_user.ts
+++ b/x-pack/plugins/security/common/model/authenticated_user.ts
@@ -26,6 +26,11 @@ export interface AuthenticatedUser extends User {
    * The name and type of the Realm where the user information were retrieved from.
    */
   lookup_realm: UserRealm;
+
+  /**
+   * Name of the Kibana authentication provider that used to authenticate user.
+   */
+  authentication_provider: string;
 }
 
 export function canUserChangePassword(user: AuthenticatedUser) {
diff --git a/x-pack/plugins/security/public/account_management/account_management_page.test.tsx b/x-pack/plugins/security/public/account_management/account_management_page.test.tsx
index b7cf8e6dd1418..4caf3d25e887b 100644
--- a/x-pack/plugins/security/public/account_management/account_management_page.test.tsx
+++ b/x-pack/plugins/security/public/account_management/account_management_page.test.tsx
@@ -10,6 +10,7 @@ import { AuthenticatedUser } from '../../common/model';
 import { AccountManagementPage } from './account_management_page';
 
 import { coreMock } from 'src/core/public/mocks';
+import { mockAuthenticatedUser } from '../../common/model/authenticated_user.mock';
 import { securityMock } from '../mocks';
 import { userAPIClientMock } from '../management/users/index.mock';
 
@@ -19,11 +20,10 @@ interface Options {
   realm?: string;
 }
 const createUser = ({ withFullName = true, withEmail = true, realm = 'native' }: Options = {}) => {
-  return {
+  return mockAuthenticatedUser({
     full_name: withFullName ? 'Casey Smith' : '',
     username: 'csmith',
     email: withEmail ? 'csmith@domain.com' : '',
-    enabled: true,
     roles: [],
     authentication_realm: {
       type: realm,
@@ -33,7 +33,7 @@ const createUser = ({ withFullName = true, withEmail = true, realm = 'native' }:
       type: realm,
       name: realm,
     },
-  };
+  });
 };
 
 function getSecuritySetupMock({ currentUser }: { currentUser: AuthenticatedUser }) {
diff --git a/x-pack/plugins/security/server/authentication/authenticator.test.ts b/x-pack/plugins/security/server/authentication/authenticator.test.ts
index dd580c890bf94..8be1762133db6 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.test.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-jest.mock('./providers/basic', () => ({ BasicAuthenticationProvider: jest.fn() }));
+jest.mock('./providers/basic');
 
 import Boom from 'boom';
 import { duration, Duration } from 'moment';
@@ -225,75 +225,6 @@ describe('Authenticator', () => {
       expect(mockSessionStorage.set).not.toHaveBeenCalled();
       expect(mockSessionStorage.clear).toHaveBeenCalled();
     });
-
-    describe('stateless login', () => {
-      it('does not create session even if authentication provider returns state', async () => {
-        const user = mockAuthenticatedUser();
-        const request = httpServerMock.createKibanaRequest();
-        const authorization = `Basic ${Buffer.from('foo:bar').toString('base64')}`;
-
-        mockBasicAuthenticationProvider.login.mockResolvedValue(
-          AuthenticationResult.succeeded(user, { state: { authorization } })
-        );
-
-        const authenticationResult = await authenticator.login(request, {
-          provider: 'basic',
-          value: {},
-          stateless: true,
-        });
-        expect(authenticationResult.succeeded()).toBe(true);
-        expect(authenticationResult.user).toEqual(user);
-
-        expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledWith(request, {}, null);
-        expect(mockSessionStorage.get).not.toHaveBeenCalled();
-        expect(mockSessionStorage.set).not.toHaveBeenCalled();
-        expect(mockSessionStorage.clear).not.toHaveBeenCalled();
-      });
-
-      it('does not clear session even if provider asked to do so.', async () => {
-        const user = mockAuthenticatedUser();
-        const request = httpServerMock.createKibanaRequest();
-
-        mockBasicAuthenticationProvider.login.mockResolvedValue(
-          AuthenticationResult.succeeded(user, { state: null })
-        );
-
-        const authenticationResult = await authenticator.login(request, {
-          provider: 'basic',
-          value: {},
-          stateless: true,
-        });
-        expect(authenticationResult.succeeded()).toBe(true);
-        expect(authenticationResult.user).toEqual(user);
-
-        expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledWith(request, {}, null);
-        expect(mockSessionStorage.get).not.toHaveBeenCalled();
-        expect(mockSessionStorage.set).not.toHaveBeenCalled();
-        expect(mockSessionStorage.clear).not.toHaveBeenCalled();
-      });
-
-      it('does not clear session even if provider failed with 401.', async () => {
-        const request = httpServerMock.createKibanaRequest();
-
-        const failureReason = Boom.unauthorized();
-        mockBasicAuthenticationProvider.login.mockResolvedValue(
-          AuthenticationResult.failed(failureReason)
-        );
-
-        const authenticationResult = await authenticator.login(request, {
-          provider: 'basic',
-          value: {},
-          stateless: true,
-        });
-        expect(authenticationResult.failed()).toBe(true);
-        expect(authenticationResult.error).toBe(failureReason);
-
-        expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledWith(request, {}, null);
-        expect(mockSessionStorage.get).not.toHaveBeenCalled();
-        expect(mockSessionStorage.set).not.toHaveBeenCalled();
-        expect(mockSessionStorage.clear).not.toHaveBeenCalled();
-      });
-    });
   });
 
   describe('`authenticate` method', () => {
diff --git a/x-pack/plugins/security/server/authentication/authenticator.ts b/x-pack/plugins/security/server/authentication/authenticator.ts
index be952a154cee4..ea7792e902ec1 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.ts
@@ -80,13 +80,6 @@ export interface ProviderLoginAttempt {
    * Login attempt can have any form and defined by the specific provider.
    */
   value: unknown;
-
-  /**
-   * Indicates whether login attempt should be performed in a "stateless" manner. If `true` provider
-   * performing login will neither be able to retrieve or update existing state if any nor persist
-   * any new state it may produce as a result of the login attempt. It's `false` by default.
-   */
-  stateless?: boolean;
 }
 
 export interface AuthenticatorOptions {
@@ -107,12 +100,12 @@ const providerMap = new Map<
     providerSpecificOptions?: AuthenticationProviderSpecificOptions
   ) => BaseAuthenticationProvider
 >([
-  ['basic', BasicAuthenticationProvider],
-  ['kerberos', KerberosAuthenticationProvider],
-  ['saml', SAMLAuthenticationProvider],
-  ['token', TokenAuthenticationProvider],
-  ['oidc', OIDCAuthenticationProvider],
-  ['pki', PKIAuthenticationProvider],
+  [BasicAuthenticationProvider.type, BasicAuthenticationProvider],
+  [KerberosAuthenticationProvider.type, KerberosAuthenticationProvider],
+  [SAMLAuthenticationProvider.type, SAMLAuthenticationProvider],
+  [TokenAuthenticationProvider.type, TokenAuthenticationProvider],
+  [OIDCAuthenticationProvider.type, OIDCAuthenticationProvider],
+  [PKIAuthenticationProvider.type, PKIAuthenticationProvider],
 ]);
 
 function assertRequest(request: KibanaRequest) {
@@ -254,7 +247,7 @@ export class Authenticator {
 
     // If we detect an existing session that belongs to a different provider than the one requested
     // to perform a login we should clear such session.
-    let existingSession = attempt.stateless ? null : await this.getSessionValue(sessionStorage);
+    let existingSession = await this.getSessionValue(sessionStorage);
     if (existingSession && existingSession.provider !== attempt.provider) {
       this.logger.debug(
         `Clearing existing session of another ("${existingSession.provider}") provider.`
@@ -281,7 +274,7 @@ export class Authenticator {
       (authenticationResult.failed() && getErrorStatusCode(authenticationResult.error) === 401);
     if (existingSession && shouldClearSession) {
       sessionStorage.clear();
-    } else if (!attempt.stateless && authenticationResult.shouldUpdateState()) {
+    } else if (authenticationResult.shouldUpdateState()) {
       const { idleTimeoutExpiration, lifespanExpiration } = this.calculateExpiry(existingSession);
       sessionStorage.set({
         state: authenticationResult.state,
diff --git a/x-pack/plugins/security/server/authentication/index.test.ts b/x-pack/plugins/security/server/authentication/index.test.ts
index 0c1095b56e6e2..d0de6d571b7a0 100644
--- a/x-pack/plugins/security/server/authentication/index.test.ts
+++ b/x-pack/plugins/security/server/authentication/index.test.ts
@@ -10,7 +10,6 @@ jest.mock('./api_keys');
 jest.mock('./authenticator');
 
 import Boom from 'boom';
-import { errors } from 'elasticsearch';
 import { first } from 'rxjs/operators';
 
 import {
@@ -27,7 +26,6 @@ import {
   AuthToolkit,
   IClusterClient,
   CoreSetup,
-  ElasticsearchErrorHelpers,
   KibanaRequest,
   LoggerFactory,
   ScopedClusterClient,
@@ -289,67 +287,66 @@ describe('setupAuthentication()', () => {
   });
 
   describe('getCurrentUser()', () => {
-    let getCurrentUser: (r: KibanaRequest) => Promise<AuthenticatedUser | null>;
+    let getCurrentUser: (r: KibanaRequest) => AuthenticatedUser | null;
     beforeEach(async () => {
       getCurrentUser = (await setupAuthentication(mockSetupAuthenticationParams)).getCurrentUser;
     });
 
-    it('returns `null` if Security is disabled', async () => {
+    it('returns `null` if Security is disabled', () => {
       mockSetupAuthenticationParams.license.isEnabled.mockReturnValue(false);
 
-      await expect(getCurrentUser(httpServerMock.createKibanaRequest())).resolves.toBe(null);
+      expect(getCurrentUser(httpServerMock.createKibanaRequest())).toBe(null);
     });
 
-    it('fails if `authenticate` call fails', async () => {
-      const failureReason = new Error('Something went wrong');
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+    it('returns user from the auth state.', () => {
+      const mockUser = mockAuthenticatedUser();
 
-      await expect(getCurrentUser(httpServerMock.createKibanaRequest())).rejects.toBe(
-        failureReason
-      );
+      const mockAuthGet = mockSetupAuthenticationParams.http.auth.get as jest.Mock;
+      mockAuthGet.mockReturnValue({ state: mockUser });
+
+      const mockRequest = httpServerMock.createKibanaRequest();
+      expect(getCurrentUser(mockRequest)).toBe(mockUser);
+      expect(mockAuthGet).toHaveBeenCalledTimes(1);
+      expect(mockAuthGet).toHaveBeenCalledWith(mockRequest);
     });
 
-    it('returns result of `authenticate` call.', async () => {
-      const mockUser = mockAuthenticatedUser();
-      mockScopedClusterClient.callAsCurrentUser.mockResolvedValue(mockUser);
+    it('returns null if auth state is not available.', () => {
+      const mockAuthGet = mockSetupAuthenticationParams.http.auth.get as jest.Mock;
+      mockAuthGet.mockReturnValue({});
 
-      await expect(getCurrentUser(httpServerMock.createKibanaRequest())).resolves.toBe(mockUser);
+      const mockRequest = httpServerMock.createKibanaRequest();
+      expect(getCurrentUser(mockRequest)).toBeNull();
+      expect(mockAuthGet).toHaveBeenCalledTimes(1);
+      expect(mockAuthGet).toHaveBeenCalledWith(mockRequest);
     });
   });
 
   describe('isAuthenticated()', () => {
-    let isAuthenticated: (r: KibanaRequest) => Promise<boolean>;
+    let isAuthenticated: (r: KibanaRequest) => boolean;
     beforeEach(async () => {
       isAuthenticated = (await setupAuthentication(mockSetupAuthenticationParams)).isAuthenticated;
     });
 
-    it('returns `true` if Security is disabled', async () => {
-      mockSetupAuthenticationParams.license.isEnabled.mockReturnValue(false);
-
-      await expect(isAuthenticated(httpServerMock.createKibanaRequest())).resolves.toBe(true);
-    });
+    it('returns `true` if request is authenticated', () => {
+      const mockIsAuthenticated = mockSetupAuthenticationParams.http.auth
+        .isAuthenticated as jest.Mock;
+      mockIsAuthenticated.mockReturnValue(true);
 
-    it('returns `true` if `authenticate` succeeds.', async () => {
-      const mockUser = mockAuthenticatedUser();
-      mockScopedClusterClient.callAsCurrentUser.mockResolvedValue(mockUser);
-
-      await expect(isAuthenticated(httpServerMock.createKibanaRequest())).resolves.toBe(true);
-    });
-
-    it('returns `false` if `authenticate` fails with 401.', async () => {
-      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
-
-      await expect(isAuthenticated(httpServerMock.createKibanaRequest())).resolves.toBe(false);
+      const mockRequest = httpServerMock.createKibanaRequest();
+      expect(isAuthenticated(mockRequest)).toBe(true);
+      expect(mockIsAuthenticated).toHaveBeenCalledTimes(1);
+      expect(mockIsAuthenticated).toHaveBeenCalledWith(mockRequest);
     });
 
-    it('fails if `authenticate` call fails with unknown reason', async () => {
-      const failureReason = new errors.BadRequest();
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+    it('returns `false` if request is not authenticated', () => {
+      const mockIsAuthenticated = mockSetupAuthenticationParams.http.auth
+        .isAuthenticated as jest.Mock;
+      mockIsAuthenticated.mockReturnValue(false);
 
-      await expect(isAuthenticated(httpServerMock.createKibanaRequest())).rejects.toBe(
-        failureReason
-      );
+      const mockRequest = httpServerMock.createKibanaRequest();
+      expect(isAuthenticated(mockRequest)).toBe(false);
+      expect(mockIsAuthenticated).toHaveBeenCalledTimes(1);
+      expect(mockIsAuthenticated).toHaveBeenCalledWith(mockRequest);
     });
   });
 
diff --git a/x-pack/plugins/security/server/authentication/index.ts b/x-pack/plugins/security/server/authentication/index.ts
index 1002ad7709b80..4b73430ff13c4 100644
--- a/x-pack/plugins/security/server/authentication/index.ts
+++ b/x-pack/plugins/security/server/authentication/index.ts
@@ -55,14 +55,12 @@ export async function setupAuthentication({
    * Retrieves currently authenticated user associated with the specified request.
    * @param request
    */
-  const getCurrentUser = async (request: KibanaRequest) => {
+  const getCurrentUser = (request: KibanaRequest) => {
     if (!license.isEnabled()) {
       return null;
     }
 
-    return (await clusterClient
-      .asScoped(request)
-      .callAsCurrentUser('shield.authenticate')) as AuthenticatedUser;
+    return (http.auth.get(request).state ?? null) as AuthenticatedUser | null;
   };
 
   const isValid = (sessionValue: ProviderSession) => {
@@ -180,18 +178,6 @@ export async function setupAuthentication({
       apiKeys.create(request, params),
     invalidateAPIKey: (request: KibanaRequest, params: InvalidateAPIKeyParams) =>
       apiKeys.invalidate(request, params),
-    isAuthenticated: async (request: KibanaRequest) => {
-      try {
-        await getCurrentUser(request);
-      } catch (err) {
-        // Don't swallow server errors.
-        if (getErrorStatusCode(err) !== 401) {
-          throw err;
-        }
-        return false;
-      }
-
-      return true;
-    },
+    isAuthenticated: (request: KibanaRequest) => http.auth.isAuthenticated(request),
   };
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/base.ts b/x-pack/plugins/security/server/authentication/providers/base.ts
index 12253f8d8f548..a40732768810d 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.ts
@@ -11,6 +11,7 @@ import {
   IClusterClient,
   Headers,
 } from '../../../../../../src/core/server';
+import { deepFreeze } from '../../../../../../src/core/utils';
 import { AuthenticatedUser } from '../../../common/model';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
@@ -35,6 +36,11 @@ export type AuthenticationProviderSpecificOptions = Record<string, unknown>;
  * Base class that all authentication providers should extend.
  */
 export abstract class BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type: string;
+
   /**
    * Logger instance bound to a specific provider context.
    */
@@ -85,8 +91,13 @@ export abstract class BaseAuthenticationProvider {
    * @param [authHeaders] Optional `Headers` dictionary to send with the request.
    */
   protected async getUser(request: KibanaRequest, authHeaders: Headers = {}) {
-    return (await this.options.client
-      .asScoped({ headers: { ...request.headers, ...authHeaders } })
-      .callAsCurrentUser('shield.authenticate')) as AuthenticatedUser;
+    return deepFreeze({
+      ...(await this.options.client
+        .asScoped({ headers: { ...request.headers, ...authHeaders } })
+        .callAsCurrentUser('shield.authenticate')),
+      // We use `this.constructor` trick to get access to the static `type` field of the specific
+      // `BaseAuthenticationProvider` subclass.
+      authentication_provider: (this.constructor as any).type,
+    } as AuthenticatedUser);
   }
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/basic.ts b/x-pack/plugins/security/server/authentication/providers/basic.ts
index 07d141b4e1b2b..a8e4e8705a7a8 100644
--- a/x-pack/plugins/security/server/authentication/providers/basic.ts
+++ b/x-pack/plugins/security/server/authentication/providers/basic.ts
@@ -34,6 +34,11 @@ interface ProviderState {
  * Provider that supports request authentication via Basic HTTP Authentication.
  */
 export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'basic';
+
   /**
    * Performs initial login request using username and password.
    * @param request Request instance.
diff --git a/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts b/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
index 27105793fc966..e4b4df3feeae2 100644
--- a/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
@@ -155,7 +155,7 @@ describe('KerberosAuthenticationProvider', () => {
 
       expect(request.headers.authorization).toBe('negotiate spnego');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'kerberos' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer some-token' });
       expect(authenticationResult.authResponseHeaders).toBeUndefined();
       expect(authenticationResult.state).toEqual({
@@ -193,7 +193,7 @@ describe('KerberosAuthenticationProvider', () => {
 
       expect(request.headers.authorization).toBe('negotiate spnego');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'kerberos' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer some-token' });
       expect(authenticationResult.authResponseHeaders).toEqual({
         'WWW-Authenticate': 'Negotiate response-token',
@@ -337,7 +337,7 @@ describe('KerberosAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toEqual({ authorization });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'kerberos' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
@@ -370,7 +370,7 @@ describe('KerberosAuthenticationProvider', () => {
 
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer newfoo' });
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'kerberos' });
       expect(authenticationResult.state).toEqual({ accessToken: 'newfoo', refreshToken: 'newbar' });
       expect(request.headers).not.toHaveProperty('authorization');
     });
@@ -419,44 +419,6 @@ describe('KerberosAuthenticationProvider', () => {
       expect(authenticationResult.authResponseHeaders).toEqual({ 'WWW-Authenticate': 'Negotiate' });
     });
 
-    it('fails with `Negotiate` challenge if both access and refresh token documents are missing and backend supports Kerberos.', async () => {
-      const request = httpServerMock.createKibanaRequest({ headers: {} });
-      const tokenPair = { accessToken: 'missing-token', refreshToken: 'missing-refresh-token' };
-
-      mockScopedClusterClient(
-        mockOptions.client,
-        sinon.match({ headers: { authorization: `Bearer ${tokenPair.accessToken}` } })
-      )
-        .callAsCurrentUser.withArgs('shield.authenticate')
-        .rejects({
-          statusCode: 500,
-          body: { error: { reason: 'token document is missing and must be present' } },
-        });
-
-      mockScopedClusterClient(
-        mockOptions.client,
-        sinon.match({
-          headers: { authorization: `Negotiate ${Buffer.from('__fake__').toString('base64')}` },
-        })
-      )
-        .callAsCurrentUser.withArgs('shield.authenticate')
-        .rejects(
-          ElasticsearchErrorHelpers.decorateNotAuthorizedError(
-            new (errors.AuthenticationException as any)('Unauthorized', {
-              body: { error: { header: { 'WWW-Authenticate': 'Negotiate' } } },
-            })
-          )
-        );
-
-      mockOptions.tokens.refresh.withArgs(tokenPair.refreshToken).resolves(null);
-
-      const authenticationResult = await provider.authenticate(request, tokenPair);
-
-      expect(authenticationResult.failed()).toBe(true);
-      expect(authenticationResult.error).toHaveProperty('output.statusCode', 401);
-      expect(authenticationResult.authResponseHeaders).toEqual({ 'WWW-Authenticate': 'Negotiate' });
-    });
-
     it('succeeds if `authorization` contains a valid token.', async () => {
       const user = mockAuthenticatedUser();
       const request = httpServerMock.createKibanaRequest({
@@ -475,7 +437,7 @@ describe('KerberosAuthenticationProvider', () => {
       expect(request.headers.authorization).toBe('Bearer some-valid-token');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toBeUndefined();
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'kerberos' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
diff --git a/x-pack/plugins/security/server/authentication/providers/kerberos.ts b/x-pack/plugins/security/server/authentication/providers/kerberos.ts
index 767eab7b4311d..b8e3b7bc23790 100644
--- a/x-pack/plugins/security/server/authentication/providers/kerberos.ts
+++ b/x-pack/plugins/security/server/authentication/providers/kerberos.ts
@@ -43,6 +43,11 @@ const WWWAuthenticateHeaderName = 'WWW-Authenticate';
  * Provider that supports Kerberos request authentication.
  */
 export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'kerberos';
+
   /**
    * Performs Kerberos request authentication.
    * @param request Request instance.
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
index dd4f6820f89f3..dae3774955859 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
@@ -311,7 +311,7 @@ describe('OIDCAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toEqual({ authorization });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'oidc' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
@@ -380,7 +380,7 @@ describe('OIDCAuthenticationProvider', () => {
       expect(authenticationResult.authHeaders).toEqual({
         authorization: 'Bearer new-access-token',
       });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'oidc' });
       expect(authenticationResult.state).toEqual({
         accessToken: 'new-access-token',
         refreshToken: 'new-refresh-token',
@@ -492,7 +492,7 @@ describe('OIDCAuthenticationProvider', () => {
       expect(request.headers.authorization).toBe('Bearer some-valid-token');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toBeUndefined();
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'oidc' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.ts b/x-pack/plugins/security/server/authentication/providers/oidc.ts
index 3737123645379..f13a2ec05231a 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.ts
@@ -6,9 +6,9 @@
 
 import Boom from 'boom';
 import type from 'type-detect';
-import { canRedirectRequest } from '../';
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
+import { canRedirectRequest } from '../can_redirect_request';
 import { DeauthenticationResult } from '../deauthentication_result';
 import { Tokens, TokenPair } from '../tokens';
 import {
@@ -62,6 +62,11 @@ interface ProviderState extends Partial<TokenPair> {
  * Provider that supports authentication using an OpenID Connect realm in Elasticsearch.
  */
 export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'oidc';
+
   /**
    * Specifies Elasticsearch OIDC realm name that Kibana should use.
    */
diff --git a/x-pack/plugins/security/server/authentication/providers/pki.test.ts b/x-pack/plugins/security/server/authentication/providers/pki.test.ts
index 76442733e7368..a2dda88c4680c 100644
--- a/x-pack/plugins/security/server/authentication/providers/pki.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/pki.test.ts
@@ -200,7 +200,7 @@ describe('PKIAuthenticationProvider', () => {
 
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer access-token' });
       expect(authenticationResult.authResponseHeaders).toBeUndefined();
       expect(authenticationResult.state).toEqual({
@@ -242,7 +242,7 @@ describe('PKIAuthenticationProvider', () => {
 
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer access-token' });
       expect(authenticationResult.authResponseHeaders).toBeUndefined();
       expect(authenticationResult.state).toEqual({
@@ -287,7 +287,7 @@ describe('PKIAuthenticationProvider', () => {
 
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer access-token' });
       expect(authenticationResult.authResponseHeaders).toBeUndefined();
       expect(authenticationResult.state).toEqual({
@@ -331,7 +331,7 @@ describe('PKIAuthenticationProvider', () => {
 
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer access-token' });
       expect(authenticationResult.authResponseHeaders).toBeUndefined();
       expect(authenticationResult.state).toEqual({
@@ -448,7 +448,7 @@ describe('PKIAuthenticationProvider', () => {
       expect(authenticationResult.authHeaders).toEqual({
         authorization: `Bearer ${state.accessToken}`,
       });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
@@ -491,7 +491,7 @@ describe('PKIAuthenticationProvider', () => {
       expect(request.headers.authorization).toBe('Bearer some-valid-token');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toBeUndefined();
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'pki' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
diff --git a/x-pack/plugins/security/server/authentication/providers/pki.ts b/x-pack/plugins/security/server/authentication/providers/pki.ts
index c7d431422a248..6d5aa9f01f2ea 100644
--- a/x-pack/plugins/security/server/authentication/providers/pki.ts
+++ b/x-pack/plugins/security/server/authentication/providers/pki.ts
@@ -44,6 +44,11 @@ function getRequestAuthenticationScheme(request: KibanaRequest) {
  * Provider that supports PKI request authentication.
  */
 export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'pki';
+
   /**
    * Performs PKI request authentication.
    * @param request Request instance.
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.test.ts b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
index 27702f70865ea..c4fdf0b25061b 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
@@ -635,7 +635,7 @@ describe('SAMLAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toEqual({ authorization });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'saml' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
@@ -696,7 +696,7 @@ describe('SAMLAuthenticationProvider', () => {
       expect(authenticationResult.authHeaders).toEqual({
         authorization: 'Bearer new-access-token',
       });
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'saml' });
       expect(authenticationResult.state).toEqual({
         username: 'user',
         accessToken: 'new-access-token',
@@ -758,82 +758,6 @@ describe('SAMLAuthenticationProvider', () => {
       );
     });
 
-    it('re-capture URL for non-AJAX requests if access token document is missing.', async () => {
-      const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
-      const state = {
-        username: 'user',
-        accessToken: 'expired-token',
-        refreshToken: 'expired-refresh-token',
-      };
-
-      mockScopedClusterClient(
-        mockOptions.client,
-        sinon.match({ headers: { authorization: `Bearer ${state.accessToken}` } })
-      )
-        .callAsCurrentUser.withArgs('shield.authenticate')
-        .rejects({
-          statusCode: 500,
-          body: { error: { reason: 'token document is missing and must be present' } },
-        });
-
-      mockOptions.tokens.refresh.withArgs(state.refreshToken).resolves(null);
-
-      const authenticationResult = await provider.authenticate(request, state);
-
-      sinon.assert.notCalled(mockOptions.client.callAsInternalUser);
-
-      expect(authenticationResult.redirected()).toBe(true);
-      expect(authenticationResult.redirectURL).toBe(
-        '/mock-server-basepath/api/security/saml/capture-url-fragment'
-      );
-      expect(authenticationResult.state).toEqual({ redirectURL: '/base-path/s/foo/some-path' });
-    });
-
-    it('initiates SAML handshake for non-AJAX requests if access token document is missing and request path is too large.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        path: `/s/foo/${'some-path'.repeat(10)}`,
-      });
-      const state = {
-        username: 'user',
-        accessToken: 'expired-token',
-        refreshToken: 'expired-refresh-token',
-      };
-
-      mockOptions.client.callAsInternalUser.withArgs('shield.samlPrepare').resolves({
-        id: 'some-request-id',
-        redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
-      });
-
-      mockScopedClusterClient(
-        mockOptions.client,
-        sinon.match({ headers: { authorization: `Bearer ${state.accessToken}` } })
-      )
-        .callAsCurrentUser.withArgs('shield.authenticate')
-        .rejects({
-          statusCode: 500,
-          body: { error: { reason: 'token document is missing and must be present' } },
-        });
-
-      mockOptions.tokens.refresh.withArgs(state.refreshToken).resolves(null);
-
-      const authenticationResult = await provider.authenticate(request, state);
-
-      sinon.assert.calledWithExactly(mockOptions.client.callAsInternalUser, 'shield.samlPrepare', {
-        body: { realm: 'test-realm' },
-      });
-
-      expect(mockOptions.logger.warn).toHaveBeenCalledTimes(1);
-      expect(mockOptions.logger.warn).toHaveBeenCalledWith(
-        'Max URL path size should not exceed 100b but it was 107b. URL is not captured.'
-      );
-
-      expect(authenticationResult.redirected()).toBe(true);
-      expect(authenticationResult.redirectURL).toBe(
-        'https://idp-host/path/login?SAMLRequest=some%20request%20'
-      );
-      expect(authenticationResult.state).toEqual({ requestId: 'some-request-id', redirectURL: '' });
-    });
-
     it('re-capture URL for non-AJAX requests if refresh token is expired.', async () => {
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
       const state = {
@@ -918,7 +842,7 @@ describe('SAMLAuthenticationProvider', () => {
       expect(request.headers.authorization).toBe('Bearer some-valid-token');
       expect(authenticationResult.succeeded()).toBe(true);
       expect(authenticationResult.authHeaders).toBeUndefined();
-      expect(authenticationResult.user).toBe(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'saml' });
       expect(authenticationResult.state).toBeUndefined();
     });
 
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.ts b/x-pack/plugins/security/server/authentication/providers/saml.ts
index faa19239fcc3b..a817159fcd445 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.ts
@@ -10,8 +10,8 @@ import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
 import { AuthenticationProviderOptions, BaseAuthenticationProvider } from './base';
+import { canRedirectRequest } from '../can_redirect_request';
 import { Tokens, TokenPair } from '../tokens';
-import { canRedirectRequest } from '..';
 
 /**
  * The state supported by the provider (for the SAML handshake or established session).
@@ -66,6 +66,11 @@ export function isSAMLRequestQuery(query: any): query is { SAMLRequest: string }
  * Provider that supports SAML request authentication.
  */
 export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'saml';
+
   /**
    * Specifies Elasticsearch SAML realm name that Kibana should use.
    */
diff --git a/x-pack/plugins/security/server/authentication/providers/token.test.ts b/x-pack/plugins/security/server/authentication/providers/token.test.ts
index a6850dcdf8321..0a55219e25d91 100644
--- a/x-pack/plugins/security/server/authentication/providers/token.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/token.test.ts
@@ -48,7 +48,7 @@ describe('TokenAuthenticationProvider', () => {
       const authenticationResult = await provider.login(request, credentials);
 
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'token' });
       expect(authenticationResult.state).toEqual(tokenPair);
       expect(authenticationResult.authHeaders).toEqual({ authorization });
     });
@@ -140,7 +140,7 @@ describe('TokenAuthenticationProvider', () => {
       const authenticationResult = await provider.authenticate(request);
 
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'token' });
       expect(authenticationResult.authHeaders).toBeUndefined();
       expect(authenticationResult.state).toBeUndefined();
     });
@@ -158,7 +158,7 @@ describe('TokenAuthenticationProvider', () => {
       const authenticationResult = await provider.authenticate(request, tokenPair);
 
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'token' });
       expect(authenticationResult.state).toBeUndefined();
       expect(authenticationResult.authHeaders).toEqual({ authorization });
       expect(request.headers).not.toHaveProperty('authorization');
@@ -192,7 +192,7 @@ describe('TokenAuthenticationProvider', () => {
       sinon.assert.calledOnce(mockOptions.tokens.refresh);
 
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'token' });
       expect(authenticationResult.state).toEqual({ accessToken: 'newfoo', refreshToken: 'newbar' });
       expect(authenticationResult.authHeaders).toEqual({ authorization: 'Bearer newfoo' });
       expect(request.headers).not.toHaveProperty('authorization');
@@ -231,7 +231,7 @@ describe('TokenAuthenticationProvider', () => {
       const authenticationResult = await provider.authenticate(request, tokenPair);
 
       expect(authenticationResult.succeeded()).toBe(true);
-      expect(authenticationResult.user).toEqual(user);
+      expect(authenticationResult.user).toEqual({ ...user, authentication_provider: 'token' });
       expect(authenticationResult.state).toBeUndefined();
       expect(authenticationResult.authHeaders).toBeUndefined();
       expect(request.headers.authorization).toEqual('Bearer foo-from-header');
@@ -300,36 +300,6 @@ describe('TokenAuthenticationProvider', () => {
       expect(authenticationResult.error).toEqual(refreshError);
     });
 
-    it('redirects non-AJAX requests to /login and clears session if token document is missing', async () => {
-      const request = httpServerMock.createKibanaRequest({ path: '/some-path' });
-      const tokenPair = { accessToken: 'foo', refreshToken: 'bar' };
-
-      mockScopedClusterClient(
-        mockOptions.client,
-        sinon.match({ headers: { authorization: `Bearer ${tokenPair.accessToken}` } })
-      )
-        .callAsCurrentUser.withArgs('shield.authenticate')
-        .rejects({
-          statusCode: 500,
-          body: { error: { reason: 'token document is missing and must be present' } },
-        });
-
-      mockOptions.tokens.refresh.withArgs(tokenPair.refreshToken).resolves(null);
-
-      const authenticationResult = await provider.authenticate(request, tokenPair);
-
-      sinon.assert.calledOnce(mockOptions.tokens.refresh);
-
-      expect(request.headers).not.toHaveProperty('authorization');
-      expect(authenticationResult.redirected()).toBe(true);
-      expect(authenticationResult.redirectURL).toBe(
-        '/base-path/login?next=%2Fbase-path%2Fsome-path'
-      );
-      expect(authenticationResult.user).toBeUndefined();
-      expect(authenticationResult.state).toEqual(null);
-      expect(authenticationResult.error).toBeUndefined();
-    });
-
     it('redirects non-AJAX requests to /login and clears session if token cannot be refreshed', async () => {
       const request = httpServerMock.createKibanaRequest({ path: '/some-path' });
       const tokenPair = { accessToken: 'foo', refreshToken: 'bar' };
diff --git a/x-pack/plugins/security/server/authentication/providers/token.ts b/x-pack/plugins/security/server/authentication/providers/token.ts
index c5f8f07e50b11..03fd003e2cbde 100644
--- a/x-pack/plugins/security/server/authentication/providers/token.ts
+++ b/x-pack/plugins/security/server/authentication/providers/token.ts
@@ -9,8 +9,8 @@ import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
 import { BaseAuthenticationProvider } from './base';
+import { canRedirectRequest } from '../can_redirect_request';
 import { Tokens, TokenPair } from '../tokens';
-import { canRedirectRequest } from '..';
 
 /**
  * Describes the parameters that are required by the provider to process the initial login request.
@@ -29,6 +29,11 @@ type ProviderState = TokenPair;
  * Provider that supports token-based request authentication.
  */
 export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
+  /**
+   * Type of the provider.
+   */
+  static readonly type = 'token';
+
   /**
    * Performs initial login request using username and password.
    * @param request Request instance.
diff --git a/x-pack/plugins/security/server/authentication/tokens.test.ts b/x-pack/plugins/security/server/authentication/tokens.test.ts
index 8d15ea69ae392..82f29310c04c0 100644
--- a/x-pack/plugins/security/server/authentication/tokens.test.ts
+++ b/x-pack/plugins/security/server/authentication/tokens.test.ts
@@ -41,10 +41,6 @@ describe('Tokens', () => {
       { statusCode: 401 },
       ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error()),
       new errors.AuthenticationException(),
-      {
-        statusCode: 500,
-        body: { error: { reason: 'token document is missing and must be present' } },
-      },
     ];
     for (const error of expirationErrors) {
       expect(Tokens.isAccessTokenExpiredError(error)).toBe(true);
diff --git a/x-pack/plugins/security/server/authentication/tokens.ts b/x-pack/plugins/security/server/authentication/tokens.ts
index 2906f28912d5b..ea7b5d5a9ff38 100644
--- a/x-pack/plugins/security/server/authentication/tokens.ts
+++ b/x-pack/plugins/security/server/authentication/tokens.ts
@@ -150,21 +150,10 @@ export class Tokens {
   /**
    * Tries to determine whether specified error that occurred while trying to authenticate request
    * using access token happened because access token is expired. We treat all `401 Unauthorized`
-   * as such. Another use case that we should temporarily support (until elastic/elasticsearch#38866
-   * is fixed) is when token document has been removed and ES responds with `500 Internal Server Error`.
+   * as such.
    * @param err Error returned from Elasticsearch.
    */
   public static isAccessTokenExpiredError(err?: any) {
-    const errorStatusCode = getErrorStatusCode(err);
-    return (
-      errorStatusCode === 401 ||
-      (errorStatusCode === 500 &&
-        !!(
-          err &&
-          err.body &&
-          err.body.error &&
-          err.body.error.reason === 'token document is missing and must be present'
-        ))
-    );
+    return getErrorStatusCode(err) === 401;
   }
 }
diff --git a/x-pack/plugins/security/server/routes/authentication/common.test.ts b/x-pack/plugins/security/server/routes/authentication/common.test.ts
index 5d5868d4cc593..4666b5abad756 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.test.ts
@@ -176,20 +176,9 @@ describe('Common authentication routes', () => {
       expect(routeConfig.validate).toBe(false);
     });
 
-    it('returns 500 if cannot retrieve current user due to unhandled exception.', async () => {
-      const unhandledException = new Error('Something went wrong.');
-      authc.getCurrentUser.mockRejectedValue(unhandledException);
-
-      const response = await routeHandler(mockContext, mockRequest, kibanaResponseFactory);
-
-      expect(response.status).toBe(500);
-      expect(response.payload).toEqual(unhandledException);
-      expect(authc.getCurrentUser).toHaveBeenCalledWith(mockRequest);
-    });
-
     it('returns current user.', async () => {
       const mockUser = mockAuthenticatedUser();
-      authc.getCurrentUser.mockResolvedValue(mockUser);
+      authc.getCurrentUser.mockReturnValue(mockUser);
 
       const response = await routeHandler(mockContext, mockRequest, kibanaResponseFactory);
 
diff --git a/x-pack/plugins/security/server/routes/authentication/common.ts b/x-pack/plugins/security/server/routes/authentication/common.ts
index cb4ec196459ee..c9856e9dff7f1 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.ts
@@ -59,7 +59,7 @@ export function defineCommonRoutes({ router, authc, basePath, logger }: RouteDef
   for (const path of ['/internal/security/me', '/api/security/v1/me']) {
     router.get(
       { path, validate: false },
-      createLicensedRouteHandler(async (context, request, response) => {
+      createLicensedRouteHandler((context, request, response) => {
         if (path === '/api/security/v1/me') {
           logger.warn(
             `The "${basePath.serverBasePath}${path}" endpoint is deprecated and will be removed in the next major version.`,
@@ -67,11 +67,7 @@ export function defineCommonRoutes({ router, authc, basePath, logger }: RouteDef
           );
         }
 
-        try {
-          return response.ok({ body: (await authc.getCurrentUser(request)) as any });
-        } catch (error) {
-          return response.customError(wrapIntoCustomErrorResponse(error));
-        }
+        return response.ok({ body: authc.getCurrentUser(request)! });
       })
     );
   }
diff --git a/x-pack/plugins/security/server/routes/users/change_password.test.ts b/x-pack/plugins/security/server/routes/users/change_password.test.ts
index 80a25e03ede62..34509edc2e9d2 100644
--- a/x-pack/plugins/security/server/routes/users/change_password.test.ts
+++ b/x-pack/plugins/security/server/routes/users/change_password.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { errors } from 'elasticsearch';
 import { ObjectType } from '@kbn/config-schema';
 import {
   IClusterClient,
@@ -13,6 +14,7 @@ import {
   RequestHandler,
   RequestHandlerContext,
   RouteConfig,
+  ScopeableRequest,
 } from '../../../../../../src/core/server';
 import { LICENSE_CHECK_STATE } from '../../../../licensing/server';
 import { Authentication, AuthenticationResult } from '../../authentication';
@@ -38,10 +40,7 @@ describe('Change password', () => {
   let routeConfig: RouteConfig<any, any, any, any>;
   let mockContext: RequestHandlerContext;
 
-  function checkPasswordChangeAPICall(
-    username: string,
-    request: ReturnType<typeof httpServerMock.createKibanaRequest>
-  ) {
+  function checkPasswordChangeAPICall(username: string, request: ScopeableRequest) {
     expect(mockClusterClient.asScoped).toHaveBeenCalledTimes(1);
     expect(mockClusterClient.asScoped).toHaveBeenCalledWith(request);
     expect(mockScopedClusterClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
@@ -55,8 +54,14 @@ describe('Change password', () => {
     router = httpServiceMock.createRouter();
     authc = authenticationMock.create();
 
-    authc.getCurrentUser.mockResolvedValue(mockAuthenticatedUser({ username: 'user' }));
+    authc.getCurrentUser.mockReturnValue(mockAuthenticatedUser({ username: 'user' }));
     authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockAuthenticatedUser()));
+    authc.getSessionInfo.mockResolvedValue({
+      now: Date.now(),
+      idleTimeoutExpiration: null,
+      lifespanExpiration: null,
+      provider: 'basic',
+    });
 
     mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
     mockClusterClient = elasticsearchServiceMock.createClusterClient();
@@ -122,14 +127,24 @@ describe('Change password', () => {
     });
 
     it('returns 403 if old password is wrong.', async () => {
-      const loginFailureReason = new Error('Something went wrong.');
-      authc.login.mockResolvedValue(AuthenticationResult.failed(loginFailureReason));
+      const changePasswordFailure = new (errors.AuthenticationException as any)('Unauthorized', {
+        body: { error: { header: { 'WWW-Authenticate': 'Negotiate' } } },
+      });
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(changePasswordFailure);
 
       const response = await routeHandler(mockContext, mockRequest, kibanaResponseFactory);
 
       expect(response.status).toBe(403);
-      expect(response.payload).toEqual(loginFailureReason);
-      expect(mockScopedClusterClient.callAsCurrentUser).not.toHaveBeenCalled();
+      expect(response.payload).toEqual(changePasswordFailure);
+
+      expect(mockScopedClusterClient.callAsCurrentUser).toHaveBeenCalledTimes(1);
+      expect(mockClusterClient.asScoped).toHaveBeenCalledTimes(1);
+      expect(mockClusterClient.asScoped).toHaveBeenCalledWith({
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
     });
 
     it(`returns 401 if user can't authenticate with new password.`, async () => {
@@ -148,10 +163,15 @@ describe('Change password', () => {
       expect(response.status).toBe(401);
       expect(response.payload).toEqual(loginFailureReason);
 
-      checkPasswordChangeAPICall(username, mockRequest);
+      checkPasswordChangeAPICall(username, {
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
     });
 
-    it('returns 500 if password update request fails.', async () => {
+    it('returns 500 if password update request fails with non-401 error.', async () => {
       const failureReason = new Error('Request failed.');
       mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
 
@@ -160,7 +180,12 @@ describe('Change password', () => {
       expect(response.status).toBe(500);
       expect(response.payload).toEqual(failureReason);
 
-      checkPasswordChangeAPICall(username, mockRequest);
+      checkPasswordChangeAPICall(username, {
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
     });
 
     it('successfully changes own password if provided old password is correct.', async () => {
@@ -169,7 +194,62 @@ describe('Change password', () => {
       expect(response.status).toBe(204);
       expect(response.payload).toBeUndefined();
 
-      checkPasswordChangeAPICall(username, mockRequest);
+      checkPasswordChangeAPICall(username, {
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
+
+      expect(authc.login).toHaveBeenCalledTimes(1);
+      expect(authc.login).toHaveBeenCalledWith(mockRequest, {
+        provider: 'basic',
+        value: { username, password: 'new-password' },
+      });
+    });
+
+    it('successfully changes own password if provided old password is correct for non-basic provider.', async () => {
+      const mockUser = mockAuthenticatedUser({
+        username: 'user',
+        authentication_provider: 'token',
+      });
+      authc.getCurrentUser.mockReturnValue(mockUser);
+      authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockUser));
+
+      const response = await routeHandler(mockContext, mockRequest, kibanaResponseFactory);
+
+      expect(response.status).toBe(204);
+      expect(response.payload).toBeUndefined();
+
+      checkPasswordChangeAPICall(username, {
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
+
+      expect(authc.login).toHaveBeenCalledTimes(1);
+      expect(authc.login).toHaveBeenCalledWith(mockRequest, {
+        provider: 'token',
+        value: { username, password: 'new-password' },
+      });
+    });
+
+    it('successfully changes own password but does not re-login if current session does not exist.', async () => {
+      authc.getSessionInfo.mockResolvedValue(null);
+      const response = await routeHandler(mockContext, mockRequest, kibanaResponseFactory);
+
+      expect(response.status).toBe(204);
+      expect(response.payload).toBeUndefined();
+
+      checkPasswordChangeAPICall(username, {
+        headers: {
+          ...mockRequest.headers,
+          authorization: `Basic ${Buffer.from(`${username}:old-password`).toString('base64')}`,
+        },
+      });
+
+      expect(authc.login).not.toHaveBeenCalled();
     });
   });
 
diff --git a/x-pack/plugins/security/server/routes/users/change_password.ts b/x-pack/plugins/security/server/routes/users/change_password.ts
index b9d04b4bd1e0e..fc3ca4573d500 100644
--- a/x-pack/plugins/security/server/routes/users/change_password.ts
+++ b/x-pack/plugins/security/server/routes/users/change_password.ts
@@ -5,7 +5,8 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { wrapIntoCustomErrorResponse } from '../../errors';
+import { canUserChangePassword } from '../../../common/model';
+import { getErrorStatusCode, wrapIntoCustomErrorResponse } from '../../errors';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
 import { RouteDefinitionParams } from '..';
 
@@ -13,7 +14,6 @@ export function defineChangeUserPasswordRoutes({
   authc,
   router,
   clusterClient,
-  config,
 }: RouteDefinitionParams) {
   router.post(
     {
@@ -27,54 +27,65 @@ export function defineChangeUserPasswordRoutes({
       },
     },
     createLicensedRouteHandler(async (context, request, response) => {
-      const username = request.params.username;
-      const { password, newPassword } = request.body;
-      const isCurrentUser = username === (await authc.getCurrentUser(request))!.username;
+      const { username } = request.params;
+      const { password: currentPassword, newPassword } = request.body;
 
-      // We should prefer `token` over `basic` if possible.
-      const providerToLoginWith = config.authc.providers.includes('token') ? 'token' : 'basic';
+      const currentUser = authc.getCurrentUser(request);
+      const isUserChangingOwnPassword =
+        currentUser && currentUser.username === username && canUserChangePassword(currentUser);
+      const currentSession = isUserChangingOwnPassword ? await authc.getSessionInfo(request) : null;
 
-      // If user tries to change own password, let's check if old password is valid first by trying
-      // to login.
-      if (isCurrentUser) {
-        try {
-          const authenticationResult = await authc.login(request, {
-            provider: providerToLoginWith,
-            value: { username, password },
-            // We shouldn't alter authentication state just yet.
-            stateless: true,
-          });
-
-          if (!authenticationResult.succeeded()) {
-            return response.forbidden({ body: authenticationResult.error });
-          }
-        } catch (error) {
-          return response.customError(wrapIntoCustomErrorResponse(error));
-        }
-      }
+      // If user is changing their own password they should provide a proof of knowledge their
+      // current password via sending it in `Authorization: Basic base64(username:current password)`
+      // HTTP header no matter how they logged in to Kibana.
+      const scopedClusterClient = clusterClient.asScoped(
+        isUserChangingOwnPassword
+          ? {
+              headers: {
+                ...request.headers,
+                authorization: `Basic ${Buffer.from(`${username}:${currentPassword}`).toString(
+                  'base64'
+                )}`,
+              },
+            }
+          : request
+      );
 
       try {
-        await clusterClient.asScoped(request).callAsCurrentUser('shield.changePassword', {
+        await scopedClusterClient.callAsCurrentUser('shield.changePassword', {
           username,
           body: { password: newPassword },
         });
+      } catch (error) {
+        // This may happen only if user's credentials are rejected meaning that current password
+        // isn't correct.
+        if (isUserChangingOwnPassword && getErrorStatusCode(error) === 401) {
+          return response.forbidden({ body: error });
+        }
+
+        return response.customError(wrapIntoCustomErrorResponse(error));
+      }
 
-        // Now we authenticate user with the new password again updating current session if any.
-        if (isCurrentUser) {
+      // If user previously had an active session and changed their own password we should re-login
+      // user with the new password and update session. We check this since it's possible to update
+      // password even if user is authenticated via HTTP headers and hence doesn't have an active
+      // session and in such cases we shouldn't create a new one.
+      if (isUserChangingOwnPassword && currentSession) {
+        try {
           const authenticationResult = await authc.login(request, {
-            provider: providerToLoginWith,
+            provider: currentUser!.authentication_provider,
             value: { username, password: newPassword },
           });
 
           if (!authenticationResult.succeeded()) {
             return response.unauthorized({ body: authenticationResult.error });
           }
+        } catch (error) {
+          return response.customError(wrapIntoCustomErrorResponse(error));
         }
-
-        return response.noContent();
-      } catch (error) {
-        return response.customError(wrapIntoCustomErrorResponse(error));
       }
+
+      return response.noContent();
     })
   );
 }
diff --git a/x-pack/plugins/task_manager/server/create_task_manager.test.ts b/x-pack/plugins/task_manager/server/create_task_manager.test.ts
index f4deeb1ea02ed..34258e15f45d1 100644
--- a/x-pack/plugins/task_manager/server/create_task_manager.test.ts
+++ b/x-pack/plugins/task_manager/server/create_task_manager.test.ts
@@ -6,8 +6,11 @@
 
 import { createTaskManager, LegacyDeps } from './create_task_manager';
 import { mockLogger } from './test_utils';
-import { CoreSetup, UuidServiceSetup } from 'kibana/server';
-import { savedObjectsRepositoryMock } from '../../../../src/core/server/mocks';
+import { CoreSetup, SavedObjectsSerializer, UuidServiceSetup } from '../../../../src/core/server';
+import {
+  savedObjectsRepositoryMock,
+  savedObjectsTypeRegistryMock,
+} from '../../../../src/core/server/mocks';
 
 jest.mock('./task_manager');
 
@@ -23,7 +26,7 @@ describe('createTaskManager', () => {
 
   const getMockLegacyDeps = (): LegacyDeps => ({
     config: {},
-    savedObjectSchemas: {},
+    savedObjectsSerializer: new SavedObjectsSerializer(savedObjectsTypeRegistryMock.create()),
     elasticsearch: {
       callAsInternalUser: jest.fn(),
     },
diff --git a/x-pack/plugins/task_manager/server/create_task_manager.ts b/x-pack/plugins/task_manager/server/create_task_manager.ts
index 5c66b8ba5bd58..9ff97bbcc17e6 100644
--- a/x-pack/plugins/task_manager/server/create_task_manager.ts
+++ b/x-pack/plugins/task_manager/server/create_task_manager.ts
@@ -7,7 +7,6 @@
 import {
   IClusterClient,
   SavedObjectsSerializer,
-  SavedObjectsSchema,
   CoreSetup,
   ISavedObjectsRepository,
 } from '../../../../src/core/server';
@@ -16,9 +15,9 @@ import { Logger } from './types';
 
 export interface LegacyDeps {
   config: any;
-  savedObjectSchemas: any;
   elasticsearch: Pick<IClusterClient, 'callAsInternalUser'>;
   savedObjectsRepository: ISavedObjectsRepository;
+  savedObjectsSerializer: SavedObjectsSerializer;
   logger: Logger;
 }
 
@@ -27,19 +26,16 @@ export function createTaskManager(
   {
     logger,
     config,
-    savedObjectSchemas,
     elasticsearch: { callAsInternalUser },
     savedObjectsRepository,
+    savedObjectsSerializer,
   }: LegacyDeps
 ) {
-  // as we use this Schema solely to interact with Tasks, we
-  // can initialise it with solely the Tasks schema
-  const serializer = new SavedObjectsSerializer(new SavedObjectsSchema(savedObjectSchemas));
   return new TaskManager({
     taskManagerId: core.uuid.getInstanceUuid(),
     config,
     savedObjectsRepository,
-    serializer,
+    serializer: savedObjectsSerializer,
     callAsInternalUser,
     logger,
   });
diff --git a/x-pack/plugins/task_manager/server/mocks.ts b/x-pack/plugins/task_manager/server/mocks.ts
new file mode 100644
index 0000000000000..00b27bd55e7dd
--- /dev/null
+++ b/x-pack/plugins/task_manager/server/mocks.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { TaskManagerSetupContract, TaskManagerStartContract } from './plugin';
+
+const createSetupMock = () => {
+  const mock: jest.Mocked<TaskManagerSetupContract> = {
+    registerLegacyAPI: jest.fn(),
+    addMiddleware: jest.fn(),
+    registerTaskDefinitions: jest.fn(),
+  };
+  return mock;
+};
+
+const createStartMock = () => {
+  const mock: jest.Mocked<TaskManagerStartContract> = {
+    fetch: jest.fn(),
+    remove: jest.fn(),
+    schedule: jest.fn(),
+    runNow: jest.fn(),
+    ensureScheduled: jest.fn(),
+  };
+  return mock;
+};
+
+export const taskManagerMock = {
+  createSetup: createSetupMock,
+  createStart: createStartMock,
+};
diff --git a/x-pack/plugins/task_manager/server/plugin.ts b/x-pack/plugins/task_manager/server/plugin.ts
index 8b09f8f2b445a..5e59be65c729d 100644
--- a/x-pack/plugins/task_manager/server/plugin.ts
+++ b/x-pack/plugins/task_manager/server/plugin.ts
@@ -4,18 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { PluginInitializerContext, Plugin, CoreSetup } from 'src/core/server';
-import { Observable, Subject } from 'rxjs';
+import { Subject } from 'rxjs';
 import { first } from 'rxjs/operators';
 import { once } from 'lodash';
 import { TaskDictionary, TaskDefinition } from './task';
 import { TaskManager } from './task_manager';
-import { createTaskManager, LegacyDeps } from './create_task_manager';
+import { createTaskManager } from './create_task_manager';
 import { TaskManagerConfig } from './config';
 import { Middleware } from './lib/middleware';
 
-export type PluginLegacyDependencies = Pick<LegacyDeps, 'savedObjectSchemas'>;
+// eslint-disable-next-line @typescript-eslint/no-empty-interface
+export interface PluginLegacyDependencies {}
 export type TaskManagerSetupContract = {
-  config$: Observable<TaskManagerConfig>;
   registerLegacyAPI: (legacyDependencies: PluginLegacyDependencies) => Promise<TaskManager>;
 } & Pick<TaskManager, 'addMiddleware' | 'registerTaskDefinitions'>;
 
@@ -40,7 +40,6 @@ export class TaskManagerPlugin
     const config$ = this.initContext.config.create<TaskManagerConfig>();
     const elasticsearch = core.elasticsearch.adminClient;
     return {
-      config$,
       registerLegacyAPI: once((__LEGACY: PluginLegacyDependencies) => {
         config$.subscribe(async config => {
           const [{ savedObjects }] = await core.getStartServices();
@@ -51,7 +50,7 @@ export class TaskManagerPlugin
               config,
               elasticsearch,
               savedObjectsRepository,
-              ...__LEGACY,
+              savedObjectsSerializer: savedObjects.createSerializer(),
             })
           );
           this.legacyTaskManager$.complete();
diff --git a/x-pack/plugins/task_manager/server/task_manager.mock.ts b/x-pack/plugins/task_manager/server/task_manager.mock.ts
index 9750dd14100d9..89d1210b00671 100644
--- a/x-pack/plugins/task_manager/server/task_manager.mock.ts
+++ b/x-pack/plugins/task_manager/server/task_manager.mock.ts
@@ -5,14 +5,12 @@
  */
 
 import { TaskManagerSetupContract, TaskManagerStartContract } from './plugin';
-import { Subject } from 'rxjs';
 
 export const taskManagerMock = {
   setup(overrides: Partial<jest.Mocked<TaskManagerSetupContract>> = {}) {
     const mocked: jest.Mocked<TaskManagerSetupContract> = {
       registerTaskDefinitions: jest.fn(),
       addMiddleware: jest.fn(),
-      config$: new Subject(),
       registerLegacyAPI: jest.fn(),
       ...overrides,
     };
diff --git a/x-pack/plugins/task_manager/server/task_manager.test.ts b/x-pack/plugins/task_manager/server/task_manager.test.ts
index a65723b2e8de7..3d48ce18c9d6a 100644
--- a/x-pack/plugins/task_manager/server/task_manager.test.ts
+++ b/x-pack/plugins/task_manager/server/task_manager.test.ts
@@ -21,13 +21,13 @@ import {
   TaskLifecycleEvent,
 } from './task_manager';
 import { savedObjectsRepositoryMock } from '../../../../src/core/server/mocks';
-import { SavedObjectsSerializer, SavedObjectsSchema } from '../../../../src/core/server';
+import { SavedObjectsSerializer, SavedObjectTypeRegistry } from '../../../../src/core/server';
 import { mockLogger } from './test_utils';
 import { asErr, asOk } from './lib/result_type';
 import { ConcreteTaskInstance, TaskLifecycleResult, TaskStatus } from './task';
 
 const savedObjectsClient = savedObjectsRepositoryMock.create();
-const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+const serializer = new SavedObjectsSerializer(new SavedObjectTypeRegistry());
 
 describe('TaskManager', () => {
   let clock: sinon.SinonFakeTimers;
diff --git a/x-pack/plugins/task_manager/server/task_store.test.ts b/x-pack/plugins/task_manager/server/task_store.test.ts
index e6cce7a664d91..6ed6ae16fa0f9 100644
--- a/x-pack/plugins/task_manager/server/task_store.test.ts
+++ b/x-pack/plugins/task_manager/server/task_store.test.ts
@@ -20,7 +20,7 @@ import { StoreOpts, OwnershipClaimingOpts, TaskStore, SearchOpts } from './task_
 import { savedObjectsRepositoryMock } from '../../../../src/core/server/mocks';
 import {
   SavedObjectsSerializer,
-  SavedObjectsSchema,
+  SavedObjectTypeRegistry,
   SavedObjectAttributes,
 } from '../../../../src/core/server';
 import { SavedObjectsErrorHelpers } from '../../../../src/core/server/saved_objects/service/lib/errors';
@@ -46,7 +46,7 @@ const taskDefinitions: TaskDictionary<TaskDefinition> = {
 };
 
 const savedObjectsClient = savedObjectsRepositoryMock.create();
-const serializer = new SavedObjectsSerializer(new SavedObjectsSchema());
+const serializer = new SavedObjectsSerializer(new SavedObjectTypeRegistry());
 
 beforeEach(() => jest.resetAllMocks());
 
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 3a6ba45413de6..b558e892895e7 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -77,123 +77,110 @@
   },
   "messages": {
     "common.ui.aggResponse.allDocsTitle": "すべてのドキュメント",
-    "common.ui.aggTypes.aggGroups.bucketsText": "バケット",
-    "common.ui.aggTypes.aggGroups.metricsText": "メトリック",
-    "common.ui.aggTypes.buckets.dateHistogramLabel": "{intervalDescription}ごとの {fieldName}",
-    "common.ui.aggTypes.buckets.dateHistogramTitle": "日付ヒストグラム",
-    "common.ui.aggTypes.buckets.dateRangeTitle": "日付範囲",
-    "common.ui.aggTypes.buckets.filtersTitle": "フィルター",
-    "common.ui.aggTypes.buckets.filterTitle": "フィルター",
-    "common.ui.aggTypes.buckets.geohashGridTitle": "ジオハッシュ",
-    "common.ui.aggTypes.buckets.geotileGridTitle": "ジオタイル",
-    "common.ui.aggTypes.buckets.histogramTitle": "ヒストグラム",
-    "common.ui.aggTypes.buckets.intervalOptions.autoDisplayName": "自動",
-    "common.ui.aggTypes.buckets.intervalOptions.dailyDisplayName": "日ごと",
-    "common.ui.aggTypes.buckets.intervalOptions.hourlyDisplayName": "1 時間ごと",
-    "common.ui.aggTypes.buckets.intervalOptions.millisecondDisplayName": "ミリ秒",
-    "common.ui.aggTypes.buckets.intervalOptions.minuteDisplayName": "分",
-    "common.ui.aggTypes.buckets.intervalOptions.monthlyDisplayName": "月ごと",
-    "common.ui.aggTypes.buckets.intervalOptions.secondDisplayName": "秒",
-    "common.ui.aggTypes.buckets.intervalOptions.weeklyDisplayName": "週ごと",
-    "common.ui.aggTypes.buckets.intervalOptions.yearlyDisplayName": "1 年ごと",
-    "common.ui.aggTypes.buckets.ipRangeLabel": "{fieldName} IP 範囲",
-    "common.ui.aggTypes.buckets.ipRangeTitle": "IPv4 範囲",
-    "common.ui.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} と {lt} {to}",
-    "common.ui.aggTypes.buckets.rangesLabel": "{fieldName} の範囲",
-    "common.ui.aggTypes.buckets.rangeTitle": "範囲",
-    "common.ui.aggTypes.buckets.significantTerms.excludeLabel": "除外",
-    "common.ui.aggTypes.buckets.significantTerms.includeLabel": "含める",
-    "common.ui.aggTypes.buckets.significantTermsLabel": "{fieldName} のトップ {size} の珍しいアイテム",
-    "common.ui.aggTypes.buckets.significantTermsTitle": "重要な用語",
-    "common.ui.aggTypes.buckets.terms.excludeLabel": "除外",
-    "common.ui.aggTypes.buckets.terms.includeLabel": "含める",
-    "common.ui.aggTypes.buckets.terms.missingBucketLabel": "欠測値",
-    "common.ui.aggTypes.buckets.terms.orderAscendingTitle": "昇順",
-    "common.ui.aggTypes.buckets.terms.orderDescendingTitle": "降順",
-    "common.ui.aggTypes.buckets.terms.otherBucketDescription": "このリクエストは、データバケットの基準外のドキュメントの数をカウントします。",
-    "common.ui.aggTypes.buckets.terms.otherBucketLabel": "その他",
-    "common.ui.aggTypes.buckets.terms.otherBucketTitle": "他のバケット",
-    "common.ui.aggTypes.buckets.termsTitle": "用語",
-    "common.ui.aggTypes.histogram.missingMaxMinValuesWarning": "自動スケールヒストグラムバケットから最高値と最低値を取得できません。これによりビジュアライゼーションのパフォーマンスが低下する可能性があります。",
-    "common.ui.aggTypes.metrics.averageBucketTitle": "平均バケット",
-    "common.ui.aggTypes.metrics.averageLabel": "平均 {field}",
-    "common.ui.aggTypes.metrics.averageTitle": "平均",
-    "common.ui.aggTypes.metrics.bucketAggTitle": "バケット集約",
-    "common.ui.aggTypes.metrics.countLabel": "カウント",
-    "common.ui.aggTypes.metrics.countTitle": "カウント",
-    "common.ui.aggTypes.metrics.cumulativeSumLabel": "累積合計",
-    "common.ui.aggTypes.metrics.cumulativeSumTitle": "累積合計",
-    "common.ui.aggTypes.metrics.derivativeLabel": "派生",
-    "common.ui.aggTypes.metrics.derivativeTitle": "派生",
-    "common.ui.aggTypes.metrics.geoBoundsLabel": "境界",
-    "common.ui.aggTypes.metrics.geoBoundsTitle": "境界",
-    "common.ui.aggTypes.metrics.geoCentroidLabel": "ジオセントロイド",
-    "common.ui.aggTypes.metrics.geoCentroidTitle": "ジオセントロイド",
-    "common.ui.aggTypes.metrics.maxBucketTitle": "最高バケット",
-    "common.ui.aggTypes.metrics.maxLabel": "最高 {field}",
-    "common.ui.aggTypes.metrics.maxTitle": "最高",
-    "common.ui.aggTypes.metrics.medianLabel": "中央 {field}",
-    "common.ui.aggTypes.metrics.medianTitle": "中央",
-    "common.ui.aggTypes.metrics.metricAggregationsSubtypeTitle": "メトリック集約",
-    "common.ui.aggTypes.metrics.metricAggTitle": "メトリック集約",
-    "common.ui.aggTypes.metrics.minBucketTitle": "最低バケット",
-    "common.ui.aggTypes.metrics.minLabel": "最低 {field}",
-    "common.ui.aggTypes.metrics.minTitle": "最低",
-    "common.ui.aggTypes.metrics.movingAvgLabel": "移動平均",
-    "common.ui.aggTypes.metrics.movingAvgTitle": "移動平均",
-    "common.ui.aggTypes.metrics.overallAverageLabel": "全体平均",
-    "common.ui.aggTypes.metrics.overallMaxLabel": "全体最高",
-    "common.ui.aggTypes.metrics.overallMinLabel": "全体最低",
-    "common.ui.aggTypes.metrics.overallSumLabel": "全体合計",
-    "common.ui.aggTypes.metrics.parentPipelineAggregationsSubtypeTitle": "親パイプライン集約",
-    "common.ui.aggTypes.metrics.percentileRanks.valuePropsLabel": "「{label}」の {format} のパーセンタイル順位",
-    "common.ui.aggTypes.metrics.percentileRanksLabel": "{field} のパーセンタイル順位",
-    "common.ui.aggTypes.metrics.percentileRanksTitle": "パーセンタイル順位",
-    "common.ui.aggTypes.metrics.percentiles.valuePropsLabel": "{label} の {percentile} パーセンタイル",
-    "common.ui.aggTypes.metrics.percentilesLabel": "{field} のパーセンタイル",
-    "common.ui.aggTypes.metrics.percentilesTitle": "パーセンタイル",
-    "common.ui.aggTypes.metrics.serialDiffLabel": "差分の推移",
-    "common.ui.aggTypes.metrics.serialDiffTitle": "差分の推移",
-    "common.ui.aggTypes.metrics.siblingPipelineAggregationsSubtypeTitle": "シブリングパイプラインアグリゲーション",
-    "common.ui.aggTypes.metrics.standardDeviation.keyDetailsLabel": "{fieldDisplayName} の標準偏差",
-    "common.ui.aggTypes.metrics.standardDeviation.lowerKeyDetailsTitle": "下の{label}",
-    "common.ui.aggTypes.metrics.standardDeviation.upperKeyDetailsTitle": "上の{label}",
-    "common.ui.aggTypes.metrics.standardDeviationLabel": "{field} の標準偏差",
-    "common.ui.aggTypes.metrics.standardDeviationTitle": "標準偏差",
-    "common.ui.aggTypes.metrics.sumBucketTitle": "合計バケット",
-    "common.ui.aggTypes.metrics.sumLabel": "{field} の合計",
-    "common.ui.aggTypes.metrics.sumTitle": "合計",
-    "common.ui.aggTypes.metrics.topHit.ascendingLabel": "昇順",
-    "common.ui.aggTypes.metrics.topHit.averageLabel": "平均",
-    "common.ui.aggTypes.metrics.topHit.concatenateLabel": "連結",
-    "common.ui.aggTypes.metrics.topHit.descendingLabel": "降順",
-    "common.ui.aggTypes.metrics.topHit.firstPrefixLabel": "最初",
-    "common.ui.aggTypes.metrics.topHit.lastPrefixLabel": "最後",
-    "common.ui.aggTypes.metrics.topHit.maxLabel": "最高",
-    "common.ui.aggTypes.metrics.topHit.minLabel": "最低",
-    "common.ui.aggTypes.metrics.topHit.sumLabel": "合計",
-    "common.ui.aggTypes.metrics.topHitTitle": "トップヒット",
-    "common.ui.aggTypes.metrics.uniqueCountLabel": "{field} のユニークカウント",
-    "common.ui.aggTypes.metrics.uniqueCountTitle": "ユニークカウント",
-    "common.ui.aggTypes.otherBucket.labelForMissingValuesLabel": "欠測値のラベル",
-    "common.ui.aggTypes.otherBucket.labelForOtherBucketLabel": "他のバケットのラベル",
-    "common.ui.aggTypes.paramTypes.field.invalidSavedFieldParameterErrorMessage": "保存された {fieldParameter} パラメーターが無効になりました。新しいフィールドを選択してください。",
-    "common.ui.aggTypes.paramTypes.field.requiredFieldParameterErrorMessage": "{fieldParameter} は必須パラメーターです",
-    "common.ui.aggTypes.string.customLabel": "カスタムラベル",
-    "common.ui.chrome.bigUrlWarningNotificationMessage": "{advancedSettingsLink}で{storeInSessionStorageParam}オプションを有効にするか、オンスクリーンビジュアルを簡素化してください。",
-    "common.ui.chrome.bigUrlWarningNotificationMessage.advancedSettingsLinkText": "高度な設定",
-    "common.ui.chrome.bigUrlWarningNotificationTitle": "URLが大きく、Kibanaの動作が停止する可能性があります",
-    "common.ui.directives.fieldNameIcons.booleanAriaLabel": "ブールフィールド",
-    "common.ui.directives.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド",
-    "common.ui.directives.fieldNameIcons.dateFieldAriaLabel": "日付フィールド",
-    "common.ui.directives.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイント",
-    "common.ui.directives.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報図形",
-    "common.ui.directives.fieldNameIcons.ipAddressFieldAriaLabel": "IP アドレスフィールド",
-    "common.ui.directives.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 フィールド",
-    "common.ui.directives.fieldNameIcons.numberFieldAriaLabel": "数値フィールド",
-    "common.ui.directives.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド",
-    "common.ui.directives.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド",
-    "common.ui.directives.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド",
+    "common.ui.aggTypes.rangesFormatMessage": "{gte} {from} と {lt} {to}",
+    "data.search.aggs.aggGroups.bucketsText": "バケット",
+    "data.search.aggs.aggGroups.metricsText": "メトリック",
+    "data.search.aggs.buckets.dateHistogramLabel": "{intervalDescription}ごとの {fieldName}",
+    "data.search.aggs.buckets.dateHistogramTitle": "日付ヒストグラム",
+    "data.search.aggs.buckets.dateRangeTitle": "日付範囲",
+    "data.search.aggs.buckets.filtersTitle": "フィルター",
+    "data.search.aggs.buckets.filterTitle": "フィルター",
+    "data.search.aggs.buckets.geohashGridTitle": "ジオハッシュ",
+    "data.search.aggs.buckets.geotileGridTitle": "ジオタイル",
+    "data.search.aggs.buckets.histogramTitle": "ヒストグラム",
+    "data.search.aggs.buckets.intervalOptions.autoDisplayName": "自動",
+    "data.search.aggs.buckets.intervalOptions.dailyDisplayName": "日ごと",
+    "data.search.aggs.buckets.intervalOptions.hourlyDisplayName": "1 時間ごと",
+    "data.search.aggs.buckets.intervalOptions.millisecondDisplayName": "ミリ秒",
+    "data.search.aggs.buckets.intervalOptions.minuteDisplayName": "分",
+    "data.search.aggs.buckets.intervalOptions.monthlyDisplayName": "月ごと",
+    "data.search.aggs.buckets.intervalOptions.secondDisplayName": "秒",
+    "data.search.aggs.buckets.intervalOptions.weeklyDisplayName": "週ごと",
+    "data.search.aggs.buckets.intervalOptions.yearlyDisplayName": "1 年ごと",
+    "data.search.aggs.buckets.ipRangeLabel": "{fieldName} IP 範囲",
+    "data.search.aggs.buckets.ipRangeTitle": "IPv4 範囲",
+    "data.search.aggs.aggTypes.rangesFormatMessage": "{gte} {from} と {lt} {to}",
+    "data.search.aggs.aggTypesLabel": "{fieldName} の範囲",
+    "data.search.aggs.buckets.rangeTitle": "範囲",
+    "data.search.aggs.buckets.significantTerms.excludeLabel": "除外",
+    "data.search.aggs.buckets.significantTerms.includeLabel": "含める",
+    "data.search.aggs.buckets.significantTermsLabel": "{fieldName} のトップ {size} の珍しいアイテム",
+    "data.search.aggs.buckets.significantTermsTitle": "重要な用語",
+    "data.search.aggs.buckets.terms.excludeLabel": "除外",
+    "data.search.aggs.buckets.terms.includeLabel": "含める",
+    "data.search.aggs.buckets.terms.missingBucketLabel": "欠測値",
+    "data.search.aggs.buckets.terms.orderAscendingTitle": "昇順",
+    "data.search.aggs.buckets.terms.orderDescendingTitle": "降順",
+    "data.search.aggs.buckets.terms.otherBucketDescription": "このリクエストは、データバケットの基準外のドキュメントの数をカウントします。",
+    "data.search.aggs.buckets.terms.otherBucketLabel": "その他",
+    "data.search.aggs.buckets.terms.otherBucketTitle": "他のバケット",
+    "data.search.aggs.buckets.termsTitle": "用語",
+    "data.search.aggs.histogram.missingMaxMinValuesWarning": "自動スケールヒストグラムバケットから最高値と最低値を取得できません。これによりビジュアライゼーションのパフォーマンスが低下する可能性があります。",
+    "data.search.aggs.metrics.averageBucketTitle": "平均バケット",
+    "data.search.aggs.metrics.averageLabel": "平均 {field}",
+    "data.search.aggs.metrics.averageTitle": "平均",
+    "data.search.aggs.metrics.bucketAggTitle": "バケット集約",
+    "data.search.aggs.metrics.countLabel": "カウント",
+    "data.search.aggs.metrics.countTitle": "カウント",
+    "data.search.aggs.metrics.cumulativeSumLabel": "累積合計",
+    "data.search.aggs.metrics.cumulativeSumTitle": "累積合計",
+    "data.search.aggs.metrics.derivativeLabel": "派生",
+    "data.search.aggs.metrics.derivativeTitle": "派生",
+    "data.search.aggs.metrics.geoBoundsLabel": "境界",
+    "data.search.aggs.metrics.geoBoundsTitle": "境界",
+    "data.search.aggs.metrics.geoCentroidLabel": "ジオセントロイド",
+    "data.search.aggs.metrics.geoCentroidTitle": "ジオセントロイド",
+    "data.search.aggs.metrics.maxBucketTitle": "最高バケット",
+    "data.search.aggs.metrics.maxLabel": "最高 {field}",
+    "data.search.aggs.metrics.maxTitle": "最高",
+    "data.search.aggs.metrics.medianLabel": "中央 {field}",
+    "data.search.aggs.metrics.medianTitle": "中央",
+    "data.search.aggs.metrics.metricAggregationsSubtypeTitle": "メトリック集約",
+    "data.search.aggs.metrics.metricAggTitle": "メトリック集約",
+    "data.search.aggs.metrics.minBucketTitle": "最低バケット",
+    "data.search.aggs.metrics.minLabel": "最低 {field}",
+    "data.search.aggs.metrics.minTitle": "最低",
+    "data.search.aggs.metrics.movingAvgLabel": "移動平均",
+    "data.search.aggs.metrics.movingAvgTitle": "移動平均",
+    "data.search.aggs.metrics.overallAverageLabel": "全体平均",
+    "data.search.aggs.metrics.overallMaxLabel": "全体最高",
+    "data.search.aggs.metrics.overallMinLabel": "全体最低",
+    "data.search.aggs.metrics.overallSumLabel": "全体合計",
+    "data.search.aggs.metrics.parentPipelineAggregationsSubtypeTitle": "親パイプライン集約",
+    "data.search.aggs.metrics.percentileRanks.valuePropsLabel": "「{label}」の {format} のパーセンタイル順位",
+    "data.search.aggs.metrics.percentileRanksLabel": "{field} のパーセンタイル順位",
+    "data.search.aggs.metrics.percentileRanksTitle": "パーセンタイル順位",
+    "data.search.aggs.metrics.percentiles.valuePropsLabel": "{label} の {percentile} パーセンタイル",
+    "data.search.aggs.metrics.percentilesLabel": "{field} のパーセンタイル",
+    "data.search.aggs.metrics.percentilesTitle": "パーセンタイル",
+    "data.search.aggs.metrics.serialDiffLabel": "差分の推移",
+    "data.search.aggs.metrics.serialDiffTitle": "差分の推移",
+    "data.search.aggs.metrics.siblingPipelineAggregationsSubtypeTitle": "シブリングパイプラインアグリゲーション",
+    "data.search.aggs.metrics.standardDeviation.keyDetailsLabel": "{fieldDisplayName} の標準偏差",
+    "data.search.aggs.metrics.standardDeviation.lowerKeyDetailsTitle": "下の{label}",
+    "data.search.aggs.metrics.standardDeviation.upperKeyDetailsTitle": "上の{label}",
+    "data.search.aggs.metrics.standardDeviationLabel": "{field} の標準偏差",
+    "data.search.aggs.metrics.standardDeviationTitle": "標準偏差",
+    "data.search.aggs.metrics.sumBucketTitle": "合計バケット",
+    "data.search.aggs.metrics.sumLabel": "{field} の合計",
+    "data.search.aggs.metrics.sumTitle": "合計",
+    "data.search.aggs.metrics.topHit.ascendingLabel": "昇順",
+    "data.search.aggs.metrics.topHit.averageLabel": "平均",
+    "data.search.aggs.metrics.topHit.concatenateLabel": "連結",
+    "data.search.aggs.metrics.topHit.descendingLabel": "降順",
+    "data.search.aggs.metrics.topHit.firstPrefixLabel": "最初",
+    "data.search.aggs.metrics.topHit.lastPrefixLabel": "最後",
+    "data.search.aggs.metrics.topHit.maxLabel": "最高",
+    "data.search.aggs.metrics.topHit.minLabel": "最低",
+    "data.search.aggs.metrics.topHit.sumLabel": "合計",
+    "data.search.aggs.metrics.topHitTitle": "トップヒット",
+    "data.search.aggs.metrics.uniqueCountLabel": "{field} のユニークカウント",
+    "data.search.aggs.metrics.uniqueCountTitle": "ユニークカウント",
+    "data.search.aggs.otherBucket.labelForMissingValuesLabel": "欠測値のラベル",
+    "data.search.aggs.otherBucket.labelForOtherBucketLabel": "他のバケットのラベル",
+    "data.search.aggs.paramTypes.field.invalidSavedFieldParameterErrorMessage": "保存された {fieldParameter} パラメーターが無効になりました。新しいフィールドを選択してください。",
+    "data.search.aggs.paramTypes.field.requiredFieldParameterErrorMessage": "{fieldParameter} は必須パラメーターです",
+    "data.search.aggs.string.customLabel": "カスタムラベル",
     "common.ui.directives.paginate.size.allDropDownOptionLabel": "すべて",
     "common.ui.dualRangeControl.mustSetBothErrorMessage": "下と上の値の両方を設定する必要があります",
     "common.ui.dualRangeControl.outsideOfRangeErrorMessage": "値は {min} と {max} の間でなければなりません",
@@ -366,11 +353,6 @@
     "common.ui.flotCharts.tueLabel": "火",
     "common.ui.flotCharts.wedLabel": "水",
     "common.ui.modals.cancelButtonLabel": "キャンセル",
-    "common.ui.notify.fatalError.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}",
-    "common.ui.notify.fatalError.unavailableServerErrorMessage": "HTTP リクエストが接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。",
-    "common.ui.notify.toaster.errorMessage": "エラー: {errorMessage}\n      {errorStack}",
-    "common.ui.notify.toaster.errorStatusMessage": "エラー {errStatus} {errStatusText}: {errMessage}",
-    "common.ui.notify.toaster.unavailableServerErrorMessage": "HTTP リクエストが接続に失敗しました。Kibana サーバーが実行されていて、ご使用のブラウザの接続が正常に動作していることを確認するか、システム管理者にお問い合わせください。",
     "common.ui.paginateControls.pageSizeLabel": "ページサイズ",
     "common.ui.paginateControls.scrollTopButtonLabel": "最上部に移動",
     "common.ui.savedObjects.confirmModal.overwriteButtonLabel": "上書き",
@@ -386,7 +368,7 @@
     "common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage": "セッションがいっぱいで安全に削除できるアイテムが見つからないため、Kibana は履歴アイテムを保存できません。\n\nこれは大抵新規タブに移動することで解決されますが、より大きな問題が原因である可能性もあります。このメッセージが定期的に表示される場合は、{gitHubIssuesUrl} で問題を報告してください。",
     "common.ui.url.replacementFailedErrorMessage": "置換に失敗、未解決の表現式: {expr}",
     "common.ui.url.savedObjectIsMissingNotificationMessage": "保存されたオブジェクトがありません",
-    "common.ui.vis.aggConfig.percentageOfLabel": "{label} のパーセンテージ",
+    "data.search.aggs.percentageOfLabel": "{label} のパーセンテージ",
     "common.ui.vis.defaultFeedbackMessage": "フィードバックがありますか？{link} で問題を報告してください。",
     "common.ui.vis.kibanaMap.leaflet.fitDataBoundsAriaLabel": "データバウンドを合わせる",
     "common.ui.vis.kibanaMap.zoomWarning": "ズームレベルが最大に達しました。完全にズームインするには、Elasticsearch と Kibana の {defaultDistribution} にアップグレードしてください。{ems} でより多くのズームレベルが利用できます。または、独自のマップサーバーを構成できます。詳細は { wms } または { configSettings} をご覧ください。",
@@ -1114,6 +1096,17 @@
     "kbn.discover.fieldChooser.searchPlaceHolder": "検索フィールド",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "フィールド設定を非表示",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "フィールド設定を表示",
+    "kbn.discover.fieldNameIcons.booleanAriaLabel": "ブールフィールド",
+    "kbn.discover.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド",
+    "kbn.discover.fieldNameIcons.dateFieldAriaLabel": "日付フィールド",
+    "kbn.discover.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイント",
+    "kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報図形",
+    "kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP アドレスフィールド",
+    "kbn.discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 フィールド",
+    "kbn.discover.fieldNameIcons.numberFieldAriaLabel": "数値フィールド",
+    "kbn.discover.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド",
+    "kbn.discover.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド",
+    "kbn.discover.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド",
     "kbn.discover.histogram.partialData.bucketTooltipText": "選択された時間範囲にはこのバケット全体は含まれていませんが、一部データが含まれている可能性があります。",
     "kbn.discover.histogramOfFoundDocumentsAriaLabel": "発見されたドキュメントのヒストグラム",
     "kbn.discover.hitsPluralTitle": "{hits, plural, one {ヒット} other {ヒット}}",
@@ -1624,7 +1617,7 @@
     "kbn.management.settings.form.clearSearchResultText": "(検索結果を消去)",
     "kbn.management.settings.form.noSearchResultText": "設定が見つかりませんでした {clearSearch}",
     "kbn.management.settings.form.searchResultText": "検索用語により {settingsCount} 件の設定が非表示になっています {clearSearch}",
-    "kbn.management.settings.pageTitle": "設定",
+    "advancedSettings.pageTitle": "設定",
     "kbn.management.settings.searchBar.unableToParseQueryErrorMessage": "クエリをパースできません",
     "kbn.management.settings.searchBarAriaLabel": "高度な設定を検索",
     "kbn.management.settings.sectionLabel": "高度な設定",
@@ -1656,24 +1649,6 @@
     "kbn.visualize.listing.table.listTitle": "ビジュアライゼーション",
     "kbn.visualize.listing.table.titleColumnName": "タイトル",
     "kbn.visualize.listing.table.typeColumnName": "タイプ",
-    "kbn.visualize.newVisWizard.betaDescription": "このビジュアライゼーションはベータ段階で、変更される可能性があります。デザインとコードはオフィシャル GA 機能よりも完成度が低く、現状のまま保証なしで提供されています。ベータ機能にはオフィシャル GA 機能の SLA が適用されません",
-    "kbn.visualize.newVisWizard.betaTitle": "ベータ",
-    "kbn.visualize.newVisWizard.chooseSourceTitle": "ソースの選択",
-    "kbn.visualize.newVisWizard.experimentalDescription": "このビジュアライゼーションは実験的なものです。デザインと導入は安定したビジュアライゼーションよりも完成度が低く、変更される可能性があります。",
-    "kbn.visualize.newVisWizard.experimentalTitle": "実験的",
-    "kbn.visualize.newVisWizard.experimentalTooltip": "このビジュアライゼーションは今後のリリースで変更または削除される可能性があり、SLA のサポート対象になりません。",
-    "kbn.visualize.newVisWizard.filterVisTypeAriaLabel": "ビジュアライゼーションのタイプでフィルタリング",
-    "kbn.visualize.newVisWizard.helpText": "タイプを選択してビジュアライゼーションの作成を始めましょう。",
-    "kbn.visualize.newVisWizard.helpTextAriaLabel": "タイプを選択してビジュアライゼーションの作成を始めましょう。ESC を押してこのモダルを閉じます。Tab キーを押して次に進みます。",
-    "kbn.visualize.newVisWizard.newVisTypeTitle": "新規 {visTypeName}",
-    "kbn.visualize.newVisWizard.resultsFound": "{resultCount} 個の{resultCount, plural, one {タイプ} other {タイプ} } が見つかりました",
-    "kbn.visualize.newVisWizard.searchSelection.notFoundLabel": "一致するインデックスまたは保存された検索が見つかりませんでした。",
-    "kbn.visualize.newVisWizard.searchSelection.savedObjectType.indexPattern": "インデックスパターン",
-    "kbn.visualize.newVisWizard.searchSelection.savedObjectType.search": "保存された検索",
-    "kbn.visualize.newVisWizard.selectVisType": "ビジュアライゼーションのタイプを選択してください",
-    "kbn.visualize.newVisWizard.title": "新規ビジュアライゼーション",
-    "kbn.visualize.newVisWizard.visTypeAliasDescription": "Visualize外でKibanaアプリケーションを開きます。",
-    "kbn.visualize.newVisWizard.visTypeAliasTitle": "Kibanaアプリケーション",
     "kbn.visualize.pageHeading": "{chartName} {chartType} ビジュアライゼーション",
     "kbn.visualize.saveDialog.saveAndAddToDashboardButtonLabel": "保存してダッシュボードに追加",
     "kbn.visualize.topNavMenu.openInspectorButtonAriaLabel": "ビジュアライゼーションのインスペクターを開く",
@@ -1690,6 +1665,14 @@
     "kbn.visualize.wizard.step1Breadcrumb": "作成",
     "kbn.visualize.wizard.step2Breadcrumb": "作成",
     "kbn.visualizeTitle": "可視化",
+    "kibana_legacy.bigUrlWarningNotificationMessage": "{advancedSettingsLink}で{storeInSessionStorageParam}オプションを有効にするか、オンスクリーンビジュアルを簡素化してください。",
+    "kibana_legacy.bigUrlWarningNotificationMessage.advancedSettingsLinkText": "高度な設定",
+    "kibana_legacy.bigUrlWarningNotificationTitle": "URLが大きく、Kibanaの動作が停止する可能性があります",
+    "kibana_legacy.notify.fatalError.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
+    "kibana_legacy.notify.fatalError.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
+    "kibana_legacy.notify.toaster.errorMessage": "错误：{errorMessage}\n      {errorStack}",
+    "kibana_legacy.notify.toaster.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
+    "kibana_legacy.notify.toaster.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
     "home.tutorials.common.auditbeat.cloudInstructions.gettingStarted.title": "はじめに",
     "home.tutorials.common.auditbeat.premCloudInstructions.gettingStarted.title": "はじめに",
     "home.tutorials.common.auditbeat.premInstructions.gettingStarted.title": "はじめに",
@@ -2433,20 +2416,6 @@
     "visTypeVislib.vislib.legend.toggleOptionsButtonAriaLabel": "{legendDataLabel}、トグルオプション",
     "kibana-react.exitFullScreenButton.exitFullScreenModeButtonLabel": "全画面を終了",
     "kibana-react.exitFullScreenButton.fullScreenModeDescription": "ESC キーで全画面モードを終了します。",
-    "kibana-react.savedObjects.finder.filterButtonLabel": "タイプ",
-    "kibana-react.savedObjects.finder.searchPlaceholder": "検索...",
-    "kibana-react.savedObjects.finder.sortAsc": "昇順",
-    "kibana-react.savedObjects.finder.sortAuto": "ベストマッチ",
-    "kibana-react.savedObjects.finder.sortButtonLabel": "並べ替え",
-    "kibana-react.savedObjects.finder.sortDesc": "降順",
-    "kibana-react.savedObjects.saveModal.cancelButtonLabel": "キャンセル",
-    "kibana-react.savedObjects.saveModal.descriptionLabel": "説明",
-    "kibana-react.savedObjects.saveModal.duplicateTitleDescription": "{confirmSaveLabel} をクリックすると、既存の {objectType} が上書きされます。",
-    "kibana-react.savedObjects.saveModal.duplicateTitleLabel": "「{title}」というタイトルの {objectType} が既に存在します",
-    "kibana-react.savedObjects.saveModal.saveAsNewLabel": "新規 {objectType} として保存",
-    "kibana-react.savedObjects.saveModal.saveButtonLabel": "保存",
-    "kibana-react.savedObjects.saveModal.saveTitle": "{objectType} を保存",
-    "kibana-react.savedObjects.saveModal.titleLabel": "タイトル",
     "newsfeed.emptyPrompt.noNewsText": "Kibanaインスタンスがインターネットにアクセスできない場合、管理者にこの機能を無効にするように依頼してください。そうでない場合は、ニュースを取り込み続けます。",
     "newsfeed.emptyPrompt.noNewsTitle": "ニュースがない場合",
     "newsfeed.flyoutList.closeButtonLabel": "閉じる",
@@ -2476,6 +2445,20 @@
     "regionMap.visParams.vectorMapLabel": "ベクトルマップ",
     "regionMap.visualization.unableToShowMismatchesWarningText": "次の各用語がシェイプの結合フィールドのシェイプと一致することを確認してください: {mismatches}",
     "regionMap.visualization.unableToShowMismatchesWarningTitle": "{mismatchesLength} {oneMismatch, plural, one { 件の結果} other { 件の結果}}をマップに表示できません",
+    "savedObjects.finder.filterButtonLabel": "タイプ",
+    "savedObjects.finder.searchPlaceholder": "検索...",
+    "savedObjects.finder.sortAsc": "昇順",
+    "savedObjects.finder.sortAuto": "ベストマッチ",
+    "savedObjects.finder.sortButtonLabel": "並べ替え",
+    "savedObjects.finder.sortDesc": "降順",
+    "savedObjects.saveModal.cancelButtonLabel": "キャンセル",
+    "savedObjects.saveModal.descriptionLabel": "説明",
+    "savedObjects.saveModal.duplicateTitleDescription": "{confirmSaveLabel} をクリックすると、既存の {objectType} が上書きされます。",
+    "savedObjects.saveModal.duplicateTitleLabel": "「{title}」というタイトルの {objectType} が既に存在します",
+    "savedObjects.saveModal.saveAsNewLabel": "新規 {objectType} として保存",
+    "savedObjects.saveModal.saveButtonLabel": "保存",
+    "savedObjects.saveModal.saveTitle": "{objectType} を保存",
+    "savedObjects.saveModal.titleLabel": "タイトル",
     "server.stats.notReadyMessage": "まだ統計が準備できていません。後程再試行してください",
     "server.status.disabledTitle": "無効",
     "server.status.greenTitle": "緑",
@@ -2897,6 +2880,24 @@
     "timelion.vis.intervalLabel": "間隔",
     "uiActions.actionPanel.title": "オプション",
     "uiActions.errors.incompatibleAction": "操作に互換性がありません",
+    "visualizations.newVisWizard.betaDescription": "このビジュアライゼーションはベータ段階で、変更される可能性があります。デザインとコードはオフィシャル GA 機能よりも完成度が低く、現状のまま保証なしで提供されています。ベータ機能にはオフィシャル GA 機能の SLA が適用されません",
+    "visualizations.newVisWizard.betaTitle": "ベータ",
+    "visualizations.newVisWizard.chooseSourceTitle": "ソースの選択",
+    "visualizations.newVisWizard.experimentalDescription": "このビジュアライゼーションは実験的なものです。デザインと導入は安定したビジュアライゼーションよりも完成度が低く、変更される可能性があります。",
+    "visualizations.newVisWizard.experimentalTitle": "実験的",
+    "visualizations.newVisWizard.experimentalTooltip": "このビジュアライゼーションは今後のリリースで変更または削除される可能性があり、SLA のサポート対象になりません。",
+    "visualizations.newVisWizard.filterVisTypeAriaLabel": "ビジュアライゼーションのタイプでフィルタリング",
+    "visualizations.newVisWizard.helpText": "タイプを選択してビジュアライゼーションの作成を始めましょう。",
+    "visualizations.newVisWizard.helpTextAriaLabel": "タイプを選択してビジュアライゼーションの作成を始めましょう。ESC を押してこのモダルを閉じます。Tab キーを押して次に進みます。",
+    "visualizations.newVisWizard.newVisTypeTitle": "新規 {visTypeName}",
+    "visualizations.newVisWizard.resultsFound": "{resultCount} 個の{resultCount, plural, one {タイプ} other {タイプ} } が見つかりました",
+    "visualizations.newVisWizard.searchSelection.notFoundLabel": "一致するインデックスまたは保存された検索が見つかりませんでした。",
+    "visualizations.newVisWizard.searchSelection.savedObjectType.indexPattern": "インデックスパターン",
+    "visualizations.newVisWizard.searchSelection.savedObjectType.search": "保存された検索",
+    "visualizations.newVisWizard.selectVisType": "ビジュアライゼーションのタイプを選択してください",
+    "visualizations.newVisWizard.title": "新規ビジュアライゼーション",
+    "visualizations.newVisWizard.visTypeAliasDescription": "Visualize外でKibanaアプリケーションを開きます。",
+    "visualizations.newVisWizard.visTypeAliasTitle": "Kibanaアプリケーション",
     "visualizations.queryGeohashBounds.unableToGetBoundErrorTitle": "バウンドを取得できませんでした",
     "visDefaultEditor.aggSelect.aggregationLabel": "集約",
     "visDefaultEditor.aggSelect.helpLinkLabel": "{aggTitle} のヘルプ",
@@ -3872,7 +3873,6 @@
     "xpack.apm.serviceDetails.metricsTabLabel": "メトリック",
     "xpack.apm.serviceDetails.nodesTabLabel": "JVM",
     "xpack.apm.serviceDetails.transactionsTabLabel": "トランザクション",
-    "xpack.apm.serviceMap.fullscreen": "全画面",
     "xpack.apm.serviceMap.zoomIn": "ズームイン",
     "xpack.apm.serviceMap.zoomOut": "ズームアウト",
     "xpack.apm.serviceNodeMetrics.containerId": "コンテナー ID",
@@ -5353,8 +5353,6 @@
     "xpack.crossClusterReplication.autoFollowPatternCreateForm.loadingRemoteClustersMessage": "リモートクラスターを読み込み中…",
     "xpack.crossClusterReplication.autoFollowPatternCreateForm.saveButtonLabel": "作成",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.closeButtonLabel": "閉じる",
-    "xpack.crossClusterReplication.autoFollowPatternDetailPanel.deleteButtonLabel": "削除",
-    "xpack.crossClusterReplication.autoFollowPatternDetailPanel.editButtonLabel": "編集",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.leaderPatternsLabel": "リーダーパターン",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.notFoundLabel": "自動フォローパターンが見つかりません",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixEmptyValue": "接頭辞がありません",
@@ -6753,23 +6751,23 @@
     "xpack.infra.waffle.unableToSelectMetricErrorTitle": "メトリックのオプションまたは値を選択できません",
     "xpack.infra.waffleTime.autoRefreshButtonLabel": "自動更新",
     "xpack.infra.waffleTime.stopRefreshingButtonLabel": "更新中止",
-    "xpack.kueryAutocomplete.andOperatorDescription": "{bothArguments}がtrueであることを条件とする",
-    "xpack.kueryAutocomplete.andOperatorDescription.bothArgumentsText": "両方の引数",
-    "xpack.kueryAutocomplete.equalOperatorDescription": "一部の値に{equals}",
-    "xpack.kueryAutocomplete.equalOperatorDescription.equalsText": "一致する",
-    "xpack.kueryAutocomplete.existOperatorDescription": "いずれかの形式中に{exists}",
-    "xpack.kueryAutocomplete.existOperatorDescription.existsText": "存在する",
-    "xpack.kueryAutocomplete.filterResultsDescription": "{fieldName}を含む結果をフィルタリング",
-    "xpack.kueryAutocomplete.greaterThanOperatorDescription": "が一部の値{greaterThan}",
-    "xpack.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText": "より大きい",
-    "xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription": "が一部の値{greaterThanOrEqualTo}",
-    "xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText": "よりも大きいまたは等しい",
-    "xpack.kueryAutocomplete.lessThanOperatorDescription": "が一部の値{lessThan}",
-    "xpack.kueryAutocomplete.lessThanOperatorDescription.lessThanText": "より小さい",
-    "xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription": "が一部の値{lessThanOrEqualTo}",
-    "xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "より小さいまたは等しい",
-    "xpack.kueryAutocomplete.orOperatorDescription": "{oneOrMoreArguments}がtrueであることを条件とする",
-    "xpack.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "1つ以上の引数",
+    "xpack.data.kueryAutocomplete.andOperatorDescription": "{bothArguments}がtrueであることを条件とする",
+    "xpack.data.kueryAutocomplete.andOperatorDescription.bothArgumentsText": "両方の引数",
+    "xpack.data.kueryAutocomplete.equalOperatorDescription": "一部の値に{equals}",
+    "xpack.data.kueryAutocomplete.equalOperatorDescription.equalsText": "一致する",
+    "xpack.data.kueryAutocomplete.existOperatorDescription": "いずれかの形式中に{exists}",
+    "xpack.data.kueryAutocomplete.existOperatorDescription.existsText": "存在する",
+    "xpack.data.kueryAutocomplete.filterResultsDescription": "{fieldName}を含む結果をフィルタリング",
+    "xpack.data.kueryAutocomplete.greaterThanOperatorDescription": "が一部の値{greaterThan}",
+    "xpack.data.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText": "より大きい",
+    "xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription": "が一部の値{greaterThanOrEqualTo}",
+    "xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText": "よりも大きいまたは等しい",
+    "xpack.data.kueryAutocomplete.lessThanOperatorDescription": "が一部の値{lessThan}",
+    "xpack.data.kueryAutocomplete.lessThanOperatorDescription.lessThanText": "より小さい",
+    "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription": "が一部の値{lessThanOrEqualTo}",
+    "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "より小さいまたは等しい",
+    "xpack.data.kueryAutocomplete.orOperatorDescription": "{oneOrMoreArguments}がtrueであることを条件とする",
+    "xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "1つ以上の引数",
     "xpack.lens.app.docLoadingError": "保存されたドキュメントの保存中にエラーが発生",
     "xpack.lens.app.docSavingError": "ドキュメントの保存中にエラーが発生",
     "xpack.lens.app.indexPatternLoadingError": "インデックスパターンの読み込み中にエラーが発生",
@@ -10393,8 +10391,6 @@
     "xpack.rollupJobs.detailPanel.jobActionMenu.buttonLabel": "管理",
     "xpack.rollupJobs.detailPanel.loadingLabel": "ロールアップジョブを読み込み中…",
     "xpack.rollupJobs.detailPanel.notFoundLabel": "ロールアップジョブが見つかりません",
-    "xpack.rollupJobs.editorConfig.dateHistogram.customInterval.helpText": "ロールアップ構成の間隔の倍数でなければなりません: {interval}",
-    "xpack.rollupJobs.editorConfig.histogram.interval.helpText": "ロールアップ構成の間隔の倍数でなければなりません: {interval}",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultButtonDescription": "要約データに制限された集約を実行します。",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultButtonText": "ロールアップインデックスパターン",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultTypeName": "ロールアップインデックスパターン",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index f7cbaa7d72158..412e31763986c 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -77,123 +77,110 @@
   },
   "messages": {
     "common.ui.aggResponse.allDocsTitle": "所有文档",
-    "common.ui.aggTypes.aggGroups.bucketsText": "存储桶",
-    "common.ui.aggTypes.aggGroups.metricsText": "指标",
-    "common.ui.aggTypes.buckets.dateHistogramLabel": "{fieldName}/{intervalDescription}",
-    "common.ui.aggTypes.buckets.dateHistogramTitle": "Date Histogram",
-    "common.ui.aggTypes.buckets.dateRangeTitle": "日期范围",
-    "common.ui.aggTypes.buckets.filtersTitle": "筛选",
-    "common.ui.aggTypes.buckets.filterTitle": "筛选",
-    "common.ui.aggTypes.buckets.geohashGridTitle": "Geohash",
-    "common.ui.aggTypes.buckets.geotileGridTitle": "地理磁贴",
-    "common.ui.aggTypes.buckets.histogramTitle": "Histogram",
-    "common.ui.aggTypes.buckets.intervalOptions.autoDisplayName": "自动",
-    "common.ui.aggTypes.buckets.intervalOptions.dailyDisplayName": "每日",
-    "common.ui.aggTypes.buckets.intervalOptions.hourlyDisplayName": "每小时",
-    "common.ui.aggTypes.buckets.intervalOptions.millisecondDisplayName": "毫秒",
-    "common.ui.aggTypes.buckets.intervalOptions.minuteDisplayName": "分钟",
-    "common.ui.aggTypes.buckets.intervalOptions.monthlyDisplayName": "每月",
-    "common.ui.aggTypes.buckets.intervalOptions.secondDisplayName": "秒",
-    "common.ui.aggTypes.buckets.intervalOptions.weeklyDisplayName": "每周",
-    "common.ui.aggTypes.buckets.intervalOptions.yearlyDisplayName": "每年",
-    "common.ui.aggTypes.buckets.ipRangeLabel": "{fieldName} IP 范围",
-    "common.ui.aggTypes.buckets.ipRangeTitle": "IPv4 范围",
-    "common.ui.aggTypes.buckets.ranges.rangesFormatMessage": "{gte} {from} 且 {lt} {to}",
-    "common.ui.aggTypes.buckets.rangesLabel": "{fieldName} 范围",
-    "common.ui.aggTypes.buckets.rangeTitle": "范围",
-    "common.ui.aggTypes.buckets.significantTerms.excludeLabel": "排除",
-    "common.ui.aggTypes.buckets.significantTerms.includeLabel": "包括",
-    "common.ui.aggTypes.buckets.significantTermsLabel": "{fieldName} 中排名前 {size} 的罕见词",
-    "common.ui.aggTypes.buckets.significantTermsTitle": "重要词",
-    "common.ui.aggTypes.buckets.terms.excludeLabel": "排除",
-    "common.ui.aggTypes.buckets.terms.includeLabel": "包括",
-    "common.ui.aggTypes.buckets.terms.missingBucketLabel": "缺失",
-    "common.ui.aggTypes.buckets.terms.orderAscendingTitle": "升序",
-    "common.ui.aggTypes.buckets.terms.orderDescendingTitle": "降序",
-    "common.ui.aggTypes.buckets.terms.otherBucketDescription": "此请求计数不符合数据存储桶条件的文档数目。",
-    "common.ui.aggTypes.buckets.terms.otherBucketLabel": "其他",
-    "common.ui.aggTypes.buckets.terms.otherBucketTitle": "其他存储桶",
-    "common.ui.aggTypes.buckets.termsTitle": "词",
-    "common.ui.aggTypes.histogram.missingMaxMinValuesWarning": "无法检索最大值和最小值以自动缩放直方图存储桶。这可能会导致可视化性能低下。",
-    "common.ui.aggTypes.metrics.averageBucketTitle": "平均存储桶",
-    "common.ui.aggTypes.metrics.averageLabel": "{field}平均值",
-    "common.ui.aggTypes.metrics.averageTitle": "平均值",
-    "common.ui.aggTypes.metrics.bucketAggTitle": "存储桶聚合",
-    "common.ui.aggTypes.metrics.countLabel": "计数",
-    "common.ui.aggTypes.metrics.countTitle": "计数",
-    "common.ui.aggTypes.metrics.cumulativeSumLabel": "累计和",
-    "common.ui.aggTypes.metrics.cumulativeSumTitle": "累计和",
-    "common.ui.aggTypes.metrics.derivativeLabel": "导数",
-    "common.ui.aggTypes.metrics.derivativeTitle": "导数",
-    "common.ui.aggTypes.metrics.geoBoundsLabel": "地理边界",
-    "common.ui.aggTypes.metrics.geoBoundsTitle": "地理边界",
-    "common.ui.aggTypes.metrics.geoCentroidLabel": "地理重心",
-    "common.ui.aggTypes.metrics.geoCentroidTitle": "地理重心",
-    "common.ui.aggTypes.metrics.maxBucketTitle": "最大存储桶",
-    "common.ui.aggTypes.metrics.maxLabel": "{field}最大值",
-    "common.ui.aggTypes.metrics.maxTitle": "最大值",
-    "common.ui.aggTypes.metrics.medianLabel": "{field}中值",
-    "common.ui.aggTypes.metrics.medianTitle": "中值",
-    "common.ui.aggTypes.metrics.metricAggregationsSubtypeTitle": "指标聚合",
-    "common.ui.aggTypes.metrics.metricAggTitle": "指标聚合",
-    "common.ui.aggTypes.metrics.minBucketTitle": "最小存储桶",
-    "common.ui.aggTypes.metrics.minLabel": "{field}最小值",
-    "common.ui.aggTypes.metrics.minTitle": "最小值",
-    "common.ui.aggTypes.metrics.movingAvgLabel": "移动平均值",
-    "common.ui.aggTypes.metrics.movingAvgTitle": "移动平均值",
-    "common.ui.aggTypes.metrics.overallAverageLabel": "总体平均值",
-    "common.ui.aggTypes.metrics.overallMaxLabel": "总体最大值",
-    "common.ui.aggTypes.metrics.overallMinLabel": "总体最大值",
-    "common.ui.aggTypes.metrics.overallSumLabel": "总和",
-    "common.ui.aggTypes.metrics.parentPipelineAggregationsSubtypeTitle": "父级管道聚合",
-    "common.ui.aggTypes.metrics.percentileRanks.valuePropsLabel": "“{label}” 的百分位数排名 {format}",
-    "common.ui.aggTypes.metrics.percentileRanksLabel": "“{field}” 的百分位数排名",
-    "common.ui.aggTypes.metrics.percentileRanksTitle": "百分位数排名",
-    "common.ui.aggTypes.metrics.percentiles.valuePropsLabel": "“{label}” 的 {percentile} 百分位数",
-    "common.ui.aggTypes.metrics.percentilesLabel": "“{field}” 的百分位数",
-    "common.ui.aggTypes.metrics.percentilesTitle": "百分位数",
-    "common.ui.aggTypes.metrics.serialDiffLabel": "序列差异",
-    "common.ui.aggTypes.metrics.serialDiffTitle": "序列差异",
-    "common.ui.aggTypes.metrics.siblingPipelineAggregationsSubtypeTitle": "同级管道聚合",
-    "common.ui.aggTypes.metrics.standardDeviation.keyDetailsLabel": "“{fieldDisplayName}” 的标准偏差",
-    "common.ui.aggTypes.metrics.standardDeviation.lowerKeyDetailsTitle": "下{label}",
-    "common.ui.aggTypes.metrics.standardDeviation.upperKeyDetailsTitle": "上{label}",
-    "common.ui.aggTypes.metrics.standardDeviationLabel": "“{field}” 的标准偏差",
-    "common.ui.aggTypes.metrics.standardDeviationTitle": "标准偏差",
-    "common.ui.aggTypes.metrics.sumBucketTitle": "求和存储桶",
-    "common.ui.aggTypes.metrics.sumLabel": "“{field}” 的和",
-    "common.ui.aggTypes.metrics.sumTitle": "和",
-    "common.ui.aggTypes.metrics.topHit.ascendingLabel": "升序",
-    "common.ui.aggTypes.metrics.topHit.averageLabel": "平均值",
-    "common.ui.aggTypes.metrics.topHit.concatenateLabel": "连接",
-    "common.ui.aggTypes.metrics.topHit.descendingLabel": "降序",
-    "common.ui.aggTypes.metrics.topHit.firstPrefixLabel": "第一",
-    "common.ui.aggTypes.metrics.topHit.lastPrefixLabel": "最后",
-    "common.ui.aggTypes.metrics.topHit.maxLabel": "最大值",
-    "common.ui.aggTypes.metrics.topHit.minLabel": "最小值",
-    "common.ui.aggTypes.metrics.topHit.sumLabel": "和",
-    "common.ui.aggTypes.metrics.topHitTitle": "最高命中结果",
-    "common.ui.aggTypes.metrics.uniqueCountLabel": "“{field}” 的唯一计数",
-    "common.ui.aggTypes.metrics.uniqueCountTitle": "唯一计数",
-    "common.ui.aggTypes.otherBucket.labelForMissingValuesLabel": "缺失值的标签",
-    "common.ui.aggTypes.otherBucket.labelForOtherBucketLabel": "其他存储桶的标签",
-    "common.ui.aggTypes.paramTypes.field.invalidSavedFieldParameterErrorMessage": "已保存的 {fieldParameter} 参数现在无效。请选择新字段。",
-    "common.ui.aggTypes.paramTypes.field.requiredFieldParameterErrorMessage": "{fieldParameter} 是必需字段",
-    "common.ui.aggTypes.string.customLabel": "定制标签",
-    "common.ui.chrome.bigUrlWarningNotificationMessage": "在{advancedSettingsLink}中启用“{storeInSessionStorageParam}”选项或简化屏幕视觉效果。",
-    "common.ui.chrome.bigUrlWarningNotificationMessage.advancedSettingsLinkText": "高级设置",
-    "common.ui.chrome.bigUrlWarningNotificationTitle": "URL 过长，Kibana 可能无法工作",
-    "common.ui.directives.fieldNameIcons.booleanAriaLabel": "布尔字段",
-    "common.ui.directives.fieldNameIcons.conflictFieldAriaLabel": "冲突字段",
-    "common.ui.directives.fieldNameIcons.dateFieldAriaLabel": "日期字段",
-    "common.ui.directives.fieldNameIcons.geoPointFieldAriaLabel": "地理位置点字段",
-    "common.ui.directives.fieldNameIcons.geoShapeFieldAriaLabel": "几何形状字段",
-    "common.ui.directives.fieldNameIcons.ipAddressFieldAriaLabel": "IP 地址字段",
-    "common.ui.directives.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 字段",
-    "common.ui.directives.fieldNameIcons.numberFieldAriaLabel": "数字字段",
-    "common.ui.directives.fieldNameIcons.sourceFieldAriaLabel": "源字段",
-    "common.ui.directives.fieldNameIcons.stringFieldAriaLabel": "字符串字段",
-    "common.ui.directives.fieldNameIcons.unknownFieldAriaLabel": "未知字段",
+    "common.ui.aggTypes.rangesFormatMessage": "{gte} {from} 且 {lt} {to}",
+    "data.search.aggs.aggGroups.bucketsText": "存储桶",
+    "data.search.aggs.aggGroups.metricsText": "指标",
+    "data.search.aggs.buckets.dateHistogramLabel": "{fieldName}/{intervalDescription}",
+    "data.search.aggs.buckets.dateHistogramTitle": "Date Histogram",
+    "data.search.aggs.buckets.dateRangeTitle": "日期范围",
+    "data.search.aggs.buckets.filtersTitle": "筛选",
+    "data.search.aggs.buckets.filterTitle": "筛选",
+    "data.search.aggs.buckets.geohashGridTitle": "Geohash",
+    "data.search.aggs.buckets.geotileGridTitle": "地理磁贴",
+    "data.search.aggs.buckets.histogramTitle": "Histogram",
+    "data.search.aggs.buckets.intervalOptions.autoDisplayName": "自动",
+    "data.search.aggs.buckets.intervalOptions.dailyDisplayName": "每日",
+    "data.search.aggs.buckets.intervalOptions.hourlyDisplayName": "每小时",
+    "data.search.aggs.buckets.intervalOptions.millisecondDisplayName": "毫秒",
+    "data.search.aggs.buckets.intervalOptions.minuteDisplayName": "分钟",
+    "data.search.aggs.buckets.intervalOptions.monthlyDisplayName": "每月",
+    "data.search.aggs.buckets.intervalOptions.secondDisplayName": "秒",
+    "data.search.aggs.buckets.intervalOptions.weeklyDisplayName": "每周",
+    "data.search.aggs.buckets.intervalOptions.yearlyDisplayName": "每年",
+    "data.search.aggs.buckets.ipRangeLabel": "{fieldName} IP 范围",
+    "data.search.aggs.buckets.ipRangeTitle": "IPv4 范围",
+    "data.search.aggs.aggTypes.rangesFormatMessage": "{gte} {from} 且 {lt} {to}",
+    "data.search.aggs.aggTypesLabel": "{fieldName} 范围",
+    "data.search.aggs.buckets.rangeTitle": "范围",
+    "data.search.aggs.buckets.significantTerms.excludeLabel": "排除",
+    "data.search.aggs.buckets.significantTerms.includeLabel": "包括",
+    "data.search.aggs.buckets.significantTermsLabel": "{fieldName} 中排名前 {size} 的罕见词",
+    "data.search.aggs.buckets.significantTermsTitle": "重要词",
+    "data.search.aggs.buckets.terms.excludeLabel": "排除",
+    "data.search.aggs.buckets.terms.includeLabel": "包括",
+    "data.search.aggs.buckets.terms.missingBucketLabel": "缺失",
+    "data.search.aggs.buckets.terms.orderAscendingTitle": "升序",
+    "data.search.aggs.buckets.terms.orderDescendingTitle": "降序",
+    "data.search.aggs.buckets.terms.otherBucketDescription": "此请求计数不符合数据存储桶条件的文档数目。",
+    "data.search.aggs.buckets.terms.otherBucketLabel": "其他",
+    "data.search.aggs.buckets.terms.otherBucketTitle": "其他存储桶",
+    "data.search.aggs.buckets.termsTitle": "词",
+    "data.search.aggs.histogram.missingMaxMinValuesWarning": "无法检索最大值和最小值以自动缩放直方图存储桶。这可能会导致可视化性能低下。",
+    "data.search.aggs.metrics.averageBucketTitle": "平均存储桶",
+    "data.search.aggs.metrics.averageLabel": "{field}平均值",
+    "data.search.aggs.metrics.averageTitle": "平均值",
+    "data.search.aggs.metrics.bucketAggTitle": "存储桶聚合",
+    "data.search.aggs.metrics.countLabel": "计数",
+    "data.search.aggs.metrics.countTitle": "计数",
+    "data.search.aggs.metrics.cumulativeSumLabel": "累计和",
+    "data.search.aggs.metrics.cumulativeSumTitle": "累计和",
+    "data.search.aggs.metrics.derivativeLabel": "导数",
+    "data.search.aggs.metrics.derivativeTitle": "导数",
+    "data.search.aggs.metrics.geoBoundsLabel": "地理边界",
+    "data.search.aggs.metrics.geoBoundsTitle": "地理边界",
+    "data.search.aggs.metrics.geoCentroidLabel": "地理重心",
+    "data.search.aggs.metrics.geoCentroidTitle": "地理重心",
+    "data.search.aggs.metrics.maxBucketTitle": "最大存储桶",
+    "data.search.aggs.metrics.maxLabel": "{field}最大值",
+    "data.search.aggs.metrics.maxTitle": "最大值",
+    "data.search.aggs.metrics.medianLabel": "{field}中值",
+    "data.search.aggs.metrics.medianTitle": "中值",
+    "data.search.aggs.metrics.metricAggregationsSubtypeTitle": "指标聚合",
+    "data.search.aggs.metrics.metricAggTitle": "指标聚合",
+    "data.search.aggs.metrics.minBucketTitle": "最小存储桶",
+    "data.search.aggs.metrics.minLabel": "{field}最小值",
+    "data.search.aggs.metrics.minTitle": "最小值",
+    "data.search.aggs.metrics.movingAvgLabel": "移动平均值",
+    "data.search.aggs.metrics.movingAvgTitle": "移动平均值",
+    "data.search.aggs.metrics.overallAverageLabel": "总体平均值",
+    "data.search.aggs.metrics.overallMaxLabel": "总体最大值",
+    "data.search.aggs.metrics.overallMinLabel": "总体最大值",
+    "data.search.aggs.metrics.overallSumLabel": "总和",
+    "data.search.aggs.metrics.parentPipelineAggregationsSubtypeTitle": "父级管道聚合",
+    "data.search.aggs.metrics.percentileRanks.valuePropsLabel": "“{label}” 的百分位数排名 {format}",
+    "data.search.aggs.metrics.percentileRanksLabel": "“{field}” 的百分位数排名",
+    "data.search.aggs.metrics.percentileRanksTitle": "百分位数排名",
+    "data.search.aggs.metrics.percentiles.valuePropsLabel": "“{label}” 的 {percentile} 百分位数",
+    "data.search.aggs.metrics.percentilesLabel": "“{field}” 的百分位数",
+    "data.search.aggs.metrics.percentilesTitle": "百分位数",
+    "data.search.aggs.metrics.serialDiffLabel": "序列差异",
+    "data.search.aggs.metrics.serialDiffTitle": "序列差异",
+    "data.search.aggs.metrics.siblingPipelineAggregationsSubtypeTitle": "同级管道聚合",
+    "data.search.aggs.metrics.standardDeviation.keyDetailsLabel": "“{fieldDisplayName}” 的标准偏差",
+    "data.search.aggs.metrics.standardDeviation.lowerKeyDetailsTitle": "下{label}",
+    "data.search.aggs.metrics.standardDeviation.upperKeyDetailsTitle": "上{label}",
+    "data.search.aggs.metrics.standardDeviationLabel": "“{field}” 的标准偏差",
+    "data.search.aggs.metrics.standardDeviationTitle": "标准偏差",
+    "data.search.aggs.metrics.sumBucketTitle": "求和存储桶",
+    "data.search.aggs.metrics.sumLabel": "“{field}” 的和",
+    "data.search.aggs.metrics.sumTitle": "和",
+    "data.search.aggs.metrics.topHit.ascendingLabel": "升序",
+    "data.search.aggs.metrics.topHit.averageLabel": "平均值",
+    "data.search.aggs.metrics.topHit.concatenateLabel": "连接",
+    "data.search.aggs.metrics.topHit.descendingLabel": "降序",
+    "data.search.aggs.metrics.topHit.firstPrefixLabel": "第一",
+    "data.search.aggs.metrics.topHit.lastPrefixLabel": "最后",
+    "data.search.aggs.metrics.topHit.maxLabel": "最大值",
+    "data.search.aggs.metrics.topHit.minLabel": "最小值",
+    "data.search.aggs.metrics.topHit.sumLabel": "和",
+    "data.search.aggs.metrics.topHitTitle": "最高命中结果",
+    "data.search.aggs.metrics.uniqueCountLabel": "“{field}” 的唯一计数",
+    "data.search.aggs.metrics.uniqueCountTitle": "唯一计数",
+    "data.search.aggs.otherBucket.labelForMissingValuesLabel": "缺失值的标签",
+    "data.search.aggs.otherBucket.labelForOtherBucketLabel": "其他存储桶的标签",
+    "data.search.aggs.paramTypes.field.invalidSavedFieldParameterErrorMessage": "已保存的 {fieldParameter} 参数现在无效。请选择新字段。",
+    "data.search.aggs.paramTypes.field.requiredFieldParameterErrorMessage": "{fieldParameter} 是必需字段",
+    "data.search.aggs.string.customLabel": "定制标签",
     "common.ui.directives.paginate.size.allDropDownOptionLabel": "全部",
     "common.ui.dualRangeControl.mustSetBothErrorMessage": "下限值和上限值都须设置",
     "common.ui.dualRangeControl.outsideOfRangeErrorMessage": "值必须是在 {min} 到 {max} 的范围内",
@@ -366,11 +353,6 @@
     "common.ui.flotCharts.tueLabel": "周二",
     "common.ui.flotCharts.wedLabel": "周三",
     "common.ui.modals.cancelButtonLabel": "取消",
-    "common.ui.notify.fatalError.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
-    "common.ui.notify.fatalError.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
-    "common.ui.notify.toaster.errorMessage": "错误：{errorMessage}\n      {errorStack}",
-    "common.ui.notify.toaster.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
-    "common.ui.notify.toaster.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
     "common.ui.paginateControls.pageSizeLabel": "页面大小",
     "common.ui.paginateControls.scrollTopButtonLabel": "滚动至顶部",
     "common.ui.savedObjects.confirmModal.overwriteButtonLabel": "覆盖",
@@ -386,7 +368,7 @@
     "common.ui.stateManagement.unableToStoreHistoryInSessionErrorMessage": "Kibana 无法将历史记录项存储在您的会话中，因为其已满，并且似乎没有任何可安全删除的项。\n\n通常可通过移至新的标签页来解决此问题，但这会导致更大的问题。如果您有规律地看到此消息，请在 {gitHubIssuesUrl} 提交问题。",
     "common.ui.url.replacementFailedErrorMessage": "替换失败，未解析的表达式：{expr}",
     "common.ui.url.savedObjectIsMissingNotificationMessage": "已保存对象缺失",
-    "common.ui.vis.aggConfig.percentageOfLabel": "{label} 的百分比",
+    "data.search.aggs.percentageOfLabel": "{label} 的百分比",
     "common.ui.vis.defaultFeedbackMessage": "想反馈？请在“{link}中创建问题。",
     "common.ui.vis.kibanaMap.leaflet.fitDataBoundsAriaLabel": "适应数据边界",
     "common.ui.vis.kibanaMap.zoomWarning": "已达到缩放级别最大数目。要一直放大，请升级到 Elasticsearch 和 Kibana 的 {defaultDistribution}。您可以通过 {ems} 免费使用其他缩放级别。或者，您可以配置自己的地图服务器。请前往 { wms } 或 { configSettings} 以获取详细信息。",
@@ -1114,6 +1096,17 @@
     "kbn.discover.fieldChooser.searchPlaceHolder": "搜索字段",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "隐藏字段设置",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "显示字段设置",
+    "kbn.discover.fieldNameIcons.booleanAriaLabel": "布尔字段",
+    "kbn.discover.fieldNameIcons.conflictFieldAriaLabel": "冲突字段",
+    "kbn.discover.fieldNameIcons.dateFieldAriaLabel": "日期字段",
+    "kbn.discover.fieldNameIcons.geoPointFieldAriaLabel": "地理位置点字段",
+    "kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel": "几何形状字段",
+    "kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP 地址字段",
+    "kbn.discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 字段",
+    "kbn.discover.fieldNameIcons.numberFieldAriaLabel": "数字字段",
+    "kbn.discover.fieldNameIcons.sourceFieldAriaLabel": "源字段",
+    "kbn.discover.fieldNameIcons.stringFieldAriaLabel": "字符串字段",
+    "kbn.discover.fieldNameIcons.unknownFieldAriaLabel": "未知字段",
     "kbn.discover.histogram.partialData.bucketTooltipText": "选定的时间范围不包括此整个存储桶，其可能包含部分数据。",
     "kbn.discover.histogramOfFoundDocumentsAriaLabel": "已找到文档的直方图",
     "kbn.discover.hitsPluralTitle": "{hits, plural, one {次命中} other {次命中}}",
@@ -1624,7 +1617,7 @@
     "kbn.management.settings.form.clearSearchResultText": "（清除搜索）",
     "kbn.management.settings.form.noSearchResultText": "未找到设置{clearSearch}",
     "kbn.management.settings.form.searchResultText": "搜索词隐藏了 {settingsCount} 个设置{clearSearch}",
-    "kbn.management.settings.pageTitle": "设置",
+    "advancedSettings.pageTitle": "设置",
     "kbn.management.settings.searchBar.unableToParseQueryErrorMessage": "无法解析查询",
     "kbn.management.settings.searchBarAriaLabel": "搜索高级设置",
     "kbn.management.settings.sectionLabel": "高级设置",
@@ -1656,24 +1649,6 @@
     "kbn.visualize.listing.table.listTitle": "可视化",
     "kbn.visualize.listing.table.titleColumnName": "标题",
     "kbn.visualize.listing.table.typeColumnName": "类型",
-    "kbn.visualize.newVisWizard.betaDescription": "此可视化为公测版，可能会进行更改。设计和代码相对于正式发行版功能还不够成熟，将按原样提供，且不提供任何保证。公测版功能不受正式发行版功能支持 SLA 的约束",
-    "kbn.visualize.newVisWizard.betaTitle": "公测版",
-    "kbn.visualize.newVisWizard.chooseSourceTitle": "选择源",
-    "kbn.visualize.newVisWizard.experimentalDescription": "这是实验性可视化。与稳定的可视化相比，其设计和实现均不够成熟，可能会随时发生更改。",
-    "kbn.visualize.newVisWizard.experimentalTitle": "实验性",
-    "kbn.visualize.newVisWizard.experimentalTooltip": "未来版本可能会更改或删除此可视化，其不受支持 SLA 的约束。",
-    "kbn.visualize.newVisWizard.filterVisTypeAriaLabel": "筛留可视化类型",
-    "kbn.visualize.newVisWizard.helpText": "通过为该可视化选择类型，来开始创建您的可视化。",
-    "kbn.visualize.newVisWizard.helpTextAriaLabel": "通过为该可视化选择类型，来开始创建您的可视化。按 Esc 键关闭此模式。按 Tab 键继续。",
-    "kbn.visualize.newVisWizard.newVisTypeTitle": "新建{visTypeName}",
-    "kbn.visualize.newVisWizard.resultsFound": "找到了 {resultCount} 个{resultCount, plural, one {类型} other {类型} }",
-    "kbn.visualize.newVisWizard.searchSelection.notFoundLabel": "未找到匹配的索引或已保存搜索。",
-    "kbn.visualize.newVisWizard.searchSelection.savedObjectType.indexPattern": "索引模式",
-    "kbn.visualize.newVisWizard.searchSelection.savedObjectType.search": "已保存搜索",
-    "kbn.visualize.newVisWizard.selectVisType": "选择可视化类型",
-    "kbn.visualize.newVisWizard.title": "新建可视化",
-    "kbn.visualize.newVisWizard.visTypeAliasDescription": "打开 Visualize 外部的 Kibana 应用程序。",
-    "kbn.visualize.newVisWizard.visTypeAliasTitle": "Kibana 应用程序",
     "kbn.visualize.pageHeading": "{chartName} {chartType}可视化",
     "kbn.visualize.saveDialog.saveAndAddToDashboardButtonLabel": "保存并添加到仪表板",
     "kbn.visualize.topNavMenu.openInspectorButtonAriaLabel": "打开检查器查看可视化",
@@ -1690,6 +1665,14 @@
     "kbn.visualize.wizard.step1Breadcrumb": "创建",
     "kbn.visualize.wizard.step2Breadcrumb": "创建",
     "kbn.visualizeTitle": "可视化",
+    "kibana_legacy.bigUrlWarningNotificationMessage": "在{advancedSettingsLink}中启用“{storeInSessionStorageParam}”选项或简化屏幕视觉效果。",
+    "kibana_legacy.bigUrlWarningNotificationMessage.advancedSettingsLinkText": "高级设置",
+    "kibana_legacy.bigUrlWarningNotificationTitle": "URL 过长，Kibana 可能无法工作",
+    "kibana_legacy.notify.fatalError.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
+    "kibana_legacy.notify.fatalError.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
+    "kibana_legacy.notify.toaster.errorMessage": "错误：{errorMessage}\n      {errorStack}",
+    "kibana_legacy.notify.toaster.errorStatusMessage": "错误 {errStatus} {errStatusText}：{errMessage}",
+    "kibana_legacy.notify.toaster.unavailableServerErrorMessage": "HTTP 请求无法连接。请检查 Kibana 服务器是否正在运行以及您的浏览器是否具有有效的连接，或请联系您的系统管理员。",
     "home.tutorials.common.auditbeat.cloudInstructions.gettingStarted.title": "入门",
     "home.tutorials.common.auditbeat.premCloudInstructions.gettingStarted.title": "入门",
     "home.tutorials.common.auditbeat.premInstructions.gettingStarted.title": "入门",
@@ -2433,20 +2416,6 @@
     "visTypeVislib.vislib.legend.toggleOptionsButtonAriaLabel": "{legendDataLabel}切换选项",
     "kibana-react.exitFullScreenButton.exitFullScreenModeButtonLabel": "退出全屏",
     "kibana-react.exitFullScreenButton.fullScreenModeDescription": "在全屏模式下，按 ESC 键可退出。",
-    "kibana-react.savedObjects.finder.filterButtonLabel": "类型",
-    "kibana-react.savedObjects.finder.searchPlaceholder": "搜索……",
-    "kibana-react.savedObjects.finder.sortAsc": "升序",
-    "kibana-react.savedObjects.finder.sortAuto": "最佳匹配",
-    "kibana-react.savedObjects.finder.sortButtonLabel": "排序",
-    "kibana-react.savedObjects.finder.sortDesc": "降序",
-    "kibana-react.savedObjects.saveModal.cancelButtonLabel": "取消",
-    "kibana-react.savedObjects.saveModal.descriptionLabel": "描述",
-    "kibana-react.savedObjects.saveModal.duplicateTitleDescription": "单击“{confirmSaveLabel}”可覆盖现有 {objectType}。",
-    "kibana-react.savedObjects.saveModal.duplicateTitleLabel": "具有标题“{title}”的 {objectType} 已存在",
-    "kibana-react.savedObjects.saveModal.saveAsNewLabel": "另存为新的 {objectType}",
-    "kibana-react.savedObjects.saveModal.saveButtonLabel": "保存",
-    "kibana-react.savedObjects.saveModal.saveTitle": "保存 {objectType}",
-    "kibana-react.savedObjects.saveModal.titleLabel": "标题",
     "newsfeed.emptyPrompt.noNewsText": "如果您的 Kibana 实例没有 Internet 连接，请让您的管理员禁用此功能。否则，我们将不断尝试获取新闻。",
     "newsfeed.emptyPrompt.noNewsTitle": "无新闻？",
     "newsfeed.flyoutList.closeButtonLabel": "鍏抽棴",
@@ -2476,6 +2445,20 @@
     "regionMap.visParams.vectorMapLabel": "矢量地图",
     "regionMap.visualization.unableToShowMismatchesWarningText": "确保每个字词与该形状的联接字段匹配：{mismatches}",
     "regionMap.visualization.unableToShowMismatchesWarningTitle": "无法在地图上显示 {mismatchesLength} {oneMismatch, plural, one { 个结果} other { 个结果}}",
+    "savedObjects.finder.filterButtonLabel": "类型",
+    "savedObjects.finder.searchPlaceholder": "搜索……",
+    "savedObjects.finder.sortAsc": "升序",
+    "savedObjects.finder.sortAuto": "最佳匹配",
+    "savedObjects.finder.sortButtonLabel": "排序",
+    "savedObjects.finder.sortDesc": "降序",
+    "savedObjects.saveModal.cancelButtonLabel": "取消",
+    "savedObjects.saveModal.descriptionLabel": "描述",
+    "savedObjects.saveModal.duplicateTitleDescription": "单击“{confirmSaveLabel}”可覆盖现有 {objectType}。",
+    "savedObjects.saveModal.duplicateTitleLabel": "具有标题“{title}”的 {objectType} 已存在",
+    "savedObjects.saveModal.saveAsNewLabel": "另存为新的 {objectType}",
+    "savedObjects.saveModal.saveButtonLabel": "保存",
+    "savedObjects.saveModal.saveTitle": "保存 {objectType}",
+    "savedObjects.saveModal.titleLabel": "标题",
     "server.stats.notReadyMessage": "统计尚未就绪。请稍后重试",
     "server.status.disabledTitle": "已禁用",
     "server.status.greenTitle": "绿",
@@ -2897,6 +2880,24 @@
     "timelion.vis.intervalLabel": "时间间隔",
     "uiActions.actionPanel.title": "选项",
     "uiActions.errors.incompatibleAction": "操作不兼容",
+    "visualizations.newVisWizard.betaDescription": "此可视化为公测版，可能会进行更改。设计和代码相对于正式发行版功能还不够成熟，将按原样提供，且不提供任何保证。公测版功能不受正式发行版功能支持 SLA 的约束",
+    "visualizations.newVisWizard.betaTitle": "公测版",
+    "visualizations.newVisWizard.chooseSourceTitle": "选择源",
+    "visualizations.newVisWizard.experimentalDescription": "这是实验性可视化。与稳定的可视化相比，其设计和实现均不够成熟，可能会随时发生更改。",
+    "visualizations.newVisWizard.experimentalTitle": "实验性",
+    "visualizations.newVisWizard.experimentalTooltip": "未来版本可能会更改或删除此可视化，其不受支持 SLA 的约束。",
+    "visualizations.newVisWizard.filterVisTypeAriaLabel": "筛留可视化类型",
+    "visualizations.newVisWizard.helpText": "通过为该可视化选择类型，来开始创建您的可视化。",
+    "visualizations.newVisWizard.helpTextAriaLabel": "通过为该可视化选择类型，来开始创建您的可视化。按 Esc 键关闭此模式。按 Tab 键继续。",
+    "visualizations.newVisWizard.newVisTypeTitle": "新建{visTypeName}",
+    "visualizations.newVisWizard.resultsFound": "找到了 {resultCount} 个{resultCount, plural, one {类型} other {类型} }",
+    "visualizations.newVisWizard.searchSelection.notFoundLabel": "未找到匹配的索引或已保存搜索。",
+    "visualizations.newVisWizard.searchSelection.savedObjectType.indexPattern": "索引模式",
+    "visualizations.newVisWizard.searchSelection.savedObjectType.search": "已保存搜索",
+    "visualizations.newVisWizard.selectVisType": "选择可视化类型",
+    "visualizations.newVisWizard.title": "新建可视化",
+    "visualizations.newVisWizard.visTypeAliasDescription": "打开 Visualize 外部的 Kibana 应用程序。",
+    "visualizations.newVisWizard.visTypeAliasTitle": "Kibana 应用程序",
     "visualizations.queryGeohashBounds.unableToGetBoundErrorTitle": "无法获取边界",
     "visDefaultEditor.aggSelect.aggregationLabel": "聚合",
     "visDefaultEditor.aggSelect.helpLinkLabel": "{aggTitle} 帮助",
@@ -3872,7 +3873,6 @@
     "xpack.apm.serviceDetails.metricsTabLabel": "指标",
     "xpack.apm.serviceDetails.nodesTabLabel": "JVM",
     "xpack.apm.serviceDetails.transactionsTabLabel": "事务",
-    "xpack.apm.serviceMap.fullscreen": "全屏",
     "xpack.apm.serviceMap.zoomIn": "放大",
     "xpack.apm.serviceMap.zoomOut": "缩小",
     "xpack.apm.serviceNodeMetrics.containerId": "容器 ID",
@@ -5352,8 +5352,6 @@
     "xpack.crossClusterReplication.autoFollowPatternCreateForm.loadingRemoteClustersMessage": "正在加载远程集群……",
     "xpack.crossClusterReplication.autoFollowPatternCreateForm.saveButtonLabel": "创建",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.closeButtonLabel": "关闭",
-    "xpack.crossClusterReplication.autoFollowPatternDetailPanel.deleteButtonLabel": "删除",
-    "xpack.crossClusterReplication.autoFollowPatternDetailPanel.editButtonLabel": "编辑",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.leaderPatternsLabel": "Leader 模式",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.notFoundLabel": "未找到自动跟随模式",
     "xpack.crossClusterReplication.autoFollowPatternDetailPanel.prefixEmptyValue": "无前缀",
@@ -6752,23 +6750,23 @@
     "xpack.infra.waffle.unableToSelectMetricErrorTitle": "无法选择指标选项或指标值。",
     "xpack.infra.waffleTime.autoRefreshButtonLabel": "自动刷新",
     "xpack.infra.waffleTime.stopRefreshingButtonLabel": "停止刷新",
-    "xpack.kueryAutocomplete.andOperatorDescription": "需要{bothArguments}为真",
-    "xpack.kueryAutocomplete.andOperatorDescription.bothArgumentsText": "两个参数都",
-    "xpack.kueryAutocomplete.equalOperatorDescription": "{equals}某一值",
-    "xpack.kueryAutocomplete.equalOperatorDescription.equalsText": "等于",
-    "xpack.kueryAutocomplete.existOperatorDescription": "以任意形式{exists}",
-    "xpack.kueryAutocomplete.existOperatorDescription.existsText": "存在",
-    "xpack.kueryAutocomplete.filterResultsDescription": "筛选包含 {fieldName} 的结果",
-    "xpack.kueryAutocomplete.greaterThanOperatorDescription": "{greaterThan}某一值",
-    "xpack.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText": "大于",
-    "xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription": "{greaterThanOrEqualTo}某一值",
-    "xpack.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText": "大于或等于",
-    "xpack.kueryAutocomplete.lessThanOperatorDescription": "{lessThan}某一值",
-    "xpack.kueryAutocomplete.lessThanOperatorDescription.lessThanText": "小于",
-    "xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription": "{lessThanOrEqualTo}某一值",
-    "xpack.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "小于或等于",
-    "xpack.kueryAutocomplete.orOperatorDescription": "需要{oneOrMoreArguments}为真",
-    "xpack.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "一个或多个参数",
+    "xpack.data.kueryAutocomplete.andOperatorDescription": "需要{bothArguments}为真",
+    "xpack.data.kueryAutocomplete.andOperatorDescription.bothArgumentsText": "两个参数都",
+    "xpack.data.kueryAutocomplete.equalOperatorDescription": "{equals}某一值",
+    "xpack.data.kueryAutocomplete.equalOperatorDescription.equalsText": "等于",
+    "xpack.data.kueryAutocomplete.existOperatorDescription": "以任意形式{exists}",
+    "xpack.data.kueryAutocomplete.existOperatorDescription.existsText": "存在",
+    "xpack.data.kueryAutocomplete.filterResultsDescription": "筛选包含 {fieldName} 的结果",
+    "xpack.data.kueryAutocomplete.greaterThanOperatorDescription": "{greaterThan}某一值",
+    "xpack.data.kueryAutocomplete.greaterThanOperatorDescription.greaterThanText": "大于",
+    "xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription": "{greaterThanOrEqualTo}某一值",
+    "xpack.data.kueryAutocomplete.greaterThanOrEqualOperatorDescription.greaterThanOrEqualToText": "大于或等于",
+    "xpack.data.kueryAutocomplete.lessThanOperatorDescription": "{lessThan}某一值",
+    "xpack.data.kueryAutocomplete.lessThanOperatorDescription.lessThanText": "小于",
+    "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription": "{lessThanOrEqualTo}某一值",
+    "xpack.data.kueryAutocomplete.lessThanOrEqualOperatorDescription.lessThanOrEqualToText": "小于或等于",
+    "xpack.data.kueryAutocomplete.orOperatorDescription": "需要{oneOrMoreArguments}为真",
+    "xpack.data.kueryAutocomplete.orOperatorDescription.oneOrMoreArgumentsText": "一个或多个参数",
     "xpack.lens.app.docLoadingError": "加载已保存文档时出错",
     "xpack.lens.app.docSavingError": "保存文档时出错",
     "xpack.lens.app.indexPatternLoadingError": "加载索引模式时出错",
@@ -10392,8 +10390,6 @@
     "xpack.rollupJobs.detailPanel.jobActionMenu.buttonLabel": "管理",
     "xpack.rollupJobs.detailPanel.loadingLabel": "正在加载汇总/打包作业……",
     "xpack.rollupJobs.detailPanel.notFoundLabel": "未找到汇总/打包作业",
-    "xpack.rollupJobs.editorConfig.dateHistogram.customInterval.helpText": "必须是汇总/打包配置时间间隔的倍数：{interval}",
-    "xpack.rollupJobs.editorConfig.histogram.interval.helpText": "必须是汇总/打包配置时间间隔的倍数：{interval}",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultButtonDescription": "针对汇总数据执行有限聚合",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultButtonText": "汇总/打包索引模式",
     "xpack.rollupJobs.editRollupIndexPattern.createIndex.defaultTypeName": "汇总/打包索引模式",
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/kibana.json b/x-pack/plugins/triggers_actions_ui/kibana.json
similarity index 54%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/kibana.json
rename to x-pack/plugins/triggers_actions_ui/kibana.json
index 3fd7389aef494..cf66883412edb 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/kibana.json
+++ b/x-pack/plugins/triggers_actions_ui/kibana.json
@@ -2,5 +2,6 @@
     "id": "triggers_actions_ui",
     "version": "kibana",
     "server": false,
-    "ui": true
+    "ui": true,
+    "requiredPlugins": ["management", "charts", "data"]
   }
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/action_type_registry.mock.ts b/x-pack/plugins/triggers_actions_ui/public/application/action_type_registry.mock.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/action_type_registry.mock.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/action_type_registry.mock.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/alert_type_registry.mock.ts b/x-pack/plugins/triggers_actions_ui/public/application/alert_type_registry.mock.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/alert_type_registry.mock.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/alert_type_registry.mock.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/app.tsx b/x-pack/plugins/triggers_actions_ui/public/application/app.tsx
similarity index 82%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/app.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/app.tsx
index 7d9a963c9c6b3..51ed3c1ebafad 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/app.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/app.tsx
@@ -12,23 +12,28 @@ import {
   HttpSetup,
   IUiSettingsClient,
   ApplicationStart,
+  ChromeBreadcrumb,
 } from 'kibana/public';
 import { BASE_PATH, Section, routeToAlertDetails } from './constants';
 import { TriggersActionsUIHome } from './home';
 import { AppContextProvider, useAppDependencies } from './app_context';
 import { hasShowAlertsCapability } from './lib/capabilities';
-import { LegacyDependencies, ActionTypeModel, AlertTypeModel } from '../types';
+import { ActionTypeModel, AlertTypeModel } from '../types';
 import { TypeRegistry } from './type_registry';
 import { AlertDetailsRouteWithApi as AlertDetailsRoute } from './sections/alert_details/components/alert_details_route';
+import { ChartsPluginStart } from '../../../../../src/plugins/charts/public';
+import { DataPublicPluginStart } from '../../../../../src/plugins/data/public';
 
 export interface AppDeps {
+  dataPlugin: DataPublicPluginStart;
+  charts: ChartsPluginStart;
   chrome: ChromeStart;
   docLinks: DocLinksStart;
   toastNotifications: ToastsSetup;
   injectedMetadata: any;
   http: HttpSetup;
   uiSettings: IUiSettingsClient;
-  legacy: LegacyDependencies;
+  setBreadcrumbs: (crumbs: ChromeBreadcrumb[]) => void;
   capabilities: ApplicationStart['capabilities'];
   actionTypeRegistry: TypeRegistry<ActionTypeModel>;
   alertTypeRegistry: TypeRegistry<AlertTypeModel>;
@@ -48,7 +53,7 @@ export const App = (appDeps: AppDeps) => {
   );
 };
 
-export const AppWithoutRouter = ({ sectionsRegex }: any) => {
+export const AppWithoutRouter = ({ sectionsRegex }: { sectionsRegex: string }) => {
   const { capabilities } = useAppDependencies();
   const canShowAlerts = hasShowAlertsCapability(capabilities);
   const DEFAULT_SECTION: Section = canShowAlerts ? 'alerts' : 'connectors';
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/app_context.tsx b/x-pack/plugins/triggers_actions_ui/public/application/app_context.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/app_context.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/app_context.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/boot.tsx b/x-pack/plugins/triggers_actions_ui/public/application/boot.tsx
similarity index 81%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/boot.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/boot.tsx
index a37bedbfbdda8..a458472c6d753 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/boot.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/boot.tsx
@@ -10,23 +10,21 @@ import { SavedObjectsClientContract } from 'src/core/public';
 
 import { App, AppDeps } from './app';
 import { setSavedObjectsClient } from '../application/components/builtin_alert_types/threshold/lib/api';
-import { LegacyDependencies } from '../types';
 
 interface BootDeps extends AppDeps {
   element: HTMLElement;
   savedObjects: SavedObjectsClientContract;
   I18nContext: any;
-  legacy: LegacyDependencies;
 }
 
 export const boot = (bootDeps: BootDeps) => {
-  const { I18nContext, element, legacy, savedObjects, ...appDeps } = bootDeps;
+  const { I18nContext, element, savedObjects, ...appDeps } = bootDeps;
 
   setSavedObjectsClient(savedObjects);
 
   render(
     <I18nContext>
-      <App {...appDeps} legacy={legacy} />
+      <App {...appDeps} />
     </I18nContext>,
     element
   );
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
similarity index 78%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
index 5c924982c3536..49a611167cf16 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
@@ -3,11 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionParamsProps } from '../../../types';
+import { EmailActionParams, EmailActionConnector } from './types';
 
 const ACTION_TYPE_ID = '.email';
 let actionTypeModel: ActionTypeModel;
@@ -40,43 +41,15 @@ describe('connector validation', () => {
       name: 'email',
       config: {
         from: 'test@test.com',
-        port: '2323',
+        port: 2323,
         host: 'localhost',
         test: 'test',
       },
-    } as ActionConnector;
+    } as EmailActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
         from: [],
-        service: [],
-        port: [],
-        host: [],
-        user: [],
-        password: [],
-      },
-    });
-
-    delete actionConnector.config.test;
-    actionConnector.config.host = 'elastic.co';
-    actionConnector.config.port = 8080;
-    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
-      errors: {
-        from: [],
-        service: [],
-        port: [],
-        host: [],
-        user: [],
-        password: [],
-      },
-    });
-    delete actionConnector.config.host;
-    delete actionConnector.config.port;
-    actionConnector.config.service = 'testService';
-    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
-      errors: {
-        from: [],
-        service: [],
         port: [],
         host: [],
         user: [],
@@ -97,12 +70,11 @@ describe('connector validation', () => {
       config: {
         from: 'test@test.com',
       },
-    } as ActionConnector;
+    } as EmailActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
         from: [],
-        service: ['Service is required.'],
         port: ['Port is required.'],
         host: ['Host is required.'],
         user: [],
@@ -168,14 +140,13 @@ describe('EmailActionConnectorFields renders', () => {
       config: {
         from: 'test@test.com',
       },
-    } as ActionConnector;
+    } as EmailActionConnector;
     const wrapper = mountWithIntl(
       <ConnectorFields
         action={actionConnector}
-        errors={{ from: [], service: [], port: [], host: [], user: [], password: [] }}
+        errors={{ from: [], port: [], host: [], user: [], password: [] }}
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="emailFromInput"]').length > 0).toBeTruthy();
@@ -198,19 +169,22 @@ describe('EmailParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<EmailActionParams>
+    >;
     const actionParams = {
+      cc: [],
+      bcc: [],
       to: ['test@test.com'],
       subject: 'test',
       message: 'test message',
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
-        errors={{}}
+        actionParams={actionParams}
+        errors={{ to: [], cc: [], bcc: [], subject: [], message: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="toEmailAddressInput"]').length > 0).toBeTruthy();
@@ -220,8 +194,6 @@ describe('EmailParamsFields renders', () => {
         .first()
         .prop('selectedOptions')
     ).toStrictEqual([{ label: 'test@test.com' }]);
-    expect(wrapper.find('[data-test-subj="ccEmailAddressInput"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="bccEmailAddressInput"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="emailSubjectInput"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="emailMessageInput"]').length > 0).toBeTruthy();
   });
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
similarity index 66%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
index a6750ccf96deb..f82b2c8c88ada 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/email.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
@@ -3,7 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { Fragment } from 'react';
+import React, { Fragment, useState, useEffect } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
 import {
   EuiFieldText,
   EuiFlexItem,
@@ -12,17 +13,22 @@ import {
   EuiFieldPassword,
   EuiComboBox,
   EuiTextArea,
+  EuiButtonEmpty,
   EuiSwitch,
   EuiFormRow,
+  EuiContextMenuItem,
+  EuiButtonIcon,
+  EuiContextMenuPanel,
+  EuiPopover,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import {
   ActionTypeModel,
   ActionConnectorFieldsProps,
-  ActionConnector,
   ValidationResult,
   ActionParamsProps,
 } from '../../../types';
+import { EmailActionParams, EmailActionConnector } from './types';
 
 export function getActionType(): ActionTypeModel {
   const mailformat = /^[^@\s]+@[^@\s]+$/;
@@ -35,11 +41,16 @@ export function getActionType(): ActionTypeModel {
         defaultMessage: 'Send email from your server.',
       }
     ),
-    validateConnector: (action: ActionConnector): ValidationResult => {
+    actionTypeTitle: i18n.translate(
+      'xpack.triggersActionsUI.components.builtinActionTypes.emailAction.actionTypeTitle',
+      {
+        defaultMessage: 'Send to email',
+      }
+    ),
+    validateConnector: (action: EmailActionConnector): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         from: new Array<string>(),
-        service: new Array<string>(),
         port: new Array<string>(),
         host: new Array<string>(),
         user: new Array<string>(),
@@ -66,7 +77,7 @@ export function getActionType(): ActionTypeModel {
           )
         );
       }
-      if (!action.config.port && !action.config.service) {
+      if (!action.config.port) {
         errors.port.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredPortText',
@@ -76,17 +87,7 @@ export function getActionType(): ActionTypeModel {
           )
         );
       }
-      if (!action.config.service && (!action.config.port || !action.config.host)) {
-        errors.service.push(
-          i18n.translate(
-            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredServiceText',
-            {
-              defaultMessage: 'Service is required.',
-            }
-          )
-        );
-      }
-      if (!action.config.host && !action.config.service) {
+      if (!action.config.host) {
         errors.host.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredHostText',
@@ -118,7 +119,7 @@ export function getActionType(): ActionTypeModel {
       }
       return validationResult;
     },
-    validateParams: (actionParams: any): ValidationResult => {
+    validateParams: (actionParams: EmailActionParams): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         to: new Array<string>(),
@@ -143,7 +144,7 @@ export function getActionType(): ActionTypeModel {
         errors.cc.push(errorText);
         errors.bcc.push(errorText);
       }
-      if (!actionParams.message) {
+      if (!actionParams.message?.length) {
         errors.message.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredMessageText',
@@ -153,7 +154,7 @@ export function getActionType(): ActionTypeModel {
           )
         );
       }
-      if (!actionParams.subject) {
+      if (!actionParams.subject?.length) {
         errors.subject.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredSubjectText',
@@ -170,12 +171,9 @@ export function getActionType(): ActionTypeModel {
   };
 }
 
-const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({
-  action,
-  editActionConfig,
-  editActionSecrets,
-  errors,
-}) => {
+const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
+  EmailActionConnector
+>> = ({ action, editActionConfig, editActionSecrets, errors }) => {
   const { from, host, port, secure } = action.config;
   const { user, password } = action.secrets;
 
@@ -265,7 +263,7 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
                   isInvalid={errors.port.length > 0 && port !== undefined}
                   fullWidth
                   name="port"
-                  value={port || ''}
+                  value={port}
                   data-test-subj="emailPortInput"
                   onChange={e => {
                     editActionConfig('port', parseInt(e.target.value, 10));
@@ -365,34 +363,79 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
   );
 };
 
-const EmailParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
+const EmailParamsFields: React.FunctionComponent<ActionParamsProps<EmailActionParams>> = ({
+  actionParams,
   editAction,
   index,
   errors,
-  hasErrors,
+  messageVariables,
+  defaultMessage,
 }) => {
-  const { to, cc, bcc, subject, message } = action;
+  const { to, cc, bcc, subject, message } = actionParams;
   const toOptions = to ? to.map((label: string) => ({ label })) : [];
   const ccOptions = cc ? cc.map((label: string) => ({ label })) : [];
   const bccOptions = bcc ? bcc.map((label: string) => ({ label })) : [];
+  const [addCC, setAddCC] = useState<boolean>(false);
+  const [addBCC, setAddBCC] = useState<boolean>(false);
 
+  const [isVariablesPopoverOpen, setIsVariablesPopoverOpen] = useState<boolean>(false);
+  useEffect(() => {
+    if (defaultMessage && defaultMessage.length > 0) {
+      editAction('message', defaultMessage, index);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+  const messageVariablesItems = messageVariables?.map((variable: string) => (
+    <EuiContextMenuItem
+      key={variable}
+      icon="empty"
+      onClick={() => {
+        editAction('message', (message ?? '').concat(` {{${variable}}}`), index);
+        setIsVariablesPopoverOpen(false);
+      }}
+    >
+      {`{{${variable}}}`}
+    </EuiContextMenuItem>
+  ));
   return (
     <Fragment>
       <EuiFormRow
         fullWidth
         error={errors.to}
-        isInvalid={hasErrors && to !== undefined}
+        isInvalid={errors.to.length > 0 && to !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.recipientTextFieldLabel',
           {
-            defaultMessage: 'To',
+            defaultMessage: 'To:',
           }
         )}
+        labelAppend={
+          <Fragment>
+            <span>
+              {!addCC ? (
+                <EuiButtonEmpty size="xs" onClick={() => setAddCC(true)}>
+                  <FormattedMessage
+                    defaultMessage="Add CC"
+                    id="xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.addCcButton"
+                  />
+                </EuiButtonEmpty>
+              ) : null}
+              {!addBCC ? (
+                <EuiButtonEmpty size="xs" onClick={() => setAddBCC(true)}>
+                  <FormattedMessage
+                    defaultMessage="{titleBcc}"
+                    id="xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.addBccButton"
+                    values={{ titleBcc: !addCC ? '/ BCC' : 'Add BCC' }}
+                  />
+                </EuiButtonEmpty>
+              ) : null}
+            </span>
+          </Fragment>
+        }
       >
         <EuiComboBox
           noSuggestions
-          isInvalid={hasErrors && to !== undefined}
+          isInvalid={errors.to.length > 0 && to !== undefined}
           fullWidth
           data-test-subj="toEmailAddressInput"
           selectedOptions={toOptions}
@@ -418,126 +461,164 @@ const EmailParamsFields: React.FunctionComponent<ActionParamsProps> = ({
           }}
         />
       </EuiFormRow>
-      <EuiFormRow
-        fullWidth
-        error={errors.cc}
-        isInvalid={hasErrors && cc !== undefined}
-        label={i18n.translate(
-          'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.recipientCopyTextFieldLabel',
-          {
-            defaultMessage: 'Cc',
-          }
-        )}
-      >
-        <EuiComboBox
-          noSuggestions
-          isInvalid={hasErrors && cc !== undefined}
+      {addCC ? (
+        <EuiFormRow
           fullWidth
-          data-test-subj="ccEmailAddressInput"
-          selectedOptions={ccOptions}
-          onCreateOption={(searchValue: string) => {
-            const newOptions = [...ccOptions, { label: searchValue }];
-            editAction(
-              'cc',
-              newOptions.map(newOption => newOption.label),
-              index
-            );
-          }}
-          onChange={(selectedOptions: Array<{ label: string }>) => {
-            editAction(
-              'cc',
-              selectedOptions.map(selectedOption => selectedOption.label),
-              index
-            );
-          }}
-          onBlur={() => {
-            if (!cc) {
-              editAction('cc', [], index);
+          error={errors.cc}
+          isInvalid={errors.cc.length > 0 && cc !== undefined}
+          label={i18n.translate(
+            'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.recipientCopyTextFieldLabel',
+            {
+              defaultMessage: 'Cc:',
             }
-          }}
-        />
-      </EuiFormRow>
-      <EuiFormRow
-        fullWidth
-        error={errors.bcc}
-        isInvalid={hasErrors && bcc !== undefined}
-        label={i18n.translate(
-          'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.recipientBccTextFieldLabel',
-          {
-            defaultMessage: 'Bcc',
-          }
-        )}
-      >
-        <EuiComboBox
-          noSuggestions
-          isInvalid={hasErrors && bcc !== undefined}
+          )}
+        >
+          <EuiComboBox
+            noSuggestions
+            isInvalid={errors.cc.length > 0 && cc !== undefined}
+            fullWidth
+            data-test-subj="ccEmailAddressInput"
+            selectedOptions={ccOptions}
+            onCreateOption={(searchValue: string) => {
+              const newOptions = [...ccOptions, { label: searchValue }];
+              editAction(
+                'cc',
+                newOptions.map(newOption => newOption.label),
+                index
+              );
+            }}
+            onChange={(selectedOptions: Array<{ label: string }>) => {
+              editAction(
+                'cc',
+                selectedOptions.map(selectedOption => selectedOption.label),
+                index
+              );
+            }}
+            onBlur={() => {
+              if (!cc) {
+                editAction('cc', [], index);
+              }
+            }}
+          />
+        </EuiFormRow>
+      ) : null}
+      {addBCC ? (
+        <EuiFormRow
           fullWidth
-          data-test-subj="bccEmailAddressInput"
-          selectedOptions={bccOptions}
-          onCreateOption={(searchValue: string) => {
-            const newOptions = [...bccOptions, { label: searchValue }];
-            editAction(
-              'bcc',
-              newOptions.map(newOption => newOption.label),
-              index
-            );
-          }}
-          onChange={(selectedOptions: Array<{ label: string }>) => {
-            editAction(
-              'bcc',
-              selectedOptions.map(selectedOption => selectedOption.label),
-              index
-            );
-          }}
-          onBlur={() => {
-            if (!bcc) {
-              editAction('bcc', [], index);
+          error={errors.bcc}
+          isInvalid={errors.bcc.length > 0 && bcc !== undefined}
+          label={i18n.translate(
+            'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.recipientBccTextFieldLabel',
+            {
+              defaultMessage: 'Bcc:',
             }
-          }}
-        />
-      </EuiFormRow>
+          )}
+        >
+          <EuiComboBox
+            noSuggestions
+            isInvalid={errors.bcc.length > 0 && bcc !== undefined}
+            fullWidth
+            data-test-subj="bccEmailAddressInput"
+            selectedOptions={bccOptions}
+            onCreateOption={(searchValue: string) => {
+              const newOptions = [...bccOptions, { label: searchValue }];
+              editAction(
+                'bcc',
+                newOptions.map(newOption => newOption.label),
+                index
+              );
+            }}
+            onChange={(selectedOptions: Array<{ label: string }>) => {
+              editAction(
+                'bcc',
+                selectedOptions.map(selectedOption => selectedOption.label),
+                index
+              );
+            }}
+            onBlur={() => {
+              if (!bcc) {
+                editAction('bcc', [], index);
+              }
+            }}
+          />
+        </EuiFormRow>
+      ) : null}
       <EuiFormRow
         fullWidth
         error={errors.subject}
-        isInvalid={hasErrors && message !== undefined}
+        isInvalid={errors.subject.length > 0 && subject !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.subjectTextFieldLabel',
           {
-            defaultMessage: 'Subject',
+            defaultMessage: 'Subject:',
           }
         )}
       >
         <EuiFieldText
           fullWidth
-          isInvalid={hasErrors && message !== undefined}
+          isInvalid={errors.subject.length > 0 && subject !== undefined}
           name="subject"
           data-test-subj="emailSubjectInput"
           value={subject || ''}
+          placeholder="Text field (placeholder)"
           onChange={e => {
             editAction('subject', e.target.value, index);
           }}
+          onBlur={() => {
+            if (!subject) {
+              editAction('subject', '', index);
+            }
+          }}
         />
       </EuiFormRow>
       <EuiFormRow
         fullWidth
         error={errors.message}
-        isInvalid={hasErrors && message !== undefined}
+        isInvalid={errors.message.length > 0 && message !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.messageTextAreaFieldLabel',
           {
-            defaultMessage: 'Message',
+            defaultMessage: 'Message:',
           }
         )}
+        labelAppend={
+          <EuiPopover
+            id="singlePanel"
+            button={
+              <EuiButtonIcon
+                onClick={() => setIsVariablesPopoverOpen(true)}
+                iconType="indexOpen"
+                aria-label={i18n.translate(
+                  'xpack.triggersActionsUI.components.builtinActionTypes.emailAction.addVariablePopoverButton',
+                  {
+                    defaultMessage: 'Add variable',
+                  }
+                )}
+              />
+            }
+            isOpen={isVariablesPopoverOpen}
+            closePopover={() => setIsVariablesPopoverOpen(false)}
+            panelPaddingSize="none"
+            anchorPosition="downLeft"
+          >
+            <EuiContextMenuPanel items={messageVariablesItems} />
+          </EuiPopover>
+        }
       >
         <EuiTextArea
           fullWidth
-          isInvalid={hasErrors && message !== undefined}
+          isInvalid={errors.message.length > 0 && message !== undefined}
           value={message || ''}
           name="message"
           data-test-subj="emailMessageInput"
           onChange={e => {
             editAction('message', e.target.value, index);
           }}
+          onBlur={() => {
+            if (!message) {
+              editAction('message', '', index);
+            }
+          }}
         />
       </EuiFormRow>
     </Fragment>
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
similarity index 89%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
index b6a7c4d82aca4..d44787f0c4ed6 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
@@ -3,11 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionParamsProps } from '../../../types';
+import { IndexActionParams, EsIndexActionConnector } from './types';
 
 const ACTION_TYPE_ID = '.index';
 let actionTypeModel: ActionTypeModel;
@@ -38,7 +39,7 @@ describe('index connector validation', () => {
       config: {
         index: 'test_es_index',
       },
-    } as ActionConnector;
+    } as EsIndexActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {},
@@ -87,14 +88,13 @@ describe('IndexActionConnectorFields renders', () => {
       config: {
         index: 'test',
       },
-    } as ActionConnector;
+    } as EsIndexActionConnector;
     const wrapper = mountWithIntl(
       <ConnectorFields
         action={actionConnector}
         errors={{}}
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="indexInput"]').length > 0).toBeTruthy();
@@ -113,7 +113,9 @@ describe('IndexParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<IndexActionParams>
+    >;
     const actionParams = {
       index: 'test_index',
       refresh: false,
@@ -121,11 +123,10 @@ describe('IndexParamsFields renders', () => {
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
-        errors={{}}
+        actionParams={actionParams}
+        errors={{ index: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="indexInput"]').length > 0).toBeTruthy();
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
similarity index 81%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
index aa15195cdc286..6af54d2bf15b4 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/es_index.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import React, { Fragment } from 'react';
-import { EuiFieldText, EuiFormRow, EuiSwitch } from '@elastic/eui';
+import { EuiFieldText, EuiFormRow, EuiSwitch, EuiSpacer } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import {
@@ -13,6 +13,7 @@ import {
   ValidationResult,
   ActionParamsProps,
 } from '../../../types';
+import { IndexActionParams, EsIndexActionConnector } from './types';
 
 export function getActionType(): ActionTypeModel {
   return {
@@ -29,17 +30,15 @@ export function getActionType(): ActionTypeModel {
     },
     actionConnectorFields: IndexActionConnectorFields,
     actionParamsFields: IndexParamsFields,
-    validateParams: (actionParams: any): ValidationResult => {
-      const validationResult = { errors: {} };
-      return validationResult;
+    validateParams: (): ValidationResult => {
+      return { errors: {} };
     },
   };
 }
 
-const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({
-  action,
-  editActionConfig,
-}) => {
+const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
+  EsIndexActionConnector
+>> = ({ action, editActionConfig }) => {
   const { index } = action.config;
   return (
     <EuiFormRow
@@ -69,20 +68,16 @@ const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
   );
 };
 
-const IndexParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
+const IndexParamsFields: React.FunctionComponent<ActionParamsProps<IndexActionParams>> = ({
+  actionParams,
   index,
   editAction,
-  errors,
-  hasErrors,
 }) => {
-  const { refresh } = action;
+  const { refresh } = actionParams;
   return (
     <Fragment>
       <EuiFormRow
         fullWidth
-        error={errors.index}
-        isInvalid={hasErrors === true && action.index !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.indexFieldLabel',
           {
@@ -92,24 +87,24 @@ const IndexParamsFields: React.FunctionComponent<ActionParamsProps> = ({
       >
         <EuiFieldText
           fullWidth
-          isInvalid={hasErrors === true && action.index !== undefined}
           name="index"
           data-test-subj="indexInput"
-          value={action.index || ''}
+          value={actionParams.index || ''}
           onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
             editAction('index', e.target.value, index);
           }}
           onBlur={() => {
-            if (!action.index) {
+            if (!actionParams.index) {
               editAction('index', '', index);
             }
           }}
         />
       </EuiFormRow>
+      <EuiSpacer color="subdued" size="m" />
       <EuiSwitch
         data-test-subj="indexRefreshCheckbox"
-        checked={refresh}
-        onChange={(e: any) => {
+        checked={refresh || false}
+        onChange={e => {
           editAction('refresh', e.target.checked, index);
         }}
         label={
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/index.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.test.tsx
similarity index 86%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.test.tsx
index 582315c95812a..31a69f9fd94ac 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.test.tsx
@@ -3,11 +3,17 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionParamsProps } from '../../../types';
+import {
+  PagerDutyActionParams,
+  EventActionOptions,
+  SeverityActionOptions,
+  PagerDutyActionConnector,
+} from './types';
 
 const ACTION_TYPE_ID = '.pagerduty';
 let actionTypeModel: ActionTypeModel;
@@ -40,7 +46,7 @@ describe('pagerduty connector validation', () => {
       config: {
         apiUrl: 'http:\\test',
       },
-    } as ActionConnector;
+    } as PagerDutyActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -66,7 +72,7 @@ describe('pagerduty connector validation', () => {
       config: {
         apiUrl: 'http:\\test',
       },
-    } as ActionConnector;
+    } as PagerDutyActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -91,7 +97,9 @@ describe('pagerduty action params validation', () => {
     };
 
     expect(actionTypeModel.validateParams(actionParams)).toEqual({
-      errors: {},
+      errors: {
+        summary: [],
+      },
     });
   });
 });
@@ -113,14 +121,13 @@ describe('PagerDutyActionConnectorFields renders', () => {
       config: {
         apiUrl: 'http:\\test',
       },
-    } as ActionConnector;
+    } as PagerDutyActionConnector;
     const wrapper = mountWithIntl(
       <ConnectorFields
         action={actionConnector}
         errors={{ routingKey: [] }}
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="pagerdutyApiUrlInput"]').length > 0).toBeTruthy();
@@ -140,13 +147,15 @@ describe('PagerDutyParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<PagerDutyActionParams>
+    >;
     const actionParams = {
-      eventAction: 'trigger',
+      eventAction: EventActionOptions.TRIGGER,
       dedupKey: 'test',
       summary: '2323',
       source: 'source',
-      severity: 'critical',
+      severity: SeverityActionOptions.CRITICAL,
       timestamp: '234654564654',
       component: 'test',
       group: 'group',
@@ -154,11 +163,10 @@ describe('PagerDutyParamsFields renders', () => {
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
-        errors={{}}
+        actionParams={actionParams}
+        errors={{ summary: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="severitySelect"]').length > 0).toBeTruthy();
@@ -174,6 +182,6 @@ describe('PagerDutyParamsFields renders', () => {
     expect(wrapper.find('[data-test-subj="componentInput"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="groupInput"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="sourceInput"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="pagerdutyDescriptionInput"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="pagerdutySummaryInput"]').length > 0).toBeTruthy();
   });
 });
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.tsx
similarity index 83%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.tsx
index 69c7ec166df60..3c1b1d258cfe2 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/pagerduty.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty.tsx
@@ -17,10 +17,10 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import {
   ActionTypeModel,
   ActionConnectorFieldsProps,
-  ActionConnector,
   ValidationResult,
   ActionParamsProps,
 } from '../../../types';
+import { PagerDutyActionParams, PagerDutyActionConnector } from './types';
 
 export function getActionType(): ActionTypeModel {
   return {
@@ -32,7 +32,13 @@ export function getActionType(): ActionTypeModel {
         defaultMessage: 'Send an event in PagerDuty.',
       }
     ),
-    validateConnector: (action: ActionConnector): ValidationResult => {
+    actionTypeTitle: i18n.translate(
+      'xpack.triggersActionsUI.components.builtinActionTypes.pagerDutyAction.actionTypeTitle',
+      {
+        defaultMessage: 'Send to PagerDuty',
+      }
+    ),
+    validateConnector: (action: PagerDutyActionConnector): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         routingKey: new Array<string>(),
@@ -50,8 +56,22 @@ export function getActionType(): ActionTypeModel {
       }
       return validationResult;
     },
-    validateParams: (actionParams: any): ValidationResult => {
+    validateParams: (actionParams: PagerDutyActionParams): ValidationResult => {
       const validationResult = { errors: {} };
+      const errors = {
+        summary: new Array<string>(),
+      };
+      validationResult.errors = errors;
+      if (!actionParams.summary?.length) {
+        errors.summary.push(
+          i18n.translate(
+            'xpack.triggersActionsUI.components.builtinActionTypes.pagerDutyAction.error.requiredSummaryText',
+            {
+              defaultMessage: 'Summary is required.',
+            }
+          )
+        );
+      }
       return validationResult;
     },
     actionConnectorFields: PagerDutyActionConnectorFields,
@@ -59,12 +79,9 @@ export function getActionType(): ActionTypeModel {
   };
 }
 
-const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({
-  errors,
-  action,
-  editActionConfig,
-  editActionSecrets,
-}) => {
+const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
+  PagerDutyActionConnector
+>> = ({ errors, action, editActionConfig, editActionSecrets }) => {
   const { apiUrl } = action.config;
   const { routingKey } = action.secrets;
   return (
@@ -137,14 +154,22 @@ const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFie
   );
 };
 
-const PagerDutyParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
+const PagerDutyParamsFields: React.FunctionComponent<ActionParamsProps<PagerDutyActionParams>> = ({
+  actionParams,
   editAction,
   index,
   errors,
-  hasErrors,
 }) => {
-  const { eventAction, dedupKey, summary, source, severity, timestamp, component, group } = action;
+  const {
+    eventAction,
+    dedupKey,
+    summary,
+    source,
+    severity,
+    timestamp,
+    component,
+    group,
+  } = actionParams;
   const severityOptions = [
     { value: 'critical', text: 'Critical' },
     { value: 'info', text: 'Info' },
@@ -332,7 +357,7 @@ const PagerDutyParamsFields: React.FunctionComponent<ActionParamsProps> = ({
         id="pagerDutySummary"
         fullWidth
         error={errors.summary}
-        isInvalid={hasErrors === true && summary !== undefined}
+        isInvalid={errors.summary.length > 0 && summary !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.pagerDutyAction.summaryFieldLabel',
           {
@@ -342,10 +367,10 @@ const PagerDutyParamsFields: React.FunctionComponent<ActionParamsProps> = ({
       >
         <EuiFieldText
           fullWidth
-          isInvalid={hasErrors === true && summary !== undefined}
+          isInvalid={errors.summary.length > 0 && summary !== undefined}
           name="summary"
           value={summary || ''}
-          data-test-subj="pagerdutyDescriptionInput"
+          data-test-subj="pagerdutySummaryInput"
           onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
             editAction('summary', e.target.value, index);
           }}
@@ -356,6 +381,31 @@ const PagerDutyParamsFields: React.FunctionComponent<ActionParamsProps> = ({
           }}
         />
       </EuiFormRow>
+      <EuiFormRow
+        id="pagerDutyClass"
+        fullWidth
+        label={i18n.translate(
+          'xpack.triggersActionsUI.components.builtinActionTypes.pagerDutyAction.classFieldLabel',
+          {
+            defaultMessage: 'Class',
+          }
+        )}
+      >
+        <EuiFieldText
+          fullWidth
+          name="class"
+          value={actionParams.class || ''}
+          data-test-subj="pagerdutyClassInput"
+          onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
+            editAction('class', e.target.value, index);
+          }}
+          onBlur={() => {
+            if (!actionParams.class) {
+              editAction('class', '', index);
+            }
+          }}
+        />
+      </EuiFormRow>
     </Fragment>
   );
 };
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.test.tsx
similarity index 83%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.test.tsx
index b79be4eef523b..fce8f25e51131 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.test.tsx
@@ -3,11 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionConnector, ActionParamsProps } from '../../../types';
+import { ServerLogActionParams, ServerLogLevelOptions } from './types';
 
 const ACTION_TYPE_ID = '.server-log';
 let actionTypeModel: ActionTypeModel;
@@ -63,18 +64,20 @@ describe('ServerLogParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<ServerLogActionParams>
+    >;
     const actionParams = {
-      message: 'test message',
-      level: 'trace',
+      level: ServerLogLevelOptions.TRACE,
+      message: 'test',
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
+        actionParams={actionParams}
         errors={{ message: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
+        defaultMessage={'test default message'}
       />
     );
     expect(wrapper.find('[data-test-subj="loggingLevelSelect"]').length > 0).toBeTruthy();
@@ -92,18 +95,19 @@ describe('ServerLogParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<ServerLogActionParams>
+    >;
     const actionParams = {
       message: 'test message',
-      level: 'info',
+      level: ServerLogLevelOptions.INFO,
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
+        actionParams={actionParams}
         errors={{ message: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="loggingLevelSelect"]').length > 0).toBeTruthy();
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.tsx
similarity index 53%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.tsx
index 885061aa81924..8d8045042cfc3 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/server_log.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/server_log.tsx
@@ -3,10 +3,19 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { Fragment } from 'react';
+import React, { Fragment, useEffect, useState } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiSelect, EuiTextArea, EuiFormRow } from '@elastic/eui';
+import {
+  EuiSelect,
+  EuiTextArea,
+  EuiFormRow,
+  EuiContextMenuItem,
+  EuiPopover,
+  EuiButtonIcon,
+  EuiContextMenuPanel,
+} from '@elastic/eui';
 import { ActionTypeModel, ValidationResult, ActionParamsProps } from '../../../types';
+import { ServerLogActionParams } from './types';
 
 export function getActionType(): ActionTypeModel {
   return {
@@ -18,16 +27,22 @@ export function getActionType(): ActionTypeModel {
         defaultMessage: 'Add a message to a Kibana log.',
       }
     ),
+    actionTypeTitle: i18n.translate(
+      'xpack.triggersActionsUI.components.builtinActionTypes.serverLogAction.actionTypeTitle',
+      {
+        defaultMessage: 'Send to Server log',
+      }
+    ),
     validateConnector: (): ValidationResult => {
       return { errors: {} };
     },
-    validateParams: (actionParams: any): ValidationResult => {
+    validateParams: (actionParams: ServerLogActionParams): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         message: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (!actionParams.message || actionParams.message.length === 0) {
+      if (!actionParams.message?.length) {
         errors.message.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredServerLogMessageText',
@@ -44,14 +59,10 @@ export function getActionType(): ActionTypeModel {
   };
 }
 
-export const ServerLogParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
-  editAction,
-  index,
-  errors,
-  hasErrors,
-}) => {
-  const { message, level } = action;
+export const ServerLogParamsFields: React.FunctionComponent<ActionParamsProps<
+  ServerLogActionParams
+>> = ({ actionParams, editAction, index, errors, messageVariables, defaultMessage }) => {
+  const { message, level } = actionParams;
   const levelOptions = [
     { value: 'trace', text: 'Trace' },
     { value: 'debug', text: 'Debug' },
@@ -60,10 +71,27 @@ export const ServerLogParamsFields: React.FunctionComponent<ActionParamsProps> =
     { value: 'error', text: 'Error' },
     { value: 'fatal', text: 'Fatal' },
   ];
+  const [isVariablesPopoverOpen, setIsVariablesPopoverOpen] = useState<boolean>(false);
 
-  // Set default value 'info' for level param
-  editAction('level', 'info', index);
-
+  useEffect(() => {
+    editAction('level', 'info', index);
+    if (defaultMessage && defaultMessage.length > 0) {
+      editAction('message', defaultMessage, index);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+  const messageVariablesItems = messageVariables?.map((variable: string) => (
+    <EuiContextMenuItem
+      key={variable}
+      icon="empty"
+      onClick={() => {
+        editAction('message', (message ?? '').concat(` {{${variable}}}`), index);
+        setIsVariablesPopoverOpen(false);
+      }}
+    >
+      {`{{${variable}}}`}
+    </EuiContextMenuItem>
+  ));
   return (
     <Fragment>
       <EuiFormRow
@@ -92,23 +120,51 @@ export const ServerLogParamsFields: React.FunctionComponent<ActionParamsProps> =
         id="loggingMessage"
         fullWidth
         error={errors.message}
-        isInvalid={hasErrors && message !== undefined}
+        isInvalid={errors.message.length > 0 && message !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.serverLogAction.logMessageFieldLabel',
           {
             defaultMessage: 'Message',
           }
         )}
+        labelAppend={
+          <EuiPopover
+            id="singlePanel"
+            button={
+              <EuiButtonIcon
+                onClick={() => setIsVariablesPopoverOpen(true)}
+                iconType="indexOpen"
+                aria-label={i18n.translate(
+                  'xpack.triggersActionsUI.components.builtinActionTypes.serverLogAction.addVariablePopoverButton',
+                  {
+                    defaultMessage: 'Add variable',
+                  }
+                )}
+              />
+            }
+            isOpen={isVariablesPopoverOpen}
+            closePopover={() => setIsVariablesPopoverOpen(false)}
+            panelPaddingSize="none"
+            anchorPosition="downLeft"
+          >
+            <EuiContextMenuPanel items={messageVariablesItems} />
+          </EuiPopover>
+        }
       >
         <EuiTextArea
           fullWidth
-          isInvalid={hasErrors && message !== undefined}
+          isInvalid={errors.message.length > 0 && message !== undefined}
           value={message || ''}
           name="message"
           data-test-subj="loggingMessageInput"
           onChange={e => {
             editAction('message', e.target.value, index);
           }}
+          onBlur={() => {
+            if (!message) {
+              editAction('message', '', index);
+            }
+          }}
         />
       </EuiFormRow>
     </Fragment>
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.test.tsx
similarity index 87%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.test.tsx
index 36beea4d2f2be..e4f8599d2e46e 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.test.tsx
@@ -3,11 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionParamsProps } from '../../../types';
+import { SlackActionParams, SlackActionConnector } from './types';
 
 const ACTION_TYPE_ID = '.slack';
 let actionTypeModel: ActionTypeModel;
@@ -38,7 +39,7 @@ describe('slack connector validation', () => {
       actionTypeId: '.email',
       name: 'email',
       config: {},
-    } as ActionConnector;
+    } as SlackActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -54,7 +55,7 @@ describe('slack connector validation', () => {
       actionTypeId: '.email',
       name: 'email',
       config: {},
-    } as ActionConnector;
+    } as SlackActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -91,7 +92,7 @@ describe('SlackActionFields renders', () => {
       actionTypeId: '.email',
       name: 'email',
       config: {},
-    } as ActionConnector;
+    } as SlackActionConnector;
     const wrapper = mountWithIntl(
       <ConnectorFields
         action={actionConnector}
@@ -116,23 +117,24 @@ describe('SlackParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<SlackActionParams>
+    >;
     const actionParams = {
       message: 'test message',
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
+        actionParams={actionParams}
         errors={{ message: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
-    expect(wrapper.find('[data-test-subj="slackMessageTextarea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="slackMessageTextArea"]').length > 0).toBeTruthy();
     expect(
       wrapper
-        .find('[data-test-subj="slackMessageTextarea"]')
+        .find('[data-test-subj="slackMessageTextArea"]')
         .first()
         .prop('value')
     ).toStrictEqual('test message');
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.tsx
similarity index 60%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.tsx
index 0ae51725169bf..916715de7ae18 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/slack.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack.tsx
@@ -3,25 +3,26 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { Fragment } from 'react';
+import React, { Fragment, useState, useEffect } from 'react';
 import {
   EuiFieldText,
   EuiTextArea,
-  EuiFlexGroup,
-  EuiFlexItem,
   EuiButtonIcon,
   EuiFormRow,
   EuiLink,
+  EuiPopover,
+  EuiContextMenuPanel,
+  EuiContextMenuItem,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import {
   ActionTypeModel,
   ActionConnectorFieldsProps,
-  ActionConnector,
   ValidationResult,
   ActionParamsProps,
 } from '../../../types';
+import { SlackActionParams, SlackActionConnector } from './types';
 
 export function getActionType(): ActionTypeModel {
   return {
@@ -33,7 +34,13 @@ export function getActionType(): ActionTypeModel {
         defaultMessage: 'Send a message to a Slack channel or user.',
       }
     ),
-    validateConnector: (action: ActionConnector): ValidationResult => {
+    actionTypeTitle: i18n.translate(
+      'xpack.triggersActionsUI.components.builtinActionTypes.slackAction.actionTypeTitle',
+      {
+        defaultMessage: 'Send to Slack',
+      }
+    ),
+    validateConnector: (action: SlackActionConnector): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         webhookUrl: new Array<string>(),
@@ -51,13 +58,13 @@ export function getActionType(): ActionTypeModel {
       }
       return validationResult;
     },
-    validateParams: (actionParams: any): ValidationResult => {
+    validateParams: (actionParams: SlackActionParams): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         message: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (!actionParams.message || actionParams.message.length === 0) {
+      if (!actionParams.message?.length) {
         errors.message.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredSlackMessageText',
@@ -74,11 +81,9 @@ export function getActionType(): ActionTypeModel {
   };
 }
 
-const SlackActionFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({
-  action,
-  editActionSecrets,
-  errors,
-}) => {
+const SlackActionFields: React.FunctionComponent<ActionConnectorFieldsProps<
+  SlackActionConnector
+>> = ({ action, editActionSecrets, errors }) => {
   const { webhookUrl } = action.secrets;
 
   return (
@@ -127,47 +132,87 @@ const SlackActionFields: React.FunctionComponent<ActionConnectorFieldsProps> = (
   );
 };
 
-const SlackParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
+const SlackParamsFields: React.FunctionComponent<ActionParamsProps<SlackActionParams>> = ({
+  actionParams,
   editAction,
   index,
   errors,
-  hasErrors,
+  messageVariables,
+  defaultMessage,
 }) => {
-  const { message } = action;
-
+  const { message } = actionParams;
+  const [isVariablesPopoverOpen, setIsVariablesPopoverOpen] = useState<boolean>(false);
+  useEffect(() => {
+    if (defaultMessage && defaultMessage.length > 0) {
+      editAction('message', defaultMessage, index);
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+  const messageVariablesItems = messageVariables?.map((variable: string, i: number) => (
+    <EuiContextMenuItem
+      key={variable}
+      data-test-subj={`variableMenuButton-${i}`}
+      icon="empty"
+      onClick={() => {
+        editAction('message', (message ?? '').concat(` {{${variable}}}`), index);
+        setIsVariablesPopoverOpen(false);
+      }}
+    >
+      {`{{${variable}}}`}
+    </EuiContextMenuItem>
+  ));
   return (
     <Fragment>
-      <EuiFlexGroup>
-        <EuiFlexItem>
-          <EuiButtonIcon
-            onClick={() => window.alert('Button clicked')}
-            iconType="indexOpen"
-            aria-label="Add variable"
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
       <EuiFormRow
         id="slackMessage"
         fullWidth
         error={errors.message}
-        isInvalid={hasErrors && message !== undefined}
+        isInvalid={errors.message.length > 0 && message !== undefined}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.slackAction.messageTextAreaFieldLabel',
           {
             defaultMessage: 'Message',
           }
         )}
+        labelAppend={
+          <EuiPopover
+            id="singlePanel"
+            button={
+              <EuiButtonIcon
+                data-test-subj="slackAddVariableButton"
+                onClick={() => setIsVariablesPopoverOpen(true)}
+                iconType="indexOpen"
+                aria-label={i18n.translate(
+                  'xpack.triggersActionsUI.components.builtinActionTypes.slackAction.addVariablePopoverButton',
+                  {
+                    defaultMessage: 'Add variable',
+                  }
+                )}
+              />
+            }
+            isOpen={isVariablesPopoverOpen}
+            closePopover={() => setIsVariablesPopoverOpen(false)}
+            panelPaddingSize="none"
+            anchorPosition="downLeft"
+          >
+            <EuiContextMenuPanel items={messageVariablesItems} />
+          </EuiPopover>
+        }
       >
         <EuiTextArea
           fullWidth
-          isInvalid={hasErrors && message !== undefined}
+          isInvalid={errors.message.length > 0 && message !== undefined}
           name="message"
-          value={message}
-          data-test-subj="slackMessageTextarea"
+          value={message || ''}
+          data-test-subj="slackMessageTextArea"
           onChange={e => {
             editAction('message', e.target.value, index);
           }}
+          onBlur={() => {
+            if (!message) {
+              editAction('message', '', index);
+            }
+          }}
         />
       </EuiFormRow>
     </Fragment>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
new file mode 100644
index 0000000000000..45a08b2d5263a
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
@@ -0,0 +1,130 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { ActionConnector } from '../../../types';
+
+export interface EmailActionParams {
+  to: string[];
+  cc: string[];
+  bcc: string[];
+  subject: string;
+  message: string;
+}
+
+export enum EventActionOptions {
+  TRIGGER = 'trigger',
+  RESOLVE = 'resolve',
+  ACKNOWLEDGE = 'acknowledge',
+}
+
+export enum SeverityActionOptions {
+  CRITICAL = 'critical',
+  ERROR = 'error',
+  WARNING = 'warning',
+  INFO = 'info',
+}
+
+export interface PagerDutyActionParams {
+  eventAction?: EventActionOptions;
+  dedupKey?: string;
+  summary?: string;
+  source?: string;
+  severity?: SeverityActionOptions;
+  timestamp?: string;
+  component?: string;
+  group?: string;
+  class?: string;
+}
+
+export interface IndexActionParams {
+  index?: string;
+  refresh?: boolean;
+  executionTimeField?: string;
+  documents: string[];
+}
+
+export enum ServerLogLevelOptions {
+  TRACE = 'trace',
+  DEBUG = 'debug',
+  INFO = 'info',
+  WARN = 'warn',
+  ERROR = 'error',
+  FATAL = 'fatal',
+}
+
+export interface ServerLogActionParams {
+  level?: ServerLogLevelOptions;
+  message: string;
+}
+
+export interface SlackActionParams {
+  message: string;
+}
+
+export interface WebhookActionParams {
+  body?: string;
+}
+
+interface EmailConfig {
+  from: string;
+  host: string;
+  port: number;
+  secure?: boolean;
+}
+
+interface EmailSecrets {
+  user: string;
+  password: string;
+}
+
+export interface EmailActionConnector extends ActionConnector {
+  config: EmailConfig;
+  secrets: EmailSecrets;
+}
+
+interface EsIndexConfig {
+  index?: string;
+}
+
+export interface EsIndexActionConnector extends ActionConnector {
+  config: EsIndexConfig;
+}
+
+interface PagerDutyConfig {
+  apiUrl?: string;
+}
+
+interface PagerDutySecrets {
+  routingKey: string;
+}
+
+export interface PagerDutyActionConnector extends ActionConnector {
+  config: PagerDutyConfig;
+  secrets: PagerDutySecrets;
+}
+
+interface SlackSecrets {
+  webhookUrl: string;
+}
+
+export interface SlackActionConnector extends ActionConnector {
+  secrets: SlackSecrets;
+}
+
+interface WebhookConfig {
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+}
+
+interface WebhookSecrets {
+  user: string;
+  password: string;
+}
+
+export interface WebhookActionConnector extends ActionConnector {
+  config: WebhookConfig;
+  secrets: WebhookSecrets;
+}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.test.tsx
similarity index 89%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.test.tsx
index cd342f2e19969..5e6c0404db532 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.test.tsx
@@ -3,11 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import React, { FunctionComponent } from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { TypeRegistry } from '../../type_registry';
 import { registerBuiltInActionTypes } from './index';
-import { ActionTypeModel, ActionConnector } from '../../../types';
+import { ActionTypeModel, ActionParamsProps } from '../../../types';
+import { WebhookActionParams, WebhookActionConnector } from './types';
 
 const ACTION_TYPE_ID = '.webhook';
 let actionTypeModel: ActionTypeModel;
@@ -41,9 +42,9 @@ describe('webhook connector validation', () => {
       config: {
         method: 'PUT',
         url: 'http:\\test',
-        headers: ['content-type: text'],
+        headers: { 'content-type': 'text' },
       },
-    } as ActionConnector;
+    } as WebhookActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -66,7 +67,7 @@ describe('webhook connector validation', () => {
       config: {
         method: 'PUT',
       },
-    } as ActionConnector;
+    } as WebhookActionConnector;
 
     expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
       errors: {
@@ -109,9 +110,9 @@ describe('WebhookActionConnectorFields renders', () => {
       config: {
         method: 'PUT',
         url: 'http:\\test',
-        headers: ['content-type: text'],
+        headers: { 'content-type': 'text' },
       },
-    } as ActionConnector;
+    } as WebhookActionConnector;
     const wrapper = mountWithIntl(
       <ConnectorFields
         action={actionConnector}
@@ -138,17 +139,18 @@ describe('WebhookParamsFields renders', () => {
     if (!actionTypeModel.actionParamsFields) {
       return;
     }
-    const ParamsFields = actionTypeModel.actionParamsFields;
+    const ParamsFields = actionTypeModel.actionParamsFields as FunctionComponent<
+      ActionParamsProps<WebhookActionParams>
+    >;
     const actionParams = {
       body: 'test message',
     };
     const wrapper = mountWithIntl(
       <ParamsFields
-        action={actionParams}
+        actionParams={actionParams}
         errors={{ body: [] }}
         editAction={() => {}}
         index={0}
-        hasErrors={false}
       />
     );
     expect(wrapper.find('[data-test-subj="webhookBodyEditor"]').length > 0).toBeTruthy();
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.tsx
similarity index 96%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.tsx
index 70a9a6f3d75b3..3000191218932 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_action_types/webhook.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook.tsx
@@ -27,10 +27,10 @@ import { i18n } from '@kbn/i18n';
 import {
   ActionTypeModel,
   ActionConnectorFieldsProps,
-  ActionConnector,
   ValidationResult,
   ActionParamsProps,
 } from '../../../types';
+import { WebhookActionParams, WebhookActionConnector } from './types';
 
 const HTTP_VERBS = ['post', 'put'];
 
@@ -44,7 +44,7 @@ export function getActionType(): ActionTypeModel {
         defaultMessage: 'Send a request to a web service.',
       }
     ),
-    validateConnector: (action: ActionConnector): ValidationResult => {
+    validateConnector: (action: WebhookActionConnector): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         url: new Array<string>(),
@@ -95,13 +95,13 @@ export function getActionType(): ActionTypeModel {
       }
       return validationResult;
     },
-    validateParams: (actionParams: any): ValidationResult => {
+    validateParams: (actionParams: WebhookActionParams): ValidationResult => {
       const validationResult = { errors: {} };
       const errors = {
         body: new Array<string>(),
       };
       validationResult.errors = errors;
-      if (!actionParams.body || actionParams.body.length === 0) {
+      if (!actionParams.body?.length) {
         errors.body.push(
           i18n.translate(
             'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredWebhookBodyText',
@@ -118,12 +118,9 @@ export function getActionType(): ActionTypeModel {
   };
 }
 
-const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> = ({
-  action,
-  editActionConfig,
-  editActionSecrets,
-  errors,
-}) => {
+const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
+  WebhookActionConnector
+>> = ({ action, editActionConfig, editActionSecrets, errors }) => {
   const [httpHeaderKey, setHttpHeaderKey] = useState<string>('');
   const [httpHeaderValue, setHttpHeaderValue] = useState<string>('');
   const [hasHeaders, setHasHeaders] = useState<boolean>(false);
@@ -453,14 +450,13 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
   );
 };
 
-const WebhookParamsFields: React.FunctionComponent<ActionParamsProps> = ({
-  action,
+const WebhookParamsFields: React.FunctionComponent<ActionParamsProps<WebhookActionParams>> = ({
+  actionParams,
   editAction,
   index,
   errors,
-  hasErrors,
 }) => {
-  const { body } = action;
+  const { body } = actionParams;
 
   return (
     <Fragment>
@@ -472,13 +468,13 @@ const WebhookParamsFields: React.FunctionComponent<ActionParamsProps> = ({
             defaultMessage: 'Body',
           }
         )}
-        isInvalid={hasErrors === true}
+        isInvalid={errors.body.length > 0 && body !== undefined}
         fullWidth
         error={errors.body}
       >
         <EuiCodeEditor
           fullWidth
-          isInvalid={hasErrors === true}
+          isInvalid={errors.body.length > 0 && body !== undefined}
           mode="json"
           width="100%"
           height="200px"
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/index.ts
similarity index 86%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/index.ts
index 6c5d440e47888..436a034e06051 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/index.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getActionType as getThresholdAlertType } from './threshold/expression';
+import { getAlertType as getThresholdAlertType } from './threshold';
 import { TypeRegistry } from '../../type_registry';
 import { AlertTypeModel } from '../../../types';
 
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/aggregation_types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/aggregation_types.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/aggregation_types.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/aggregation_types.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/comparators.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/comparators.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/comparators.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/comparators.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/constants/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/constants/index.ts
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/expression.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/expression.tsx
new file mode 100644
index 0000000000000..1708b2f0ae016
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/expression.tsx
@@ -0,0 +1,449 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, Fragment, useEffect } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiFlexItem,
+  EuiFlexGroup,
+  EuiExpression,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiSelect,
+  EuiSpacer,
+  EuiComboBox,
+  EuiComboBoxOptionProps,
+  EuiFormRow,
+  EuiCallOut,
+} from '@elastic/eui';
+import { COMPARATORS, builtInComparators } from '../../../../common/constants';
+import {
+  getMatchingIndicesForThresholdAlertType,
+  getThresholdAlertTypeFields,
+  loadIndexPatterns,
+} from './lib/api';
+import { getTimeFieldOptions } from '../../../../common/lib/get_time_options';
+import { ThresholdVisualization } from './visualization';
+import { WhenExpression } from '../../../../common';
+import {
+  OfExpression,
+  ThresholdExpression,
+  ForLastExpression,
+  GroupByExpression,
+} from '../../../../common';
+import { builtInAggregationTypes } from '../../../../common/constants';
+import { IndexThresholdAlertParams } from './types';
+import { AlertsContextValue } from '../../../context/alerts_context';
+
+const DEFAULT_VALUES = {
+  AGGREGATION_TYPE: 'count',
+  TERM_SIZE: 5,
+  THRESHOLD_COMPARATOR: COMPARATORS.GREATER_THAN,
+  TIME_WINDOW_SIZE: 5,
+  TIME_WINDOW_UNIT: 'm',
+  TRIGGER_INTERVAL_SIZE: 1,
+  TRIGGER_INTERVAL_UNIT: 'm',
+  THRESHOLD: [1000, 5000],
+  GROUP_BY: 'all',
+};
+
+const expressionFieldsWithValidation = [
+  'index',
+  'timeField',
+  'aggField',
+  'termSize',
+  'termField',
+  'threshold0',
+  'threshold1',
+  'timeWindowSize',
+];
+
+interface IndexThresholdProps {
+  alertParams: IndexThresholdAlertParams;
+  setAlertParams: (property: string, value: any) => void;
+  setAlertProperty: (key: string, value: any) => void;
+  errors: { [key: string]: string[] };
+  alertsContext: AlertsContextValue;
+}
+
+export const IndexThresholdAlertTypeExpression: React.FunctionComponent<IndexThresholdProps> = ({
+  alertParams,
+  setAlertParams,
+  setAlertProperty,
+  errors,
+  alertsContext,
+}) => {
+  const {
+    index,
+    timeField,
+    aggType,
+    aggField,
+    groupBy,
+    termSize,
+    termField,
+    thresholdComparator,
+    threshold,
+    timeWindowSize,
+    timeWindowUnit,
+  } = alertParams;
+
+  const firstFieldOption = {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.sections.alertAdd.threshold.timeFieldOptionLabel',
+      {
+        defaultMessage: 'Select a field',
+      }
+    ),
+    value: '',
+  };
+  const { http } = alertsContext;
+
+  const [indexPopoverOpen, setIndexPopoverOpen] = useState(false);
+  const [indexPatterns, setIndexPatterns] = useState([]);
+  const [esFields, setEsFields] = useState<Record<string, any>>([]);
+  const [indexOptions, setIndexOptions] = useState<EuiComboBoxOptionProps[]>([]);
+  const [timeFieldOptions, setTimeFieldOptions] = useState([firstFieldOption]);
+  const [isIndiciesLoading, setIsIndiciesLoading] = useState<boolean>(false);
+
+  const hasExpressionErrors = !!Object.keys(errors).find(
+    errorKey =>
+      expressionFieldsWithValidation.includes(errorKey) &&
+      errors[errorKey].length >= 1 &&
+      (alertParams as { [key: string]: any })[errorKey] !== undefined
+  );
+
+  const canShowVizualization = !!Object.keys(errors).find(
+    errorKey => expressionFieldsWithValidation.includes(errorKey) && errors[errorKey].length >= 1
+  );
+
+  const getIndexPatterns = async () => {
+    const indexPatternObjects = await loadIndexPatterns();
+    const titles = indexPatternObjects.map((indexPattern: any) => indexPattern.attributes.title);
+    setIndexPatterns(titles);
+  };
+
+  const expressionErrorMessage = i18n.translate(
+    'xpack.triggersActionsUI.sections.alertAdd.threshold.fixErrorInExpressionBelowValidationMessage',
+    {
+      defaultMessage: 'Expression contains errors.',
+    }
+  );
+
+  const setDefaultExpressionValues = () => {
+    setAlertProperty('params', {
+      aggType: DEFAULT_VALUES.AGGREGATION_TYPE,
+      termSize: DEFAULT_VALUES.TERM_SIZE,
+      thresholdComparator: DEFAULT_VALUES.THRESHOLD_COMPARATOR,
+      timeWindowSize: DEFAULT_VALUES.TIME_WINDOW_SIZE,
+      timeWindowUnit: DEFAULT_VALUES.TIME_WINDOW_UNIT,
+      triggerIntervalUnit: DEFAULT_VALUES.TRIGGER_INTERVAL_UNIT,
+      groupBy: DEFAULT_VALUES.GROUP_BY,
+      threshold: DEFAULT_VALUES.THRESHOLD,
+    });
+  };
+
+  const getFields = async (indexes: string[]) => {
+    return await getThresholdAlertTypeFields({ indexes, http });
+  };
+
+  useEffect(() => {
+    getIndexPatterns();
+  }, []);
+
+  useEffect(() => {
+    setDefaultExpressionValues();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  interface IOption {
+    label: string;
+    options: Array<{ value: string; label: string }>;
+  }
+
+  const getIndexOptions = async (pattern: string, indexPatternsParam: string[]) => {
+    const options: IOption[] = [];
+
+    if (!pattern) {
+      return options;
+    }
+
+    const matchingIndices = (await getMatchingIndicesForThresholdAlertType({
+      pattern,
+      http,
+    })) as string[];
+    const matchingIndexPatterns = indexPatternsParam.filter(anIndexPattern => {
+      return anIndexPattern.includes(pattern);
+    }) as string[];
+
+    if (matchingIndices.length || matchingIndexPatterns.length) {
+      const matchingOptions = _.uniq([...matchingIndices, ...matchingIndexPatterns]);
+
+      options.push({
+        label: i18n.translate(
+          'xpack.triggersActionsUI.sections.alertAdd.threshold.indicesAndIndexPatternsLabel',
+          {
+            defaultMessage: 'Based on your indices and index patterns',
+          }
+        ),
+        options: matchingOptions.map(match => {
+          return {
+            label: match,
+            value: match,
+          };
+        }),
+      });
+    }
+
+    options.push({
+      label: i18n.translate('xpack.triggersActionsUI.sections.alertAdd.threshold.chooseLabel', {
+        defaultMessage: 'Choose…',
+      }),
+      options: [
+        {
+          value: pattern,
+          label: pattern,
+        },
+      ],
+    });
+
+    return options;
+  };
+
+  const indexPopover = (
+    <Fragment>
+      <EuiSpacer />
+      <EuiFlexGroup justifyContent="spaceBetween">
+        <EuiFlexItem>
+          <EuiFormRow
+            id="indexSelectSearchBox"
+            fullWidth
+            label={
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.alertAdd.threshold.indicesToQueryLabel"
+                defaultMessage="Indices to query"
+              />
+            }
+            isInvalid={errors.index.length > 0 && index !== undefined}
+            error={errors.index}
+            helpText={
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.alertAdd.threshold.howToBroadenSearchQueryDescription"
+                defaultMessage="Use * to broaden your query."
+              />
+            }
+          >
+            <EuiComboBox
+              fullWidth
+              async
+              isLoading={isIndiciesLoading}
+              isInvalid={errors.index.length > 0 && index !== undefined}
+              noSuggestions={!indexOptions.length}
+              options={indexOptions}
+              data-test-subj="thresholdIndexesComboBox"
+              selectedOptions={(index || []).map((anIndex: string) => {
+                return {
+                  label: anIndex,
+                  value: anIndex,
+                };
+              })}
+              onChange={async (selected: EuiComboBoxOptionProps[]) => {
+                setAlertParams(
+                  'index',
+                  selected.map(aSelected => aSelected.value)
+                );
+                const indices = selected.map(s => s.value as string);
+
+                // reset time field and expression fields if indices are deleted
+                if (indices.length === 0) {
+                  setTimeFieldOptions([firstFieldOption]);
+                  setDefaultExpressionValues();
+                  return;
+                }
+                const currentEsFields = await getFields(indices);
+                const timeFields = getTimeFieldOptions(currentEsFields as any);
+
+                setEsFields(currentEsFields);
+                setTimeFieldOptions([firstFieldOption, ...timeFields]);
+              }}
+              onSearchChange={async search => {
+                setIsIndiciesLoading(true);
+                setIndexOptions(await getIndexOptions(search, indexPatterns));
+                setIsIndiciesLoading(false);
+              }}
+              onBlur={() => {
+                if (!index) {
+                  setAlertParams('index', []);
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiFormRow
+            id="thresholdTimeField"
+            fullWidth
+            label={
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.alertAdd.threshold.timeFieldLabel"
+                defaultMessage="Time field"
+              />
+            }
+            isInvalid={errors.timeField.length > 0 && timeField !== undefined}
+            error={errors.timeField}
+          >
+            <EuiSelect
+              options={timeFieldOptions}
+              isInvalid={errors.timeField.length > 0 && timeField !== undefined}
+              fullWidth
+              name="thresholdTimeField"
+              data-test-subj="thresholdAlertTimeFieldSelect"
+              value={timeField}
+              onChange={e => {
+                setAlertParams('timeField', e.target.value);
+              }}
+              onBlur={() => {
+                if (timeField === undefined) {
+                  setAlertParams('timeField', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer />
+    </Fragment>
+  );
+
+  return (
+    <Fragment>
+      {hasExpressionErrors ? (
+        <Fragment>
+          <EuiSpacer />
+          <EuiCallOut color="danger" size="s" title={expressionErrorMessage} />
+          <EuiSpacer />
+        </Fragment>
+      ) : null}
+      <EuiFlexGroup gutterSize="s" wrap>
+        <EuiFlexItem grow={false}>
+          <EuiPopover
+            id="indexPopover"
+            button={
+              <EuiExpression
+                data-test-subj="selectIndexExpression"
+                description={i18n.translate(
+                  'xpack.triggersActionsUI.sections.alertAdd.threshold.indexLabel',
+                  {
+                    defaultMessage: 'index',
+                  }
+                )}
+                value={index || firstFieldOption.text}
+                isActive={indexPopoverOpen}
+                onClick={() => {
+                  setIndexPopoverOpen(true);
+                }}
+                color={index ? 'secondary' : 'danger'}
+              />
+            }
+            isOpen={indexPopoverOpen}
+            closePopover={() => {
+              setIndexPopoverOpen(false);
+            }}
+            ownFocus
+            withTitle
+            anchorPosition="downLeft"
+            zIndex={8000}
+          >
+            <div style={{ width: '450px' }}>
+              <EuiPopoverTitle>
+                {i18n.translate(
+                  'xpack.triggersActionsUI.sections.alertAdd.threshold.indexButtonLabel',
+                  {
+                    defaultMessage: 'index',
+                  }
+                )}
+              </EuiPopoverTitle>
+              {indexPopover}
+            </div>
+          </EuiPopover>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <WhenExpression
+            aggType={aggType ?? DEFAULT_VALUES.AGGREGATION_TYPE}
+            onChangeSelectedAggType={(selectedAggType: string) =>
+              setAlertParams('aggType', selectedAggType)
+            }
+          />
+        </EuiFlexItem>
+        {aggType && builtInAggregationTypes[aggType].fieldRequired ? (
+          <EuiFlexItem grow={false}>
+            <OfExpression
+              aggField={aggField}
+              fields={esFields}
+              aggType={aggType}
+              errors={errors}
+              onChangeSelectedAggField={(selectedAggField?: string) =>
+                setAlertParams('aggField', selectedAggField)
+              }
+            />
+          </EuiFlexItem>
+        ) : null}
+        <EuiFlexItem grow={false}>
+          <GroupByExpression
+            groupBy={groupBy || DEFAULT_VALUES.GROUP_BY}
+            termField={termField}
+            termSize={termSize}
+            errors={errors}
+            fields={esFields}
+            onChangeSelectedGroupBy={selectedGroupBy => setAlertParams('groupBy', selectedGroupBy)}
+            onChangeSelectedTermField={selectedTermField =>
+              setAlertParams('termField', selectedTermField)
+            }
+            onChangeSelectedTermSize={selectedTermSize =>
+              setAlertParams('termSize', selectedTermSize)
+            }
+          />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <ThresholdExpression
+            thresholdComparator={thresholdComparator ?? DEFAULT_VALUES.THRESHOLD_COMPARATOR}
+            threshold={threshold}
+            errors={errors}
+            onChangeSelectedThreshold={selectedThresholds =>
+              setAlertParams('threshold', selectedThresholds)
+            }
+            onChangeSelectedThresholdComparator={selectedThresholdComparator =>
+              setAlertParams('thresholdComparator', selectedThresholdComparator)
+            }
+          />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <ForLastExpression
+            timeWindowSize={timeWindowSize || 1}
+            timeWindowUnit={timeWindowUnit || ''}
+            errors={errors}
+            onChangeWindowSize={(selectedWindowSize: any) =>
+              setAlertParams('timeWindowSize', selectedWindowSize)
+            }
+            onChangeWindowUnit={(selectedWindowUnit: any) =>
+              setAlertParams('timeWindowUnit', selectedWindowUnit)
+            }
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      {canShowVizualization ? null : (
+        <Fragment>
+          <ThresholdVisualization
+            alertParams={alertParams}
+            aggregationTypes={builtInAggregationTypes}
+            comparators={builtInComparators}
+            alertsContext={alertsContext}
+          />
+        </Fragment>
+      )}
+    </Fragment>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/index.ts
new file mode 100644
index 0000000000000..e388149311075
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/index.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+import { AlertTypeModel, ValidationResult } from '../../../../types';
+import { IndexThresholdAlertTypeExpression } from './expression';
+import { IndexThresholdAlertParams } from './types';
+import { builtInGroupByTypes, builtInAggregationTypes } from '../../../../common/constants';
+
+export function getAlertType(): AlertTypeModel {
+  return {
+    id: 'threshold',
+    name: 'Index Threshold',
+    iconClass: 'alert',
+    alertParamsExpression: IndexThresholdAlertTypeExpression,
+    validate: (alertParams: IndexThresholdAlertParams): ValidationResult => {
+      const {
+        index,
+        timeField,
+        aggType,
+        aggField,
+        groupBy,
+        termSize,
+        termField,
+        threshold,
+        timeWindowSize,
+      } = alertParams;
+      const validationResult = { errors: {} };
+      const errors = {
+        aggField: new Array<string>(),
+        termSize: new Array<string>(),
+        termField: new Array<string>(),
+        timeWindowSize: new Array<string>(),
+        threshold0: new Array<string>(),
+        threshold1: new Array<string>(),
+        index: new Array<string>(),
+        timeField: new Array<string>(),
+      };
+      validationResult.errors = errors;
+      if (!index || index.length === 0) {
+        errors.index.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredIndexText', {
+            defaultMessage: 'Index is required.',
+          })
+        );
+      }
+      if (!timeField) {
+        errors.timeField.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredTimeFieldText', {
+            defaultMessage: 'Time field is required.',
+          })
+        );
+      }
+      if (aggType && builtInAggregationTypes[aggType].fieldRequired && !aggField) {
+        errors.aggField.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredAggFieldText', {
+            defaultMessage: 'Aggregation field is required.',
+          })
+        );
+      }
+      if (!termSize) {
+        errors.termSize.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredTermSizedText', {
+            defaultMessage: 'Term size is required.',
+          })
+        );
+      }
+      if (!termField && groupBy && builtInGroupByTypes[groupBy].sizeRequired) {
+        errors.termField.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredtTermFieldText', {
+            defaultMessage: 'Term field is required.',
+          })
+        );
+      }
+      if (!timeWindowSize) {
+        errors.timeWindowSize.push(
+          i18n.translate(
+            'xpack.triggersActionsUI.sections.addAlert.error.requiredTimeWindowSizeText',
+            {
+              defaultMessage: 'Time window size is required.',
+            }
+          )
+        );
+      }
+      if (threshold && threshold.length > 0 && !threshold[0]) {
+        errors.threshold0.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredThreshold0Text', {
+            defaultMessage: 'Threshold0, is required.',
+          })
+        );
+      }
+      if (threshold && threshold.length > 1 && !threshold[1]) {
+        errors.threshold1.push(
+          i18n.translate('xpack.triggersActionsUI.sections.addAlert.error.requiredThreshold1Text', {
+            defaultMessage: 'Threshold1 is required.',
+          })
+        );
+      }
+      return validationResult;
+    },
+    defaultActionMessage: 'Alert [{{ctx.metadata.name}}] has exceeded the threshold',
+  };
+}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/lib/api.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/api.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/lib/api.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/api.ts
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.test.ts
new file mode 100644
index 0000000000000..34e435be152f6
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.test.ts
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+
+import { calcAutoIntervalLessThan, calcAutoIntervalNear } from './calc_auto_interval';
+
+describe('calcAutoIntervalNear', () => {
+  test('1h/0 buckets = 0ms buckets', () => {
+    const interval = calcAutoIntervalNear(0, Number(moment.duration(1, 'h')));
+    expect(interval.asMilliseconds()).toBe(0);
+  });
+
+  test('undefined/100 buckets = 0ms buckets', () => {
+    const interval = calcAutoIntervalNear(0, undefined as any);
+    expect(interval.asMilliseconds()).toBe(0);
+  });
+
+  test('1ms/100 buckets = 1ms buckets', () => {
+    const interval = calcAutoIntervalNear(100, Number(moment.duration(1, 'ms')));
+    expect(interval.asMilliseconds()).toBe(1);
+  });
+
+  test('200ms/100 buckets = 2ms buckets', () => {
+    const interval = calcAutoIntervalNear(100, Number(moment.duration(200, 'ms')));
+    expect(interval.asMilliseconds()).toBe(2);
+  });
+
+  test('1s/1000 buckets = 1ms buckets', () => {
+    const interval = calcAutoIntervalNear(1000, Number(moment.duration(1, 's')));
+    expect(interval.asMilliseconds()).toBe(1);
+  });
+
+  test('1000h/1000 buckets = 1h buckets', () => {
+    const interval = calcAutoIntervalNear(1000, Number(moment.duration(1000, 'hours')));
+    expect(interval.asHours()).toBe(1);
+  });
+
+  test('1h/100 buckets = 30s buckets', () => {
+    const interval = calcAutoIntervalNear(100, Number(moment.duration(1, 'hours')));
+    expect(interval.asSeconds()).toBe(30);
+  });
+
+  test('1d/25 buckets = 1h buckets', () => {
+    const interval = calcAutoIntervalNear(25, Number(moment.duration(1, 'day')));
+    expect(interval.asHours()).toBe(1);
+  });
+
+  test('1y/1000 buckets = 12h buckets', () => {
+    const interval = calcAutoIntervalNear(1000, Number(moment.duration(1, 'year')));
+    expect(interval.asHours()).toBe(12);
+  });
+
+  test('1y/10000 buckets = 1h buckets', () => {
+    const interval = calcAutoIntervalNear(10000, Number(moment.duration(1, 'year')));
+    expect(interval.asHours()).toBe(1);
+  });
+
+  test('1y/100000 buckets = 5m buckets', () => {
+    const interval = calcAutoIntervalNear(100000, Number(moment.duration(1, 'year')));
+    expect(interval.asMinutes()).toBe(5);
+  });
+});
+
+describe('calcAutoIntervalLessThan', () => {
+  test('1h/0 buckets = 0ms buckets', () => {
+    const interval = calcAutoIntervalLessThan(0, Number(moment.duration(1, 'h')));
+    expect(interval.asMilliseconds()).toBe(0);
+  });
+
+  test('undefined/100 buckets = 0ms buckets', () => {
+    const interval = calcAutoIntervalLessThan(0, undefined as any);
+    expect(interval.asMilliseconds()).toBe(0);
+  });
+
+  test('1ms/100 buckets = 1ms buckets', () => {
+    const interval = calcAutoIntervalLessThan(100, Number(moment.duration(1, 'ms')));
+    expect(interval.asMilliseconds()).toBe(1);
+  });
+
+  test('200ms/100 buckets = 2ms buckets', () => {
+    const interval = calcAutoIntervalLessThan(100, Number(moment.duration(200, 'ms')));
+    expect(interval.asMilliseconds()).toBe(2);
+  });
+
+  test('1s/1000 buckets = 1ms buckets', () => {
+    const interval = calcAutoIntervalLessThan(1000, Number(moment.duration(1, 's')));
+    expect(interval.asMilliseconds()).toBe(1);
+  });
+
+  test('1000h/1000 buckets = 1h buckets', () => {
+    const interval = calcAutoIntervalLessThan(1000, Number(moment.duration(1000, 'hours')));
+    expect(interval.asHours()).toBe(1);
+  });
+
+  test('1h/100 buckets = 30s buckets', () => {
+    const interval = calcAutoIntervalLessThan(100, Number(moment.duration(1, 'hours')));
+    expect(interval.asSeconds()).toBe(30);
+  });
+
+  test('1d/25 buckets = 30m buckets', () => {
+    const interval = calcAutoIntervalLessThan(25, Number(moment.duration(1, 'day')));
+    expect(interval.asMinutes()).toBe(30);
+  });
+
+  test('1y/1000 buckets = 3h buckets', () => {
+    const interval = calcAutoIntervalLessThan(1000, Number(moment.duration(1, 'year')));
+    expect(interval.asHours()).toBe(3);
+  });
+
+  test('1y/10000 buckets = 30m buckets', () => {
+    const interval = calcAutoIntervalLessThan(10000, Number(moment.duration(1, 'year')));
+    expect(interval.asMinutes()).toBe(30);
+  });
+
+  test('1y/100000 buckets = 5m buckets', () => {
+    const interval = calcAutoIntervalLessThan(100000, Number(moment.duration(1, 'year')));
+    expect(interval.asMinutes()).toBe(5);
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.ts
new file mode 100644
index 0000000000000..c910f1e6752d4
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_auto_interval.ts
@@ -0,0 +1,132 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+
+const boundsDescending = [
+  {
+    bound: Infinity,
+    interval: Number(moment.duration(1, 'year')),
+  },
+  {
+    bound: Number(moment.duration(1, 'year')),
+    interval: Number(moment.duration(1, 'month')),
+  },
+  {
+    bound: Number(moment.duration(3, 'week')),
+    interval: Number(moment.duration(1, 'week')),
+  },
+  {
+    bound: Number(moment.duration(1, 'week')),
+    interval: Number(moment.duration(1, 'd')),
+  },
+  {
+    bound: Number(moment.duration(24, 'hour')),
+    interval: Number(moment.duration(12, 'hour')),
+  },
+  {
+    bound: Number(moment.duration(6, 'hour')),
+    interval: Number(moment.duration(3, 'hour')),
+  },
+  {
+    bound: Number(moment.duration(2, 'hour')),
+    interval: Number(moment.duration(1, 'hour')),
+  },
+  {
+    bound: Number(moment.duration(45, 'minute')),
+    interval: Number(moment.duration(30, 'minute')),
+  },
+  {
+    bound: Number(moment.duration(20, 'minute')),
+    interval: Number(moment.duration(10, 'minute')),
+  },
+  {
+    bound: Number(moment.duration(9, 'minute')),
+    interval: Number(moment.duration(5, 'minute')),
+  },
+  {
+    bound: Number(moment.duration(3, 'minute')),
+    interval: Number(moment.duration(1, 'minute')),
+  },
+  {
+    bound: Number(moment.duration(45, 'second')),
+    interval: Number(moment.duration(30, 'second')),
+  },
+  {
+    bound: Number(moment.duration(15, 'second')),
+    interval: Number(moment.duration(10, 'second')),
+  },
+  {
+    bound: Number(moment.duration(7.5, 'second')),
+    interval: Number(moment.duration(5, 'second')),
+  },
+  {
+    bound: Number(moment.duration(5, 'second')),
+    interval: Number(moment.duration(1, 'second')),
+  },
+  {
+    bound: Number(moment.duration(500, 'ms')),
+    interval: Number(moment.duration(100, 'ms')),
+  },
+];
+
+function getPerBucketMs(count: number, duration: number) {
+  const ms = duration / count;
+  return isFinite(ms) ? ms : NaN;
+}
+
+function normalizeMinimumInterval(targetMs: number) {
+  const value = isNaN(targetMs) ? 0 : Math.max(Math.floor(targetMs), 1);
+  return moment.duration(value);
+}
+
+/**
+ * Using some simple rules we pick a "pretty" interval that will
+ * produce around the number of buckets desired given a time range.
+ *
+ * @param targetBucketCount desired number of buckets
+ * @param duration time range the agg covers
+ */
+export function calcAutoIntervalNear(targetBucketCount: number, duration: number) {
+  const targetPerBucketMs = getPerBucketMs(targetBucketCount, duration);
+
+  // Find the first bound which is smaller than our target.
+  const lowerBoundIndex = boundsDescending.findIndex(({ bound }) => {
+    const boundMs = Number(bound);
+    return boundMs <= targetPerBucketMs;
+  });
+
+  // The bound immediately preceeding that lower bound contains the
+  // interval most closely matching our target.
+  if (lowerBoundIndex !== -1) {
+    const nearestInterval = boundsDescending[lowerBoundIndex - 1].interval;
+    return moment.duration(nearestInterval);
+  }
+
+  // If the target is smaller than any of our bounds, then we'll use it for the interval as-is.
+  return normalizeMinimumInterval(targetPerBucketMs);
+}
+
+/**
+ * Pick a "pretty" interval that produces no more than the maxBucketCount
+ * for the given time range.
+ *
+ * @param maxBucketCount maximum number of buckets to create
+ * @param duration amount of time covered by the agg
+ */
+export function calcAutoIntervalLessThan(maxBucketCount: number, duration: number) {
+  const maxPerBucketMs = getPerBucketMs(maxBucketCount, duration);
+
+  for (const { interval } of boundsDescending) {
+    // Find the highest interval which meets our per bucket limitation.
+    if (interval <= maxPerBucketMs) {
+      return moment.duration(interval);
+    }
+  }
+
+  // If the max is smaller than any of our intervals, then we'll use it for the interval as-is.
+  return normalizeMinimumInterval(maxPerBucketMs);
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_es_interval.js b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_es_interval.js
new file mode 100644
index 0000000000000..bb5725c567b1f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/calc_es_interval.js
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import dateMath from '@elastic/datemath';
+
+import { parseEsInterval } from '../../../../../../../../../../src/plugins/data/public';
+
+const unitsDesc = dateMath.unitsDesc;
+const largeMax = unitsDesc.indexOf('M');
+
+/**
+ * Convert a moment.duration into an es
+ * compatible expression, and provide
+ * associated metadata
+ *
+ * @param  {moment.duration} duration
+ * @return {object}
+ */
+export function convertDurationToNormalizedEsInterval(duration) {
+  for (let i = 0; i < unitsDesc.length; i++) {
+    const unit = unitsDesc[i];
+    const val = duration.as(unit);
+    // find a unit that rounds neatly
+    if (val >= 1 && Math.floor(val) === val) {
+      // if the unit is "large", like years, but
+      // isn't set to 1 ES will puke. So keep going until
+      // we get out of the "large" units
+      if (i <= largeMax && val !== 1) {
+        continue;
+      }
+
+      return {
+        value: val,
+        unit: unit,
+        expression: val + unit,
+      };
+    }
+  }
+
+  const ms = duration.as('ms');
+  return {
+    value: ms,
+    unit: 'ms',
+    expression: ms + 'ms',
+  };
+}
+
+export function convertIntervalToEsInterval(interval) {
+  const { value, unit } = parseEsInterval(interval);
+  return {
+    value,
+    unit,
+    expression: interval,
+  };
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.d.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.d.ts
new file mode 100644
index 0000000000000..d62655518f44a
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.d.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const TimeBuckets: any;
diff --git a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/index.js b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.js
similarity index 80%
rename from x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/index.js
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.js
index 441648a8701e0..4f2cce5861424 100644
--- a/x-pack/legacy/plugins/index_lifecycle_management/server/lib/is_es_error_factory/index.js
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/index.js
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { isEsErrorFactory } from './is_es_error_factory';
+export { TimeBuckets } from './time_buckets';
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/time_buckets.js b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/time_buckets.js
new file mode 100644
index 0000000000000..f49e85ddefea8
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/lib/time_buckets/time_buckets.js
@@ -0,0 +1,397 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import _ from 'lodash';
+import moment from 'moment';
+import { calcAutoIntervalLessThan, calcAutoIntervalNear } from './calc_auto_interval';
+import {
+  convertDurationToNormalizedEsInterval,
+  convertIntervalToEsInterval,
+} from './calc_es_interval';
+import { fieldFormats, parseInterval } from '../../../../../../../../../../src/plugins/data/public';
+
+function isValidMoment(m) {
+  return m && 'isValid' in m && m.isValid();
+}
+
+/**
+ * Helper class for wrapping the concept of an "Interval",
+ * which describes a timespan that will separate moments.
+ *
+ * @param {state} object - one of ""
+ * @param {[type]} display [description]
+ */
+function TimeBuckets(uiSettings, dataFieldsFormats) {
+  this.uiSettings = uiSettings;
+  this.dataFieldsFormats = dataFieldsFormats;
+  return TimeBuckets.__cached__(this);
+}
+
+/****
+ *  PUBLIC API
+ ****/
+
+/**
+ * Set the bounds that these buckets are expected to cover.
+ * This is required to support interval "auto" as well
+ * as interval scaling.
+ *
+ * @param {object} input - an object with properties min and max,
+ *                       representing the edges for the time span
+ *                       we should cover
+ *
+ * @returns {undefined}
+ */
+TimeBuckets.prototype.setBounds = function(input) {
+  if (!input) return this.clearBounds();
+
+  let bounds;
+  if (_.isPlainObject(input)) {
+    // accept the response from timefilter.getActiveBounds()
+    bounds = [input.min, input.max];
+  } else {
+    bounds = Array.isArray(input) ? input : [];
+  }
+
+  const moments = _(bounds)
+    .map(_.ary(moment, 1))
+    .sortBy(Number);
+
+  const valid = moments.size() === 2 && moments.every(isValidMoment);
+  if (!valid) {
+    this.clearBounds();
+    throw new Error('invalid bounds set: ' + input);
+  }
+
+  this._lb = moments.shift();
+  this._ub = moments.pop();
+  if (this.getDuration().asSeconds() < 0) {
+    throw new TypeError('Intervals must be positive');
+  }
+};
+
+/**
+ * Clear the stored bounds
+ *
+ * @return {undefined}
+ */
+TimeBuckets.prototype.clearBounds = function() {
+  this._lb = this._ub = null;
+};
+
+/**
+ * Check to see if we have received bounds yet
+ *
+ * @return {Boolean}
+ */
+TimeBuckets.prototype.hasBounds = function() {
+  return isValidMoment(this._ub) && isValidMoment(this._lb);
+};
+
+/**
+ * Return the current bounds, if we have any.
+ *
+ * THIS DOES NOT CLONE THE BOUNDS, so editing them
+ * may have unexpected side-effects. Always
+ * call bounds.min.clone() before editing
+ *
+ * @return {object|undefined} - If bounds are not defined, this
+ *                      returns undefined, else it returns the bounds
+ *                      for these buckets. This object has two props,
+ *                      min and max. Each property will be a moment()
+ *                      object
+ *
+ */
+TimeBuckets.prototype.getBounds = function() {
+  if (!this.hasBounds()) return;
+  return {
+    min: this._lb,
+    max: this._ub,
+  };
+};
+
+/**
+ * Get a moment duration object representing
+ * the distance between the bounds, if the bounds
+ * are set.
+ *
+ * @return {moment.duration|undefined}
+ */
+TimeBuckets.prototype.getDuration = function() {
+  if (!this.hasBounds()) return;
+  return moment.duration(this._ub - this._lb, 'ms');
+};
+
+/**
+ * Update the interval at which buckets should be
+ * generated.
+ *
+ * Input can be one of the following:
+ *  - Any object from src/legacy/ui/agg_types/buckets/_interval_options.js
+ *  - "auto"
+ *  - Pass a valid moment unit
+ *  - a moment.duration object.
+ *
+ * @param {object|string|moment.duration} input - see desc
+ */
+TimeBuckets.prototype.setInterval = function(input) {
+  // Preserve the original units because they're lost when the interval is converted to a
+  // moment duration object.
+  this.originalInterval = input;
+
+  let interval = input;
+
+  // selection object -> val
+  if (_.isObject(input)) {
+    interval = input.val;
+  }
+
+  if (!interval || interval === 'auto') {
+    this._i = 'auto';
+    return;
+  }
+
+  if (_.isString(interval)) {
+    input = interval;
+    interval = parseInterval(interval);
+    if (+interval === 0) {
+      interval = null;
+    }
+  }
+
+  // if the value wasn't converted to a duration, and isn't
+  // already a duration, we have a problem
+  if (!moment.isDuration(interval)) {
+    throw new TypeError('"' + input + '" is not a valid interval.');
+  }
+
+  this._i = interval;
+};
+
+/**
+ * Get the interval for the buckets. If the
+ * number of buckets created by the interval set
+ * is larger than config:histogram:maxBars then the
+ * interval will be scaled up. If the number of buckets
+ * created is less than one, the interval is scaled back.
+ *
+ * The interval object returned is a moment.duration
+ * object that has been decorated with the following
+ * properties.
+ *
+ * interval.description: a text description of the interval.
+ *   designed to be used list "field per {{ desc }}".
+ *     - "minute"
+ *     - "10 days"
+ *     - "3 years"
+ *
+ * interval.expr: the elasticsearch expression that creates this
+ *   interval. If the interval does not properly form an elasticsearch
+ *   expression it will be forced into one.
+ *
+ * interval.scaled: the interval was adjusted to
+ *   accommodate the maxBars setting.
+ *
+ * interval.scale: the number that y-values should be
+ *   multiplied by
+ *
+ * interval.scaleDescription: a description that reflects
+ *   the values which will be produced by using the
+ *   interval.scale.
+ *
+ *
+ * @return {[type]} [description]
+ */
+TimeBuckets.prototype.getInterval = function(useNormalizedEsInterval = true) {
+  const self = this;
+  const duration = self.getDuration();
+  const parsedInterval = readInterval();
+
+  if (useNormalizedEsInterval) {
+    return decorateInterval(maybeScaleInterval(parsedInterval));
+  } else {
+    return decorateInterval(parsedInterval);
+  }
+
+  // either pull the interval from state or calculate the auto-interval
+  function readInterval() {
+    const interval = self._i;
+    if (moment.isDuration(interval)) return interval;
+    return calcAutoIntervalNear(self.uiSettings.get('histogram:barTarget'), Number(duration));
+  }
+
+  // check to see if the interval should be scaled, and scale it if so
+  function maybeScaleInterval(interval) {
+    if (!self.hasBounds()) return interval;
+
+    const maxLength = self.uiSettings.get('histogram:maxBars');
+    const approxLen = duration / interval;
+    let scaled;
+
+    if (approxLen > maxLength) {
+      scaled = calcAutoIntervalLessThan(maxLength, Number(duration));
+    } else {
+      return interval;
+    }
+
+    if (+scaled === +interval) return interval;
+
+    decorateInterval(interval);
+    return _.assign(scaled, {
+      preScaled: interval,
+      scale: interval / scaled,
+      scaled: true,
+    });
+  }
+
+  // append some TimeBuckets specific props to the interval
+  function decorateInterval(interval) {
+    const esInterval = useNormalizedEsInterval
+      ? convertDurationToNormalizedEsInterval(interval)
+      : convertIntervalToEsInterval(self.originalInterval);
+    interval.esValue = esInterval.value;
+    interval.esUnit = esInterval.unit;
+    interval.expression = esInterval.expression;
+    interval.overflow = duration > interval ? moment.duration(interval - duration) : false;
+
+    const prettyUnits = moment.normalizeUnits(esInterval.unit);
+    if (esInterval.value === 1) {
+      interval.description = prettyUnits;
+    } else {
+      interval.description = esInterval.value + ' ' + prettyUnits + 's';
+    }
+
+    return interval;
+  }
+};
+
+/**
+ * Get a date format string that will represent dates that
+ * progress at our interval.
+ *
+ * Since our interval can be as small as 1ms, the default
+ * date format is usually way too much. with `dateFormat:scaled`
+ * users can modify how dates are formatted within series
+ * produced by TimeBuckets
+ *
+ * @return {string}
+ */
+TimeBuckets.prototype.getScaledDateFormat = function() {
+  const interval = this.getInterval();
+  const rules = this.uiSettings.get('dateFormat:scaled');
+
+  for (let i = rules.length - 1; i >= 0; i--) {
+    const rule = rules[i];
+    if (!rule[0] || interval >= moment.duration(rule[0])) {
+      return rule[1];
+    }
+  }
+
+  return this.uiSettings.get('dateFormat');
+};
+
+TimeBuckets.prototype.getScaledDateFormatter = function() {
+  const fieldFormatsService = this.dataFieldsFormats;
+  const DateFieldFormat = fieldFormatsService.getType(fieldFormats.FIELD_FORMAT_IDS.DATE);
+
+  return new DateFieldFormat(
+    {
+      pattern: this.getScaledDateFormat(),
+    },
+    configPath => this.uiSettings.get(configPath)
+  );
+};
+
+TimeBuckets.__cached__ = function(self) {
+  let cache = {};
+  const sameMoment = same(moment.isMoment);
+  const sameDuration = same(moment.isDuration);
+
+  const desc = {
+    __cached__: {
+      value: self,
+    },
+  };
+
+  const breakers = {
+    setBounds: 'bounds',
+    clearBounds: 'bounds',
+    setInterval: 'interval',
+  };
+
+  const resources = {
+    bounds: {
+      setup: function() {
+        return [self._lb, self._ub];
+      },
+      changes: function(prev) {
+        return !sameMoment(prev[0], self._lb) || !sameMoment(prev[1], self._ub);
+      },
+    },
+    interval: {
+      setup: function() {
+        return self._i;
+      },
+      changes: function(prev) {
+        return !sameDuration(prev, this._i);
+      },
+    },
+  };
+
+  function cachedGetter(prop) {
+    return {
+      value: function cachedGetter(...rest) {
+        if (cache.hasOwnProperty(prop)) {
+          return cache[prop];
+        }
+
+        return (cache[prop] = self[prop](...rest));
+      },
+    };
+  }
+
+  function cacheBreaker(prop) {
+    const resource = resources[breakers[prop]];
+    const setup = resource.setup;
+    const changes = resource.changes;
+    const fn = self[prop];
+
+    return {
+      value: function cacheBreaker() {
+        const prev = setup.call(self);
+        const ret = fn.apply(self, arguments);
+
+        if (changes.call(self, prev)) {
+          cache = {};
+        }
+
+        return ret;
+      },
+    };
+  }
+
+  function same(checkType) {
+    return function(a, b) {
+      if (a === b) return true;
+      if (checkType(a) === checkType(b)) return +a === +b;
+      return false;
+    };
+  }
+
+  _.forOwn(TimeBuckets.prototype, function(fn, prop) {
+    if (prop[0] === '_') return;
+
+    if (breakers.hasOwnProperty(prop)) {
+      desc[prop] = cacheBreaker(prop);
+    } else {
+      desc[prop] = cachedGetter(prop);
+    }
+  });
+
+  return Object.create(self, desc);
+};
+
+export { TimeBuckets };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/types.ts
new file mode 100644
index 0000000000000..356b0fbbc0845
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/types.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface Comparator {
+  text: string;
+  value: string;
+  requiredValues: number;
+}
+
+export interface AggregationType {
+  text: string;
+  fieldRequired: boolean;
+  value: string;
+  validNormalizedTypes: string[];
+}
+
+export interface GroupByType {
+  text: string;
+  sizeRequired: boolean;
+  value: string;
+  validNormalizedTypes: string[];
+}
+
+export interface IndexThresholdAlertParams {
+  index: string[];
+  timeField?: string;
+  aggType: string;
+  aggField?: string;
+  groupBy?: string;
+  termSize?: number;
+  termField?: string;
+  thresholdComparator?: string;
+  threshold: number[];
+  timeWindowSize: number;
+  timeWindowUnit: string;
+}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/visualization.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/visualization.tsx
similarity index 77%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/visualization.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/visualization.tsx
index 9ba79bba8fef6..ce7ef0dd39bac 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/visualization.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/visualization.tsx
@@ -19,16 +19,16 @@ import {
   ScaleType,
   Settings,
 } from '@elastic/charts';
-import { TimeBuckets } from 'ui/time_buckets';
 import dateMath from '@elastic/datemath';
 import moment from 'moment-timezone';
 import { EuiCallOut, EuiLoadingChart, EuiSpacer, EuiEmptyPrompt, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { npStart } from 'ui/new_platform';
 import { getThresholdAlertVisualizationData } from './lib/api';
-import { comparators, aggregationTypes } from './expression';
-import { useAppDependencies } from '../../../app_context';
-import { Alert } from '../../../../types';
+import { AggregationType, Comparator } from '../../../../common/types';
+/* TODO: This file was copied from ui/time_buckets for NP migration. We should clean this up and add TS support */
+import { TimeBuckets } from './lib/time_buckets';
+import { AlertsContextValue } from '../../../context/alerts_context';
+import { IndexThresholdAlertParams } from './types';
 
 const customTheme = () => {
   return {
@@ -76,36 +76,35 @@ const getDomain = (alertParams: any) => {
   };
 };
 
-const getThreshold = (alertParams: any) => {
-  return alertParams.threshold.slice(
-    0,
-    comparators[alertParams.thresholdComparator].requiredValues
-  );
-};
-
-const getTimeBuckets = (alertParams: any) => {
+const getTimeBuckets = (
+  uiSettings: IUiSettingsClient,
+  dataFieldsFormats: any,
+  alertParams: any
+) => {
   const domain = getDomain(alertParams);
-  const timeBuckets = new TimeBuckets();
+  const timeBuckets = new TimeBuckets(uiSettings, dataFieldsFormats);
   timeBuckets.setBounds(domain);
   return timeBuckets;
 };
 
 interface Props {
-  alert: Alert;
+  alertParams: IndexThresholdAlertParams;
+  aggregationTypes: { [key: string]: AggregationType };
+  comparators: {
+    [key: string]: Comparator;
+  };
+  alertsContext: AlertsContextValue;
 }
 
-export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }) => {
-  const { http, uiSettings, toastNotifications } = useAppDependencies();
-  const [isLoading, setIsLoading] = useState(false);
-  const [error, setError] = useState<undefined | any>(undefined);
-  const [visualizationData, setVisualizationData] = useState<Record<string, any>>([]);
-
-  const chartsTheme = npStart.plugins.charts.theme.useChartsTheme();
+export const ThresholdVisualization: React.FunctionComponent<Props> = ({
+  alertParams,
+  aggregationTypes,
+  comparators,
+  alertsContext,
+}) => {
   const {
     index,
     timeField,
-    triggerIntervalSize,
-    triggerIntervalUnit,
     aggType,
     aggField,
     termSize,
@@ -115,21 +114,12 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
     timeWindowUnit,
     groupBy,
     threshold,
-  } = alert.params;
+  } = alertParams;
+  const { http, toastNotifications, charts, uiSettings, dataFieldsFormats } = alertsContext;
 
-  const domain = getDomain(alert.params);
-  const timeBuckets = new TimeBuckets();
-  timeBuckets.setBounds(domain);
-  const interval = timeBuckets.getInterval().expression;
-  const visualizeOptions = {
-    rangeFrom: domain.min,
-    rangeTo: domain.max,
-    interval,
-    timezone: getTimezone(uiSettings),
-  };
-
-  // Fetching visualization data is independent of alert actions
-  const alertWithoutActions = { ...alert.params, actions: [], type: 'threshold' };
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState<undefined | any>(undefined);
+  const [visualizationData, setVisualizationData] = useState<Record<string, any>>([]);
 
   useEffect(() => {
     (async () => {
@@ -143,12 +133,14 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
           })
         );
       } catch (e) {
-        toastNotifications.addDanger({
-          title: i18n.translate(
-            'xpack.triggersActionsUI.sections.alertAdd.unableToLoadVisualizationMessage',
-            { defaultMessage: 'Unable to load visualization' }
-          ),
-        });
+        if (toastNotifications) {
+          toastNotifications.addDanger({
+            title: i18n.translate(
+              'xpack.triggersActionsUI.sections.alertAdd.unableToLoadVisualizationMessage',
+              { defaultMessage: 'Unable to load visualization' }
+            ),
+          });
+        }
         setError(e);
       } finally {
         setIsLoading(false);
@@ -158,8 +150,6 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
   }, [
     index,
     timeField,
-    triggerIntervalSize,
-    triggerIntervalUnit,
     aggType,
     aggField,
     termSize,
@@ -172,6 +162,25 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
   ]);
   /* eslint-enable react-hooks/exhaustive-deps */
 
+  if (!charts || !uiSettings || !dataFieldsFormats) {
+    return null;
+  }
+  const chartsTheme = charts.theme.useChartsTheme();
+
+  const domain = getDomain(alertParams);
+  const timeBuckets = new TimeBuckets(uiSettings, dataFieldsFormats);
+  timeBuckets.setBounds(domain);
+  const interval = timeBuckets.getInterval().expression;
+  const visualizeOptions = {
+    rangeFrom: domain.min,
+    rangeTo: domain.max,
+    interval,
+    timezone: getTimezone(uiSettings),
+  };
+
+  // Fetching visualization data is independent of alert actions
+  const alertWithoutActions = { ...alertParams, actions: [], type: 'threshold' };
+
   if (isLoading) {
     return (
       <EuiEmptyPrompt
@@ -210,11 +219,17 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
     );
   }
 
+  const getThreshold = () => {
+    return thresholdComparator
+      ? threshold.slice(0, comparators[thresholdComparator].requiredValues)
+      : [];
+  };
+
   if (visualizationData) {
     const alertVisualizationDataKeys = Object.keys(visualizationData);
     const timezone = getTimezone(uiSettings);
-    const actualThreshold = getThreshold(alert.params);
-    let maxY = actualThreshold[actualThreshold.length - 1];
+    const actualThreshold = getThreshold();
+    let maxY = actualThreshold[actualThreshold.length - 1] as any;
 
     (Object.values(visualizationData) as number[][][]).forEach(data => {
       data.forEach(([, y]) => {
@@ -226,7 +241,7 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
     const dateFormatter = (d: number) => {
       return moment(d)
         .tz(timezone)
-        .format(getTimeBuckets(alert.params).getScaledDateFormat());
+        .format(getTimeBuckets(uiSettings, dataFieldsFormats, alertParams).getScaledDateFormat());
     };
     const aggLabel = aggregationTypes[aggType].text;
     return (
@@ -280,17 +295,18 @@ export const ThresholdVisualization: React.FunctionComponent<Props> = ({ alert }
           </Chart>
         ) : (
           <EuiCallOut
+            size="s"
             title={
               <FormattedMessage
                 id="xpack.triggersActionsUI.sections.alertAdd.thresholdPreviewChart.noDataTitle"
-                defaultMessage="No data"
+                defaultMessage="No data matches that query"
               />
             }
             color="warning"
           >
             <FormattedMessage
               id="xpack.triggersActionsUI.sections.alertAdd.thresholdPreviewChart.dataDoesNotExistTextMessage"
-              defaultMessage="Your index and condition did not return any data."
+              defaultMessage="Check your time range and filters to make sure they are correct"
             />
           </EuiCallOut>
         )}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/delete_connectors_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/delete_connectors_modal.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/delete_connectors_modal.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/delete_connectors_modal.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/section_loading.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/section_loading.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/section_loading.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/components/section_loading.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/plugin.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/plugin.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/time_units.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/time_units.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/constants/time_units.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/constants/time_units.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/context/actions_connectors_context.tsx b/x-pack/plugins/triggers_actions_ui/public/application/context/actions_connectors_context.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/context/actions_connectors_context.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/context/actions_connectors_context.tsx
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/context/alerts_context.tsx b/x-pack/plugins/triggers_actions_ui/public/application/context/alerts_context.tsx
new file mode 100644
index 0000000000000..9b6b4a2cf1f22
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/context/alerts_context.tsx
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext, createContext } from 'react';
+import { HttpSetup, IUiSettingsClient, ToastsApi } from 'kibana/public';
+import { ChartsPluginSetup } from 'src/plugins/charts/public';
+import { FieldFormatsRegistry } from 'src/plugins/data/common/field_formats/static';
+import { TypeRegistry } from '../type_registry';
+import { AlertTypeModel, ActionTypeModel } from '../../types';
+
+export interface AlertsContextValue {
+  addFlyoutVisible: boolean;
+  setAddFlyoutVisibility: React.Dispatch<React.SetStateAction<boolean>>;
+  reloadAlerts?: () => Promise<void>;
+  http: HttpSetup;
+  alertTypeRegistry: TypeRegistry<AlertTypeModel>;
+  actionTypeRegistry: TypeRegistry<ActionTypeModel>;
+  uiSettings?: IUiSettingsClient;
+  toastNotifications?: Pick<
+    ToastsApi,
+    'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError'
+  >;
+  charts?: ChartsPluginSetup;
+  dataFieldsFormats?: Pick<FieldFormatsRegistry, 'register'>;
+}
+
+const AlertsContext = createContext<AlertsContextValue>(null as any);
+
+export const AlertsContextProvider = ({
+  children,
+  value,
+}: {
+  value: AlertsContextValue;
+  children: React.ReactNode;
+}) => {
+  return <AlertsContext.Provider value={value}>{children}</AlertsContext.Provider>;
+};
+
+export const useAlertsContext = () => {
+  const ctx = useContext(AlertsContext);
+  if (!ctx) {
+    throw new Error('ActionsConnectorsContext has not been set.');
+  }
+  return ctx;
+};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/home.tsx b/x-pack/plugins/triggers_actions_ui/public/application/home.tsx
similarity index 93%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/home.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/home.tsx
index 5d518bce569e4..ba30b838a8593 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/home.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/home.tsx
@@ -37,11 +37,7 @@ export const TriggersActionsUIHome: React.FunctionComponent<RouteComponentProps<
   },
   history,
 }) => {
-  const {
-    chrome,
-    capabilities,
-    legacy: { MANAGEMENT_BREADCRUMB },
-  } = useAppDependencies();
+  const { chrome, capabilities, setBreadcrumbs } = useAppDependencies();
 
   const canShowActions = hasShowActionsCapability(capabilities);
   const canShowAlerts = hasShowAlertsCapability(capabilities);
@@ -80,9 +76,9 @@ export const TriggersActionsUIHome: React.FunctionComponent<RouteComponentProps<
 
   // Set breadcrumb and page title
   useEffect(() => {
-    chrome.setBreadcrumbs([MANAGEMENT_BREADCRUMB, getCurrentBreadcrumb(section || 'home')]);
+    setBreadcrumbs([getCurrentBreadcrumb(section || 'home')]);
     chrome.docTitle.change(getCurrentDocTitle(section || 'home'));
-  }, [section, chrome, MANAGEMENT_BREADCRUMB]);
+  }, [section, chrome, setBreadcrumbs]);
 
   return (
     <EuiPageBody>
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/action_connector_api.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api.test.ts
similarity index 97%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/action_connector_api.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api.test.ts
index 00a55bb2588bb..f568e0a71d0cf 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/action_connector_api.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { ActionConnector, ActionConnectorWithoutId, ActionType } from '../../types';
-import { httpServiceMock } from '../../../../../../../../src/core/public/mocks';
+import { httpServiceMock } from '../../../../../../src/core/public/mocks';
 import {
   createActionConnector,
   deleteActions,
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/action_connector_api.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/action_connector_api.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/alert_api.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
similarity index 93%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/alert_api.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
index 35d1a095188de..306d959b3523e 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/alert_api.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { Alert, AlertType } from '../../types';
-import { httpServiceMock } from '../../../../../../../../src/core/public/mocks';
+import { httpServiceMock } from '../../../../../../src/core/public/mocks';
 import {
   createAlert,
   deleteAlert,
@@ -35,6 +35,8 @@ describe('loadAlertTypes', () => {
       {
         id: 'test',
         name: 'Test',
+        actionVariables: ['var1'],
+        actionGroups: ['default'],
       },
     ];
     http.get.mockResolvedValueOnce(resolvedValue);
@@ -300,6 +302,7 @@ describe('createAlert', () => {
   test('should call create alert API', async () => {
     const alertToCreate = {
       name: 'test',
+      consumer: 'alerting',
       tags: ['foo'],
       enabled: true,
       alertTypeId: 'test',
@@ -309,7 +312,6 @@ describe('createAlert', () => {
       actions: [],
       params: {},
       throttle: null,
-      consumer: '',
       createdAt: new Date('1970-01-01T00:00:00.000Z'),
       updatedAt: new Date('1970-01-01T00:00:00.000Z'),
       apiKey: null,
@@ -331,7 +333,7 @@ describe('createAlert', () => {
       Array [
         "/api/alert",
         Object {
-          "body": "{\\"name\\":\\"test\\",\\"tags\\":[\\"foo\\"],\\"enabled\\":true,\\"alertTypeId\\":\\"test\\",\\"schedule\\":{\\"interval\\":\\"1m\\"},\\"actions\\":[],\\"params\\":{},\\"throttle\\":null,\\"consumer\\":\\"\\",\\"createdAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"updatedAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"apiKey\\":null,\\"apiKeyOwner\\":null}",
+          "body": "{\\"name\\":\\"test\\",\\"consumer\\":\\"alerting\\",\\"tags\\":[\\"foo\\"],\\"enabled\\":true,\\"alertTypeId\\":\\"test\\",\\"schedule\\":{\\"interval\\":\\"1m\\"},\\"actions\\":[],\\"params\\":{},\\"throttle\\":null,\\"createdAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"updatedAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"apiKey\\":null,\\"apiKeyOwner\\":null}",
         },
       ]
     `);
@@ -342,6 +344,7 @@ describe('updateAlert', () => {
   test('should call alert update API', async () => {
     const alertToUpdate = {
       throttle: '1m',
+      consumer: 'alerting',
       name: 'test',
       tags: ['foo'],
       schedule: {
@@ -349,7 +352,6 @@ describe('updateAlert', () => {
       },
       params: {},
       actions: [],
-      consumer: '',
       createdAt: new Date('1970-01-01T00:00:00.000Z'),
       updatedAt: new Date('1970-01-01T00:00:00.000Z'),
       apiKey: null,
@@ -373,7 +375,7 @@ describe('updateAlert', () => {
       Array [
         "/api/alert/123",
         Object {
-          "body": "{\\"throttle\\":\\"1m\\",\\"name\\":\\"test\\",\\"tags\\":[\\"foo\\"],\\"schedule\\":{\\"interval\\":\\"1m\\"},\\"params\\":{},\\"actions\\":[],\\"consumer\\":\\"\\",\\"createdAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"updatedAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"apiKey\\":null,\\"apiKeyOwner\\":null}",
+          "body": "{\\"throttle\\":\\"1m\\",\\"consumer\\":\\"alerting\\",\\"name\\":\\"test\\",\\"tags\\":[\\"foo\\"],\\"schedule\\":{\\"interval\\":\\"1m\\"},\\"params\\":{},\\"actions\\":[],\\"createdAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"updatedAt\\":\\"1970-01-01T00:00:00.000Z\\",\\"apiKey\\":null,\\"apiKeyOwner\\":null}",
         },
       ]
     `);
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/alert_api.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/alert_api.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/breadcrumb.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/breadcrumb.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/breadcrumb.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/breadcrumb.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/capabilities.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/capabilities.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/doc_title.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/doc_title.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/doc_title.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/doc_title.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_options.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_options.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_options.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_options.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_options.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_options.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_options.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_options.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_unit_label.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_unit_label.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/get_time_unit_label.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/get_time_unit_label.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/value_validators.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/value_validators.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/value_validators.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/value_validators.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/value_validators.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/value_validators.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/lib/value_validators.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/lib/value_validators.ts
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/_index.scss b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/_index.scss
new file mode 100644
index 0000000000000..f8fa882cd617d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/_index.scss
@@ -0,0 +1,3 @@
+.actConnectorModal {
+  z-index: 9000;
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx
new file mode 100644
index 0000000000000..f7becb16c244a
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { actionTypeRegistryMock } from '../../action_type_registry.mock';
+import { ValidationResult, ActionConnector } from '../../../types';
+import { ActionConnectorForm } from './action_connector_form';
+const actionTypeRegistry = actionTypeRegistryMock.create();
+
+describe('action_connector_form', () => {
+  let deps: any;
+  beforeAll(async () => {
+    const mocks = coreMock.createSetup();
+    const [
+      {
+        chrome,
+        docLinks,
+        application: { capabilities },
+      },
+    ] = await mocks.getStartServices();
+    deps = {
+      chrome,
+      docLinks,
+      toastNotifications: mocks.notifications.toasts,
+      injectedMetadata: mocks.injectedMetadata,
+      http: mocks.http,
+      uiSettings: mocks.uiSettings,
+      capabilities: {
+        ...capabilities,
+        actions: {
+          delete: true,
+          save: true,
+          show: true,
+        },
+      },
+      legacy: {
+        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
+      },
+      actionTypeRegistry: actionTypeRegistry as any,
+      alertTypeRegistry: {} as any,
+    };
+  });
+
+  it('renders action_connector_form', () => {
+    const actionType = {
+      id: 'my-action-type',
+      iconClass: 'test',
+      selectMessage: 'test',
+      validateConnector: (): ValidationResult => {
+        return { errors: {} };
+      },
+      validateParams: (): ValidationResult => {
+        const validationResult = { errors: {} };
+        return validationResult;
+      },
+      actionConnectorFields: null,
+      actionParamsFields: null,
+    };
+    actionTypeRegistry.get.mockReturnValue(actionType);
+    actionTypeRegistry.has.mockReturnValue(true);
+
+    const initialConnector = {
+      actionTypeId: actionType.id,
+      config: {},
+      secrets: {},
+    } as ActionConnector;
+    let wrapper;
+    if (deps) {
+      wrapper = mountWithIntl(
+        <ActionConnectorForm
+          actionTypeName={'my-action-type-name'}
+          connector={initialConnector}
+          dispatch={() => {}}
+          serverError={null}
+          errors={{ name: [] }}
+          actionTypeRegistry={deps.actionTypeRegistry}
+        />
+      );
+    }
+    const connectorNameField = wrapper?.find('[data-test-subj="nameInput"]');
+    expect(connectorNameField?.exists()).toBeTruthy();
+    expect(connectorNameField?.first().prop('value')).toBe('');
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx
new file mode 100644
index 0000000000000..9f2b203246280
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx
@@ -0,0 +1,154 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { Fragment } from 'react';
+import {
+  EuiForm,
+  EuiCallOut,
+  EuiLink,
+  EuiText,
+  EuiSpacer,
+  EuiFieldText,
+  EuiFormRow,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ReducerAction } from './connector_reducer';
+import { ActionConnector, IErrorObject, ActionTypeModel } from '../../../types';
+import { TypeRegistry } from '../../type_registry';
+
+export function validateBaseProperties(actionObject: ActionConnector) {
+  const validationResult = { errors: {} };
+  const verrors = {
+    name: new Array<string>(),
+  };
+  validationResult.errors = verrors;
+  if (!actionObject.name) {
+    verrors.name.push(
+      i18n.translate(
+        'xpack.triggersActionsUI.sections.actionConnectorForm.error.requiredNameText',
+        {
+          defaultMessage: 'Name is required.',
+        }
+      )
+    );
+  }
+  return validationResult;
+}
+
+interface ActionConnectorProps {
+  connector: ActionConnector;
+  dispatch: React.Dispatch<ReducerAction>;
+  actionTypeName: string;
+  serverError: {
+    body: { message: string; error: string };
+  } | null;
+  errors: IErrorObject;
+  actionTypeRegistry: TypeRegistry<ActionTypeModel>;
+}
+
+export const ActionConnectorForm = ({
+  connector,
+  dispatch,
+  actionTypeName,
+  serverError,
+  errors,
+  actionTypeRegistry,
+}: ActionConnectorProps) => {
+  const setActionProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
+  };
+
+  const setActionConfigProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setConfigProperty' }, payload: { key, value } });
+  };
+
+  const setActionSecretsProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setSecretsProperty' }, payload: { key, value } });
+  };
+
+  const actionTypeRegistered = actionTypeRegistry.get(connector.actionTypeId);
+  if (!actionTypeRegistered)
+    return (
+      <Fragment>
+        <EuiCallOut
+          title={i18n.translate(
+            'xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionTypeConfigurationWarningTitleText',
+            {
+              defaultMessage: 'Action type not registered',
+            }
+          )}
+          color="warning"
+          iconType="help"
+        >
+          <EuiText>
+            <p>
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionConfigurationWarningDescriptionText"
+                defaultMessage="To create this connector, you must configure at least one {actionType} account. {docLink}"
+                values={{
+                  actionType: actionTypeName,
+                  docLink: (
+                    <EuiLink target="_blank">
+                      <FormattedMessage
+                        id="xpack.triggersActionsUI.sections.actionConnectorForm.actions.actionConfigurationWarningHelpLinkText"
+                        defaultMessage="Learn more."
+                      />
+                    </EuiLink>
+                  ),
+                }}
+              />
+            </p>
+          </EuiText>
+        </EuiCallOut>
+        <EuiSpacer />
+      </Fragment>
+    );
+
+  const FieldsComponent = actionTypeRegistered.actionConnectorFields;
+
+  return (
+    <EuiForm isInvalid={serverError !== null} error={serverError?.body.message}>
+      <EuiFormRow
+        id="actionName"
+        fullWidth
+        label={
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.actionConnectorForm.actionNameLabel"
+            defaultMessage="Connector name"
+          />
+        }
+        isInvalid={errors.name.length > 0 && connector.name !== undefined}
+        error={errors.name}
+      >
+        <EuiFieldText
+          fullWidth
+          isInvalid={errors.name.length > 0 && connector.name !== undefined}
+          name="name"
+          placeholder="Untitled"
+          data-test-subj="nameInput"
+          value={connector.name || ''}
+          onChange={e => {
+            setActionProperty('name', e.target.value);
+          }}
+          onBlur={() => {
+            if (!connector.name) {
+              setActionProperty('name', '');
+            }
+          }}
+        />
+      </EuiFormRow>
+      <EuiSpacer size="m" />
+      {FieldsComponent !== null ? (
+        <FieldsComponent
+          action={connector}
+          errors={errors}
+          editActionConfig={setActionConfigProperty}
+          editActionSecrets={setActionSecretsProperty}
+        />
+      ) : null}
+    </EuiForm>
+  );
+};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.test.tsx
similarity index 71%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.test.tsx
index 6d98a5e3d120f..c1c6d9d94e810 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.test.tsx
@@ -5,12 +5,11 @@
  */
 import * as React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { coreMock } from '../../../../../../../../../src/core/public/mocks';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { ActionsConnectorsContextProvider } from '../../context/actions_connectors_context';
 import { actionTypeRegistryMock } from '../../action_type_registry.mock';
 import { ActionTypeMenu } from './action_type_menu';
 import { ValidationResult } from '../../../types';
-import { AppContextProvider } from '../../app_context';
 const actionTypeRegistry = actionTypeRegistryMock.create();
 
 describe('connector_add_flyout', () => {
@@ -67,25 +66,26 @@ describe('connector_add_flyout', () => {
     actionTypeRegistry.get.mockReturnValueOnce(actionType);
 
     const wrapper = mountWithIntl(
-      <AppContextProvider appDeps={deps}>
-        <ActionsConnectorsContextProvider
-          value={{
-            addFlyoutVisible: true,
-            setAddFlyoutVisibility: state => {},
-            editFlyoutVisible: false,
-            setEditFlyoutVisibility: state => {},
-            actionTypesIndex: {
-              'first-action-type': { id: 'first-action-type', name: 'first', enabled: true },
-              'second-action-type': { id: 'second-action-type', name: 'second', enabled: true },
-            },
-            reloadConnectors: () => {
-              return new Promise<void>(() => {});
-            },
-          }}
-        >
-          <ActionTypeMenu onActionTypeChange={onActionTypeChange} />
-        </ActionsConnectorsContextProvider>
-      </AppContextProvider>
+      <ActionsConnectorsContextProvider
+        value={{
+          addFlyoutVisible: true,
+          setAddFlyoutVisibility: state => {},
+          editFlyoutVisible: false,
+          setEditFlyoutVisibility: state => {},
+          actionTypesIndex: {
+            'first-action-type': { id: 'first-action-type', name: 'first', enabled: true },
+            'second-action-type': { id: 'second-action-type', name: 'second', enabled: true },
+          },
+          reloadConnectors: () => {
+            return new Promise<void>(() => {});
+          },
+        }}
+      >
+        <ActionTypeMenu
+          onActionTypeChange={onActionTypeChange}
+          actionTypeRegistry={deps.actionTypeRegistry}
+        />
+      </ActionsConnectorsContextProvider>
     );
 
     expect(wrapper.find('[data-test-subj="first-action-type-card"]').exists()).toBeTruthy();
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx
similarity index 53%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx
index 19373fda79b9e..ddd08cf6d6d79 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/action_type_menu.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx
@@ -3,29 +3,19 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { Fragment } from 'react';
-import {
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiCard,
-  EuiIcon,
-  EuiFlexGrid,
-  EuiFlyoutBody,
-  EuiFlyoutFooter,
-  EuiButtonEmpty,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { ActionType } from '../../../types';
+import React from 'react';
+import { EuiFlexItem, EuiCard, EuiIcon, EuiFlexGrid } from '@elastic/eui';
+import { ActionType, ActionTypeModel } from '../../../types';
 import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
-import { useAppDependencies } from '../../app_context';
+import { TypeRegistry } from '../../type_registry';
 
 interface Props {
   onActionTypeChange: (actionType: ActionType) => void;
+  actionTypeRegistry: TypeRegistry<ActionTypeModel>;
 }
 
-export const ActionTypeMenu = ({ onActionTypeChange }: Props) => {
-  const { actionTypeRegistry } = useAppDependencies();
-  const { actionTypesIndex, setAddFlyoutVisibility } = useActionsConnectorsContext();
+export const ActionTypeMenu = ({ onActionTypeChange, actionTypeRegistry }: Props) => {
+  const { actionTypesIndex } = useActionsConnectorsContext();
   if (!actionTypesIndex) {
     return null;
   }
@@ -45,7 +35,7 @@ export const ActionTypeMenu = ({ onActionTypeChange }: Props) => {
 
   const cardNodes = actionTypes
     .sort((a, b) => a.name.localeCompare(b.name))
-    .map((item, index): any => {
+    .map((item, index) => {
       return (
         <EuiFlexItem key={index}>
           <EuiCard
@@ -59,25 +49,5 @@ export const ActionTypeMenu = ({ onActionTypeChange }: Props) => {
       );
     });
 
-  return (
-    <Fragment>
-      <EuiFlyoutBody>
-        <EuiFlexGrid columns={2}>{cardNodes}</EuiFlexGrid>
-      </EuiFlyoutBody>
-      <EuiFlyoutFooter>
-        <EuiFlexGroup justifyContent="spaceBetween">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty onClick={() => setAddFlyoutVisibility(false)}>
-              {i18n.translate(
-                'xpack.triggersActionsUI.sections.actionConnectorForm.cancelButtonLabel',
-                {
-                  defaultMessage: 'Cancel',
-                }
-              )}
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      </EuiFlyoutFooter>
-    </Fragment>
-  );
+  return <EuiFlexGrid columns={2}>{cardNodes}</EuiFlexGrid>;
 };
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.test.tsx
similarity index 56%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.test.tsx
index a03296c7c3679..6b87002a1d2cf 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_add_flyout.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.test.tsx
@@ -5,35 +5,39 @@
  */
 import * as React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { coreMock } from '../../../../../../../../../src/core/public/mocks';
-import { ReactWrapper } from 'enzyme';
-import { act } from 'react-dom/test-utils';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { ConnectorAddFlyout } from './connector_add_flyout';
 import { ActionsConnectorsContextProvider } from '../../context/actions_connectors_context';
 import { actionTypeRegistryMock } from '../../action_type_registry.mock';
 import { ValidationResult } from '../../../types';
 import { AppContextProvider } from '../../app_context';
+import { AppDeps } from '../../app';
+import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+
 const actionTypeRegistry = actionTypeRegistryMock.create();
 
 describe('connector_add_flyout', () => {
-  let wrapper: ReactWrapper<any>;
+  let deps: AppDeps | null;
 
   beforeAll(async () => {
-    const mockes = coreMock.createSetup();
+    const mocks = coreMock.createSetup();
     const [
       {
         chrome,
         docLinks,
         application: { capabilities },
       },
-    ] = await mockes.getStartServices();
-    const deps = {
+    ] = await mocks.getStartServices();
+    deps = {
       chrome,
       docLinks,
-      toastNotifications: mockes.notifications.toasts,
-      injectedMetadata: mockes.injectedMetadata,
-      http: mockes.http,
-      uiSettings: mockes.uiSettings,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
+      toastNotifications: mocks.notifications.toasts,
+      injectedMetadata: mocks.injectedMetadata,
+      http: mocks.http,
+      uiSettings: mocks.uiSettings,
       capabilities: {
         ...capabilities,
         actions: {
@@ -42,37 +46,10 @@ describe('connector_add_flyout', () => {
           show: true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: {} as any,
     };
-
-    await act(async () => {
-      wrapper = mountWithIntl(
-        <AppContextProvider appDeps={deps}>
-          <ActionsConnectorsContextProvider
-            value={{
-              addFlyoutVisible: true,
-              setAddFlyoutVisibility: state => {},
-              editFlyoutVisible: false,
-              setEditFlyoutVisibility: state => {},
-              actionTypesIndex: {
-                'my-action-type': { id: 'my-action-type', name: 'test', enabled: true },
-              },
-              reloadConnectors: () => {
-                return new Promise<void>(() => {});
-              },
-            }}
-          >
-            <ConnectorAddFlyout />
-          </ActionsConnectorsContextProvider>
-        </AppContextProvider>
-      );
-    });
-
-    await waitForRender(wrapper);
   });
 
   it('renders action type menu on flyout open', () => {
@@ -93,13 +70,27 @@ describe('connector_add_flyout', () => {
     actionTypeRegistry.get.mockReturnValueOnce(actionType);
     actionTypeRegistry.has.mockReturnValue(true);
 
+    const wrapper = mountWithIntl(
+      <AppContextProvider appDeps={deps}>
+        <ActionsConnectorsContextProvider
+          value={{
+            addFlyoutVisible: true,
+            setAddFlyoutVisibility: state => {},
+            editFlyoutVisible: false,
+            setEditFlyoutVisibility: state => {},
+            actionTypesIndex: {
+              'my-action-type': { id: 'my-action-type', name: 'test', enabled: true },
+            },
+            reloadConnectors: () => {
+              return new Promise<void>(() => {});
+            },
+          }}
+        >
+          <ConnectorAddFlyout />
+        </ActionsConnectorsContextProvider>
+      </AppContextProvider>
+    );
     expect(wrapper.find('ActionTypeMenu')).toHaveLength(1);
     expect(wrapper.find('[data-test-subj="my-action-type-card"]').exists()).toBeTruthy();
   });
 });
-
-async function waitForRender(wrapper: ReactWrapper<any, any>) {
-  await Promise.resolve();
-  await Promise.resolve();
-  wrapper.update();
-}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx
new file mode 100644
index 0000000000000..0749ae1d30e9e
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx
@@ -0,0 +1,213 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useCallback, useState, Fragment, useReducer } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiTitle,
+  EuiFlyoutHeader,
+  EuiFlyout,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiText,
+  EuiFlyoutFooter,
+  EuiButtonEmpty,
+  EuiButton,
+  EuiFlyoutBody,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
+import { ActionTypeMenu } from './action_type_menu';
+import { ActionConnectorForm, validateBaseProperties } from './action_connector_form';
+import { ActionType, ActionConnector, IErrorObject } from '../../../types';
+import { useAppDependencies } from '../../app_context';
+import { connectorReducer } from './connector_reducer';
+import { hasSaveActionsCapability } from '../../lib/capabilities';
+import { createActionConnector } from '../../lib/action_connector_api';
+
+export const ConnectorAddFlyout = () => {
+  let hasErrors = false;
+  const { http, toastNotifications, capabilities, actionTypeRegistry } = useAppDependencies();
+  const [actionType, setActionType] = useState<ActionType | undefined>(undefined);
+
+  // hooks
+  const initialConnector = {
+    actionTypeId: actionType?.id ?? '',
+    config: {},
+    secrets: {},
+  } as ActionConnector;
+  const [{ connector }, dispatch] = useReducer(connectorReducer, { connector: initialConnector });
+  const setActionProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
+  };
+  const setConnector = (value: any) => {
+    dispatch({ command: { type: 'setConnector' }, payload: { key: 'connector', value } });
+  };
+
+  const {
+    addFlyoutVisible,
+    setAddFlyoutVisibility,
+    reloadConnectors,
+  } = useActionsConnectorsContext();
+  const [isSaving, setIsSaving] = useState<boolean>(false);
+
+  const closeFlyout = useCallback(() => {
+    setAddFlyoutVisibility(false);
+    setActionType(undefined);
+    setConnector(initialConnector);
+  }, [setAddFlyoutVisibility, initialConnector]);
+
+  const [serverError, setServerError] = useState<{
+    body: { message: string; error: string };
+  } | null>(null);
+  const canSave = hasSaveActionsCapability(capabilities);
+
+  if (!addFlyoutVisible) {
+    return null;
+  }
+
+  function onActionTypeChange(newActionType: ActionType) {
+    setActionType(newActionType);
+    setActionProperty('actionTypeId', newActionType.id);
+  }
+
+  let currentForm;
+  let actionTypeModel;
+  if (!actionType) {
+    currentForm = (
+      <ActionTypeMenu
+        onActionTypeChange={onActionTypeChange}
+        actionTypeRegistry={actionTypeRegistry}
+      />
+    );
+  } else {
+    actionTypeModel = actionTypeRegistry.get(actionType.id);
+
+    const errors = {
+      ...actionTypeModel?.validateConnector(connector).errors,
+      ...validateBaseProperties(connector).errors,
+    } as IErrorObject;
+    hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
+
+    currentForm = (
+      <ActionConnectorForm
+        actionTypeName={actionType.name}
+        connector={connector}
+        dispatch={dispatch}
+        serverError={serverError}
+        errors={errors}
+        actionTypeRegistry={actionTypeRegistry}
+      />
+    );
+  }
+
+  const onActionConnectorSave = async (): Promise<ActionConnector | undefined> =>
+    await createActionConnector({ http, connector })
+      .then(savedConnector => {
+        toastNotifications.addSuccess(
+          i18n.translate(
+            'xpack.triggersActionsUI.sections.addConnectorForm.updateSuccessNotificationText',
+            {
+              defaultMessage: "Created '{connectorName}'",
+              values: {
+                connectorName: savedConnector.name,
+              },
+            }
+          )
+        );
+        return savedConnector;
+      })
+      .catch(errorRes => {
+        setServerError(errorRes);
+        return undefined;
+      });
+
+  return (
+    <EuiFlyout onClose={closeFlyout} aria-labelledby="flyoutActionAddTitle" size="m">
+      <EuiFlyoutHeader hasBorder>
+        <EuiFlexGroup gutterSize="m" alignItems="center">
+          {actionTypeModel && actionTypeModel.iconClass ? (
+            <EuiFlexItem grow={false}>
+              <EuiIcon type={actionTypeModel.iconClass} size="xl" />
+            </EuiFlexItem>
+          ) : null}
+          <EuiFlexItem>
+            {actionTypeModel && actionType ? (
+              <Fragment>
+                <EuiTitle size="s">
+                  <h3 id="flyoutTitle">
+                    <FormattedMessage
+                      defaultMessage="{actionTypeName} connector"
+                      id="xpack.triggersActionsUI.sections.addConnectorForm.flyoutTitle"
+                      values={{
+                        actionTypeName: actionType.name,
+                      }}
+                    />
+                  </h3>
+                </EuiTitle>
+                <EuiText size="s" color="subdued">
+                  {actionTypeModel.selectMessage}
+                </EuiText>
+              </Fragment>
+            ) : (
+              <EuiTitle size="s">
+                <h3 id="selectConnectorFlyoutTitle">
+                  <FormattedMessage
+                    defaultMessage="Select a connector"
+                    id="xpack.triggersActionsUI.sections.addConnectorForm.selectConnectorFlyoutTitle"
+                  />
+                </h3>
+              </EuiTitle>
+            )}
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>{currentForm}</EuiFlyoutBody>
+
+      <EuiFlyoutFooter>
+        <EuiFlexGroup justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty onClick={closeFlyout}>
+              {i18n.translate(
+                'xpack.triggersActionsUI.sections.actionConnectorAdd.cancelButtonLabel',
+                {
+                  defaultMessage: 'Cancel',
+                }
+              )}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          {canSave && actionTypeModel && actionType ? (
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                fill
+                color="secondary"
+                data-test-subj="saveNewActionButton"
+                type="submit"
+                iconType="check"
+                isDisabled={hasErrors}
+                isLoading={isSaving}
+                onClick={async () => {
+                  setIsSaving(true);
+                  const savedAction = await onActionConnectorSave();
+                  setIsSaving(false);
+                  if (savedAction) {
+                    closeFlyout();
+                    reloadConnectors();
+                  }
+                }}
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.actionConnectorAdd.saveButtonLabel"
+                  defaultMessage="Save"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          ) : null}
+        </EuiFlexGroup>
+      </EuiFlyoutFooter>
+    </EuiFlyout>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx
new file mode 100644
index 0000000000000..d9f3e98919d76
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { ConnectorAddModal } from './connector_add_modal';
+import { ActionsConnectorsContextProvider } from '../../context/actions_connectors_context';
+import { actionTypeRegistryMock } from '../../action_type_registry.mock';
+import { ValidationResult } from '../../../types';
+import { AppDeps } from '../../app';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/mocks';
+const actionTypeRegistry = actionTypeRegistryMock.create();
+
+describe('connector_add_modal', () => {
+  let deps: AppDeps | null;
+
+  beforeAll(async () => {
+    const mocks = coreMock.createSetup();
+    const [
+      {
+        chrome,
+        docLinks,
+        application: { capabilities },
+      },
+    ] = await mocks.getStartServices();
+    deps = {
+      chrome,
+      docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
+      toastNotifications: mocks.notifications.toasts,
+      injectedMetadata: mocks.injectedMetadata,
+      http: mocks.http,
+      uiSettings: mocks.uiSettings,
+      capabilities: {
+        ...capabilities,
+        actions: {
+          delete: true,
+          save: true,
+          show: true,
+        },
+      },
+      setBreadcrumbs: jest.fn(),
+      actionTypeRegistry: actionTypeRegistry as any,
+      alertTypeRegistry: {} as any,
+    };
+  });
+  it('renders connector modal form if addModalVisible is true', () => {
+    const actionTypeModel = {
+      id: 'my-action-type',
+      iconClass: 'test',
+      selectMessage: 'test',
+      validateConnector: (): ValidationResult => {
+        return { errors: {} };
+      },
+      validateParams: (): ValidationResult => {
+        const validationResult = { errors: {} };
+        return validationResult;
+      },
+      actionConnectorFields: null,
+      actionParamsFields: null,
+    };
+    actionTypeRegistry.get.mockReturnValueOnce(actionTypeModel);
+    actionTypeRegistry.has.mockReturnValue(true);
+
+    const actionType = {
+      id: 'my-action-type',
+      name: 'test',
+      enabled: true,
+    };
+
+    const wrapper = deps
+      ? mountWithIntl(
+          <ActionsConnectorsContextProvider
+            value={{
+              addFlyoutVisible: true,
+              setAddFlyoutVisibility: state => {},
+              editFlyoutVisible: false,
+              setEditFlyoutVisibility: state => {},
+              actionTypesIndex: {
+                'my-action-type': { id: 'my-action-type', name: 'test', enabled: true },
+              },
+              reloadConnectors: () => {
+                return new Promise<void>(() => {});
+              },
+            }}
+          >
+            <ConnectorAddModal
+              addModalVisible={true}
+              setAddModalVisibility={() => {}}
+              actionType={actionType}
+              http={deps.http}
+              actionTypeRegistry={deps.actionTypeRegistry}
+              alertTypeRegistry={deps.alertTypeRegistry}
+              toastNotifications={deps.toastNotifications}
+            />
+          </ActionsConnectorsContextProvider>
+        )
+      : undefined;
+    expect(wrapper?.find('EuiModalHeader')).toHaveLength(1);
+    expect(wrapper?.find('[data-test-subj="saveActionButtonModal"]').exists()).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx
new file mode 100644
index 0000000000000..55386ec6d61f9
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx
@@ -0,0 +1,189 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useCallback, useReducer, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiTitle, EuiFlexItem, EuiIcon, EuiFlexGroup } from '@elastic/eui';
+import {
+  EuiModal,
+  EuiButton,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiModalBody,
+  EuiModalFooter,
+} from '@elastic/eui';
+import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiOverlayMask } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { HttpSetup, ToastsApi } from 'kibana/public';
+import { ActionConnectorForm, validateBaseProperties } from './action_connector_form';
+import {
+  ActionType,
+  ActionConnector,
+  IErrorObject,
+  AlertTypeModel,
+  ActionTypeModel,
+} from '../../../types';
+import { connectorReducer } from './connector_reducer';
+import { createActionConnector } from '../../lib/action_connector_api';
+import { TypeRegistry } from '../../type_registry';
+
+interface ConnectorAddModalProps {
+  actionType: ActionType;
+  addModalVisible: boolean;
+  setAddModalVisibility: React.Dispatch<React.SetStateAction<boolean>>;
+  postSaveEventHandler?: (savedAction: ActionConnector) => void;
+  http: HttpSetup;
+  alertTypeRegistry: TypeRegistry<AlertTypeModel>;
+  actionTypeRegistry: TypeRegistry<ActionTypeModel>;
+  toastNotifications?: Pick<
+    ToastsApi,
+    'get$' | 'add' | 'remove' | 'addSuccess' | 'addWarning' | 'addDanger' | 'addError'
+  >;
+}
+
+export const ConnectorAddModal = ({
+  actionType,
+  addModalVisible,
+  setAddModalVisibility,
+  postSaveEventHandler,
+  http,
+  toastNotifications,
+  actionTypeRegistry,
+}: ConnectorAddModalProps) => {
+  let hasErrors = false;
+  const initialConnector = {
+    actionTypeId: actionType.id,
+    config: {},
+    secrets: {},
+  } as ActionConnector;
+  const [isSaving, setIsSaving] = useState<boolean>(false);
+
+  const [{ connector }, dispatch] = useReducer(connectorReducer, { connector: initialConnector });
+  const setConnector = (value: any) => {
+    dispatch({ command: { type: 'setConnector' }, payload: { key: 'connector', value } });
+  };
+  const [serverError, setServerError] = useState<{
+    body: { message: string; error: string };
+  } | null>(null);
+
+  const closeModal = useCallback(() => {
+    setAddModalVisibility(false);
+    setConnector(initialConnector);
+    setServerError(null);
+  }, [initialConnector, setAddModalVisibility]);
+
+  if (!addModalVisible) {
+    return null;
+  }
+  const actionTypeModel = actionTypeRegistry.get(actionType.id);
+  const errors = {
+    ...actionTypeModel?.validateConnector(connector).errors,
+    ...validateBaseProperties(connector).errors,
+  } as IErrorObject;
+  hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
+
+  const onActionConnectorSave = async (): Promise<ActionConnector | undefined> =>
+    await createActionConnector({ http, connector })
+      .then(savedConnector => {
+        if (toastNotifications) {
+          toastNotifications.addSuccess(
+            i18n.translate(
+              'xpack.triggersActionsUI.sections.addModalConnectorForm.updateSuccessNotificationText',
+              {
+                defaultMessage: "Created '{connectorName}'",
+                values: {
+                  connectorName: savedConnector.name,
+                },
+              }
+            )
+          );
+        }
+        return savedConnector;
+      })
+      .catch(errorRes => {
+        setServerError(errorRes);
+        return undefined;
+      });
+
+  return (
+    <EuiOverlayMask className="actConnectorModal">
+      <EuiModal onClose={closeModal}>
+        <EuiModalHeader>
+          <EuiModalHeaderTitle>
+            <EuiFlexGroup gutterSize="m" alignItems="center">
+              {actionTypeModel && actionTypeModel.iconClass ? (
+                <EuiFlexItem grow={false}>
+                  <EuiIcon type={actionTypeModel.iconClass} size="xl" />
+                </EuiFlexItem>
+              ) : null}
+              <EuiFlexItem>
+                <EuiTitle size="s">
+                  <h3 id="flyoutTitle">
+                    <FormattedMessage
+                      defaultMessage="{actionTypeName} connector"
+                      id="xpack.triggersActionsUI.sections.addModalConnectorForm.flyoutTitle"
+                      values={{
+                        actionTypeName: actionType.name,
+                      }}
+                    />
+                  </h3>
+                </EuiTitle>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiModalHeaderTitle>
+        </EuiModalHeader>
+
+        <EuiModalBody>
+          <ActionConnectorForm
+            connector={connector}
+            actionTypeName={actionType.name}
+            dispatch={dispatch}
+            serverError={serverError}
+            errors={errors}
+            actionTypeRegistry={actionTypeRegistry}
+          />
+        </EuiModalBody>
+
+        <EuiModalFooter>
+          <EuiButtonEmpty onClick={closeModal}>
+            {i18n.translate(
+              'xpack.triggersActionsUI.sections.addModalConnectorForm.cancelButtonLabel',
+              {
+                defaultMessage: 'Cancel',
+              }
+            )}
+          </EuiButtonEmpty>
+
+          <EuiButton
+            fill
+            color="secondary"
+            data-test-subj="saveActionButtonModal"
+            type="submit"
+            iconType="check"
+            isDisabled={hasErrors}
+            isLoading={isSaving}
+            onClick={async () => {
+              setIsSaving(true);
+              const savedAction = await onActionConnectorSave();
+              setIsSaving(false);
+              if (savedAction) {
+                if (postSaveEventHandler) {
+                  postSaveEventHandler(savedAction);
+                }
+                closeModal();
+              }
+            }}
+          >
+            <FormattedMessage
+              id="xpack.triggersActionsUI.sections.addModalConnectorForm.saveButtonLabel"
+              defaultMessage="Save"
+            />
+          </EuiButton>
+        </EuiModalFooter>
+      </EuiModal>
+    </EuiOverlayMask>
+  );
+};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx
similarity index 87%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx
index 0dc38523bfab8..a82003759d973 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.test.tsx
@@ -5,12 +5,15 @@
  */
 import * as React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { coreMock } from '../../../../../../../../../src/core/public/mocks';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 import { ActionsConnectorsContextProvider } from '../../context/actions_connectors_context';
 import { actionTypeRegistryMock } from '../../action_type_registry.mock';
 import { ValidationResult } from '../../../types';
 import { ConnectorEditFlyout } from './connector_edit_flyout';
 import { AppContextProvider } from '../../app_context';
+import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+
 const actionTypeRegistry = actionTypeRegistryMock.create();
 let deps: any;
 
@@ -27,6 +30,8 @@ describe('connector_edit_flyout', () => {
     deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: mockes.injectedMetadata,
       http: mockes.http,
@@ -39,9 +44,7 @@ describe('connector_edit_flyout', () => {
           show: true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: {} as any,
     };
@@ -91,7 +94,7 @@ describe('connector_edit_flyout', () => {
             },
           }}
         >
-          <ConnectorEditFlyout connector={connector} />
+          <ConnectorEditFlyout initialConnector={connector} />
         </ActionsConnectorsContextProvider>
       </AppContextProvider>
     );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
new file mode 100644
index 0000000000000..f7ad6f95d048f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useCallback, useReducer, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiTitle,
+  EuiFlyoutHeader,
+  EuiFlyout,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiButtonEmpty,
+  EuiButton,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useActionsConnectorsContext } from '../../context/actions_connectors_context';
+import { ActionConnectorForm, validateBaseProperties } from './action_connector_form';
+import { useAppDependencies } from '../../app_context';
+import { ActionConnectorTableItem, ActionConnector, IErrorObject } from '../../../types';
+import { connectorReducer } from './connector_reducer';
+import { updateActionConnector } from '../../lib/action_connector_api';
+import { hasSaveActionsCapability } from '../../lib/capabilities';
+
+export interface ConnectorEditProps {
+  initialConnector: ActionConnectorTableItem;
+}
+
+export const ConnectorEditFlyout = ({ initialConnector }: ConnectorEditProps) => {
+  let hasErrors = false;
+  const { http, toastNotifications, capabilities, actionTypeRegistry } = useAppDependencies();
+  const canSave = hasSaveActionsCapability(capabilities);
+  const {
+    editFlyoutVisible,
+    setEditFlyoutVisibility,
+    reloadConnectors,
+  } = useActionsConnectorsContext();
+  const closeFlyout = useCallback(() => setEditFlyoutVisibility(false), [setEditFlyoutVisibility]);
+  const [{ connector }, dispatch] = useReducer(connectorReducer, {
+    connector: { ...initialConnector, secrets: {} },
+  });
+  const [isSaving, setIsSaving] = useState<boolean>(false);
+  const [serverError, setServerError] = useState<{
+    body: { message: string; error: string };
+  } | null>(null);
+
+  if (!editFlyoutVisible) {
+    return null;
+  }
+
+  const actionTypeModel = actionTypeRegistry.get(connector.actionTypeId);
+  const errors = {
+    ...actionTypeModel?.validateConnector(connector).errors,
+    ...validateBaseProperties(connector).errors,
+  } as IErrorObject;
+  hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
+
+  const onActionConnectorSave = async (): Promise<ActionConnector | undefined> =>
+    await updateActionConnector({ http, connector, id: connector.id })
+      .then(savedConnector => {
+        toastNotifications.addSuccess(
+          i18n.translate(
+            'xpack.triggersActionsUI.sections.editConnectorForm.updateSuccessNotificationText',
+            {
+              defaultMessage: "Updated '{connectorName}'",
+              values: {
+                connectorName: savedConnector.name,
+              },
+            }
+          )
+        );
+        return savedConnector;
+      })
+      .catch(errorRes => {
+        setServerError(errorRes);
+        return undefined;
+      });
+
+  return (
+    <EuiFlyout onClose={closeFlyout} aria-labelledby="flyoutActionAddTitle" size="m">
+      <EuiFlyoutHeader hasBorder>
+        <EuiFlexGroup gutterSize="s" alignItems="center">
+          {actionTypeModel ? (
+            <EuiFlexItem grow={false}>
+              <EuiIcon type={actionTypeModel.iconClass} size="m" />
+            </EuiFlexItem>
+          ) : null}
+          <EuiFlexItem>
+            <EuiTitle size="s">
+              <h3 id="flyoutTitle">
+                <FormattedMessage
+                  defaultMessage="Edit connector"
+                  id="xpack.triggersActionsUI.sections.editConnectorForm.flyoutTitle"
+                />
+              </h3>
+            </EuiTitle>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        <ActionConnectorForm
+          connector={connector}
+          serverError={serverError}
+          errors={errors}
+          actionTypeName={connector.actionType}
+          dispatch={dispatch}
+          actionTypeRegistry={actionTypeRegistry}
+        />
+      </EuiFlyoutBody>
+      <EuiFlyoutFooter>
+        <EuiFlexGroup justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty onClick={closeFlyout}>
+              {i18n.translate(
+                'xpack.triggersActionsUI.sections.editConnectorForm.cancelButtonLabel',
+                {
+                  defaultMessage: 'Cancel',
+                }
+              )}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          {canSave && actionTypeModel ? (
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                fill
+                color="secondary"
+                data-test-subj="saveEditedActionButton"
+                type="submit"
+                iconType="check"
+                isDisabled={hasErrors}
+                isLoading={isSaving}
+                onClick={async () => {
+                  setIsSaving(true);
+                  const savedAction = await onActionConnectorSave();
+                  setIsSaving(false);
+                  if (savedAction) {
+                    closeFlyout();
+                    reloadConnectors();
+                  }
+                }}
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.editConnectorForm.saveButtonLabel"
+                  defaultMessage="Save"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          ) : null}
+        </EuiFlexGroup>
+      </EuiFlyoutFooter>
+    </EuiFlyout>
+  );
+};
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_reducer.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_reducer.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_reducer.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_reducer.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_reducer.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_reducer.ts
similarity index 84%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_reducer.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_reducer.ts
index 4a2610f965735..4d094cd869420 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/connector_reducer.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_reducer.ts
@@ -6,7 +6,7 @@
 import { isEqual } from 'lodash';
 
 interface CommandType {
-  type: 'setProperty' | 'setConfigProperty' | 'setSecretsProperty';
+  type: 'setConnector' | 'setProperty' | 'setConfigProperty' | 'setSecretsProperty';
 }
 
 export interface ActionState {
@@ -26,6 +26,17 @@ export const connectorReducer = (state: ActionState, action: ReducerAction) => {
   const { connector } = state;
 
   switch (command.type) {
+    case 'setConnector': {
+      const { key, value } = payload;
+      if (key === 'connector') {
+        return {
+          ...state,
+          connector: value,
+        };
+      } else {
+        return state;
+      }
+    }
     case 'setProperty': {
       const { key, value } = payload;
       if (isEqual(connector[key], value)) {
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/action_connector_form/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/index.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/_index.scss b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/_index.scss
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/_index.scss
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/_index.scss
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.scss b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.scss
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.scss
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.scss
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
similarity index 91%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
index da502fb86521b..509bd7131394e 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
@@ -6,11 +6,14 @@
 import * as React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { ActionsConnectorsList } from './actions_connectors_list';
-import { coreMock } from '../../../../../../../../../../src/core/public/mocks';
+import { coreMock } from '../../../../../../../../src/core/public/mocks';
 import { ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { actionTypeRegistryMock } from '../../../action_type_registry.mock';
 import { AppContextProvider } from '../../../app_context';
+import { chartPluginMock } from '../../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../../src/plugins/data/public/mocks';
+
 jest.mock('../../../lib/action_connector_api', () => ({
   loadAllActions: jest.fn(),
   loadActionTypes: jest.fn(),
@@ -52,6 +55,8 @@ describe('actions_connectors_list component empty', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: mockes.injectedMetadata,
       http: mockes.http,
@@ -64,9 +69,7 @@ describe('actions_connectors_list component empty', () => {
           'actions:delete': true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: {} as any,
     };
@@ -149,6 +152,8 @@ describe('actions_connectors_list component with items', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: mockes.injectedMetadata,
       http: mockes.http,
@@ -161,9 +166,7 @@ describe('actions_connectors_list component with items', () => {
           'actions:delete': true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: {
         get() {
           return null;
@@ -233,6 +236,8 @@ describe('actions_connectors_list component empty with show only capability', ()
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: mockes.injectedMetadata,
       http: mockes.http,
@@ -245,9 +250,7 @@ describe('actions_connectors_list component empty with show only capability', ()
           'actions:delete': false,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: {
         get() {
           return null;
@@ -322,6 +325,8 @@ describe('actions_connectors_list with show only capability', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: mockes.injectedMetadata,
       http: mockes.http,
@@ -334,9 +339,7 @@ describe('actions_connectors_list with show only capability', () => {
           'actions:delete': false,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: {
         get() {
           return null;
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
similarity index 98%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
index e98c3b2c08749..bed285f668e01 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
@@ -384,7 +384,12 @@ export const ActionsConnectorsList: React.FunctionComponent = () => {
         }}
       >
         <ConnectorAddFlyout />
-        {editedConnectorItem ? <ConnectorEditFlyout connector={editedConnectorItem} /> : null}
+        {editedConnectorItem ? (
+          <ConnectorEditFlyout
+            key={editedConnectorItem.id}
+            initialConnector={editedConnectorItem}
+          />
+        ) : null}
       </ActionsConnectorsContextProvider>
     </section>
   );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.test.tsx
new file mode 100644
index 0000000000000..05adccf982b7f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.test.tsx
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { act } from 'react-dom/test-utils';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { AlertAdd } from './alert_add';
+import { actionTypeRegistryMock } from '../../action_type_registry.mock';
+import { ValidationResult } from '../../../types';
+import { AppDeps } from '../../app';
+import { AlertsContextProvider } from '../../context/alerts_context';
+import { alertTypeRegistryMock } from '../../alert_type_registry.mock';
+import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+import { ReactWrapper } from 'enzyme';
+const actionTypeRegistry = actionTypeRegistryMock.create();
+const alertTypeRegistry = alertTypeRegistryMock.create();
+
+describe('alert_add', () => {
+  let deps: AppDeps | null;
+  let wrapper: ReactWrapper<any>;
+
+  beforeAll(async () => {
+    const mockes = coreMock.createSetup();
+    const [
+      {
+        chrome,
+        docLinks,
+        application: { capabilities },
+      },
+    ] = await mockes.getStartServices();
+    deps = {
+      chrome,
+      docLinks,
+      toastNotifications: mockes.notifications.toasts,
+      injectedMetadata: mockes.injectedMetadata,
+      http: mockes.http,
+      uiSettings: mockes.uiSettings,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
+      capabilities: {
+        ...capabilities,
+        alerting: {
+          delete: true,
+          save: true,
+          show: true,
+        },
+      },
+      setBreadcrumbs: jest.fn(),
+      actionTypeRegistry: actionTypeRegistry as any,
+      alertTypeRegistry: alertTypeRegistry as any,
+    };
+    const alertType = {
+      id: 'my-alert-type',
+      iconClass: 'test',
+      name: 'test-alert',
+      validate: (): ValidationResult => {
+        return { errors: {} };
+      },
+      alertParamsExpression: () => <React.Fragment />,
+    };
+
+    const actionTypeModel = {
+      id: 'my-action-type',
+      iconClass: 'test',
+      selectMessage: 'test',
+      validateConnector: (): ValidationResult => {
+        return { errors: {} };
+      },
+      validateParams: (): ValidationResult => {
+        const validationResult = { errors: {} };
+        return validationResult;
+      },
+      actionConnectorFields: null,
+      actionParamsFields: null,
+    };
+    actionTypeRegistry.get.mockReturnValueOnce(actionTypeModel);
+    actionTypeRegistry.has.mockReturnValue(true);
+    alertTypeRegistry.list.mockReturnValue([alertType]);
+    alertTypeRegistry.get.mockReturnValue(alertType);
+    alertTypeRegistry.has.mockReturnValue(true);
+    actionTypeRegistry.list.mockReturnValue([actionTypeModel]);
+    actionTypeRegistry.has.mockReturnValue(true);
+
+    await act(async () => {
+      if (deps) {
+        wrapper = mountWithIntl(
+          <AlertsContextProvider
+            value={{
+              addFlyoutVisible: true,
+              setAddFlyoutVisibility: state => {},
+              reloadAlerts: () => {
+                return new Promise<void>(() => {});
+              },
+              http: deps.http,
+              actionTypeRegistry: deps.actionTypeRegistry,
+              alertTypeRegistry: deps.alertTypeRegistry,
+              toastNotifications: deps.toastNotifications,
+              uiSettings: deps.uiSettings,
+            }}
+          >
+            <AlertAdd consumer={'alerting'} />
+          </AlertsContextProvider>
+        );
+      }
+    });
+    await waitForRender(wrapper);
+  });
+
+  it('renders alert add flyout', () => {
+    expect(wrapper.find('[data-test-subj="addAlertFlyoutTitle"]').exists()).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="saveAlertButton"]').exists()).toBeTruthy();
+  });
+});
+
+async function waitForRender(wrapper: ReactWrapper<any, any>) {
+  await Promise.resolve();
+  await Promise.resolve();
+  wrapper.update();
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.tsx
new file mode 100644
index 0000000000000..a88f916346985
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_add.tsx
@@ -0,0 +1,192 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useCallback, useReducer, useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiTitle,
+  EuiFlyoutHeader,
+  EuiFlyout,
+  EuiFlyoutFooter,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+  EuiButton,
+  EuiFlyoutBody,
+  EuiPortal,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { useAlertsContext } from '../../context/alerts_context';
+import { Alert, AlertAction, IErrorObject } from '../../../types';
+import { AlertForm, validateBaseProperties } from './alert_form';
+import { alertReducer } from './alert_reducer';
+import { createAlert } from '../../lib/alert_api';
+
+interface AlertAddProps {
+  consumer: string;
+  alertTypeId?: string;
+  canChangeTrigger?: boolean;
+}
+
+export const AlertAdd = ({ consumer, canChangeTrigger, alertTypeId }: AlertAddProps) => {
+  const initialAlert = ({
+    params: {},
+    consumer,
+    alertTypeId,
+    schedule: {
+      interval: '1m',
+    },
+    actions: [],
+    tags: [],
+  } as unknown) as Alert;
+
+  const [{ alert }, dispatch] = useReducer(alertReducer, { alert: initialAlert });
+  const [isSaving, setIsSaving] = useState<boolean>(false);
+
+  const setAlert = (value: any) => {
+    dispatch({ command: { type: 'setAlert' }, payload: { key: 'alert', value } });
+  };
+
+  const {
+    addFlyoutVisible,
+    setAddFlyoutVisibility,
+    reloadAlerts,
+    http,
+    toastNotifications,
+    alertTypeRegistry,
+    actionTypeRegistry,
+  } = useAlertsContext();
+
+  const closeFlyout = useCallback(() => {
+    setAddFlyoutVisibility(false);
+    setAlert(initialAlert);
+    setServerError(null);
+  }, [initialAlert, setAddFlyoutVisibility]);
+
+  const [serverError, setServerError] = useState<{
+    body: { message: string; error: string };
+  } | null>(null);
+
+  if (!addFlyoutVisible) {
+    return null;
+  }
+
+  const alertType = alertTypeRegistry.get(alert.alertTypeId);
+  const errors = {
+    ...(alertType ? alertType.validate(alert.params).errors : []),
+    ...validateBaseProperties(alert).errors,
+  } as IErrorObject;
+  const hasErrors = !!Object.keys(errors).find(errorKey => errors[errorKey].length >= 1);
+
+  const actionsErrors = alert.actions.reduce(
+    (acc: Record<string, { errors: IErrorObject }>, alertAction: AlertAction) => {
+      const actionType = actionTypeRegistry.get(alertAction.actionTypeId);
+      if (!actionType) {
+        return { ...acc };
+      }
+      const actionValidationErrors = actionType.validateParams(alertAction.params);
+      return { ...acc, [alertAction.id]: actionValidationErrors };
+    },
+    {}
+  ) as Record<string, { errors: IErrorObject }>;
+
+  const hasActionErrors = !!Object.entries(actionsErrors)
+    .map(([, actionErrors]) => actionErrors)
+    .find((actionErrors: { errors: IErrorObject }) => {
+      return !!Object.keys(actionErrors.errors).find(
+        errorKey => actionErrors.errors[errorKey].length >= 1
+      );
+    });
+
+  async function onSaveAlert(): Promise<Alert | undefined> {
+    try {
+      const newAlert = await createAlert({ http, alert });
+      if (toastNotifications) {
+        toastNotifications.addSuccess(
+          i18n.translate('xpack.triggersActionsUI.sections.alertForm.saveSuccessNotificationText', {
+            defaultMessage: "Saved '{alertName}'",
+            values: {
+              alertName: newAlert.name,
+            },
+          })
+        );
+      }
+      return newAlert;
+    } catch (errorRes) {
+      setServerError(errorRes);
+      return undefined;
+    }
+  }
+
+  return (
+    <EuiPortal>
+      <EuiFlyout
+        onClose={closeFlyout}
+        aria-labelledby="flyoutAlertAddTitle"
+        size="m"
+        maxWidth={620}
+        ownFocus
+      >
+        <EuiFlyoutHeader hasBorder>
+          <EuiTitle size="s" data-test-subj="addAlertFlyoutTitle">
+            <h3 id="flyoutTitle">
+              <FormattedMessage
+                defaultMessage="Create Alert"
+                id="xpack.triggersActionsUI.sections.alertAdd.flyoutTitle"
+              />
+            </h3>
+          </EuiTitle>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody>
+          <AlertForm
+            alert={alert}
+            dispatch={dispatch}
+            errors={errors}
+            serverError={serverError}
+            canChangeTrigger={canChangeTrigger}
+          />
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiFlexGroup justifyContent="spaceBetween">
+            <EuiFlexItem grow={false}>
+              <EuiButtonEmpty data-test-subj="cancelSaveAlertButton" onClick={closeFlyout}>
+                {i18n.translate('xpack.triggersActionsUI.sections.alertAdd.cancelButtonLabel', {
+                  defaultMessage: 'Cancel',
+                })}
+              </EuiButtonEmpty>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiButton
+                fill
+                color="secondary"
+                data-test-subj="saveAlertButton"
+                type="submit"
+                iconType="check"
+                isDisabled={hasErrors || hasActionErrors}
+                isLoading={isSaving}
+                onClick={async () => {
+                  setIsSaving(true);
+                  const savedAlert = await onSaveAlert();
+                  setIsSaving(false);
+                  if (savedAlert) {
+                    closeFlyout();
+                    if (reloadAlerts) {
+                      reloadAlerts();
+                    }
+                  }
+                }}
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.alertAdd.saveButtonLabel"
+                  defaultMessage="Save"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    </EuiPortal>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.test.tsx
new file mode 100644
index 0000000000000..ce524ed8178ee
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.test.tsx
@@ -0,0 +1,232 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { Fragment } from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { ReactWrapper } from 'enzyme';
+import { act } from 'react-dom/test-utils';
+import { actionTypeRegistryMock } from '../../action_type_registry.mock';
+import { alertTypeRegistryMock } from '../../alert_type_registry.mock';
+import { ValidationResult, Alert } from '../../../types';
+import { AlertForm } from './alert_form';
+import { AppDeps } from '../../app';
+import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
+import { AlertsContextProvider } from '../../context/alerts_context';
+const actionTypeRegistry = actionTypeRegistryMock.create();
+const alertTypeRegistry = alertTypeRegistryMock.create();
+describe('alert_form', () => {
+  let deps: AppDeps | null;
+  const alertType = {
+    id: 'my-alert-type',
+    iconClass: 'test',
+    name: 'test-alert',
+    validate: (): ValidationResult => {
+      return { errors: {} };
+    },
+    alertParamsExpression: () => <Fragment />,
+  };
+
+  const actionType = {
+    id: 'my-action-type',
+    iconClass: 'test',
+    selectMessage: 'test',
+    validateConnector: (): ValidationResult => {
+      return { errors: {} };
+    },
+    validateParams: (): ValidationResult => {
+      const validationResult = { errors: {} };
+      return validationResult;
+    },
+    actionConnectorFields: null,
+    actionParamsFields: null,
+  };
+  beforeAll(async () => {
+    const mockes = coreMock.createSetup();
+    const [
+      {
+        chrome,
+        docLinks,
+        application: { capabilities },
+      },
+    ] = await mockes.getStartServices();
+    deps = {
+      chrome,
+      docLinks,
+      toastNotifications: mockes.notifications.toasts,
+      injectedMetadata: mockes.injectedMetadata,
+      http: mockes.http,
+      uiSettings: mockes.uiSettings,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
+      capabilities: {
+        ...capabilities,
+        siem: {
+          'alerting:show': true,
+          'alerting:save': true,
+          'alerting:delete': false,
+        },
+      },
+      setBreadcrumbs: jest.fn(),
+      actionTypeRegistry: actionTypeRegistry as any,
+      alertTypeRegistry: alertTypeRegistry as any,
+    };
+  });
+
+  describe('alert_form create alert', () => {
+    let wrapper: ReactWrapper<any>;
+
+    beforeAll(async () => {
+      alertTypeRegistry.list.mockReturnValue([alertType]);
+      alertTypeRegistry.has.mockReturnValue(true);
+      actionTypeRegistry.list.mockReturnValue([actionType]);
+      actionTypeRegistry.has.mockReturnValue(true);
+
+      const initialAlert = ({
+        name: 'test',
+        params: {},
+        consumer: 'alerting',
+        schedule: {
+          interval: '1m',
+        },
+        actions: [],
+        tags: [],
+        muteAll: false,
+        enabled: false,
+        mutedInstanceIds: [],
+      } as unknown) as Alert;
+
+      await act(async () => {
+        if (deps) {
+          wrapper = mountWithIntl(
+            <AlertsContextProvider
+              value={{
+                addFlyoutVisible: true,
+                setAddFlyoutVisibility: state => {},
+                reloadAlerts: () => {
+                  return new Promise<void>(() => {});
+                },
+                http: deps.http,
+                actionTypeRegistry: deps.actionTypeRegistry,
+                alertTypeRegistry: deps.alertTypeRegistry,
+                toastNotifications: deps.toastNotifications,
+                uiSettings: deps.uiSettings,
+              }}
+            >
+              <AlertForm
+                alert={initialAlert}
+                dispatch={() => {}}
+                errors={{ name: [] }}
+                serverError={null}
+              />
+            </AlertsContextProvider>
+          );
+        }
+      });
+
+      await waitForRender(wrapper);
+    });
+
+    it('renders alert name', () => {
+      const alertNameField = wrapper.find('[data-test-subj="alertNameInput"]');
+      expect(alertNameField.exists()).toBeTruthy();
+      expect(alertNameField.first().prop('value')).toBe('test');
+    });
+
+    it('renders registered selected alert type', () => {
+      const alertTypeSelectOptions = wrapper.find('[data-test-subj="my-alert-type-SelectOption"]');
+      expect(alertTypeSelectOptions.exists()).toBeTruthy();
+    });
+
+    it('renders registered action types', () => {
+      const alertTypeSelectOptions = wrapper.find(
+        '[data-test-subj=".server-log-ActionTypeSelectOption"]'
+      );
+      expect(alertTypeSelectOptions.exists()).toBeFalsy();
+    });
+  });
+
+  describe('alert_form edit alert', () => {
+    let wrapper: ReactWrapper<any>;
+
+    beforeAll(async () => {
+      alertTypeRegistry.list.mockReturnValue([alertType]);
+      alertTypeRegistry.get.mockReturnValue(alertType);
+      alertTypeRegistry.has.mockReturnValue(true);
+      actionTypeRegistry.list.mockReturnValue([actionType]);
+      actionTypeRegistry.has.mockReturnValue(true);
+
+      const initialAlert = ({
+        name: 'test',
+        alertTypeId: alertType.id,
+        params: {},
+        consumer: 'alerting',
+        schedule: {
+          interval: '1m',
+        },
+        actions: [],
+        tags: [],
+        muteAll: false,
+        enabled: false,
+        mutedInstanceIds: [],
+      } as unknown) as Alert;
+
+      await act(async () => {
+        if (deps) {
+          wrapper = mountWithIntl(
+            <AlertsContextProvider
+              value={{
+                addFlyoutVisible: true,
+                setAddFlyoutVisibility: state => {},
+                reloadAlerts: () => {
+                  return new Promise<void>(() => {});
+                },
+                http: deps.http,
+                actionTypeRegistry: deps.actionTypeRegistry,
+                alertTypeRegistry: deps.alertTypeRegistry,
+                toastNotifications: deps.toastNotifications,
+                uiSettings: deps.uiSettings,
+              }}
+            >
+              <AlertForm
+                alert={initialAlert}
+                dispatch={() => {}}
+                errors={{ name: [] }}
+                serverError={null}
+              />
+            </AlertsContextProvider>
+          );
+        }
+      });
+
+      await waitForRender(wrapper);
+    });
+
+    it('renders alert name', () => {
+      const alertNameField = wrapper.find('[data-test-subj="alertNameInput"]');
+      expect(alertNameField.exists()).toBeTruthy();
+      expect(alertNameField.first().prop('value')).toBe('test');
+    });
+
+    it('renders registered selected alert type', () => {
+      const alertTypeSelectOptions = wrapper.find('[data-test-subj="selectedAlertTypeTitle"]');
+      expect(alertTypeSelectOptions.exists()).toBeTruthy();
+    });
+
+    it('renders registered action types', () => {
+      const actionTypeSelectOptions = wrapper.find(
+        '[data-test-subj="my-action-type-ActionTypeSelectOption"]'
+      );
+      expect(actionTypeSelectOptions.exists()).toBeTruthy();
+    });
+  });
+
+  async function waitForRender(wrapper: ReactWrapper<any, any>) {
+    await Promise.resolve();
+    await Promise.resolve();
+    wrapper.update();
+  }
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.tsx
new file mode 100644
index 0000000000000..90b84e11fccd2
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_form.tsx
@@ -0,0 +1,869 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { Fragment, useState, useEffect } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIcon,
+  EuiTitle,
+  EuiForm,
+  EuiSpacer,
+  EuiFieldText,
+  EuiFlexGrid,
+  EuiFormRow,
+  EuiComboBox,
+  EuiKeyPadMenuItem,
+  EuiLink,
+  EuiFieldNumber,
+  EuiSelect,
+  EuiIconTip,
+  EuiAccordion,
+  EuiButtonIcon,
+  EuiEmptyPrompt,
+  EuiButtonEmpty,
+} from '@elastic/eui';
+import { loadAlertTypes } from '../../lib/alert_api';
+import { loadActionTypes, loadAllActions } from '../../lib/action_connector_api';
+import { AlertReducerAction } from './alert_reducer';
+import {
+  AlertTypeModel,
+  Alert,
+  IErrorObject,
+  ActionTypeModel,
+  AlertAction,
+  ActionTypeIndex,
+  ActionConnector,
+  AlertTypeIndex,
+} from '../../../types';
+import { SectionLoading } from '../../components/section_loading';
+import { ConnectorAddModal } from '../action_connector_form/connector_add_modal';
+import { getTimeOptions } from '../../../common/lib/get_time_options';
+import { useAlertsContext } from '../../context/alerts_context';
+
+export function validateBaseProperties(alertObject: Alert) {
+  const validationResult = { errors: {} };
+  const errors = {
+    name: new Array<string>(),
+    interval: new Array<string>(),
+    alertTypeId: new Array<string>(),
+    actionConnectors: new Array<string>(),
+  };
+  validationResult.errors = errors;
+  if (!alertObject.name) {
+    errors.name.push(
+      i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredNameText', {
+        defaultMessage: 'Name is required.',
+      })
+    );
+  }
+  if (!alertObject.schedule.interval) {
+    errors.interval.push(
+      i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredIntervalText', {
+        defaultMessage: 'Check interval is required.',
+      })
+    );
+  }
+  if (!alertObject.alertTypeId) {
+    errors.alertTypeId.push(
+      i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredAlertTypeIdText', {
+        defaultMessage: 'Alert trigger is required.',
+      })
+    );
+  }
+  return validationResult;
+}
+
+interface AlertFormProps {
+  alert: Alert;
+  dispatch: React.Dispatch<AlertReducerAction>;
+  errors: IErrorObject;
+  serverError: {
+    body: { message: string; error: string };
+  } | null;
+  canChangeTrigger?: boolean; // to hide Change trigger button
+}
+
+interface ActiveActionConnectorState {
+  actionTypeId: string;
+  index: number;
+}
+
+export const AlertForm = ({
+  alert,
+  canChangeTrigger = true,
+  dispatch,
+  errors,
+  serverError,
+}: AlertFormProps) => {
+  const alertsContext = useAlertsContext();
+  const { http, toastNotifications, alertTypeRegistry, actionTypeRegistry } = alertsContext;
+
+  const [alertTypeModel, setAlertTypeModel] = useState<AlertTypeModel | null>(
+    alertTypeRegistry.get(alert.alertTypeId)
+  );
+
+  const [addModalVisible, setAddModalVisibility] = useState<boolean>(false);
+  const [isLoadingActionTypes, setIsLoadingActionTypes] = useState<boolean>(false);
+  const [actionTypesIndex, setActionTypesIndex] = useState<ActionTypeIndex | undefined>(undefined);
+  const [alertTypesIndex, setAlertTypesIndex] = useState<AlertTypeIndex | undefined>(undefined);
+  const [alertInterval, setAlertInterval] = useState<number | null>(null);
+  const [alertIntervalUnit, setAlertIntervalUnit] = useState<string>('m');
+  const [alertThrottle, setAlertThrottle] = useState<number | null>(null);
+  const [alertThrottleUnit, setAlertThrottleUnit] = useState<string>('m');
+  const [isAddActionPanelOpen, setIsAddActionPanelOpen] = useState<boolean>(true);
+  const [connectors, setConnectors] = useState<ActionConnector[]>([]);
+  const [defaultActionGroup, setDefaultActionGroup] = useState<string | undefined>(undefined);
+  const [activeActionItem, setActiveActionItem] = useState<ActiveActionConnectorState | undefined>(
+    undefined
+  );
+
+  // load action types
+  useEffect(() => {
+    (async () => {
+      try {
+        setIsLoadingActionTypes(true);
+        const actionTypes = await loadActionTypes({ http });
+        const index: ActionTypeIndex = {};
+        for (const actionTypeItem of actionTypes) {
+          index[actionTypeItem.id] = actionTypeItem;
+        }
+        setActionTypesIndex(index);
+      } catch (e) {
+        if (toastNotifications) {
+          toastNotifications.addDanger({
+            title: i18n.translate(
+              'xpack.triggersActionsUI.sections.alertForm.unableToLoadActionTypesMessage',
+              { defaultMessage: 'Unable to load action types' }
+            ),
+          });
+        }
+      } finally {
+        setIsLoadingActionTypes(false);
+      }
+    })();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  // load alert types
+  useEffect(() => {
+    (async () => {
+      try {
+        const alertTypes = await loadAlertTypes({ http });
+        // temp hack of API result
+        alertTypes.push({
+          id: 'threshold',
+          actionGroups: ['Alert', 'Warning', 'If unacknowledged'],
+          name: 'threshold',
+          actionVariables: ['ctx.metadata.name', 'ctx.metadata.test'],
+        });
+        const index: AlertTypeIndex = {};
+        for (const alertTypeItem of alertTypes) {
+          index[alertTypeItem.id] = alertTypeItem;
+        }
+        if (alert.alertTypeId) {
+          setDefaultActionGroup(index[alert.alertTypeId].actionGroups[0]);
+        }
+        setAlertTypesIndex(index);
+      } catch (e) {
+        if (toastNotifications) {
+          toastNotifications.addDanger({
+            title: i18n.translate(
+              'xpack.triggersActionsUI.sections.alertForm.unableToLoadAlertTypesMessage',
+              { defaultMessage: 'Unable to load alert types' }
+            ),
+          });
+        }
+      }
+    })();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  useEffect(() => {
+    loadConnectors();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  const setAlertProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
+  };
+
+  const setAlertParams = (key: string, value: any) => {
+    dispatch({ command: { type: 'setAlertParams' }, payload: { key, value } });
+  };
+
+  const setScheduleProperty = (key: string, value: any) => {
+    dispatch({ command: { type: 'setScheduleProperty' }, payload: { key, value } });
+  };
+
+  const setActionParamsProperty = (key: string, value: any, index: number) => {
+    dispatch({ command: { type: 'setAlertActionParams' }, payload: { key, value, index } });
+  };
+
+  const setActionProperty = (key: string, value: any, index: number) => {
+    dispatch({ command: { type: 'setAlertActionProperty' }, payload: { key, value, index } });
+  };
+
+  const tagsOptions = alert.tags ? alert.tags.map((label: string) => ({ label })) : [];
+
+  async function loadConnectors() {
+    try {
+      const actionsResponse = await loadAllActions({ http });
+      setConnectors(actionsResponse.data);
+    } catch (e) {
+      if (toastNotifications) {
+        toastNotifications.addDanger({
+          title: i18n.translate(
+            'xpack.triggersActionsUI.sections.alertForm.unableToLoadActionsMessage',
+            {
+              defaultMessage: 'Unable to load connectors',
+            }
+          ),
+        });
+      }
+    }
+  }
+
+  const actionsErrors = alert.actions.reduce(
+    (acc: Record<string, { errors: IErrorObject }>, alertAction: AlertAction) => {
+      const actionType = actionTypeRegistry.get(alertAction.actionTypeId);
+      if (!actionType) {
+        return { ...acc };
+      }
+      const actionValidationErrors = actionType.validateParams(alertAction.params);
+      return { ...acc, [alertAction.id]: actionValidationErrors };
+    },
+    {}
+  );
+
+  const AlertParamsExpressionComponent = alertTypeModel
+    ? alertTypeModel.alertParamsExpression
+    : null;
+
+  function addActionType(actionTypeModel: ActionTypeModel) {
+    setIsAddActionPanelOpen(false);
+    const actionTypeConnectors = connectors.filter(
+      field => field.actionTypeId === actionTypeModel.id
+    );
+    let freeConnectors;
+    if (actionTypeConnectors.length > 0) {
+      // Should we allow adding multiple actions to the same connector under the alert?
+      freeConnectors = actionTypeConnectors.filter(
+        (actionConnector: ActionConnector) =>
+          !alert.actions.find((actionItem: AlertAction) => actionItem.id === actionConnector.id)
+      );
+      if (freeConnectors.length > 0) {
+        alert.actions.push({
+          id: '',
+          actionTypeId: actionTypeModel.id,
+          group: defaultActionGroup ?? 'Alert',
+          params: {},
+        });
+        setActionProperty('id', freeConnectors[0].id, alert.actions.length - 1);
+      }
+    }
+    if (actionTypeConnectors.length === 0 || !freeConnectors || freeConnectors.length === 0) {
+      // if no connectors exists or all connectors is already assigned an action under current alert
+      // set actionType as id to be able to create new connector within the alert form
+      alert.actions.push({
+        id: '',
+        actionTypeId: actionTypeModel.id,
+        group: defaultActionGroup ?? 'Alert',
+        params: {},
+      });
+      setActionProperty('id', alert.actions.length, alert.actions.length - 1);
+    }
+  }
+
+  const alertTypeNodes = alertTypeRegistry.list().map(function(item, index) {
+    return (
+      <EuiKeyPadMenuItem
+        key={index}
+        data-test-subj={`${item.id}-SelectOption`}
+        label={item.name}
+        onClick={() => {
+          setAlertProperty('alertTypeId', item.id);
+          setAlertTypeModel(item);
+          if (
+            alertTypesIndex &&
+            alertTypesIndex[item.id] &&
+            alertTypesIndex[item.id].actionGroups.length > 0
+          ) {
+            setDefaultActionGroup(alertTypesIndex[item.id].actionGroups[0]);
+          }
+        }}
+      >
+        <EuiIcon size="xl" type={item.iconClass} />
+      </EuiKeyPadMenuItem>
+    );
+  });
+
+  const actionTypeNodes = actionTypeRegistry.list().map(function(item, index) {
+    return (
+      <EuiKeyPadMenuItem
+        key={index}
+        data-test-subj={`${item.id}-ActionTypeSelectOption`}
+        label={actionTypesIndex ? actionTypesIndex[item.id].name : item.id}
+        onClick={() => addActionType(item)}
+      >
+        <EuiIcon size="xl" type={item.iconClass} />
+      </EuiKeyPadMenuItem>
+    );
+  });
+
+  const getSelectedOptions = (actionItemId: string) => {
+    const val = connectors.find(connector => connector.id === actionItemId);
+    if (!val) {
+      return [];
+    }
+    return [
+      {
+        label: val.name,
+        value: val.name,
+        id: actionItemId,
+      },
+    ];
+  };
+
+  const getActionTypeForm = (
+    actionItem: AlertAction,
+    actionConnector: ActionConnector,
+    index: number
+  ) => {
+    const optionsList = connectors
+      .filter(
+        connectorItem =>
+          connectorItem.actionTypeId === actionItem.actionTypeId &&
+          (connectorItem.id === actionItem.id ||
+            !alert.actions.find(
+              (existingAction: AlertAction) =>
+                existingAction.id === connectorItem.id && existingAction.group === actionItem.group
+            ))
+      )
+      .map(({ name, id }) => ({
+        label: name,
+        key: id,
+        id,
+      }));
+    const actionTypeRegisterd = actionTypeRegistry.get(actionConnector.actionTypeId);
+    if (actionTypeRegisterd === null || actionItem.group !== defaultActionGroup) return null;
+    const ParamsFieldsComponent = actionTypeRegisterd.actionParamsFields;
+    const actionParamsErrors: { errors: IErrorObject } =
+      Object.keys(actionsErrors).length > 0 ? actionsErrors[actionItem.id] : { errors: {} };
+
+    return (
+      <EuiAccordion
+        initialIsOpen={true}
+        key={index}
+        id={index.toString()}
+        className="euiAccordionForm"
+        buttonContentClassName="euiAccordionForm__button"
+        data-test-subj="alertActionAccordion"
+        buttonContent={
+          <EuiFlexGroup gutterSize="s" alignItems="center">
+            <EuiFlexItem grow={false}>
+              <EuiIcon type={actionTypeRegisterd.iconClass} size="m" />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiTitle size="s">
+                <h5>
+                  <FormattedMessage
+                    defaultMessage="Action: {actionConnectorName}"
+                    id="xpack.triggersActionsUI.sections.alertForm.selectAlertActionTypeEditTitle"
+                    values={{
+                      actionConnectorName: actionConnector.name,
+                    }}
+                  />
+                </h5>
+              </EuiTitle>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        }
+        extraAction={
+          <EuiButtonIcon
+            iconType="cross"
+            color="danger"
+            className="euiAccordionForm__extraAction"
+            aria-label={i18n.translate(
+              'xpack.triggersActionsUI.sections.alertForm.accordion.deleteIconAriaLabel',
+              {
+                defaultMessage: 'Delete',
+              }
+            )}
+            onClick={() => {
+              const updatedActions = alert.actions.filter(
+                (item: AlertAction) => item.id !== actionItem.id
+              );
+              setAlertProperty('actions', updatedActions);
+              setIsAddActionPanelOpen(
+                updatedActions.filter((item: AlertAction) => item.id !== actionItem.id).length === 0
+              );
+              setActiveActionItem(undefined);
+            }}
+          />
+        }
+        paddingSize="l"
+      >
+        <EuiFlexGroup component="div">
+          <EuiFlexItem>
+            <EuiFormRow
+              fullWidth
+              label={
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.alertForm.actionIdLabel"
+                  defaultMessage="{connectorInstance} instance"
+                  values={{
+                    connectorInstance: actionTypesIndex
+                      ? actionTypesIndex[actionConnector.actionTypeId].name
+                      : actionConnector.actionTypeId,
+                  }}
+                />
+              }
+              labelAppend={
+                <EuiButtonEmpty
+                  size="xs"
+                  onClick={() => {
+                    setActiveActionItem({ actionTypeId: actionItem.actionTypeId, index });
+                    setAddModalVisibility(true);
+                  }}
+                >
+                  <FormattedMessage
+                    defaultMessage="Add new"
+                    id="xpack.triggersActionsUI.sections.alertForm.addNewConnectorEmptyButton"
+                  />
+                </EuiButtonEmpty>
+              }
+            >
+              <EuiComboBox
+                fullWidth
+                singleSelection={{ asPlainText: true }}
+                options={optionsList}
+                selectedOptions={getSelectedOptions(actionItem.id)}
+                onChange={selectedOptions => {
+                  setActionProperty('id', selectedOptions[0].id, index);
+                }}
+                isClearable={false}
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+        <EuiSpacer size="xl" />
+        {ParamsFieldsComponent ? (
+          <ParamsFieldsComponent
+            actionParams={actionItem.params as any}
+            index={index}
+            errors={actionParamsErrors.errors}
+            editAction={setActionParamsProperty}
+            messageVariables={
+              alertTypesIndex ? alertTypesIndex[alert.alertTypeId].actionVariables : undefined
+            }
+            defaultMessage={alertTypeModel?.defaultActionMessage ?? undefined}
+          />
+        ) : null}
+      </EuiAccordion>
+    );
+  };
+
+  const getAddConnectorsForm = (actionItem: AlertAction, index: number) => {
+    const actionTypeName = actionTypesIndex
+      ? actionTypesIndex[actionItem.actionTypeId].name
+      : actionItem.actionTypeId;
+    const actionTypeRegisterd = actionTypeRegistry.get(actionItem.actionTypeId);
+    if (actionTypeRegisterd === null || actionItem.group !== defaultActionGroup) return null;
+    return (
+      <EuiAccordion
+        initialIsOpen={true}
+        key={index}
+        id={index.toString()}
+        className="euiAccordionForm"
+        buttonContentClassName="euiAccordionForm__button"
+        data-test-subj="alertActionAccordion"
+        buttonContent={
+          <EuiFlexGroup gutterSize="s" alignItems="center">
+            <EuiFlexItem grow={false}>
+              <EuiIcon type={actionTypeRegisterd.iconClass} size="m" />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiTitle size="s">
+                <h5>
+                  <FormattedMessage
+                    defaultMessage="Action: {actionConnectorName}"
+                    id="xpack.triggersActionsUI.sections.alertForm.selectAlertActionTypeEditTitle"
+                    values={{
+                      actionConnectorName: actionTypeRegisterd.actionTypeTitle,
+                    }}
+                  />
+                </h5>
+              </EuiTitle>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        }
+        extraAction={
+          <EuiButtonIcon
+            iconType="cross"
+            color="danger"
+            className="euiAccordionForm__extraAction"
+            aria-label={i18n.translate(
+              'xpack.triggersActionsUI.sections.alertForm.accordion.deleteIconAriaLabel',
+              {
+                defaultMessage: 'Delete',
+              }
+            )}
+            onClick={() => {
+              const updatedActions = alert.actions.filter(
+                (item: AlertAction) => item.id !== actionItem.id
+              );
+              setAlertProperty('actions', updatedActions);
+              setIsAddActionPanelOpen(
+                updatedActions.filter((item: AlertAction) => item.id !== actionItem.id).length === 0
+              );
+              setActiveActionItem(undefined);
+            }}
+          />
+        }
+        paddingSize="l"
+      >
+        <EuiEmptyPrompt
+          title={
+            <FormattedMessage
+              id="xpack.triggersActionsUI.sections.alertForm.emptyConnectorsLabel"
+              defaultMessage="There are no {actionTypeName} connectors"
+              values={{
+                actionTypeName,
+              }}
+            />
+          }
+          actions={[
+            <EuiButton
+              color="primary"
+              fill
+              data-test-subj="createActionConnectorButton"
+              onClick={() => {
+                setActiveActionItem({ actionTypeId: actionItem.actionTypeId, index });
+                setAddModalVisibility(true);
+              }}
+            >
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.alertForm.addConnectorButtonLabel"
+                defaultMessage="Add {actionTypeName} connector"
+                values={{
+                  actionTypeName,
+                }}
+              />
+            </EuiButton>,
+          ]}
+        />
+      </EuiAccordion>
+    );
+  };
+
+  const selectedGroupActions = (
+    <Fragment>
+      {alert.actions.map((actionItem: AlertAction, index: number) => {
+        const actionConnector = connectors.find(field => field.id === actionItem.id);
+        // connectors doesn't exists
+        if (!actionConnector) {
+          return getAddConnectorsForm(actionItem, index);
+        }
+        return getActionTypeForm(actionItem, actionConnector, index);
+      })}
+      <EuiSpacer size="m" />
+      {isAddActionPanelOpen === false ? (
+        <EuiButton
+          iconType="plusInCircle"
+          data-test-subj="addAlertActionButton"
+          onClick={() => setIsAddActionPanelOpen(true)}
+        >
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.alertForm.addActionButtonLabel"
+            defaultMessage="Add action"
+          />
+        </EuiButton>
+      ) : null}
+    </Fragment>
+  );
+
+  const alertTypeDetails = (
+    <Fragment>
+      <EuiFlexGroup alignItems="center" gutterSize="s">
+        <EuiFlexItem>
+          <EuiTitle size="s" data-test-subj="selectedAlertTypeTitle">
+            <h5 id="selectedAlertTypeTitle">
+              <FormattedMessage
+                defaultMessage="Trigger: {alertType}"
+                id="xpack.triggersActionsUI.sections.alertForm.selectedAlertTypeTitle"
+                values={{ alertType: alertTypeModel ? alertTypeModel.name : '' }}
+              />
+            </h5>
+          </EuiTitle>
+        </EuiFlexItem>
+        {canChangeTrigger ? (
+          <EuiFlexItem grow={false}>
+            <EuiLink
+              onClick={() => {
+                setAlertProperty('alertTypeId', null);
+                setAlertTypeModel(null);
+              }}
+            >
+              <FormattedMessage
+                defaultMessage="Change"
+                id="xpack.triggersActionsUI.sections.alertForm.changeAlertTypeLink"
+              />
+            </EuiLink>
+          </EuiFlexItem>
+        ) : null}
+      </EuiFlexGroup>
+      {AlertParamsExpressionComponent ? (
+        <AlertParamsExpressionComponent
+          alertParams={alert.params}
+          errors={errors}
+          setAlertParams={setAlertParams}
+          setAlertProperty={setAlertProperty}
+          alertsContext={alertsContext}
+        />
+      ) : null}
+      <EuiSpacer size="xl" />
+      {selectedGroupActions}
+      {isAddActionPanelOpen ? (
+        <Fragment>
+          <EuiTitle size="s">
+            <h5 id="alertActionTypeTitle">
+              <FormattedMessage
+                defaultMessage="Actions: Select an action type"
+                id="xpack.triggersActionsUI.sections.alertForm.selectAlertActionTypeTitle"
+              />
+            </h5>
+          </EuiTitle>
+          <EuiSpacer />
+          <EuiFlexGroup gutterSize="s" wrap>
+            {isLoadingActionTypes ? (
+              <SectionLoading>
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.alertForm.loadingActionTypesDescription"
+                  defaultMessage="Loading action types…"
+                />
+              </SectionLoading>
+            ) : (
+              actionTypeNodes
+            )}
+          </EuiFlexGroup>
+        </Fragment>
+      ) : null}
+    </Fragment>
+  );
+
+  const labelForAlertChecked = (
+    <>
+      <FormattedMessage
+        id="xpack.triggersActionsUI.sections.alertForm.checkFieldLabel"
+        defaultMessage="Check every"
+      />{' '}
+      <EuiIconTip
+        position="right"
+        type="questionInCircle"
+        content={i18n.translate('xpack.triggersActionsUI.sections.alertForm.checkWithTooltip', {
+          defaultMessage: 'This is some help text here for check alert.',
+        })}
+      />
+    </>
+  );
+
+  const labelForAlertRenotify = (
+    <>
+      <FormattedMessage
+        id="xpack.triggersActionsUI.sections.alertForm.renotifyFieldLabel"
+        defaultMessage="Re-notify every"
+      />{' '}
+      <EuiIconTip
+        position="right"
+        type="questionInCircle"
+        content={i18n.translate('xpack.triggersActionsUI.sections.alertForm.renotifyWithTooltip', {
+          defaultMessage: 'This is some help text here for re-notify alert.',
+        })}
+      />
+    </>
+  );
+
+  return (
+    <EuiForm isInvalid={serverError !== null} error={serverError?.body.message}>
+      <EuiFlexGrid columns={2}>
+        <EuiFlexItem>
+          <EuiFormRow
+            fullWidth
+            id="alertName"
+            label={
+              <FormattedMessage
+                id="xpack.triggersActionsUI.sections.alertForm.alertNameLabel"
+                defaultMessage="Name"
+              />
+            }
+            isInvalid={errors.name.length > 0 && alert.name !== undefined}
+            error={errors.name}
+          >
+            <EuiFieldText
+              fullWidth
+              isInvalid={errors.name.length > 0 && alert.name !== undefined}
+              compressed
+              name="name"
+              data-test-subj="alertNameInput"
+              value={alert.name || ''}
+              onChange={e => {
+                setAlertProperty('name', e.target.value);
+              }}
+              onBlur={() => {
+                if (!alert.name) {
+                  setAlertProperty('name', '');
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiFormRow
+            fullWidth
+            label={i18n.translate(
+              'xpack.triggersActionsUI.sections.actionAdd.indexAction.indexTextFieldLabel',
+              {
+                defaultMessage: 'Tags (optional)',
+              }
+            )}
+          >
+            <EuiComboBox
+              noSuggestions
+              fullWidth
+              compressed
+              data-test-subj="tagsComboBox"
+              selectedOptions={tagsOptions}
+              onCreateOption={(searchValue: string) => {
+                const newOptions = [...tagsOptions, { label: searchValue }];
+                setAlertProperty(
+                  'tags',
+                  newOptions.map(newOption => newOption.label)
+                );
+              }}
+              onChange={(selectedOptions: Array<{ label: string }>) => {
+                setAlertProperty(
+                  'tags',
+                  selectedOptions.map(selectedOption => selectedOption.label)
+                );
+              }}
+              onBlur={() => {
+                if (!alert.tags) {
+                  setAlertProperty('tags', []);
+                }
+              }}
+            />
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGrid>
+      <EuiSpacer size="m" />
+      <EuiFlexGrid columns={2}>
+        <EuiFlexItem>
+          <EuiFormRow fullWidth compressed label={labelForAlertChecked}>
+            <EuiFlexGroup gutterSize="s">
+              <EuiFlexItem>
+                <EuiFieldNumber
+                  fullWidth
+                  min={1}
+                  compressed
+                  value={alertInterval || 1}
+                  name="interval"
+                  data-test-subj="intervalInput"
+                  onChange={e => {
+                    const interval = e.target.value !== '' ? parseInt(e.target.value, 10) : null;
+                    setAlertInterval(interval);
+                    setScheduleProperty('interval', `${e.target.value}${alertIntervalUnit}`);
+                  }}
+                />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiSelect
+                  fullWidth
+                  compressed
+                  value={alertIntervalUnit}
+                  options={getTimeOptions(alertInterval ?? 1)}
+                  onChange={e => {
+                    setAlertIntervalUnit(e.target.value);
+                    setScheduleProperty('interval', `${alertInterval}${e.target.value}`);
+                  }}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFormRow>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiFormRow fullWidth label={labelForAlertRenotify}>
+            <EuiFlexGroup gutterSize="s">
+              <EuiFlexItem>
+                <EuiFieldNumber
+                  fullWidth
+                  min={1}
+                  compressed
+                  value={alertThrottle || ''}
+                  name="throttle"
+                  data-test-subj="throttleInput"
+                  onChange={e => {
+                    const throttle = e.target.value !== '' ? parseInt(e.target.value, 10) : null;
+                    setAlertThrottle(throttle);
+                    setAlertProperty('throttle', `${e.target.value}${alertThrottleUnit}`);
+                  }}
+                />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiSelect
+                  compressed
+                  value={alertThrottleUnit}
+                  options={getTimeOptions(alertThrottle ?? 1)}
+                  onChange={e => {
+                    setAlertThrottleUnit(e.target.value);
+                    setAlertProperty('throttle', `${alertThrottle}${e.target.value}`);
+                  }}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFormRow>
+        </EuiFlexItem>
+      </EuiFlexGrid>
+      <EuiSpacer size="m" />
+      {alertTypeModel ? (
+        <Fragment>{alertTypeDetails}</Fragment>
+      ) : (
+        <Fragment>
+          <EuiTitle size="s">
+            <h5 id="alertTypeTitle">
+              <FormattedMessage
+                defaultMessage="Trigger: Select a trigger type"
+                id="xpack.triggersActionsUI.sections.alertForm.selectAlertTypeTitle"
+              />
+            </h5>
+          </EuiTitle>
+          <EuiSpacer />
+          <EuiFlexGroup gutterSize="s" wrap>
+            {alertTypeNodes}
+          </EuiFlexGroup>
+        </Fragment>
+      )}
+      {actionTypesIndex && activeActionItem ? (
+        <ConnectorAddModal
+          key={activeActionItem.index}
+          actionType={actionTypesIndex[activeActionItem.actionTypeId]}
+          addModalVisible={addModalVisible}
+          setAddModalVisibility={setAddModalVisibility}
+          postSaveEventHandler={(savedAction: ActionConnector) => {
+            connectors.push(savedAction);
+            setActionProperty('id', savedAction.id, activeActionItem.index);
+          }}
+          actionTypeRegistry={actionTypeRegistry}
+          alertTypeRegistry={alertTypeRegistry}
+          http={http}
+          toastNotifications={toastNotifications}
+        />
+      ) : null}
+    </EuiForm>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.test.ts
new file mode 100644
index 0000000000000..bd320de144024
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.test.ts
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { alertReducer } from './alert_reducer';
+import { Alert } from '../../../types';
+
+describe('alert reducer', () => {
+  let initialAlert: Alert;
+  beforeAll(() => {
+    initialAlert = ({
+      params: {},
+      consumer: 'alerting',
+      alertTypeId: null,
+      schedule: {
+        interval: '1m',
+      },
+      actions: [],
+      tags: [],
+    } as unknown) as Alert;
+  });
+
+  // setAlert
+  test('if modified alert was reset to initial', () => {
+    const alert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setProperty' },
+        payload: {
+          key: 'name',
+          value: 'new name',
+        },
+      }
+    );
+    expect(alert.alert.name).toBe('new name');
+
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setAlert' },
+        payload: {
+          key: 'alert',
+          value: initialAlert,
+        },
+      }
+    );
+    expect(updatedAlert.alert.name).toBeUndefined();
+  });
+
+  test('if property name was changed', () => {
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setProperty' },
+        payload: {
+          key: 'name',
+          value: 'new name',
+        },
+      }
+    );
+    expect(updatedAlert.alert.name).toBe('new name');
+  });
+
+  test('if initial schedule property was updated', () => {
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setScheduleProperty' },
+        payload: {
+          key: 'interval',
+          value: '10s',
+        },
+      }
+    );
+    expect(updatedAlert.alert.schedule.interval).toBe('10s');
+  });
+
+  test('if alert params property was added and updated', () => {
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setAlertParams' },
+        payload: {
+          key: 'testParam',
+          value: 'new test params property',
+        },
+      }
+    );
+    expect(updatedAlert.alert.params.testParam).toBe('new test params property');
+
+    const updatedAlertParamsProperty = alertReducer(
+      { alert: updatedAlert.alert },
+      {
+        command: { type: 'setAlertParams' },
+        payload: {
+          key: 'testParam',
+          value: 'test params property updated',
+        },
+      }
+    );
+    expect(updatedAlertParamsProperty.alert.params.testParam).toBe('test params property updated');
+  });
+
+  test('if alert action params property was added and updated', () => {
+    initialAlert.actions.push({
+      id: '',
+      actionTypeId: 'testId',
+      group: 'Alert',
+      params: {},
+    });
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setAlertActionParams' },
+        payload: {
+          key: 'testActionParam',
+          value: 'new test action params property',
+          index: 0,
+        },
+      }
+    );
+    expect(updatedAlert.alert.actions[0].params.testActionParam).toBe(
+      'new test action params property'
+    );
+
+    const updatedAlertActionParamsProperty = alertReducer(
+      { alert: updatedAlert.alert },
+      {
+        command: { type: 'setAlertActionParams' },
+        payload: {
+          key: 'testActionParam',
+          value: 'test action params property updated',
+          index: 0,
+        },
+      }
+    );
+    expect(updatedAlertActionParamsProperty.alert.actions[0].params.testActionParam).toBe(
+      'test action params property updated'
+    );
+  });
+
+  test('if alert action property was updated', () => {
+    initialAlert.actions.push({
+      id: '',
+      actionTypeId: 'testId',
+      group: 'Alert',
+      params: {},
+    });
+    const updatedAlert = alertReducer(
+      { alert: initialAlert },
+      {
+        command: { type: 'setAlertActionProperty' },
+        payload: {
+          key: 'group',
+          value: 'Warning',
+          index: 0,
+        },
+      }
+    );
+    expect(updatedAlert.alert.actions[0].group).toBe('Warning');
+  });
+});
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_reducer.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.ts
similarity index 87%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_reducer.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.ts
index 9c2260f0178be..2e56f4b026b4a 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/alert_reducer.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/alert_reducer.ts
@@ -9,6 +9,7 @@ interface CommandType {
   type:
     | 'setAlert'
     | 'setProperty'
+    | 'setScheduleProperty'
     | 'setAlertParams'
     | 'setAlertActionParams'
     | 'setAlertActionProperty';
@@ -57,6 +58,23 @@ export const alertReducer = (state: any, action: AlertReducerAction) => {
         };
       }
     }
+    case 'setScheduleProperty': {
+      const { key, value } = payload;
+      if (isEqual(alert.schedule[key], value)) {
+        return state;
+      } else {
+        return {
+          ...state,
+          alert: {
+            ...alert,
+            schedule: {
+              ...alert.schedule,
+              [key]: value,
+            },
+          },
+        };
+      }
+    }
     case 'setAlertParams': {
       const { key, value } = payload;
       if (isEqual(alert.params[key], value)) {
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_add/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_add/index.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
similarity index 92%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
index 228bceb87cad7..683aca742ac87 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
@@ -43,6 +43,8 @@ describe('alert_details', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     expect(
@@ -61,6 +63,8 @@ describe('alert_details', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     expect(
@@ -86,6 +90,8 @@ describe('alert_details', () => {
       const alertType = {
         id: '.noop',
         name: 'No Op',
+        actionGroups: ['default'],
+        actionVariables: [],
       };
 
       const actionTypes: ActionType[] = [
@@ -133,6 +139,8 @@ describe('alert_details', () => {
       const alertType = {
         id: '.noop',
         name: 'No Op',
+        actionGroups: ['default'],
+        actionVariables: [],
       };
       const actionTypes: ActionType[] = [
         {
@@ -181,6 +189,8 @@ describe('alert_details', () => {
       const alertType = {
         id: '.noop',
         name: 'No Op',
+        actionGroups: ['default'],
+        actionVariables: [],
       };
 
       expect(
@@ -203,6 +213,8 @@ describe('alert_details', () => {
       const alertType = {
         id: '.noop',
         name: 'No Op',
+        actionGroups: ['default'],
+        actionVariables: [],
       };
 
       expect(
@@ -225,6 +237,8 @@ describe('alert_details', () => {
       const alertType = {
         id: '.noop',
         name: 'No Op',
+        actionGroups: ['default'],
+        actionVariables: [],
       };
 
       expect(
@@ -252,6 +266,8 @@ describe('enable button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableButton = shallow(
@@ -275,6 +291,8 @@ describe('enable button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableButton = shallow(
@@ -298,6 +316,8 @@ describe('enable button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const disableAlert = jest.fn();
@@ -330,6 +350,8 @@ describe('enable button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableAlert = jest.fn();
@@ -365,6 +387,8 @@ describe('mute button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableButton = shallow(
@@ -389,6 +413,8 @@ describe('mute button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableButton = shallow(
@@ -413,6 +439,8 @@ describe('mute button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const muteAlert = jest.fn();
@@ -446,6 +474,8 @@ describe('mute button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const unmuteAlert = jest.fn();
@@ -479,6 +509,8 @@ describe('mute button', () => {
     const alertType = {
       id: '.noop',
       name: 'No Op',
+      actionGroups: ['default'],
+      actionVariables: [],
     };
 
     const enableButton = shallow(
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details_route.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details_route.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details_route.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alert_details/components/alert_details_route.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/action_type_filter.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/action_type_filter.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/action_type_filter.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/action_type_filter.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
similarity index 91%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
index f410fff44172f..9bdad54f03352 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
@@ -5,7 +5,7 @@
  */
 import * as React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { coreMock } from '../../../../../../../../../../src/core/public/mocks';
+import { coreMock } from '../../../../../../../../src/core/public/mocks';
 import { ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 import { actionTypeRegistryMock } from '../../../action_type_registry.mock';
@@ -13,6 +13,9 @@ import { alertTypeRegistryMock } from '../../../alert_type_registry.mock';
 import { AlertsList } from './alerts_list';
 import { ValidationResult } from '../../../../types';
 import { AppContextProvider } from '../../../app_context';
+import { chartPluginMock } from '../../../../../../../../src/plugins/charts/public/mocks';
+import { dataPluginMock } from '../../../../../../../../src/plugins/data/public/mocks';
+
 jest.mock('../../../lib/action_connector_api', () => ({
   loadActionTypes: jest.fn(),
   loadAllActions: jest.fn(),
@@ -46,7 +49,6 @@ actionTypeRegistry.list.mockReturnValue([]);
 
 describe('alerts_list component empty', () => {
   let wrapper: ReactWrapper<any>;
-
   beforeEach(async () => {
     const { loadAlerts, loadAlertTypes } = jest.requireMock('../../../lib/alert_api');
     const { loadActionTypes, loadAllActions } = jest.requireMock(
@@ -87,6 +89,8 @@ describe('alerts_list component empty', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: {
         getInjectedVar(name: string) {
@@ -105,9 +109,7 @@ describe('alerts_list component empty', () => {
           'alerting:delete': true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: alertTypeRegistry as any,
     };
@@ -124,14 +126,13 @@ describe('alerts_list component empty', () => {
   });
 
   it('renders empty list', () => {
-    expect(wrapper.find('[data-test-subj="createAlertButton"]').find('EuiButton')).toHaveLength(1);
+    expect(wrapper.find('[data-test-subj="createFirstAlertEmptyPrompt"]').exists()).toBeTruthy();
   });
 
-  test('if click create button should render AlertAdd', () => {
-    wrapper
-      .find('[data-test-subj="createAlertButton"]')
-      .first()
-      .simulate('click');
+  it('renders Create alert button', () => {
+    expect(
+      wrapper.find('[data-test-subj="createFirstAlertButton"]').find('EuiButton')
+    ).toHaveLength(1);
     expect(wrapper.find('AlertAdd')).toHaveLength(1);
   });
 });
@@ -213,6 +214,8 @@ describe('alerts_list component with items', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: {
         getInjectedVar(name: string) {
@@ -231,9 +234,7 @@ describe('alerts_list component with items', () => {
           'alerting:delete': true,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: alertTypeRegistry as any,
     };
@@ -300,6 +301,8 @@ describe('alerts_list component empty with show only capability', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: {
         getInjectedVar(name: string) {
@@ -318,9 +321,7 @@ describe('alerts_list component empty with show only capability', () => {
           'alerting:delete': false,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: {
         get() {
           return null;
@@ -422,6 +423,8 @@ describe('alerts_list with show only capability', () => {
     const deps = {
       chrome,
       docLinks,
+      dataPlugin: dataPluginMock.createStartContract(),
+      charts: chartPluginMock.createStartContract(),
       toastNotifications: mockes.notifications.toasts,
       injectedMetadata: {
         getInjectedVar(name: string) {
@@ -440,9 +443,7 @@ describe('alerts_list with show only capability', () => {
           'alerting:delete': false,
         },
       },
-      legacy: {
-        MANAGEMENT_BREADCRUMB: { set: () => {} } as any,
-      },
+      setBreadcrumbs: jest.fn(),
       actionTypeRegistry: actionTypeRegistry as any,
       alertTypeRegistry: alertTypeRegistry as any,
     };
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
similarity index 63%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
index 32de924f63e80..a89215e6c2964 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/alerts_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import React, { Fragment, useEffect, useState } from 'react';
+import React, { useEffect, useState, Fragment } from 'react';
 import {
   EuiBasicTable,
   EuiButton,
@@ -15,6 +15,7 @@ import {
   EuiFlexItem,
   EuiIcon,
   EuiSpacer,
+  EuiEmptyPrompt,
   EuiLink,
 } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
@@ -48,7 +49,17 @@ interface AlertState {
 
 export const AlertsList: React.FunctionComponent = () => {
   const history = useHistory();
-  const { http, injectedMetadata, toastNotifications, capabilities } = useAppDependencies();
+  const {
+    http,
+    injectedMetadata,
+    toastNotifications,
+    capabilities,
+    alertTypeRegistry,
+    actionTypeRegistry,
+    uiSettings,
+    charts,
+    dataPlugin,
+  } = useAppDependencies();
   const canDelete = hasDeleteAlertsCapability(capabilities);
   const canSave = hasSaveAlertsCapability(capabilities);
   const createAlertUiEnabled = injectedMetadata.getInjectedVar('createAlertUiEnabled');
@@ -245,100 +256,156 @@ export const AlertsList: React.FunctionComponent = () => {
     );
   }
 
-  return (
-    <section data-test-subj="alertsList">
-      <Fragment>
-        <EuiSpacer size="m" />
-        <AlertsContextProvider value={{ alertFlyoutVisible, setAlertFlyoutVisibility }}>
-          <EuiFlexGroup>
-            {selectedIds.length > 0 && canDelete && (
-              <EuiFlexItem grow={false}>
-                <BulkOperationPopover>
-                  <AlertQuickEditButtons
-                    selectedItems={convertAlertsToTableItems(
-                      filterAlertsById(alertsState.data, selectedIds),
-                      alertTypesState.data
-                    )}
-                    onPerformingAction={() => setIsPerformingAction(true)}
-                    onActionPerformed={() => {
-                      loadAlertsData();
-                      setIsPerformingAction(false);
-                    }}
-                  />
-                </BulkOperationPopover>
-              </EuiFlexItem>
-            )}
-            <EuiFlexItem>
-              <EuiFieldText
-                fullWidth
-                data-test-subj="alertSearchField"
-                prepend={<EuiIcon type="search" />}
-                onChange={e => setInputText(e.target.value)}
-                onKeyUp={e => {
-                  if (e.keyCode === ENTER_KEY) {
-                    setSearchText(inputText);
-                  }
-                }}
-                placeholder={i18n.translate(
-                  'xpack.triggersActionsUI.sections.alertsList.searchPlaceholderTitle',
-                  { defaultMessage: 'Search...' }
+  const emptyPrompt = (
+    <EuiEmptyPrompt
+      iconType="watchesApp"
+      data-test-subj="createFirstAlertEmptyPrompt"
+      title={
+        <h2>
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.alertsList.emptyTitle"
+            defaultMessage="Create your first alert"
+          />
+        </h2>
+      }
+      body={
+        <p>
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.alertsList.emptyDesc"
+            defaultMessage="Recieve an alert through email, slack or other connectors when a certain trigger is hit"
+          />
+        </p>
+      }
+      actions={
+        <EuiButton
+          data-test-subj="createFirstAlertButton"
+          key="create-action"
+          fill
+          iconType="plusInCircle"
+          iconSide="left"
+          onClick={() => setAlertFlyoutVisibility(true)}
+        >
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.alertsList.emptyButton"
+            defaultMessage="Create alert"
+          />
+        </EuiButton>
+      }
+    />
+  );
+
+  const table = (
+    <Fragment>
+      <EuiFlexGroup gutterSize="s">
+        {selectedIds.length > 0 && canDelete && (
+          <EuiFlexItem grow={false}>
+            <BulkOperationPopover>
+              <AlertQuickEditButtons
+                selectedItems={convertAlertsToTableItems(
+                  filterAlertsById(alertsState.data, selectedIds),
+                  alertTypesState.data
                 )}
+                onPerformingAction={() => setIsPerformingAction(true)}
+                onActionPerformed={() => {
+                  loadAlertsData();
+                  setIsPerformingAction(false);
+                }}
               />
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiFlexGroup>
-                {toolsRight.map((tool, index: number) => (
-                  <EuiFlexItem key={index} grow={false}>
-                    {tool}
-                  </EuiFlexItem>
-                ))}
-              </EuiFlexGroup>
-            </EuiFlexItem>
+            </BulkOperationPopover>
+          </EuiFlexItem>
+        )}
+        <EuiFlexItem>
+          <EuiFieldText
+            fullWidth
+            data-test-subj="alertSearchField"
+            prepend={<EuiIcon type="search" />}
+            onChange={e => setInputText(e.target.value)}
+            onKeyUp={e => {
+              if (e.keyCode === ENTER_KEY) {
+                setSearchText(inputText);
+              }
+            }}
+            placeholder={i18n.translate(
+              'xpack.triggersActionsUI.sections.alertsList.searchPlaceholderTitle',
+              { defaultMessage: 'Search' }
+            )}
+          />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup gutterSize="s">
+            {toolsRight.map((tool, index: number) => (
+              <EuiFlexItem key={index} grow={false}>
+                {tool}
+              </EuiFlexItem>
+            ))}
           </EuiFlexGroup>
+        </EuiFlexItem>
+      </EuiFlexGroup>
 
-          {/* Large to remain consistent with ActionsList table spacing */}
-          <EuiSpacer size="l" />
+      {/* Large to remain consistent with ActionsList table spacing */}
+      <EuiSpacer size="l" />
 
-          <EuiBasicTable
-            loading={alertsState.isLoading || alertTypesState.isLoading || isPerformingAction}
-            /* Don't display alerts until we have the alert types initialized */
-            items={
-              alertTypesState.isInitialized === false
-                ? []
-                : convertAlertsToTableItems(alertsState.data, alertTypesState.data)
-            }
-            itemId="id"
-            columns={alertsTableColumns}
-            rowProps={() => ({
-              'data-test-subj': 'alert-row',
-            })}
-            cellProps={() => ({
-              'data-test-subj': 'cell',
-            })}
-            data-test-subj="alertsList"
-            pagination={{
-              pageIndex: page.index,
-              pageSize: page.size,
-              /* Don't display alert count until we have the alert types initialized */
-              totalItemCount:
-                alertTypesState.isInitialized === false ? 0 : alertsState.totalItemCount,
-            }}
-            selection={
-              canDelete
-                ? {
-                    onSelectionChange(updatedSelectedItemsList: AlertTableItem[]) {
-                      setSelectedIds(updatedSelectedItemsList.map(item => item.id));
-                    },
-                  }
-                : undefined
-            }
-            onChange={({ page: changedPage }: { page: Pagination }) => {
-              setPage(changedPage);
-            }}
-          />
-          <AlertAdd refreshList={loadAlertsData} />
-        </AlertsContextProvider>
-      </Fragment>
+      <EuiBasicTable
+        loading={alertsState.isLoading || alertTypesState.isLoading || isPerformingAction}
+        /* Don't display alerts until we have the alert types initialized */
+        items={
+          alertTypesState.isInitialized === false
+            ? []
+            : convertAlertsToTableItems(alertsState.data, alertTypesState.data)
+        }
+        itemId="id"
+        columns={alertsTableColumns}
+        rowProps={() => ({
+          'data-test-subj': 'alert-row',
+        })}
+        cellProps={() => ({
+          'data-test-subj': 'cell',
+        })}
+        data-test-subj="alertsList"
+        pagination={{
+          pageIndex: page.index,
+          pageSize: page.size,
+          /* Don't display alert count until we have the alert types initialized */
+          totalItemCount: alertTypesState.isInitialized === false ? 0 : alertsState.totalItemCount,
+        }}
+        selection={
+          canDelete
+            ? {
+                onSelectionChange(updatedSelectedItemsList: AlertTableItem[]) {
+                  setSelectedIds(updatedSelectedItemsList.map(item => item.id));
+                },
+              }
+            : undefined
+        }
+        onChange={({ page: changedPage }: { page: Pagination }) => {
+          setPage(changedPage);
+        }}
+      />
+    </Fragment>
+  );
+
+  return (
+    <section data-test-subj="alertsList">
+      <EuiSpacer size="m" />
+      {convertAlertsToTableItems(alertsState.data, alertTypesState.data).length !== 0 && table}
+      {convertAlertsToTableItems(alertsState.data, alertTypesState.data).length === 0 &&
+        emptyPrompt}
+      <AlertsContextProvider
+        value={{
+          addFlyoutVisible: alertFlyoutVisible,
+          setAddFlyoutVisibility: setAlertFlyoutVisibility,
+          reloadAlerts: loadAlertsData,
+          http,
+          actionTypeRegistry,
+          alertTypeRegistry,
+          toastNotifications,
+          uiSettings,
+          charts,
+          dataFieldsFormats: dataPlugin.fieldFormats,
+        }}
+      >
+        <AlertAdd consumer={'alerting'} />
+      </AlertsContextProvider>
     </section>
   );
 };
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/collapsed_item_actions.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/type_filter.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/type_filter.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/alerts_list/components/type_filter.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/type_filter.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/alert_quick_edit_buttons.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/alert_quick_edit_buttons.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/bulk_operation_popover.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/bulk_operation_popover.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_actions_api_operations.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.test.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_actions_api_operations.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.test.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_actions_api_operations.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_actions_api_operations.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_bulk_alert_api_operations.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_bulk_alert_api_operations.test.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_bulk_alert_api_operations.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_bulk_alert_api_operations.test.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_bulk_alert_api_operations.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_bulk_alert_api_operations.tsx
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/sections/common/components/with_bulk_alert_api_operations.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_bulk_alert_api_operations.tsx
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/type_registry.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/type_registry.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/type_registry.test.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/type_registry.test.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/type_registry.ts b/x-pack/plugins/triggers_actions_ui/public/application/type_registry.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/type_registry.ts
rename to x-pack/plugins/triggers_actions_ui/public/application/type_registry.ts
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/constants/aggregation_types.ts b/x-pack/plugins/triggers_actions_ui/public/common/constants/aggregation_types.ts
new file mode 100644
index 0000000000000..fb0fde1b9d9a5
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/constants/aggregation_types.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AggregationType } from '../types';
+
+export enum AGGREGATION_TYPES {
+  COUNT = 'count',
+  AVERAGE = 'avg',
+  SUM = 'sum',
+  MIN = 'min',
+  MAX = 'max',
+}
+
+export const builtInAggregationTypes: { [key: string]: AggregationType } = {
+  count: {
+    text: 'count()',
+    fieldRequired: false,
+    value: AGGREGATION_TYPES.COUNT,
+    validNormalizedTypes: [],
+  },
+  avg: {
+    text: 'average()',
+    fieldRequired: true,
+    validNormalizedTypes: ['number'],
+    value: AGGREGATION_TYPES.AVERAGE,
+  },
+  sum: {
+    text: 'sum()',
+    fieldRequired: true,
+    validNormalizedTypes: ['number'],
+    value: AGGREGATION_TYPES.SUM,
+  },
+  min: {
+    text: 'min()',
+    fieldRequired: true,
+    validNormalizedTypes: ['number', 'date'],
+    value: AGGREGATION_TYPES.MIN,
+  },
+  max: {
+    text: 'max()',
+    fieldRequired: true,
+    validNormalizedTypes: ['number', 'date'],
+    value: AGGREGATION_TYPES.MAX,
+  },
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/constants/comparators.ts b/x-pack/plugins/triggers_actions_ui/public/common/constants/comparators.ts
new file mode 100644
index 0000000000000..50c9dd0019e8b
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/constants/comparators.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { Comparator } from '../types';
+
+export enum COMPARATORS {
+  GREATER_THAN = '>',
+  GREATER_THAN_OR_EQUALS = '>=',
+  BETWEEN = 'between',
+  LESS_THAN = '<',
+  LESS_THAN_OR_EQUALS = '<=',
+}
+
+export const builtInComparators: { [key: string]: Comparator } = {
+  [COMPARATORS.GREATER_THAN]: {
+    text: i18n.translate('xpack.triggersActionsUI.common.constants.comparators.isAboveLabel', {
+      defaultMessage: 'Is above',
+    }),
+    value: COMPARATORS.GREATER_THAN,
+    requiredValues: 1,
+  },
+  [COMPARATORS.GREATER_THAN_OR_EQUALS]: {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.constants.comparators.isAboveOrEqualsLabel',
+      {
+        defaultMessage: 'Is above or equals',
+      }
+    ),
+    value: COMPARATORS.GREATER_THAN_OR_EQUALS,
+    requiredValues: 1,
+  },
+  [COMPARATORS.LESS_THAN]: {
+    text: i18n.translate('xpack.triggersActionsUI.common.constants.comparators.isBelowLabel', {
+      defaultMessage: 'Is below',
+    }),
+    value: COMPARATORS.LESS_THAN,
+    requiredValues: 1,
+  },
+  [COMPARATORS.LESS_THAN_OR_EQUALS]: {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.constants.comparators.isBelowOrEqualsLabel',
+      {
+        defaultMessage: 'Is below or equals',
+      }
+    ),
+    value: COMPARATORS.LESS_THAN_OR_EQUALS,
+    requiredValues: 1,
+  },
+  [COMPARATORS.BETWEEN]: {
+    text: i18n.translate('xpack.triggersActionsUI.common.constants.comparators.isBetweenLabel', {
+      defaultMessage: 'Is between',
+    }),
+    value: COMPARATORS.BETWEEN,
+    requiredValues: 2,
+  },
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/constants/group_by_types.ts b/x-pack/plugins/triggers_actions_ui/public/common/constants/group_by_types.ts
new file mode 100644
index 0000000000000..41964de0fd942
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/constants/group_by_types.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+import { GroupByType } from '../types';
+
+export const builtInGroupByTypes: { [key: string]: GroupByType } = {
+  all: {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.constants.comparators.groupByTypes.allDocumentsLabel',
+      {
+        defaultMessage: 'all documents',
+      }
+    ),
+    sizeRequired: false,
+    value: 'all',
+    validNormalizedTypes: [],
+  },
+  top: {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.constants.comparators.groupByTypes.topLabel',
+      {
+        defaultMessage: 'top',
+      }
+    ),
+    sizeRequired: true,
+    value: 'top',
+    validNormalizedTypes: ['number', 'date', 'keyword'],
+  },
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/common/constants/index.ts
new file mode 100644
index 0000000000000..816dc894ab9ec
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/constants/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { COMPARATORS, builtInComparators } from './comparators';
+export { AGGREGATION_TYPES, builtInAggregationTypes } from './aggregation_types';
+export { builtInGroupByTypes } from './group_by_types';
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.test.tsx
new file mode 100644
index 0000000000000..6ae3056001c8f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.test.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { shallow } from 'enzyme';
+import { EuiPopoverTitle } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { ForLastExpression } from './for_the_last';
+
+describe('for the last expression', () => {
+  it('renders with defined options', () => {
+    const onChangeWindowSize = jest.fn();
+    const onChangeWindowUnit = jest.fn();
+    const wrapper = shallow(
+      <ForLastExpression
+        errors={{ timeWindowSize: [] }}
+        timeWindowSize={5}
+        timeWindowUnit={'m'}
+        onChangeWindowSize={onChangeWindowSize}
+        onChangeWindowUnit={onChangeWindowUnit}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="timeWindowSizeNumber"]').length > 0).toBeTruthy();
+  });
+
+  it('renders with default timeWindowSize and timeWindowUnit', () => {
+    const onChangeWindowSize = jest.fn();
+    const onChangeWindowUnit = jest.fn();
+    const wrapper = shallow(
+      <ForLastExpression
+        errors={{ timeWindowSize: [] }}
+        onChangeWindowSize={onChangeWindowSize}
+        onChangeWindowUnit={onChangeWindowUnit}
+      />
+    );
+    wrapper.simulate('click');
+    expect(wrapper.find('[value=1]').length > 0).toBeTruthy();
+    expect(wrapper.find('[value="s"]').length > 0).toBeTruthy();
+    expect(
+      wrapper.contains(
+        <EuiPopoverTitle>
+          <FormattedMessage
+            id="xpack.triggersActionsUI.common.expressionItems.forTheLast.popoverTitle"
+            defaultMessage="For the last"
+          />
+        </EuiPopoverTitle>
+      )
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.tsx
new file mode 100644
index 0000000000000..844551de3171d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/for_the_last.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiExpression,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiSelect,
+  EuiFlexGroup,
+  EuiFormRow,
+  EuiFlexItem,
+  EuiFieldNumber,
+} from '@elastic/eui';
+import { getTimeUnitLabel } from '../lib/get_time_unit_label';
+import { TIME_UNITS } from '../../application/constants';
+import { getTimeOptions } from '../lib/get_time_options';
+
+interface ForLastExpressionProps {
+  timeWindowSize?: number;
+  timeWindowUnit?: string;
+  errors: { [key: string]: string[] };
+  onChangeWindowSize: (selectedWindowSize: number | '') => void;
+  onChangeWindowUnit: (selectedWindowUnit: string) => void;
+  popupPosition?:
+    | 'upCenter'
+    | 'upLeft'
+    | 'upRight'
+    | 'downCenter'
+    | 'downLeft'
+    | 'downRight'
+    | 'leftCenter'
+    | 'leftUp'
+    | 'leftDown'
+    | 'rightCenter'
+    | 'rightUp'
+    | 'rightDown';
+}
+
+export const ForLastExpression = ({
+  timeWindowSize = 1,
+  timeWindowUnit = 's',
+  errors,
+  onChangeWindowSize,
+  onChangeWindowUnit,
+  popupPosition,
+}: ForLastExpressionProps) => {
+  const [alertDurationPopoverOpen, setAlertDurationPopoverOpen] = useState(false);
+
+  return (
+    <EuiPopover
+      button={
+        <EuiExpression
+          description={i18n.translate(
+            'xpack.triggersActionsUI.common.expressionItems.forTheLast.descriptionLabel',
+            {
+              defaultMessage: 'for the last',
+            }
+          )}
+          value={`${timeWindowSize} ${getTimeUnitLabel(
+            timeWindowUnit as TIME_UNITS,
+            timeWindowSize.toString()
+          )}`}
+          isActive={alertDurationPopoverOpen}
+          onClick={() => {
+            setAlertDurationPopoverOpen(true);
+          }}
+          color={timeWindowSize ? 'secondary' : 'danger'}
+        />
+      }
+      isOpen={alertDurationPopoverOpen}
+      closePopover={() => {
+        setAlertDurationPopoverOpen(false);
+      }}
+      ownFocus
+      withTitle
+      anchorPosition={popupPosition ?? 'downLeft'}
+    >
+      <div>
+        <EuiPopoverTitle>
+          <FormattedMessage
+            id="xpack.triggersActionsUI.common.expressionItems.forTheLast.popoverTitle"
+            defaultMessage="For the last"
+          />
+        </EuiPopoverTitle>
+        <EuiFlexGroup>
+          <EuiFlexItem grow={false}>
+            <EuiFormRow
+              isInvalid={errors.timeWindowSize.length > 0 && timeWindowSize !== undefined}
+              error={errors.timeWindowSize}
+            >
+              <EuiFieldNumber
+                data-test-subj="timeWindowSizeNumber"
+                isInvalid={errors.timeWindowSize.length > 0 && timeWindowSize !== undefined}
+                min={1}
+                value={timeWindowSize}
+                onChange={e => {
+                  const { value } = e.target;
+                  const timeWindowSizeVal = value !== '' ? parseInt(value, 10) : value;
+                  onChangeWindowSize(timeWindowSizeVal);
+                }}
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiSelect
+              data-test-subj="timeWindowUnitSelect"
+              value={timeWindowUnit}
+              onChange={e => {
+                onChangeWindowUnit(e.target.value);
+              }}
+              options={getTimeOptions(timeWindowSize)}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx
new file mode 100644
index 0000000000000..39cca005d5176
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.test.tsx
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { shallow } from 'enzyme';
+import { EuiPopoverTitle } from '@elastic/eui';
+import { GroupByExpression } from './group_by_over';
+
+describe('group by expression', () => {
+  it('renders with builtin group by types', () => {
+    const onChangeSelectedTermField = jest.fn();
+    const onChangeSelectedGroupBy = jest.fn();
+    const onChangeSelectedTermSize = jest.fn();
+    const wrapper = shallow(
+      <GroupByExpression
+        errors={{ termSize: [], termField: [] }}
+        fields={[{}]}
+        groupBy={'all'}
+        onChangeSelectedGroupBy={onChangeSelectedGroupBy}
+        onChangeSelectedTermField={onChangeSelectedTermField}
+        onChangeSelectedTermSize={onChangeSelectedTermSize}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="overExpressionSelect"]')).toMatchInlineSnapshot(`
+      <EuiSelect
+        data-test-subj="overExpressionSelect"
+        onChange={[Function]}
+        options={
+          Array [
+            Object {
+              "text": "all documents",
+              "value": "all",
+            },
+            Object {
+              "text": "top",
+              "value": "top",
+            },
+          ]
+        }
+        value="all"
+      />
+    `);
+  });
+
+  it('renders with aggregation type fields', () => {
+    const onChangeSelectedTermField = jest.fn();
+    const onChangeSelectedGroupBy = jest.fn();
+    const onChangeSelectedTermSize = jest.fn();
+    const wrapper = shallow(
+      <GroupByExpression
+        errors={{ termSize: [], termField: [] }}
+        fields={[{ normalizedType: 'number', name: 'test', text: 'test text' }]}
+        groupBy={'top'}
+        onChangeSelectedGroupBy={onChangeSelectedGroupBy}
+        onChangeSelectedTermField={onChangeSelectedTermField}
+        onChangeSelectedTermSize={onChangeSelectedTermSize}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="fieldsExpressionSelect"]')).toMatchInlineSnapshot(`
+        <EuiSelect
+          data-test-subj="fieldsExpressionSelect"
+          isInvalid={false}
+          onBlur={[Function]}
+          onChange={[Function]}
+          options={
+            Array [
+              Object {
+                "text": "Select a field",
+                "value": "",
+              },
+              Object {
+                "text": "test",
+                "value": "test",
+              },
+            ]
+          }
+        />
+    `);
+  });
+
+  it('renders with default aggreagation type preselected if no aggType was set', () => {
+    const onChangeSelectedTermField = jest.fn();
+    const onChangeSelectedGroupBy = jest.fn();
+    const onChangeSelectedTermSize = jest.fn();
+    const wrapper = shallow(
+      <GroupByExpression
+        errors={{ termSize: [], termField: [] }}
+        fields={[{}]}
+        groupBy={'all'}
+        onChangeSelectedGroupBy={onChangeSelectedGroupBy}
+        onChangeSelectedTermField={onChangeSelectedTermField}
+        onChangeSelectedTermSize={onChangeSelectedTermSize}
+      />
+    );
+    wrapper.simulate('click');
+    expect(wrapper.find('[value="all"]').length > 0).toBeTruthy();
+    expect(wrapper.contains(<EuiPopoverTitle>over</EuiPopoverTitle>)).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx
new file mode 100644
index 0000000000000..01e454187d398
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/group_by_over.tsx
@@ -0,0 +1,205 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, Fragment } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiExpression,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiSelect,
+  EuiFieldNumber,
+} from '@elastic/eui';
+import { builtInGroupByTypes } from '../constants';
+import { GroupByType } from '../types';
+
+interface GroupByExpressionProps {
+  groupBy: string;
+  errors: { [key: string]: string[] };
+  onChangeSelectedTermSize: (selectedTermSize?: number) => void;
+  onChangeSelectedTermField: (selectedTermField?: string) => void;
+  onChangeSelectedGroupBy: (selectedGroupBy?: string) => void;
+  fields: Record<string, any>;
+  termSize?: number;
+  termField?: string;
+  customGroupByTypes?: {
+    [key: string]: GroupByType;
+  };
+  popupPosition?:
+    | 'upCenter'
+    | 'upLeft'
+    | 'upRight'
+    | 'downCenter'
+    | 'downLeft'
+    | 'downRight'
+    | 'leftCenter'
+    | 'leftUp'
+    | 'leftDown'
+    | 'rightCenter'
+    | 'rightUp'
+    | 'rightDown';
+}
+
+export const GroupByExpression = ({
+  groupBy,
+  errors,
+  onChangeSelectedTermSize,
+  onChangeSelectedTermField,
+  onChangeSelectedGroupBy,
+  fields,
+  termSize,
+  termField,
+  customGroupByTypes,
+  popupPosition,
+}: GroupByExpressionProps) => {
+  const groupByTypes = customGroupByTypes ?? builtInGroupByTypes;
+  const [groupByPopoverOpen, setGroupByPopoverOpen] = useState(false);
+  const MIN_TERM_SIZE = 1;
+  const firstFieldOption = {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.expressionItems.groupByType.timeFieldOptionLabel',
+      {
+        defaultMessage: 'Select a field',
+      }
+    ),
+    value: '',
+  };
+
+  return (
+    <EuiPopover
+      button={
+        <EuiExpression
+          description={`${
+            groupByTypes[groupBy].sizeRequired
+              ? i18n.translate(
+                  'xpack.triggersActionsUI.common.expressionItems.groupByType.groupedOverLabel',
+                  {
+                    defaultMessage: 'grouped over',
+                  }
+                )
+              : i18n.translate(
+                  'xpack.triggersActionsUI.common.expressionItems.groupByType.overLabel',
+                  {
+                    defaultMessage: 'over',
+                  }
+                )
+          }`}
+          value={`${groupByTypes[groupBy].text} ${
+            groupByTypes[groupBy].sizeRequired
+              ? `${termSize} ${termField ? `'${termField}'` : ''}`
+              : ''
+          }`}
+          isActive={groupByPopoverOpen || (groupBy === 'top' && !(termSize && termField))}
+          onClick={() => {
+            setGroupByPopoverOpen(true);
+          }}
+          color={groupBy === 'all' || (termSize && termField) ? 'secondary' : 'danger'}
+        />
+      }
+      isOpen={groupByPopoverOpen}
+      closePopover={() => {
+        setGroupByPopoverOpen(false);
+      }}
+      ownFocus
+      withTitle
+      anchorPosition={popupPosition ?? 'downRight'}
+    >
+      <div>
+        <EuiPopoverTitle>
+          {i18n.translate(
+            'xpack.triggersActionsUI.common.expressionItems.groupByType.overButtonLabel',
+            {
+              defaultMessage: 'over',
+            }
+          )}
+        </EuiPopoverTitle>
+        <EuiFlexGroup justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiSelect
+              data-test-subj="overExpressionSelect"
+              value={groupBy}
+              onChange={e => {
+                if (groupByTypes[e.target.value].sizeRequired) {
+                  onChangeSelectedTermSize(MIN_TERM_SIZE);
+                  onChangeSelectedTermField('');
+                } else {
+                  onChangeSelectedTermSize(undefined);
+                  onChangeSelectedTermField(undefined);
+                }
+                onChangeSelectedGroupBy(e.target.value);
+              }}
+              options={Object.values(groupByTypes).map(({ text, value }) => {
+                return {
+                  text,
+                  value,
+                };
+              })}
+            />
+          </EuiFlexItem>
+
+          {groupByTypes[groupBy].sizeRequired ? (
+            <Fragment>
+              <EuiFlexItem grow={false}>
+                <EuiFormRow
+                  isInvalid={errors.termSize.length > 0 && termSize !== undefined}
+                  error={errors.termSize}
+                >
+                  <EuiFieldNumber
+                    isInvalid={errors.termSize.length > 0 && termSize !== undefined}
+                    value={termSize}
+                    onChange={e => {
+                      const { value } = e.target;
+                      const termSizeVal = value !== '' ? parseFloat(value) : MIN_TERM_SIZE;
+                      onChangeSelectedTermSize(termSizeVal);
+                    }}
+                    min={MIN_TERM_SIZE}
+                  />
+                </EuiFormRow>
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <EuiFormRow
+                  isInvalid={errors.termField.length > 0 && termField !== undefined}
+                  error={errors.termField}
+                >
+                  <EuiSelect
+                    data-test-subj="fieldsExpressionSelect"
+                    value={termField}
+                    isInvalid={errors.termField.length > 0 && termField !== undefined}
+                    onChange={e => {
+                      onChangeSelectedTermField(e.target.value);
+                    }}
+                    options={fields.reduce(
+                      (options: any, field: { name: string; normalizedType: string }) => {
+                        if (
+                          groupByTypes[groupBy].validNormalizedTypes.includes(field.normalizedType)
+                        ) {
+                          options.push({
+                            text: field.name,
+                            value: field.name,
+                          });
+                        }
+                        return options;
+                      },
+                      [firstFieldOption]
+                    )}
+                    onBlur={() => {
+                      if (termField === undefined) {
+                        onChangeSelectedTermField('');
+                      }
+                    }}
+                  />
+                </EuiFormRow>
+              </EuiFlexItem>
+            </Fragment>
+          ) : null}
+        </EuiFlexGroup>
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/index.ts b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/index.ts
new file mode 100644
index 0000000000000..1dde99c2996cd
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { WhenExpression } from './when';
+export { OfExpression } from './of';
+export { GroupByExpression } from './group_by_over';
+export { ThresholdExpression } from './threshold';
+export { ForLastExpression } from './for_the_last';
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.test.tsx
new file mode 100644
index 0000000000000..2e674f4fb47b1
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.test.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { shallow } from 'enzyme';
+import { EuiPopoverTitle } from '@elastic/eui';
+import { OfExpression } from './of';
+
+describe('of expression', () => {
+  it('renders of builtin aggregation types', () => {
+    const onChangeSelectedAggField = jest.fn();
+    const wrapper = shallow(
+      <OfExpression
+        aggType="count"
+        errors={{ aggField: [] }}
+        fields={[{ normalizedType: 'number', name: 'test', text: 'test text' }]}
+        aggField="test"
+        onChangeSelectedAggField={onChangeSelectedAggField}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="availablefieldsOptionsComboBox"]'))
+      .toMatchInlineSnapshot(`
+      <EuiComboBox
+        compressed={false}
+        data-test-subj="availablefieldsOptionsComboBox"
+        fullWidth={true}
+        isClearable={true}
+        isInvalid={false}
+        noSuggestions={true}
+        onChange={[Function]}
+        options={Array []}
+        placeholder="Select a field"
+        selectedOptions={
+          Array [
+            Object {
+              "label": "test",
+            },
+          ]
+        }
+        singleSelection={
+          Object {
+            "asPlainText": true,
+          }
+        }
+      />
+    `);
+  });
+
+  it('renders with custom aggregation types', () => {
+    const onChangeSelectedAggField = jest.fn();
+    const wrapper = shallow(
+      <OfExpression
+        aggType="test2"
+        errors={{ aggField: [] }}
+        fields={[{ normalizedType: 'number', name: 'test2', text: 'test text' }]}
+        aggField="test"
+        onChangeSelectedAggField={onChangeSelectedAggField}
+        customAggTypesOptions={{
+          test1: {
+            text: 'Test1()',
+            fieldRequired: false,
+            value: 'test1',
+            validNormalizedTypes: [],
+          },
+          test2: {
+            text: 'Test2()',
+            fieldRequired: true,
+            validNormalizedTypes: ['number'],
+            value: 'test2',
+          },
+        }}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="availablefieldsOptionsComboBox"]'))
+      .toMatchInlineSnapshot(`
+    <EuiComboBox
+      compressed={false}
+      data-test-subj="availablefieldsOptionsComboBox"
+      fullWidth={true}
+      isClearable={true}
+      isInvalid={false}
+      noSuggestions={false}
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "label": "test2",
+          },
+        ]
+      }
+      placeholder="Select a field"
+      selectedOptions={
+        Array [
+          Object {
+            "label": "test",
+          },
+        ]
+      }
+      singleSelection={
+        Object {
+          "asPlainText": true,
+        }
+      }
+    />
+    `);
+  });
+
+  it('renders with default aggreagation type preselected if no aggType was set', () => {
+    const onChangeSelectedAggField = jest.fn();
+    const wrapper = shallow(
+      <OfExpression
+        aggType="count"
+        errors={{ aggField: [] }}
+        fields={[{ normalizedType: 'number', name: 'test', text: 'test text' }]}
+        aggField="test"
+        onChangeSelectedAggField={onChangeSelectedAggField}
+      />
+    );
+    wrapper.simulate('click');
+    expect(wrapper.contains(<EuiPopoverTitle>of</EuiPopoverTitle>)).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.tsx
new file mode 100644
index 0000000000000..954e584d52a87
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/of.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiExpression,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiComboBox,
+} from '@elastic/eui';
+import { builtInAggregationTypes } from '../constants';
+import { AggregationType } from '../types';
+
+interface OfExpressionProps {
+  aggType: string;
+  aggField?: string;
+  errors: { [key: string]: string[] };
+  onChangeSelectedAggField: (selectedAggType?: string) => void;
+  fields: Record<string, any>;
+  customAggTypesOptions?: {
+    [key: string]: AggregationType;
+  };
+  popupPosition?:
+    | 'upCenter'
+    | 'upLeft'
+    | 'upRight'
+    | 'downCenter'
+    | 'downLeft'
+    | 'downRight'
+    | 'leftCenter'
+    | 'leftUp'
+    | 'leftDown'
+    | 'rightCenter'
+    | 'rightUp'
+    | 'rightDown';
+}
+
+export const OfExpression = ({
+  aggType,
+  aggField,
+  errors,
+  onChangeSelectedAggField,
+  fields,
+  customAggTypesOptions,
+  popupPosition,
+}: OfExpressionProps) => {
+  const [aggFieldPopoverOpen, setAggFieldPopoverOpen] = useState(false);
+  const firstFieldOption = {
+    text: i18n.translate(
+      'xpack.triggersActionsUI.common.expressionItems.of.selectTimeFieldOptionLabel',
+      {
+        defaultMessage: 'Select a field',
+      }
+    ),
+    value: '',
+  };
+  const aggregationTypes = customAggTypesOptions ?? builtInAggregationTypes;
+
+  const availablefieldsOptions = fields.reduce((esFieldOptions: any[], field: any) => {
+    if (aggregationTypes[aggType].validNormalizedTypes.includes(field.normalizedType)) {
+      esFieldOptions.push({
+        label: field.name,
+      });
+    }
+    return esFieldOptions;
+  }, []);
+
+  return (
+    <EuiPopover
+      id="aggFieldPopover"
+      button={
+        <EuiExpression
+          description={i18n.translate(
+            'xpack.triggersActionsUI.common.expressionItems.of.buttonLabel',
+            {
+              defaultMessage: 'of',
+            }
+          )}
+          value={aggField || firstFieldOption.text}
+          isActive={aggFieldPopoverOpen || !aggField}
+          onClick={() => {
+            setAggFieldPopoverOpen(true);
+          }}
+          color={aggField ? 'secondary' : 'danger'}
+        />
+      }
+      isOpen={aggFieldPopoverOpen}
+      closePopover={() => {
+        setAggFieldPopoverOpen(false);
+      }}
+      withTitle
+      anchorPosition={popupPosition ?? 'downRight'}
+      zIndex={8000}
+    >
+      <div>
+        <EuiPopoverTitle>
+          {i18n.translate('xpack.triggersActionsUI.common.expressionItems.of.popoverTitle', {
+            defaultMessage: 'of',
+          })}
+        </EuiPopoverTitle>
+        <EuiFlexGroup>
+          <EuiFlexItem grow={false} className="watcherThresholdAlertAggFieldContainer">
+            <EuiFormRow
+              fullWidth
+              isInvalid={errors.aggField.length > 0 && aggField !== undefined}
+              error={errors.aggField}
+            >
+              <EuiComboBox
+                fullWidth
+                singleSelection={{ asPlainText: true }}
+                data-test-subj="availablefieldsOptionsComboBox"
+                isInvalid={errors.aggField.length > 0 && aggField !== undefined}
+                placeholder={firstFieldOption.text}
+                options={availablefieldsOptions}
+                noSuggestions={!availablefieldsOptions.length}
+                selectedOptions={aggField ? [{ label: aggField }] : []}
+                onChange={selectedOptions => {
+                  onChangeSelectedAggField(
+                    selectedOptions.length === 1 ? selectedOptions[0].label : undefined
+                  );
+                  setAggFieldPopoverOpen(false);
+                }}
+              />
+            </EuiFormRow>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx
new file mode 100644
index 0000000000000..bd3c7383d4b9c
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.test.tsx
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { shallow } from 'enzyme';
+import { EuiPopoverTitle } from '@elastic/eui';
+import { ThresholdExpression } from './threshold';
+
+describe('threshold expression', () => {
+  it('renders of builtin comparators', () => {
+    const onChangeSelectedThreshold = jest.fn();
+    const onChangeSelectedThresholdComparator = jest.fn();
+    const wrapper = shallow(
+      <ThresholdExpression
+        thresholdComparator={'between'}
+        errors={{ threshold0: [] }}
+        onChangeSelectedThreshold={onChangeSelectedThreshold}
+        onChangeSelectedThresholdComparator={onChangeSelectedThresholdComparator}
+      />
+    );
+    expect(wrapper.find('[data-test-subj="comparatorOptionsComboBox"]')).toMatchInlineSnapshot(`
+    <EuiSelect
+      data-test-subj="comparatorOptionsComboBox"
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "text": "Is above",
+            "value": ">",
+          },
+          Object {
+            "text": "Is above or equals",
+            "value": ">=",
+          },
+          Object {
+            "text": "Is below",
+            "value": "<",
+          },
+          Object {
+            "text": "Is below or equals",
+            "value": "<=",
+          },
+          Object {
+            "text": "Is between",
+            "value": "between",
+          },
+        ]
+      }
+      value="between"
+    />
+    `);
+  });
+
+  it('renders with treshold title', () => {
+    const onChangeSelectedThreshold = jest.fn();
+    const onChangeSelectedThresholdComparator = jest.fn();
+    const wrapper = shallow(
+      <ThresholdExpression
+        thresholdComparator={'between'}
+        errors={{ threshold0: [] }}
+        onChangeSelectedThreshold={onChangeSelectedThreshold}
+        onChangeSelectedThresholdComparator={onChangeSelectedThresholdComparator}
+      />
+    );
+    expect(wrapper.contains(<EuiPopoverTitle>Is between</EuiPopoverTitle>)).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
new file mode 100644
index 0000000000000..ecbf0aee63e2d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/threshold.tsx
@@ -0,0 +1,151 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, Fragment } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiExpression,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiSelect,
+  EuiFieldNumber,
+  EuiText,
+} from '@elastic/eui';
+import { builtInComparators } from '../constants';
+import { Comparator } from '../types';
+
+interface ThresholdExpressionProps {
+  thresholdComparator: string;
+  errors: { [key: string]: string[] };
+  onChangeSelectedThresholdComparator: (selectedThresholdComparator?: string) => void;
+  onChangeSelectedThreshold: (selectedThreshold?: number[]) => void;
+  customComparators?: {
+    [key: string]: Comparator;
+  };
+  threshold?: number[];
+  popupPosition?:
+    | 'upCenter'
+    | 'upLeft'
+    | 'upRight'
+    | 'downCenter'
+    | 'downLeft'
+    | 'downRight'
+    | 'leftCenter'
+    | 'leftUp'
+    | 'leftDown'
+    | 'rightCenter'
+    | 'rightUp'
+    | 'rightDown';
+}
+
+export const ThresholdExpression = ({
+  thresholdComparator,
+  errors,
+  onChangeSelectedThresholdComparator,
+  onChangeSelectedThreshold,
+  customComparators,
+  threshold = [],
+  popupPosition,
+}: ThresholdExpressionProps) => {
+  const comparators = customComparators ?? builtInComparators;
+  const [alertThresholdPopoverOpen, setAlertThresholdPopoverOpen] = useState(false);
+
+  const andThresholdText = i18n.translate(
+    'xpack.triggersActionsUI.common.expressionItems.threshold.andLabel',
+    {
+      defaultMessage: 'AND',
+    }
+  );
+
+  return (
+    <EuiPopover
+      button={
+        <EuiExpression
+          data-test-subj="thresholdPopover"
+          description={comparators[thresholdComparator].text}
+          value={(threshold || [])
+            .slice(0, comparators[thresholdComparator].requiredValues)
+            .join(` ${andThresholdText} `)}
+          isActive={Boolean(
+            alertThresholdPopoverOpen ||
+              (errors.threshold0 && errors.threshold0.length) ||
+              (errors.threshold1 && errors.threshold1.length)
+          )}
+          onClick={() => {
+            setAlertThresholdPopoverOpen(true);
+          }}
+          color={
+            (errors.threshold0 && errors.threshold0.length) ||
+            (errors.threshold1 && errors.threshold1.length)
+              ? 'danger'
+              : 'secondary'
+          }
+        />
+      }
+      isOpen={alertThresholdPopoverOpen}
+      closePopover={() => {
+        setAlertThresholdPopoverOpen(false);
+      }}
+      ownFocus
+      withTitle
+      anchorPosition={popupPosition ?? 'downLeft'}
+    >
+      <div>
+        <EuiPopoverTitle>{comparators[thresholdComparator].text}</EuiPopoverTitle>
+        <EuiFlexGroup>
+          <EuiFlexItem grow={false}>
+            <EuiSelect
+              data-test-subj="comparatorOptionsComboBox"
+              value={thresholdComparator}
+              onChange={e => {
+                onChangeSelectedThresholdComparator(e.target.value);
+              }}
+              options={Object.values(comparators).map(({ text, value }) => {
+                return { text, value };
+              })}
+            />
+          </EuiFlexItem>
+          {Array.from(Array(comparators[thresholdComparator].requiredValues)).map((_notUsed, i) => {
+            return (
+              <Fragment key={`threshold${i}`}>
+                {i > 0 ? (
+                  <EuiFlexItem
+                    grow={false}
+                    className="watcherThresholdWatchInBetweenComparatorText"
+                  >
+                    <EuiText>{andThresholdText}</EuiText>
+                  </EuiFlexItem>
+                ) : null}
+                <EuiFlexItem grow={false}>
+                  <EuiFormRow>
+                    <EuiFieldNumber
+                      data-test-subj="alertThresholdInput"
+                      value={!threshold || threshold[i] === null ? 0 : threshold[i]}
+                      min={0}
+                      step={0.1}
+                      onChange={e => {
+                        const { value } = e.target;
+                        const thresholdVal = value !== '' ? parseFloat(value) : undefined;
+                        const newThreshold = [...threshold];
+                        if (thresholdVal) {
+                          newThreshold[i] = thresholdVal;
+                        }
+                        onChangeSelectedThreshold(newThreshold);
+                      }}
+                    />
+                  </EuiFormRow>
+                </EuiFlexItem>
+              </Fragment>
+            );
+          })}
+        </EuiFlexGroup>
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.test.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.test.tsx
new file mode 100644
index 0000000000000..02b6bf24977c9
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.test.tsx
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as React from 'react';
+import { shallow } from 'enzyme';
+import { EuiPopoverTitle } from '@elastic/eui';
+import { WhenExpression } from './when';
+
+describe('when expression', () => {
+  it('renders with builtin aggregation types', () => {
+    const onChangeSelectedAggType = jest.fn();
+    const wrapper = shallow(
+      <WhenExpression aggType={'count'} onChangeSelectedAggType={onChangeSelectedAggType} />
+    );
+    expect(wrapper.find('[data-test-subj="whenExpressionSelect"]')).toMatchInlineSnapshot(`
+    <EuiSelect
+      data-test-subj="whenExpressionSelect"
+      fullWidth={true}
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "text": "count()",
+            "value": "count",
+          },
+          Object {
+            "text": "average()",
+            "value": "avg",
+          },
+          Object {
+            "text": "sum()",
+            "value": "sum",
+          },
+          Object {
+            "text": "min()",
+            "value": "min",
+          },
+          Object {
+            "text": "max()",
+            "value": "max",
+          },
+        ]
+      }
+      value="count"
+    />
+    `);
+  });
+
+  it('renders with custom aggregation types', () => {
+    const onChangeSelectedAggType = jest.fn();
+    const wrapper = shallow(
+      <WhenExpression
+        aggType={'count'}
+        onChangeSelectedAggType={onChangeSelectedAggType}
+        customAggTypesOptions={{
+          count: {
+            text: 'Test1()',
+            fieldRequired: false,
+            value: 'test1',
+            validNormalizedTypes: [],
+          },
+          avg: {
+            text: 'Test2()',
+            fieldRequired: true,
+            validNormalizedTypes: ['number'],
+            value: 'test2',
+          },
+        }}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="whenExpressionSelect"]')).toMatchInlineSnapshot(`
+    <EuiSelect
+      data-test-subj="whenExpressionSelect"
+      fullWidth={true}
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "text": "Test1()",
+            "value": "test1",
+          },
+          Object {
+            "text": "Test2()",
+            "value": "test2",
+          },
+        ]
+      }
+      value="count"
+    />
+    `);
+  });
+
+  it('renders when popover title', () => {
+    const onChangeSelectedAggType = jest.fn();
+    const wrapper = shallow(
+      <WhenExpression aggType={'avg'} onChangeSelectedAggType={onChangeSelectedAggType} />
+    );
+    wrapper.simulate('click');
+    expect(wrapper.find('[value="avg"]').length > 0).toBeTruthy();
+    expect(wrapper.contains(<EuiPopoverTitle>when</EuiPopoverTitle>)).toBeTruthy();
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.tsx b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.tsx
new file mode 100644
index 0000000000000..b20040608ed9e
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/expression_items/when.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiExpression, EuiPopover, EuiPopoverTitle, EuiSelect } from '@elastic/eui';
+import { builtInAggregationTypes } from '../constants';
+import { AggregationType } from '../types';
+
+interface WhenExpressionProps {
+  aggType: string;
+  customAggTypesOptions?: { [key: string]: AggregationType };
+  onChangeSelectedAggType: (selectedAggType: string) => void;
+  popupPosition?:
+    | 'upCenter'
+    | 'upLeft'
+    | 'upRight'
+    | 'downCenter'
+    | 'downLeft'
+    | 'downRight'
+    | 'leftCenter'
+    | 'leftUp'
+    | 'leftDown'
+    | 'rightCenter'
+    | 'rightUp'
+    | 'rightDown';
+}
+
+export const WhenExpression = ({
+  aggType,
+  customAggTypesOptions,
+  onChangeSelectedAggType,
+  popupPosition,
+}: WhenExpressionProps) => {
+  const [aggTypePopoverOpen, setAggTypePopoverOpen] = useState(false);
+  const aggregationTypes = customAggTypesOptions ?? builtInAggregationTypes;
+  return (
+    <EuiPopover
+      button={
+        <EuiExpression
+          data-test-subj="whenExpression"
+          description={i18n.translate(
+            'xpack.triggersActionsUI.common.expressionItems.threshold.descriptionLabel',
+            {
+              defaultMessage: 'when',
+            }
+          )}
+          value={aggregationTypes[aggType].text}
+          isActive={aggTypePopoverOpen}
+          onClick={() => {
+            setAggTypePopoverOpen(true);
+          }}
+        />
+      }
+      isOpen={aggTypePopoverOpen}
+      closePopover={() => {
+        setAggTypePopoverOpen(false);
+      }}
+      ownFocus
+      withTitle
+      anchorPosition={popupPosition ?? 'downLeft'}
+    >
+      <div>
+        <EuiPopoverTitle>
+          {i18n.translate('xpack.triggersActionsUI.common.expressionItems.threshold.popoverTitle', {
+            defaultMessage: 'when',
+          })}
+        </EuiPopoverTitle>
+        <EuiSelect
+          data-test-subj="whenExpressionSelect"
+          value={aggType}
+          fullWidth
+          onChange={e => {
+            onChangeSelectedAggType(e.target.value);
+            setAggTypePopoverOpen(false);
+          }}
+          options={Object.values(aggregationTypes).map(({ text, value }) => {
+            return {
+              text,
+              value,
+            };
+          })}
+        />
+      </div>
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/index.ts b/x-pack/plugins/triggers_actions_ui/public/common/index.ts
similarity index 75%
rename from x-pack/legacy/plugins/uptime/server/lib/adapters/pings/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/common/index.ts
index 37324a8f521f6..94089a274e79d 100644
--- a/x-pack/legacy/plugins/uptime/server/lib/adapters/pings/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/common/index.ts
@@ -4,5 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './types';
-export { elasticsearchPingsAdapter } from './es_pings';
+export * from './expression_items';
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.test.ts b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.test.ts
new file mode 100644
index 0000000000000..51bacaf922420
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.test.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { getTimeOptions, getTimeFieldOptions } from './get_time_options';
+
+describe('get_time_options', () => {
+  test('if getTimeOptions return single unit time options', () => {
+    const timeUnitValue = getTimeOptions(1);
+    expect(timeUnitValue).toMatchObject([
+      { text: 'second', value: 's' },
+      { text: 'minute', value: 'm' },
+      { text: 'hour', value: 'h' },
+      { text: 'day', value: 'd' },
+    ]);
+  });
+
+  test('if getTimeOptions return multiple unit time options', () => {
+    const timeUnitValue = getTimeOptions(10);
+    expect(timeUnitValue).toMatchObject([
+      { text: 'seconds', value: 's' },
+      { text: 'minutes', value: 'm' },
+      { text: 'hours', value: 'h' },
+      { text: 'days', value: 'd' },
+    ]);
+  });
+
+  test('if getTimeFieldOptions return only date type fields', () => {
+    const timeOnlyTypeFields = getTimeFieldOptions([
+      { type: 'date', name: 'order_date' },
+      { type: 'number', name: 'sum' },
+    ]);
+    expect(timeOnlyTypeFields).toMatchObject([{ text: 'order_date', value: 'order_date' }]);
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.ts b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.ts
new file mode 100644
index 0000000000000..aab29bd6ec5b0
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_options.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getTimeUnitLabel } from './get_time_unit_label';
+import { TIME_UNITS } from '../../application/constants';
+
+export const getTimeOptions = (unitSize: number) =>
+  Object.entries(TIME_UNITS).map(([_key, value]) => {
+    return {
+      text: getTimeUnitLabel(value, unitSize.toString()),
+      value,
+    };
+  });
+
+interface TimeFieldOptions {
+  text: string;
+  value: string;
+}
+
+export const getTimeFieldOptions = (
+  fields: Array<{ type: string; name: string }>
+): TimeFieldOptions[] => {
+  const options: TimeFieldOptions[] = [];
+
+  fields.forEach((field: { type: string; name: string }) => {
+    if (field.type === 'date') {
+      options.push({
+        text: field.name,
+        value: field.name,
+      });
+    }
+  });
+  return options;
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_unit_label.ts b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_unit_label.ts
new file mode 100644
index 0000000000000..08aa111691786
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/common/lib/get_time_unit_label.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { TIME_UNITS } from '../../application/constants';
+
+export function getTimeUnitLabel(timeUnit = TIME_UNITS.SECOND, timeValue = '0') {
+  switch (timeUnit) {
+    case TIME_UNITS.SECOND:
+      return i18n.translate('xpack.triggersActionsUI.timeUnits.secondLabel', {
+        defaultMessage: '{timeValue, plural, one {second} other {seconds}}',
+        values: { timeValue },
+      });
+    case TIME_UNITS.MINUTE:
+      return i18n.translate('xpack.triggersActionsUI.timeUnits.minuteLabel', {
+        defaultMessage: '{timeValue, plural, one {minute} other {minutes}}',
+        values: { timeValue },
+      });
+    case TIME_UNITS.HOUR:
+      return i18n.translate('xpack.triggersActionsUI.timeUnits.hourLabel', {
+        defaultMessage: '{timeValue, plural, one {hour} other {hours}}',
+        values: { timeValue },
+      });
+    case TIME_UNITS.DAY:
+      return i18n.translate('xpack.triggersActionsUI.timeUnits.dayLabel', {
+        defaultMessage: '{timeValue, plural, one {day} other {days}}',
+        values: { timeValue },
+      });
+  }
+}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/types.ts b/x-pack/plugins/triggers_actions_ui/public/common/types.ts
similarity index 100%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/application/components/builtin_alert_types/threshold/types.ts
rename to x-pack/plugins/triggers_actions_ui/public/common/types.ts
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/index.ts b/x-pack/plugins/triggers_actions_ui/public/index.ts
similarity index 77%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/index.ts
rename to x-pack/plugins/triggers_actions_ui/public/index.ts
index 7eed516019dd0..f13ed5983d0d1 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/index.ts
@@ -7,6 +7,9 @@
 import { PluginInitializerContext } from 'src/core/public';
 import { Plugin } from './plugin';
 
+export { AlertsContextProvider } from './application/context/alerts_context';
+export { AlertAdd } from './application/sections/alert_add';
+
 export function plugin(ctx: PluginInitializerContext) {
   return new Plugin(ctx);
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/plugin.ts b/x-pack/plugins/triggers_actions_ui/public/plugin.ts
new file mode 100644
index 0000000000000..459197d80d7aa
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/plugin.ts
@@ -0,0 +1,101 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreStart, PluginInitializerContext, Plugin as CorePlugin } from 'src/core/public';
+
+import { i18n } from '@kbn/i18n';
+import { registerBuiltInActionTypes } from './application/components/builtin_action_types';
+import { registerBuiltInAlertTypes } from './application/components/builtin_alert_types';
+import { hasShowActionsCapability, hasShowAlertsCapability } from './application/lib/capabilities';
+import { ActionTypeModel, AlertTypeModel } from './types';
+import { TypeRegistry } from './application/type_registry';
+import { ManagementStart } from '../../../../src/plugins/management/public';
+import { boot } from './application/boot';
+import { ChartsPluginStart } from '../../../../src/plugins/charts/public';
+import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
+
+export interface TriggersAndActionsUIPublicPluginSetup {
+  actionTypeRegistry: TypeRegistry<ActionTypeModel>;
+  alertTypeRegistry: TypeRegistry<AlertTypeModel>;
+}
+
+export type Start = void;
+
+interface PluginsStart {
+  data: DataPublicPluginStart;
+  charts: ChartsPluginStart;
+  management: ManagementStart;
+}
+
+export class Plugin implements CorePlugin<TriggersAndActionsUIPublicPluginSetup, Start> {
+  private actionTypeRegistry: TypeRegistry<ActionTypeModel>;
+  private alertTypeRegistry: TypeRegistry<AlertTypeModel>;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    const actionTypeRegistry = new TypeRegistry<ActionTypeModel>();
+    this.actionTypeRegistry = actionTypeRegistry;
+
+    const alertTypeRegistry = new TypeRegistry<AlertTypeModel>();
+    this.alertTypeRegistry = alertTypeRegistry;
+  }
+
+  public setup(): TriggersAndActionsUIPublicPluginSetup {
+    registerBuiltInActionTypes({
+      actionTypeRegistry: this.actionTypeRegistry,
+    });
+
+    registerBuiltInAlertTypes({
+      alertTypeRegistry: this.alertTypeRegistry,
+    });
+
+    return {
+      actionTypeRegistry: this.actionTypeRegistry,
+      alertTypeRegistry: this.alertTypeRegistry,
+    };
+  }
+
+  public start(core: CoreStart, plugins: PluginsStart) {
+    const { capabilities } = core.application;
+
+    const canShowActions = hasShowActionsCapability(capabilities);
+    const canShowAlerts = hasShowAlertsCapability(capabilities);
+
+    // Don't register routes when user doesn't have access to the application
+    if (!canShowActions && !canShowAlerts) {
+      return;
+    }
+
+    plugins.management.sections.getSection('kibana')!.registerApp({
+      id: 'triggersActions',
+      title: i18n.translate('xpack.triggersActionsUI.managementSection.displayName', {
+        defaultMessage: 'Alerts and Actions',
+      }),
+      order: 7,
+      mount: params => {
+        boot({
+          dataPlugin: plugins.data,
+          charts: plugins.charts,
+          element: params.element,
+          toastNotifications: core.notifications.toasts,
+          injectedMetadata: core.injectedMetadata,
+          http: core.http,
+          uiSettings: core.uiSettings,
+          docLinks: core.docLinks,
+          chrome: core.chrome,
+          savedObjects: core.savedObjects.client,
+          I18nContext: core.i18n.Context,
+          capabilities: core.application.capabilities,
+          setBreadcrumbs: params.setBreadcrumbs,
+          actionTypeRegistry: this.actionTypeRegistry,
+          alertTypeRegistry: this.alertTypeRegistry,
+        });
+        return () => {};
+      },
+    });
+  }
+
+  public stop() {}
+}
diff --git a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
similarity index 74%
rename from x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/types.ts
rename to x-pack/plugins/triggers_actions_ui/public/types.ts
index 7fb7d0bf48e4d..73ecafb023848 100644
--- a/x-pack/legacy/plugins/triggers_actions_ui/np_ready/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -3,10 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { ActionType } from '../../actions/common';
 import { TypeRegistry } from './application/type_registry';
-import { SanitizedAlert as Alert, AlertAction } from '../../../alerting/common';
-import { ActionType } from '../../../../../plugins/actions/common';
-
+import { SanitizedAlert as Alert, AlertAction } from '../../../legacy/plugins/alerting/common';
 export { Alert, AlertAction };
 export { ActionType };
 
@@ -15,20 +14,20 @@ export type AlertTypeIndex = Record<string, AlertType>;
 export type ActionTypeRegistryContract = PublicMethodsOf<TypeRegistry<ActionTypeModel>>;
 export type AlertTypeRegistryContract = PublicMethodsOf<TypeRegistry<AlertTypeModel>>;
 
-export interface ActionConnectorFieldsProps {
-  action: ActionConnector;
+export interface ActionConnectorFieldsProps<TActionCOnnector> {
+  action: TActionCOnnector;
   editActionConfig: (property: string, value: any) => void;
   editActionSecrets: (property: string, value: any) => void;
   errors: { [key: string]: string[] };
-  hasErrors?: boolean;
 }
 
-export interface ActionParamsProps {
-  action: any;
+export interface ActionParamsProps<TParams> {
+  actionParams: TParams;
   index: number;
   editAction: (property: string, value: any, index: number) => void;
   errors: { [key: string]: string[] };
-  hasErrors?: boolean;
+  messageVariables?: string[];
+  defaultMessage?: string;
 }
 
 export interface Pagination {
@@ -40,10 +39,11 @@ export interface ActionTypeModel {
   id: string;
   iconClass: string;
   selectMessage: string;
-  validateConnector: (action: ActionConnector) => ValidationResult;
+  actionTypeTitle?: string;
+  validateConnector: (connector: any) => ValidationResult;
   validateParams: (actionParams: any) => ValidationResult;
-  actionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps> | null;
-  actionParamsFields: React.FunctionComponent<ActionParamsProps> | null;
+  actionConnectorFields: React.FunctionComponent<any> | null;
+  actionParamsFields: any;
 }
 
 export interface ValidationResult {
@@ -68,6 +68,8 @@ export interface ActionConnectorTableItem extends ActionConnector {
 export interface AlertType {
   id: string;
   name: string;
+  actionGroups: string[];
+  actionVariables: string[];
 }
 
 export type AlertWithoutId = Omit<Alert, 'id'>;
@@ -81,14 +83,11 @@ export interface AlertTypeModel {
   id: string;
   name: string;
   iconClass: string;
-  validate: (alert: Alert) => ValidationResult;
+  validate: (alertParams: any) => ValidationResult;
   alertParamsExpression: React.FunctionComponent<any>;
+  defaultActionMessage?: string;
 }
 
 export interface IErrorObject {
   [key: string]: string[];
 }
-
-export interface LegacyDependencies {
-  MANAGEMENT_BREADCRUMB: { text: string; href?: string };
-}
diff --git a/x-pack/plugins/watcher/public/legacy/time_buckets.js b/x-pack/plugins/watcher/public/legacy/time_buckets.js
index 8b7e4be784fe7..5d5e9e8dcb1a4 100644
--- a/x-pack/plugins/watcher/public/legacy/time_buckets.js
+++ b/x-pack/plugins/watcher/public/legacy/time_buckets.js
@@ -130,7 +130,7 @@ TimeBuckets.prototype.getDuration = function() {
  * generated.
  *
  * Input can be one of the following:
- *  - Any object from src/legacy/ui/agg_types/buckets/_interval_options.js
+ *  - Any object from src/plugins/data/public/search/aggs/buckets/_interval_options.ts
  *  - "auto"
  *  - Pass a valid moment unit
  *  - a moment.duration object.
diff --git a/x-pack/test/api_integration/apis/endpoint/alerts.ts b/x-pack/test/api_integration/apis/endpoint/alerts.ts
new file mode 100644
index 0000000000000..c08d17e96b180
--- /dev/null
+++ b/x-pack/test/api_integration/apis/endpoint/alerts.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect/expect.js';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function({ getService }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertest');
+  describe('test alerts api', () => {
+    describe('Tests for alerts API', () => {
+      before(() => esArchiver.load('endpoint/alerts/api_feature'));
+      after(() => esArchiver.unload('endpoint/alerts/api_feature'));
+      it('alerts api should return one entry for each alert with default paging', async () => {
+        const { body } = await supertest
+          .post('/api/endpoint/alerts')
+          .set('kbn-xsrf', 'xxx')
+          .send({})
+          .expect(200);
+        expect(body.total).to.eql(132);
+        expect(body.alerts.length).to.eql(10);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+        expect(body.result_from_index).to.eql(0);
+      });
+
+      it('alerts api should return page based on paging properties passed.', async () => {
+        const { body } = await supertest
+          .post('/api/endpoint/alerts')
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            page_size: 1,
+            page_index: 1,
+          })
+          .expect(200);
+        expect(body.total).to.eql(132);
+        expect(body.alerts.length).to.eql(1);
+        expect(body.request_page_size).to.eql(1);
+        expect(body.request_page_index).to.eql(1);
+        expect(body.result_from_index).to.eql(1);
+      });
+
+      it('alerts api should return accurate total alerts if page index produces no result', async () => {
+        const { body } = await supertest
+          .get('/api/endpoint/alerts?page_size=100&page_index=3')
+          .set('kbn-xsrf', 'xxx')
+          .expect(200);
+        expect(body.total).to.eql(132);
+        expect(body.alerts.length).to.eql(0);
+        expect(body.request_page_size).to.eql(100);
+        expect(body.request_page_index).to.eql(3);
+        expect(body.result_from_index).to.eql(300);
+      });
+
+      it('alerts api should return 400 when paging properties are below boundaries.', async () => {
+        const { body } = await supertest
+          .get('/api/endpoint/alerts?page_size=0')
+          .set('kbn-xsrf', 'xxx')
+          .expect(400);
+        expect(body.message).to.contain('Value is [0] but it must be equal to or greater than [1]');
+      });
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/endpoint/endpoints.ts b/x-pack/test/api_integration/apis/endpoint/endpoints.ts
index 1c520fe92e38e..210e9d78d7e18 100644
--- a/x-pack/test/api_integration/apis/endpoint/endpoints.ts
+++ b/x-pack/test/api_integration/apis/endpoint/endpoints.ts
@@ -40,7 +40,7 @@ export default function({ getService }: FtrProviderContext) {
         expect(body.request_page_index).to.eql(0);
       });
 
-      it('endpoints api should return page based on params passed.', async () => {
+      it('endpoints api should return page based on paging properties passed.', async () => {
         const { body } = await supertest
           .post('/api/endpoint/endpoints')
           .set('kbn-xsrf', 'xxx')
@@ -102,6 +102,46 @@ export default function({ getService }: FtrProviderContext) {
           .expect(400);
         expect(body.message).to.contain('Value is [0] but it must be equal to or greater than [1]');
       });
+
+      it('endpoints api should return page based on filters passed.', async () => {
+        const { body } = await supertest
+          .post('/api/endpoint/endpoints')
+          .set('kbn-xsrf', 'xxx')
+          .send({ filter: 'not host.ip:10.101.149.26' })
+          .expect(200);
+        expect(body.total).to.eql(2);
+        expect(body.endpoints.length).to.eql(2);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+      });
+
+      it('endpoints api should return page based on filters and paging passed.', async () => {
+        const notIncludedIp = '10.101.149.26';
+        const { body } = await supertest
+          .post('/api/endpoint/endpoints')
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            paging_properties: [
+              {
+                page_size: 10,
+              },
+              {
+                page_index: 0,
+              },
+            ],
+            filter: `not host.ip:${notIncludedIp}`,
+          })
+          .expect(200);
+        expect(body.total).to.eql(2);
+        const resultIps: string[] = [].concat(
+          ...body.endpoints.map((metadata: Record<string, any>) => metadata.host.ip)
+        );
+        expect(resultIps).to.eql(['10.192.213.130', '10.70.28.129', '10.46.229.234']);
+        expect(resultIps).not.include.eql(notIncludedIp);
+        expect(body.endpoints.length).to.eql(2);
+        expect(body.request_page_size).to.eql(10);
+        expect(body.request_page_index).to.eql(0);
+      });
     });
   });
 }
diff --git a/x-pack/test/api_integration/apis/endpoint/index.ts b/x-pack/test/api_integration/apis/endpoint/index.ts
index a3f0e828d7240..238c63640386a 100644
--- a/x-pack/test/api_integration/apis/endpoint/index.ts
+++ b/x-pack/test/api_integration/apis/endpoint/index.ts
@@ -8,7 +8,9 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function endpointAPIIntegrationTests({ loadTestFile }: FtrProviderContext) {
   describe('Endpoint plugin', function() {
+    this.tags(['endpoint']);
     loadTestFile(require.resolve('./resolver'));
     loadTestFile(require.resolve('./endpoints'));
+    loadTestFile(require.resolve('./alerts'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/lens/field_stats.ts b/x-pack/test/api_integration/apis/lens/field_stats.ts
index b2bb791e2da7f..51d81668d275d 100644
--- a/x-pack/test/api_integration/apis/lens/field_stats.ts
+++ b/x-pack/test/api_integration/apis/lens/field_stats.ts
@@ -47,6 +47,24 @@ export default ({ getService }: FtrProviderContext) => {
           .expect(404);
       });
 
+      it('should also work without specifying a time field', async () => {
+        const { body } = await supertest
+          .post('/api/lens/index_stats/logstash-2015.09.22/field')
+          .set(COMMON_HEADERS)
+          .send({
+            dslQuery: { match_all: {} },
+            fromDate: TEST_START_TIME,
+            toDate: TEST_END_TIME,
+            field: {
+              name: 'bytes',
+              type: 'number',
+            },
+          })
+          .expect(200);
+
+        expect(body).to.have.property('totalDocuments', 4633);
+      });
+
       it('should return an auto histogram for numbers and top values', async () => {
         const { body } = await supertest
           .post('/api/lens/index_stats/logstash-2015.09.22/field')
diff --git a/x-pack/test/api_integration/apis/lens/telemetry.ts b/x-pack/test/api_integration/apis/lens/telemetry.ts
index 5e6830c8f4689..653df453c2560 100644
--- a/x-pack/test/api_integration/apis/lens/telemetry.ts
+++ b/x-pack/test/api_integration/apis/lens/telemetry.ts
@@ -6,14 +6,13 @@
 
 import moment from 'moment';
 import expect from '@kbn/expect';
-import { KibanaConfig } from 'src/legacy/server/kbn_server';
 import { Client, SearchParams } from 'elasticsearch';
+import { APICaller } from 'kibana/server';
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
-import { getDailyEvents } from '../../../../legacy/plugins/lens/server/usage/task';
-import { getVisualizationCounts } from '../../../../legacy/plugins/lens/server/usage/visualization_counts';
+import { getDailyEvents } from '../../../../plugins/lens/server/usage/task';
+import { getVisualizationCounts } from '../../../../plugins/lens/server/usage/visualization_counts';
 
 const COMMON_HEADERS = {
   'kbn-xsrf': 'some-xsrf-token',
@@ -23,9 +22,9 @@ const COMMON_HEADERS = {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const es: Client = getService('legacyEs');
-  const callCluster: CallCluster = (((path: 'search', searchParams: SearchParams) => {
+  const callCluster: APICaller = (((path: 'search', searchParams: SearchParams) => {
     return es[path].call(es, searchParams);
-  }) as unknown) as CallCluster;
+  }) as unknown) as APICaller;
 
   async function assertExpectedSavedObjects(num: number) {
     // Make sure that new/deleted docs are available to search
@@ -189,13 +188,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       await esArchiver.loadIfNeeded('lens/basic');
 
-      const results = await getVisualizationCounts(callCluster, {
-        // Fake KibanaConfig service
-        get() {
-          return '.kibana';
-        },
-        has: () => false,
-      } as KibanaConfig);
+      const results = await getVisualizationCounts(callCluster, '.kibana');
 
       expect(results).to.have.keys([
         'saved_overall',
diff --git a/x-pack/test/api_integration/apis/management/cross_cluster_replication/fixtures.js b/x-pack/test/api_integration/apis/management/cross_cluster_replication/fixtures.js
index ede3870af1f2b..de47f5d9ea85e 100644
--- a/x-pack/test/api_integration/apis/management/cross_cluster_replication/fixtures.js
+++ b/x-pack/test/api_integration/apis/management/cross_cluster_replication/fixtures.js
@@ -7,7 +7,8 @@
 import { REMOTE_CLUSTER_NAME } from './constants';
 import { getRandomString } from './lib';
 
-export const getAutoFollowIndexPayload = (remoteCluster = REMOTE_CLUSTER_NAME) => ({
+export const getAutoFollowIndexPayload = (remoteCluster = REMOTE_CLUSTER_NAME, active = true) => ({
+  active,
   remoteCluster,
   leaderIndexPatterns: ['leader-*'],
   followIndexPattern: '{{leader_index}}_follower',
diff --git a/x-pack/test/api_integration/apis/management/index_management/settings.js b/x-pack/test/api_integration/apis/management/index_management/settings.js
index 54cc4f0a06c79..3d66657517d52 100644
--- a/x-pack/test/api_integration/apis/management/index_management/settings.js
+++ b/x-pack/test/api_integration/apis/management/index_management/settings.js
@@ -58,7 +58,6 @@ export default function({ getService }) {
         'max_ngram_diff',
         'translog',
         'auto_expand_replicas',
-        'mapper',
         'requests',
         'data_path',
         'highlight',
diff --git a/x-pack/test/api_integration/apis/security/basic_login.js b/x-pack/test/api_integration/apis/security/basic_login.js
index 62deedad6c35c..d4b41603944f6 100644
--- a/x-pack/test/api_integration/apis/security/basic_login.js
+++ b/x-pack/test/api_integration/apis/security/basic_login.js
@@ -126,6 +126,7 @@ export default function({ getService }) {
         'enabled',
         'authentication_realm',
         'lookup_realm',
+        'authentication_provider',
       ]);
       expect(apiResponse.body.username).to.be(validUsername);
     });
@@ -165,6 +166,7 @@ export default function({ getService }) {
           'enabled',
           'authentication_realm',
           'lookup_realm',
+          'authentication_provider',
         ]);
         expect(apiResponse.body.username).to.be(validUsername);
       });
diff --git a/x-pack/test/functional/apps/rollup_job/index.js b/x-pack/test/functional/apps/rollup_job/index.js
index 146cc4e8dbdf0..055b239058eac 100644
--- a/x-pack/test/functional/apps/rollup_job/index.js
+++ b/x-pack/test/functional/apps/rollup_job/index.js
@@ -10,5 +10,6 @@ export default function({ loadTestFile }) {
 
     loadTestFile(require.resolve('./rollup_jobs'));
     loadTestFile(require.resolve('./hybrid_index_pattern'));
+    loadTestFile(require.resolve('./tsvb'));
   });
 }
diff --git a/x-pack/test/functional/apps/rollup_job/tsvb.js b/x-pack/test/functional/apps/rollup_job/tsvb.js
new file mode 100644
index 0000000000000..f3782c4c91644
--- /dev/null
+++ b/x-pack/test/functional/apps/rollup_job/tsvb.js
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import datemath from '@elastic/datemath';
+import expect from '@kbn/expect';
+import mockRolledUpData from './hybrid_index_helper';
+
+export default function({ getService, getPageObjects }) {
+  const es = getService('legacyEs');
+  const esArchiver = getService('esArchiver');
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects([
+    'common',
+    'settings',
+    'visualize',
+    'visualBuilder',
+    'timePicker',
+  ]);
+
+  describe('tsvb integration', function() {
+    //Since rollups can only be created once with the same name (even if you delete it),
+    //we add the Date.now() to avoid name collision if you run the tests locally back to back.
+    const rollupJobName = `tsvb-test-rollup-job-${Date.now()}`;
+    const rollupSourceIndexName = 'rollup-source-data';
+    const rollupTargetIndexName = `rollup-target-data`;
+    const now = new Date();
+    const pastDates = [
+      datemath.parse('now-1m', { forceNow: now }),
+      datemath.parse('now-2m', { forceNow: now }),
+      datemath.parse('now-3m', { forceNow: now }),
+    ];
+
+    before(async () => {
+      // load visualize to have an index pattern ready, otherwise visualize will redirect
+      await esArchiver.load('visualize/default');
+    });
+
+    it('create rollup tsvb', async () => {
+      //Create data for rollup job so it doesn't fail
+      await es.index({
+        index: rollupSourceIndexName,
+        body: {
+          '@timestamp': new Date().toISOString(),
+        },
+      });
+
+      await retry.try(async () => {
+        //Create a rollup for kibana to recognize
+        await es.transport.request({
+          path: `/_rollup/job/${rollupJobName}`,
+          method: 'PUT',
+          body: {
+            index_pattern: rollupSourceIndexName,
+            rollup_index: rollupTargetIndexName,
+            cron: '*/10 * * * * ?',
+            groups: {
+              date_histogram: {
+                fixed_interval: '1000ms',
+                field: '@timestamp',
+                time_zone: 'UTC',
+              },
+            },
+            timeout: '20s',
+            page_size: 1000,
+          },
+        });
+      });
+
+      await pastDates.map(async day => {
+        await es.index(mockRolledUpData(rollupJobName, rollupTargetIndexName, day));
+      });
+
+      await PageObjects.visualize.navigateToNewVisualization();
+      await PageObjects.visualize.clickVisualBuilder();
+      await PageObjects.visualBuilder.checkVisualBuilderIsPresent();
+      await PageObjects.timePicker.openQuickSelectTimeMenu();
+      await testSubjects.click('superDatePickerCommonlyUsed_Last_24 hours');
+      await PageObjects.visualBuilder.clickMetric();
+      await PageObjects.visualBuilder.checkMetricTabIsPresent();
+      await PageObjects.visualBuilder.clickPanelOptions('metric');
+      await PageObjects.visualBuilder.setIndexPatternValue(rollupTargetIndexName);
+      await PageObjects.visualBuilder.setIntervalValue('1d');
+      await PageObjects.visualBuilder.setDropLastBucket(false);
+      await PageObjects.common.sleep(3000);
+      const newValue = await PageObjects.visualBuilder.getMetricValue();
+      expect(newValue).to.eql('3');
+    });
+
+    after(async () => {
+      // Delete the rollup job.
+      await es.transport.request({
+        path: `/_rollup/job/${rollupJobName}`,
+        method: 'DELETE',
+      });
+
+      await es.indices.delete({ index: rollupTargetIndexName });
+      await es.indices.delete({ index: rollupSourceIndexName });
+      await esArchiver.load('empty_kibana');
+    });
+  });
+}
diff --git a/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/data.json.gz b/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/data.json.gz
new file mode 100644
index 0000000000000..8d3c9fe5fd233
Binary files /dev/null and b/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/mappings.json b/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/mappings.json
new file mode 100644
index 0000000000000..725a58af99325
--- /dev/null
+++ b/x-pack/test/functional/es_archives/endpoint/alerts/api_feature/mappings.json
@@ -0,0 +1,5265 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "my-index",
+    "mappings": {
+      "_meta": {
+        "version": "1.5.0-dev"
+      },
+      "date_detection": false,
+      "dynamic": "strict",
+      "dynamic_templates": [
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "authenticode": {
+          "properties": {
+            "cert_signer": {
+              "properties": {
+                "issuer_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp_string": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "cert_timestamp": {
+              "properties": {
+                "issuer_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "timestamp_string": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "more_info_link": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "program_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "publisher_link": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "call_stack": {
+          "properties": {
+            "instruction_pointer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "memory_section": {
+              "properties": {
+                "memory_address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "memory_size": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "protection": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "module_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "rva": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "symbol_info": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "doc_values": false,
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file_classification": {
+          "properties": {
+            "captured_file": {
+              "type": "boolean"
+            },
+            "entry_modified": {
+              "type": "double"
+            },
+            "is_signature_trusted": {
+              "type": "boolean"
+            },
+            "macro_details": {
+              "properties": {
+                "code_page": {
+                  "type": "long"
+                },
+                "errors": {
+                  "properties": {
+                    "count": {
+                      "type": "long"
+                    },
+                    "error_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "file_extension": {
+                  "type": "long"
+                },
+                "macro_collection_hashes": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "project_file_hashes": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "stream_data": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_code_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                }
+              }
+            },
+            "malware_classification": {
+              "properties": {
+                "compressed_malware_features": {
+                  "properties": {
+                    "data_buffer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "decompressed_size": {
+                      "type": "integer"
+                    },
+                    "encoding": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prevention_threshold": {
+                  "type": "double"
+                },
+                "score": {
+                  "type": "double"
+                },
+                "threshold": {
+                  "type": "double"
+                },
+                "upx_packed": {
+                  "type": "boolean"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "quarantine_result": {
+              "properties": {
+                "alert_correlation_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "quarantine_path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "signature_signer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "temp_file_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user_blacklisted": {
+              "type": "boolean"
+            },
+            "yara_hits": {
+              "properties": {
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "matched_data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rule_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "imphash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "integer"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "malware_classification": {
+          "properties": {
+            "compressed_malware_features": {
+              "properties": {
+                "data_buffer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "decompressed_size": {
+                  "type": "integer"
+                },
+                "encoding": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "identifier": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "prevention_threshold": {
+              "type": "double"
+            },
+            "score": {
+              "type": "double"
+            },
+            "threshold": {
+              "type": "double"
+            },
+            "upx_packed": {
+              "type": "boolean"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "modules": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "authenticode": {
+              "properties": {
+                "cert_signer": {
+                  "properties": {
+                    "issuer_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timestamp_string": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "cert_timestamp": {
+                  "properties": {
+                    "issuer_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timestamp_string": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "more_info_link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "program_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "publisher_link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "compile_time": {
+              "type": "date"
+            },
+            "hash": {
+              "properties": {
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "malware_classification": {
+              "properties": {
+                "compressed_malware_features": {
+                  "properties": {
+                    "data_buffer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "decompressed_size": {
+                      "type": "integer"
+                    },
+                    "encoding": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prevention_threshold": {
+                  "type": "double"
+                },
+                "score": {
+                  "type": "double"
+                },
+                "threshold": {
+                  "type": "double"
+                },
+                "upx_packed": {
+                  "type": "boolean"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "mapped_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mapped_size": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe_exports": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ordinal": {
+                  "type": "long"
+                }
+              },
+              "type": "nested"
+            },
+            "pe_imports": {
+              "properties": {
+                "dll_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "import_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "signature_signer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "signature_status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "argv_list": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "authenticode": {
+              "properties": {
+                "cert_signer": {
+                  "properties": {
+                    "issuer_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timestamp_string": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "cert_timestamp": {
+                  "properties": {
+                    "issuer_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "timestamp_string": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "more_info_link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "program_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "publisher_link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "cpu_percent": {
+              "type": "double"
+            },
+            "cwd": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "defense_evasions": {
+              "properties": {
+                "call_stack": {
+                  "properties": {
+                    "instruction_pointer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_section": {
+                      "properties": {
+                        "memory_address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "memory_size": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "protection": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "module_path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rva": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "symbol_info": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "delta_count": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "evasion_subtype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "evasion_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "instruction_pointer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "memory_sections": {
+                  "properties": {
+                    "memory_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protection": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "module_path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "thread": {
+                  "properties": {
+                    "thread_id": {
+                      "type": "long"
+                    },
+                    "thread_start_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "total_memory_size": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "env_variables": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "file_hash": {
+              "properties": {
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "gid": {
+              "type": "long"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "handle": {
+              "properties": {
+                "handle_id": {
+                  "type": "long"
+                },
+                "handle_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handle_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "has_unbacked_execute_memory": {
+              "type": "boolean"
+            },
+            "hash": {
+              "properties": {
+                "imphash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash_matched_module": {
+              "type": "boolean"
+            },
+            "is_endpoint": {
+              "type": "boolean"
+            },
+            "malware_classification": {
+              "properties": {
+                "compressed_malware_features": {
+                  "properties": {
+                    "data_buffer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "decompressed_size": {
+                      "type": "integer"
+                    },
+                    "encoding": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prevention_threshold": {
+                  "type": "double"
+                },
+                "score": {
+                  "type": "double"
+                },
+                "threshold": {
+                  "type": "double"
+                },
+                "upx_packed": {
+                  "type": "boolean"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "memory_percent": {
+              "type": "double"
+            },
+            "memory_region": {
+              "properties": {
+                "allocation_base": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "allocation_protection": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "histogram": {
+                  "properties": {
+                    "histogram_array": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "histogram_flavor": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "histogram_resolution": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "length": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "memory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "memory_address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "module_path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "permission": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "protection": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_base": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_size": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unbacked_on_disk": {
+                  "type": "boolean"
+                }
+              },
+              "type": "nested"
+            },
+            "modules": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "authenticode": {
+                  "properties": {
+                    "cert_signer": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "cert_timestamp": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "more_info_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "program_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "publisher_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "compile_time": {
+                  "type": "date"
+                },
+                "hash": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "malware_classification": {
+                  "properties": {
+                    "compressed_malware_features": {
+                      "properties": {
+                        "data_buffer": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "decompressed_size": {
+                          "type": "integer"
+                        },
+                        "encoding": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "identifier": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prevention_threshold": {
+                      "type": "double"
+                    },
+                    "score": {
+                      "type": "double"
+                    },
+                    "threshold": {
+                      "type": "double"
+                    },
+                    "upx_packed": {
+                      "type": "boolean"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "mapped_address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mapped_size": {
+                  "type": "long"
+                },
+                "path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pe_exports": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ordinal": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "pe_imports": {
+                  "properties": {
+                    "dll_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "import_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "signature_signer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_threads": {
+              "type": "long"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe_info": {
+              "properties": {
+                "architecture": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "authenticode": {
+                  "properties": {
+                    "cert_signer": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "cert_timestamp": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "more_info_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "program_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "publisher_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "compile_time": {
+                  "type": "long"
+                },
+                "entry_point_address": {
+                  "type": "long"
+                },
+                "is_dll": {
+                  "type": "boolean"
+                },
+                "malware_classification": {
+                  "properties": {
+                    "compressed_malware_features": {
+                      "properties": {
+                        "data_buffer": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "decompressed_size": {
+                          "type": "integer"
+                        },
+                        "encoding": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "identifier": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prevention_threshold": {
+                      "type": "double"
+                    },
+                    "score": {
+                      "type": "double"
+                    },
+                    "threshold": {
+                      "type": "double"
+                    },
+                    "upx_packed": {
+                      "type": "boolean"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "pe_exports": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ordinal": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "pe_imports": {
+                  "properties": {
+                    "dll_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "import_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "resources": {
+                  "properties": {
+                    "resource_data": {
+                      "properties": {
+                        "entropy": {
+                          "type": "double"
+                        },
+                        "size": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "resource_id": {
+                      "type": "long"
+                    },
+                    "resource_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "sections": {
+                  "properties": {
+                    "entropy": {
+                      "type": "double"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_offset": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "raw_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "virtual_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "virtual_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "signature_signer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version_info": {
+                  "properties": {
+                    "code_page": {
+                      "type": "long"
+                    },
+                    "key": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "language": {
+                      "type": "long"
+                    },
+                    "value_string": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "phys_memory_bytes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "services": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "session_id": {
+              "type": "long"
+            },
+            "short_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "signature_signer": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "signature_status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "threads": {
+              "properties": {
+                "entrypoint": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "uptime": {
+                  "type": "long"
+                }
+              },
+              "type": "nested"
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "token": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "impersonation_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "integrity_level": {
+                  "type": "long"
+                },
+                "integrity_level_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "is_appcontainer": {
+                  "type": "boolean"
+                },
+                "privileges": {
+                  "properties": {
+                    "description": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "sid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "tty_device_major_number": {
+              "type": "integer"
+            },
+            "tty_device_minor_number": {
+              "type": "integer"
+            },
+            "tty_device_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "type": "long"
+            },
+            "unbacked_execute_byte_count": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "unbacked_execute_region_count": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "unique_pid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "unique_ppid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "virt_memory_bytes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "target": {
+          "properties": {
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "argv_list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "authenticode": {
+                  "properties": {
+                    "cert_signer": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "cert_timestamp": {
+                      "properties": {
+                        "issuer_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "subject_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "timestamp_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "more_info_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "program_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "publisher_link": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cpu_percent": {
+                  "type": "double"
+                },
+                "cwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "defense_evasions": {
+                  "properties": {
+                    "call_stack": {
+                      "properties": {
+                        "instruction_pointer": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "memory_section": {
+                          "properties": {
+                            "memory_address": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "memory_size": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "protection": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "module_path": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "rva": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "symbol_info": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "delta_count": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "evasion_subtype": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "evasion_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "instruction_pointer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_sections": {
+                      "properties": {
+                        "memory_address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "memory_size": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "protection": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "module_path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "thread": {
+                      "properties": {
+                        "thread_id": {
+                          "type": "long"
+                        },
+                        "thread_start_address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "total_memory_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "env_variables": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "file_hash": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "gid": {
+                  "type": "long"
+                },
+                "group": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handle": {
+                  "properties": {
+                    "handle_id": {
+                      "type": "long"
+                    },
+                    "handle_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "handle_type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "has_unbacked_execute_memory": {
+                  "type": "boolean"
+                },
+                "hash": {
+                  "properties": {
+                    "imphash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash_matched_module": {
+                  "type": "boolean"
+                },
+                "is_endpoint": {
+                  "type": "boolean"
+                },
+                "malware_classification": {
+                  "properties": {
+                    "compressed_malware_features": {
+                      "properties": {
+                        "data_buffer": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "decompressed_size": {
+                          "type": "integer"
+                        },
+                        "encoding": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "identifier": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prevention_threshold": {
+                      "type": "double"
+                    },
+                    "score": {
+                      "type": "double"
+                    },
+                    "threshold": {
+                      "type": "double"
+                    },
+                    "upx_packed": {
+                      "type": "boolean"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "memory_percent": {
+                  "type": "double"
+                },
+                "memory_region": {
+                  "properties": {
+                    "allocation_base": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "allocation_protection": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "bytes": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "histogram": {
+                      "properties": {
+                        "histogram_array": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "histogram_flavor": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "histogram_resolution": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "length": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "module_path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "permission": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protection": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_base": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "region_tag": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "unbacked_on_disk": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "modules": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "authenticode": {
+                      "properties": {
+                        "cert_signer": {
+                          "properties": {
+                            "issuer_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "serial_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "timestamp_string": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "cert_timestamp": {
+                          "properties": {
+                            "issuer_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "serial_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "timestamp_string": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "more_info_link": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "program_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "publisher_link": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "compile_time": {
+                      "type": "date"
+                    },
+                    "hash": {
+                      "properties": {
+                        "imphash": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "md5": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha1": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "sha256": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "malware_classification": {
+                      "properties": {
+                        "compressed_malware_features": {
+                          "properties": {
+                            "data_buffer": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "decompressed_size": {
+                              "type": "integer"
+                            },
+                            "encoding": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "identifier": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "prevention_threshold": {
+                          "type": "double"
+                        },
+                        "score": {
+                          "type": "double"
+                        },
+                        "threshold": {
+                          "type": "double"
+                        },
+                        "upx_packed": {
+                          "type": "boolean"
+                        },
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "mapped_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "mapped_size": {
+                      "type": "long"
+                    },
+                    "path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pe_exports": {
+                      "properties": {
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ordinal": {
+                          "type": "long"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "pe_imports": {
+                      "properties": {
+                        "dll_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "import_names": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "signature_signer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "num_threads": {
+                  "type": "long"
+                },
+                "parent": {
+                  "properties": {
+                    "args": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "args_count": {
+                      "type": "long"
+                    },
+                    "command_line": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "executable": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "exit_code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "pgid": {
+                      "type": "long"
+                    },
+                    "pid": {
+                      "type": "long"
+                    },
+                    "ppid": {
+                      "type": "long"
+                    },
+                    "start": {
+                      "type": "date"
+                    },
+                    "thread": {
+                      "properties": {
+                        "id": {
+                          "type": "long"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "title": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "uptime": {
+                      "type": "long"
+                    },
+                    "working_directory": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "pe_info": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "authenticode": {
+                      "properties": {
+                        "cert_signer": {
+                          "properties": {
+                            "issuer_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "serial_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "timestamp_string": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "cert_timestamp": {
+                          "properties": {
+                            "issuer_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "serial_number": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "subject_name": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "timestamp_string": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "more_info_link": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "program_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "publisher_link": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "compile_time": {
+                      "type": "long"
+                    },
+                    "entry_point_address": {
+                      "type": "long"
+                    },
+                    "is_dll": {
+                      "type": "boolean"
+                    },
+                    "malware_classification": {
+                      "properties": {
+                        "compressed_malware_features": {
+                          "properties": {
+                            "data_buffer": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "decompressed_size": {
+                              "type": "integer"
+                            },
+                            "encoding": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "identifier": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "prevention_threshold": {
+                          "type": "double"
+                        },
+                        "score": {
+                          "type": "double"
+                        },
+                        "threshold": {
+                          "type": "double"
+                        },
+                        "upx_packed": {
+                          "type": "boolean"
+                        },
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "pe_exports": {
+                      "properties": {
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ordinal": {
+                          "type": "long"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "pe_imports": {
+                      "properties": {
+                        "dll_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "import_names": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "resources": {
+                      "properties": {
+                        "resource_data": {
+                          "properties": {
+                            "entropy": {
+                              "type": "double"
+                            },
+                            "size": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "resource_id": {
+                          "type": "long"
+                        },
+                        "resource_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "resource_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "sections": {
+                      "properties": {
+                        "entropy": {
+                          "type": "double"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "raw_offset": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "raw_size": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "virtual_address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "virtual_size": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "signature_signer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version_info": {
+                      "properties": {
+                        "code_page": {
+                          "type": "long"
+                        },
+                        "key": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "language": {
+                          "type": "long"
+                        },
+                        "value_string": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    }
+                  }
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "phys_memory_bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "services": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "session_id": {
+                  "type": "long"
+                },
+                "short_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_signer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "threads": {
+                  "properties": {
+                    "entrypoint": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "type": "long"
+                    },
+                    "start": {
+                      "type": "date"
+                    },
+                    "uptime": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "token": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "impersonation_level": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "integrity_level": {
+                      "type": "long"
+                    },
+                    "integrity_level_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "is_appcontainer": {
+                      "type": "boolean"
+                    },
+                    "privileges": {
+                      "properties": {
+                        "description": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "enabled": {
+                          "type": "boolean"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "sid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "tty_device_major_number": {
+                  "type": "integer"
+                },
+                "tty_device_minor_number": {
+                  "type": "integer"
+                },
+                "tty_device_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "type": "long"
+                },
+                "unbacked_execute_byte_count": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unbacked_execute_region_count": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unique_pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unique_ppid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "virt_memory_bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "thread": {
+              "properties": {
+                "call_stack": {
+                  "properties": {
+                    "instruction_pointer": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_section": {
+                      "properties": {
+                        "memory_address": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "memory_size": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "protection": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "module_path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "rva": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "symbol_info": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "service_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "start_address": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start_address_module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "token": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "impersonation_level": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "integrity_level": {
+                      "type": "long"
+                    },
+                    "integrity_level_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "is_appcontainer": {
+                      "type": "boolean"
+                    },
+                    "privileges": {
+                      "properties": {
+                        "description": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "enabled": {
+                          "type": "boolean"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      },
+                      "type": "nested"
+                    },
+                    "sid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "thread": {
+          "properties": {
+            "call_stack": {
+              "properties": {
+                "instruction_pointer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "memory_section": {
+                  "properties": {
+                    "memory_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "memory_size": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "protection": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "module_path": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rva": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "symbol_info": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "id": {
+              "type": "long"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start": {
+              "type": "date"
+            },
+            "start_address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "start_address_module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "token": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "impersonation_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "integrity_level": {
+                  "type": "long"
+                },
+                "integrity_level_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "is_appcontainer": {
+                  "type": "boolean"
+                },
+                "privileges": {
+                  "properties": {
+                    "description": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "sid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "token": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "impersonation_level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "integrity_level": {
+              "type": "long"
+            },
+            "integrity_level_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "is_appcontainer": {
+              "type": "boolean"
+            },
+            "privileges": {
+              "properties": {
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "sid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "refresh_interval": "1s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/services/machine_learning/data_frame_analytics_table.ts b/x-pack/test/functional/services/machine_learning/data_frame_analytics_table.ts
index 0324b440548bc..1d710a1c4cec7 100644
--- a/x-pack/test/functional/services/machine_learning/data_frame_analytics_table.ts
+++ b/x-pack/test/functional/services/machine_learning/data_frame_analytics_table.ts
@@ -92,7 +92,7 @@ export function MachineLearningDataFrameAnalyticsTableProvider({ getService }: F
     public async openResultsView() {
       await this.assertJobViewButtonExists();
       await testSubjects.click('mlAnalyticsJobViewButton');
-      await testSubjects.existOrFail('mlPageDataFrameAnalyticsExploration', { timeout: 5000 });
+      await testSubjects.existOrFail('mlPageDataFrameAnalyticsExploration', { timeout: 20 * 1000 });
     }
 
     public async filterWithSearchString(filter: string) {
diff --git a/x-pack/test/functional/services/machine_learning/job_table.ts b/x-pack/test/functional/services/machine_learning/job_table.ts
index eed6d180b4dca..153a0ac477b47 100644
--- a/x-pack/test/functional/services/machine_learning/job_table.ts
+++ b/x-pack/test/functional/services/machine_learning/job_table.ts
@@ -176,6 +176,7 @@ export function MachineLearningJobTableProvider({ getService }: FtrProviderConte
     }
 
     public async assertJobRowFields(jobId: string, expectedRow: object) {
+      await this.refreshJobList();
       const rows = await this.parseJobTable();
       const jobRow = rows.filter(row => row.id === jobId)[0];
       expect(jobRow).to.eql(expectedRow);
diff --git a/x-pack/test/functional/services/uptime.ts b/x-pack/test/functional/services/uptime.ts
index 1d8e0c97b99c4..938be2c71ae74 100644
--- a/x-pack/test/functional/services/uptime.ts
+++ b/x-pack/test/functional/services/uptime.ts
@@ -9,6 +9,7 @@ import { FtrProviderContext } from '../ftr_provider_context';
 export function UptimeProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const browser = getService('browser');
+  const retry = getService('retry');
 
   return {
     async assertExists(key: string) {
@@ -17,7 +18,9 @@ export function UptimeProvider({ getService }: FtrProviderContext) {
       }
     },
     async monitorIdExists(key: string) {
-      await testSubjects.existOrFail(key);
+      await retry.tryForTime(10000, async () => {
+        await testSubjects.existOrFail(key);
+      });
     },
     async monitorPageLinkExists(monitorId: string) {
       await testSubjects.existOrFail(`monitor-page-link-${monitorId}`);
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
index 0276ca8109732..84081309c18d9 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
@@ -16,7 +16,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const testSubjects = getService('testSubjects');
   const pageObjects = getPageObjects(['common', 'triggersActionsUI', 'header']);
   const supertest = getService('supertest');
-  const retry = getService('retry');
+  const find = getService('find');
 
   async function createAlert() {
     const { body: createdAlert } = await supertest
@@ -43,9 +43,52 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await testSubjects.click('alertsTab');
     });
 
+    it('should create an alert', async () => {
+      const alertName = generateUniqueKey();
+
+      await pageObjects.triggersActionsUI.clickCreateAlertButton();
+
+      const nameInput = await testSubjects.find('alertNameInput');
+      await nameInput.click();
+      await nameInput.clearValue();
+      await nameInput.type(alertName);
+
+      await testSubjects.click('threshold-SelectOption');
+
+      await testSubjects.click('.slack-ActionTypeSelectOption');
+      await testSubjects.click('createActionConnectorButton');
+      const connectorNameInput = await testSubjects.find('nameInput');
+      await connectorNameInput.click();
+      await connectorNameInput.clearValue();
+      const connectorName = generateUniqueKey();
+      await connectorNameInput.type(connectorName);
+
+      const slackWebhookUrlInput = await testSubjects.find('slackWebhookUrlInput');
+      await slackWebhookUrlInput.click();
+      await slackWebhookUrlInput.clearValue();
+      await slackWebhookUrlInput.type('https://test');
+
+      await find.clickByCssSelector('[data-test-subj="saveActionButtonModal"]:not(disabled)');
+
+      const loggingMessageInput = await testSubjects.find('slackMessageTextArea');
+      await loggingMessageInput.click();
+      await loggingMessageInput.clearValue();
+      await loggingMessageInput.type('test message');
+
+      await testSubjects.click('slackAddVariableButton');
+      const variableMenuButton = await testSubjects.find('variableMenuButton-0');
+      await variableMenuButton.click();
+
+      await testSubjects.click('selectIndexExpression');
+
+      await find.clickByCssSelector('[data-test-subj="cancelSaveAlertButton"]');
+
+      // TODO: implement saving to the server, when threshold API will be ready
+    });
+
     it('should search for alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       const searchResults = await pageObjects.triggersActionsUI.getAlertsList();
@@ -61,7 +104,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should search for tags', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(`${createdAlert.name} foo`);
 
       const searchResults = await pageObjects.triggersActionsUI.getAlertsList();
@@ -77,7 +120,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should disable single alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click('collapsedItemActions');
@@ -95,7 +138,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should re-enable single alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click('collapsedItemActions');
@@ -119,7 +162,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should mute single alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click('collapsedItemActions');
@@ -137,7 +180,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should unmute single alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click('collapsedItemActions');
@@ -161,24 +204,21 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should delete single alert', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click('collapsedItemActions');
 
       await testSubjects.click('deleteAlert');
-
-      await retry.try(async () => {
-        await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
-
-        const searchResults = await pageObjects.triggersActionsUI.getAlertsList();
-        expect(searchResults.length).to.eql(0);
-      });
+      const emptyPrompt = await find.byCssSelector(
+        '[data-test-subj="createFirstAlertEmptyPrompt"]'
+      );
+      expect(await emptyPrompt.elementHasClass('euiEmptyPrompt')).to.be(true);
     });
 
     it('should mute all selection', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click(`checkboxSelectRow-${createdAlert.id}`);
@@ -201,7 +241,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should unmute all selection', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click(`checkboxSelectRow-${createdAlert.id}`);
@@ -226,7 +266,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should disable all selection', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click(`checkboxSelectRow-${createdAlert.id}`);
@@ -249,7 +289,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should enable all selection', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click(`checkboxSelectRow-${createdAlert.id}`);
@@ -274,7 +314,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('should delete all selection', async () => {
       const createdAlert = await createAlert();
-
+      await pageObjects.common.navigateToApp('triggersActions');
       await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
 
       await testSubjects.click(`checkboxSelectRow-${createdAlert.id}`);
@@ -283,12 +323,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
       await testSubjects.click('deleteAll');
 
-      await retry.try(async () => {
-        await pageObjects.triggersActionsUI.searchAlerts(createdAlert.name);
-
-        const searchResults = await pageObjects.triggersActionsUI.getAlertsList();
-        expect(searchResults.length).to.eql(0);
-      });
+      const emptyPrompt = await find.byCssSelector(
+        '[data-test-subj="createFirstAlertEmptyPrompt"]'
+      );
+      expect(await emptyPrompt.elementHasClass('euiEmptyPrompt')).to.be(true);
     });
   });
 };
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
index d037155a29e12..9d656b08a3abd 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
@@ -35,7 +35,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await nameInput.clearValue();
       await nameInput.type(connectorName);
 
-      await find.clickByCssSelector('[data-test-subj="saveActionButton"]:not(disabled)');
+      await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
 
       const toastTitle = await pageObjects.common.closeToast();
       expect(toastTitle).to.eql(`Created '${connectorName}'`);
@@ -65,7 +65,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await nameInput.clearValue();
       await nameInput.type(connectorName);
 
-      await find.clickByCssSelector('[data-test-subj="saveActionButton"]:not(disabled)');
+      await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
 
       await pageObjects.common.closeToast();
 
@@ -81,7 +81,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await nameInputToUpdate.clearValue();
       await nameInputToUpdate.type(updatedConnectorName);
 
-      await find.clickByCssSelector('[data-test-subj="saveActionButton"]:not(disabled)');
+      await find.clickByCssSelector('[data-test-subj="saveEditedActionButton"]:not(disabled)');
 
       const toastTitle = await pageObjects.common.closeToast();
       expect(toastTitle).to.eql(`Updated '${updatedConnectorName}'`);
@@ -109,7 +109,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await nameInput.clearValue();
         await nameInput.type(connectorName);
 
-        await find.clickByCssSelector('[data-test-subj="saveActionButton"]:not(disabled)');
+        await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
         await pageObjects.common.closeToast();
       }
       const connectorName = generateUniqueKey();
@@ -147,7 +147,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await nameInput.clearValue();
         await nameInput.type(connectorName);
 
-        await find.clickByCssSelector('[data-test-subj="saveActionButton"]:not(disabled)');
+        await find.clickByCssSelector('[data-test-subj="saveNewActionButton"]:not(disabled)');
         await pageObjects.common.closeToast();
       }
 
diff --git a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
index ae66ac0ddddfb..91c7fe1f97d12 100644
--- a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
+++ b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
@@ -18,11 +18,21 @@ export function TriggersActionsPageProvider({ getService }: FtrProviderContext)
     async getSectionHeadingText() {
       return await testSubjects.getVisibleText('appTitle');
     },
+    async clickCreateFirstConnectorButton() {
+      const createBtn = await find.byCssSelector('[data-test-subj="createFirstActionButton"]');
+      const createBtnIsVisible = await createBtn.isDisplayed();
+      if (createBtnIsVisible) {
+        await createBtn.click();
+      }
+    },
     async clickCreateConnectorButton() {
-      const createBtn = await find.byCssSelector(
-        '[data-test-subj="createActionButton"],[data-test-subj="createFirstActionButton"]'
-      );
-      await createBtn.click();
+      const createBtn = await find.byCssSelector('[data-test-subj="createActionButton"]');
+      const createBtnIsVisible = await createBtn.isDisplayed();
+      if (createBtnIsVisible) {
+        await createBtn.click();
+      } else {
+        await this.clickCreateFirstConnectorButton();
+      }
     },
     async searchConnectors(searchText: string) {
       const searchBox = await find.byCssSelector('[data-test-subj="actionsList"] .euiFieldSearch');
@@ -109,5 +119,11 @@ export function TriggersActionsPageProvider({ getService }: FtrProviderContext)
         expect(valueAfter).not.to.eql(valueBefore);
       });
     },
+    async clickCreateAlertButton() {
+      const createBtn = await find.byCssSelector(
+        '[data-test-subj="createAlertButton"],[data-test-subj="createFirstAlertButton"]'
+      );
+      await createBtn.click();
+    },
   };
 }
diff --git a/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts b/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
index 203f90c55aa82..570d7026cf99e 100644
--- a/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
+++ b/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
@@ -74,6 +74,7 @@ export default function({ getService }: FtrProviderContext) {
 
       expect(user.username).to.eql(username);
       expect(user.authentication_realm).to.eql({ name: 'reserved', type: 'reserved' });
+      expect(user.authentication_provider).to.eql('basic');
     });
 
     describe('initiating SPNEGO', () => {
@@ -129,6 +130,7 @@ export default function({ getService }: FtrProviderContext) {
             enabled: true,
             authentication_realm: { name: 'kerb1', type: 'kerberos' },
             lookup_realm: { name: 'kerb1', type: 'kerberos' },
+            authentication_provider: 'kerberos',
           });
       });
 
diff --git a/x-pack/test/oidc_api_integration/apis/authorization_code_flow/oidc_auth.js b/x-pack/test/oidc_api_integration/apis/authorization_code_flow/oidc_auth.js
index 57bcd1b041c49..094537fd61436 100644
--- a/x-pack/test/oidc_api_integration/apis/authorization_code_flow/oidc_auth.js
+++ b/x-pack/test/oidc_api_integration/apis/authorization_code_flow/oidc_auth.js
@@ -173,6 +173,7 @@ export default function({ getService }) {
           'enabled',
           'authentication_realm',
           'lookup_realm',
+          'authentication_provider',
         ]);
 
         expect(apiResponse.body.username).to.be('user1');
@@ -222,6 +223,7 @@ export default function({ getService }) {
           'enabled',
           'authentication_realm',
           'lookup_realm',
+          'authentication_provider',
         ]);
 
         expect(apiResponse.body.username).to.be('user2');
diff --git a/x-pack/test/oidc_api_integration/apis/implicit_flow/oidc_auth.ts b/x-pack/test/oidc_api_integration/apis/implicit_flow/oidc_auth.ts
index 1f5a64835416a..7d013e97732f9 100644
--- a/x-pack/test/oidc_api_integration/apis/implicit_flow/oidc_auth.ts
+++ b/x-pack/test/oidc_api_integration/apis/implicit_flow/oidc_auth.ts
@@ -142,6 +142,7 @@ export default function({ getService }: FtrProviderContext) {
           'enabled',
           'authentication_realm',
           'lookup_realm',
+          'authentication_provider',
         ]);
 
         expect(apiResponse.body.username).to.be('user1');
diff --git a/x-pack/test/pki_api_integration/apis/security/pki_auth.ts b/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
index 186ed824b3b6c..1ae7488fcf379 100644
--- a/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
+++ b/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
@@ -90,6 +90,7 @@ export default function({ getService }: FtrProviderContext) {
 
       expect(user.username).to.eql(username);
       expect(user.authentication_realm).to.eql({ name: 'reserved', type: 'reserved' });
+      expect(user.authentication_provider).to.eql('basic');
     });
 
     it('should properly set cookie and authenticate user', async () => {
@@ -118,6 +119,7 @@ export default function({ getService }: FtrProviderContext) {
         },
         authentication_realm: { name: 'pki1', type: 'pki' },
         lookup_realm: { name: 'pki1', type: 'pki' },
+        authentication_provider: 'pki',
       });
 
       // Cookie should be accepted.
@@ -160,6 +162,7 @@ export default function({ getService }: FtrProviderContext) {
           },
           authentication_realm: { name: 'pki1', type: 'pki' },
           lookup_realm: { name: 'pki1', type: 'pki' },
+          authentication_provider: 'pki',
         });
 
       checkCookieIsSet(request.cookie(response.headers['set-cookie'][0])!);
diff --git a/x-pack/test/saml_api_integration/apis/security/saml_login.ts b/x-pack/test/saml_api_integration/apis/security/saml_login.ts
index 0436d59906ea8..6ede8aadeb5a7 100644
--- a/x-pack/test/saml_api_integration/apis/security/saml_login.ts
+++ b/x-pack/test/saml_api_integration/apis/security/saml_login.ts
@@ -56,6 +56,7 @@ export default function({ getService }: FtrProviderContext) {
       'enabled',
       'authentication_realm',
       'lookup_realm',
+      'authentication_provider',
     ]);
 
     expect(apiResponse.body.username).to.be('a@b.c');
@@ -88,6 +89,7 @@ export default function({ getService }: FtrProviderContext) {
 
       expect(user.username).to.eql(username);
       expect(user.authentication_realm).to.eql({ name: 'reserved', type: 'reserved' });
+      expect(user.authentication_provider).to.eql('basic');
     });
 
     describe('capture URL fragment', () => {
diff --git a/yarn.lock b/yarn.lock
index caa5587a0bbd0..a35cd1d541762 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1880,17 +1880,19 @@
   dependencies:
     "@elastic/apm-rum-core" "^4.7.0"
 
-"@elastic/charts@^16.1.0":
-  version "16.1.0"
-  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-16.1.0.tgz#67cf11625dcd7e1c2cf16ef53349e6a68a73f5b1"
-  integrity sha512-0jZ7thhGmYC0ZdEVkxfg6M66epCD7k7BfYIi12FnrmIK+mUD2IPhR8b2TJXvaojPryN4YTNreGRncQ9R58fOoQ==
+"@elastic/charts@^17.0.2":
+  version "17.0.2"
+  resolved "https://registry.yarnpkg.com/@elastic/charts/-/charts-17.0.2.tgz#0bd2cb7b78bd60255eed2a9b0ce5049a62dc5d8a"
+  integrity sha512-hz31Yma/HSdu9tRS/05xNXY+YuaHOadD9Gd+eh7ankNlJJOFI4IRV6F8BMnloeWYedNXBSTp4susFLwJNQQ+0w==
   dependencies:
     "@types/d3-shape" "^1.3.1"
     classnames "^2.2.6"
     d3-array "^1.2.4"
     d3-collection "^1.0.7"
+    d3-color "^1.4.0"
     d3-scale "^1.0.7"
     d3-shape "^1.3.4"
+    fast-deep-equal "^3.1.1"
     konva "^4.0.18"
     newtype-ts "^0.2.4"
     prop-types "^15.7.2"
@@ -1902,7 +1904,7 @@
     reselect "^4.0.0"
     resize-observer-polyfill "^1.5.1"
     ts-debounce "^1.0.0"
-    utility-types "^3.9.0"
+    utility-types "^3.10.0"
     uuid "^3.3.2"
 
 "@elastic/elasticsearch@^7.4.0":
@@ -2041,6 +2043,11 @@
   resolved "https://registry.yarnpkg.com/@elastic/numeral/-/numeral-2.3.3.tgz#94d38a35bd315efa7a6918b22695128fc40a885e"
   integrity sha512-0OyB9oztlYIq8F1LHjcNf+T089PKfYw78tgUY+q2dtox/jmb4xzFKtI9kv1hwAt5tcgBUTtUMK9kszpSh1UZaQ==
 
+"@elastic/numeral@2.3.5":
+  version "2.3.5"
+  resolved "https://registry.yarnpkg.com/@elastic/numeral/-/numeral-2.3.5.tgz#fcaeac57ddc55cd4b7f0b9c7e070c242dd5d0600"
+  integrity sha512-lJVZHPuI2csrfwDIEdKedFqNIF+5YsyqvX2soAqhu49iKOd9n7tifLRn30vP6D7oKd+6HsiGfPzT0nzdJWsexQ==
+
 "@elastic/request-crypto@^1.0.2":
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/@elastic/request-crypto/-/request-crypto-1.0.2.tgz#bf27bf009227166f3eeb2b5193a108752335ebd3"
@@ -5655,10 +5662,12 @@ abort-controller@^2.0.3:
   dependencies:
     event-target-shim "^5.0.0"
 
-abortcontroller-polyfill@^1.3.0:
-  version "1.3.0"
-  resolved "https://registry.yarnpkg.com/abortcontroller-polyfill/-/abortcontroller-polyfill-1.3.0.tgz#de69af32ae926c210b7efbcc29bf644ee4838b00"
-  integrity sha512-lbWQgf+eRvku3va8poBlDBO12FigTQr9Zb7NIjXrePrhxWVKdCP2wbDl1tLDaYa18PWTom3UEWwdH13S46I+yA==
+abort-controller@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/abort-controller/-/abort-controller-3.0.0.tgz#eaf54d53b62bae4138e809ca225c8439a6efb392"
+  integrity sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==
+  dependencies:
+    event-target-shim "^5.0.0"
 
 accept@3.x.x:
   version "3.0.2"
@@ -5860,12 +5869,12 @@ aggregate-error@^1.0.0:
     indent-string "^3.0.0"
 
 aggregate-error@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/aggregate-error/-/aggregate-error-3.0.0.tgz#5b5a3c95e9095f311c9ab16c19fb4f3527cd3f79"
-  integrity sha512-yKD9kEoJIR+2IFqhMwayIBgheLYbB3PS2OBhWae1L/ODTd/JF/30cW0bc9TqzRL3k4U41Dieu3BF4I29p8xesA==
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/aggregate-error/-/aggregate-error-3.0.1.tgz#db2fe7246e536f40d9b5442a39e117d7dd6a24e0"
+  integrity sha512-quoaXsZ9/BLNae5yiNoUz+Nhkwz83GhWwtYFglcjEQB2NDHCIpApbqXxIFnm4Pq/Nvhrsq5sYJFyohrrxnTGAA==
   dependencies:
     clean-stack "^2.0.0"
-    indent-string "^3.2.0"
+    indent-string "^4.0.0"
 
 "airbnb-js-shims@^1 || ^2":
   version "2.1.1"
@@ -5952,7 +5961,7 @@ ajv@^6.1.0, ajv@^6.5.5:
     json-schema-traverse "^0.4.1"
     uri-js "^4.2.2"
 
-ajv@^6.10.0, ajv@^6.10.2:
+ajv@^6.10.0:
   version "6.10.2"
   resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.10.2.tgz#d3cea04d6b017b2894ad69040fec8b623eb4bd52"
   integrity sha512-TXtUUEYHuaTEbLZWIKUr5pmBuhDLy+8KYtPYdcV8qC+pOZL+NKqYwvWSRrVXHn+ZmRRAu8vJTAznH7Oag6RVRw==
@@ -5962,6 +5971,16 @@ ajv@^6.10.0, ajv@^6.10.2:
     json-schema-traverse "^0.4.1"
     uri-js "^4.2.2"
 
+ajv@^6.10.2:
+  version "6.11.0"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.11.0.tgz#c3607cbc8ae392d8a5a536f25b21f8e5f3f87fe9"
+  integrity sha512-nCprB/0syFYy9fVYU1ox1l2KN8S9I+tziH8D4zdZuLT3N6RMlGSGt5FSTpAiHB/Whv8Qs1cWHma1aMKZyaHRKA==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    fast-json-stable-stringify "^2.0.0"
+    json-schema-traverse "^0.4.1"
+    uri-js "^4.2.2"
+
 ajv@^6.9.1:
   version "6.9.2"
   resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.9.2.tgz#4927adb83e7f48e5a32b45729744c71ec39c9c7b"
@@ -5993,10 +6012,10 @@ ammo@3.x.x:
   dependencies:
     hoek "5.x.x"
 
-angular-aria@^1.7.8:
-  version "1.7.8"
-  resolved "https://registry.yarnpkg.com/angular-aria/-/angular-aria-1.7.8.tgz#3954250ef516b57cdd3cdf41ff4ee6fcfdc84ceb"
-  integrity sha512-facq/111sZKL2wUUqRA1GnGt+lZ8KAcX9Aw04cNA+OyEkoaoRC77NY4VSOTQxghlSd0OPAdLeFnmETnuiWrpLg==
+angular-aria@^1.7.9:
+  version "1.7.9"
+  resolved "https://registry.yarnpkg.com/angular-aria/-/angular-aria-1.7.9.tgz#90c61895ffbd876e95915222b32a7bd0070af7e3"
+  integrity sha512-luI3Jemd1AbOQW0krdzfEG3fM0IFtLY0bSSqIDEx3POE0XjKIC1MkrO8Csyq9PPgueLphyAPofzUwZ8YeZ88SA==
 
 angular-elastic@^2.5.1:
   version "2.5.1"
@@ -6005,30 +6024,30 @@ angular-elastic@^2.5.1:
   dependencies:
     angular ">=1.0.6"
 
-angular-mocks@^1.7.8:
-  version "1.7.8"
-  resolved "https://registry.yarnpkg.com/angular-mocks/-/angular-mocks-1.7.8.tgz#95e7887ca91d1a3e176cc22f2d1941d284ce9767"
-  integrity sha512-LB13ESBT0eJrhQhfPXyLR9qm4LI9g44hyBFwUqZKEHEA4DpfxVTu0ONipiNoN0zWtmEAezA8u2gjcoaO2TStig==
+angular-mocks@^1.7.9:
+  version "1.7.9"
+  resolved "https://registry.yarnpkg.com/angular-mocks/-/angular-mocks-1.7.9.tgz#0a3b7e28b9a493b4e3010ed2b0f69a68e9b4f79b"
+  integrity sha512-LQRqqiV3sZ7NTHBnNmLT0bXtE5e81t97+hkJ56oU0k3dqKv1s6F+nBWRlOVzqHWPGFOiPS8ZJVdrS8DFzHyNIA==
 
 angular-recursion@^1.0.5:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/angular-recursion/-/angular-recursion-1.0.5.tgz#cd405428a0bf55faf52eaa7988c1fe69cd930543"
   integrity sha1-zUBUKKC/Vfr1Lqp5iMH+ac2TBUM=
 
-angular-resource@1.7.8:
-  version "1.7.8"
-  resolved "https://registry.yarnpkg.com/angular-resource/-/angular-resource-1.7.8.tgz#9577dbcc02cdbb76398febc5fc7ee103c86c5c50"
-  integrity sha512-zuPQ0ZX9Q8WnZ0KMtJlKYUSIXWRQSbFzMkRV9zG8cYYSsMAZlXar5Hqmd5gzxC3O28AGM7BCEJ+iYs3UNL4qdA==
+angular-resource@1.7.9:
+  version "1.7.9"
+  resolved "https://registry.yarnpkg.com/angular-resource/-/angular-resource-1.7.9.tgz#fa53623fae2c60debe2410d692447dcb0ba02396"
+  integrity sha512-rXXhCE2qT31Pn4Sl+2XL+ntv4zxnA2OzY+clCl8/pOp/s/gIzxpQlEtXipo3QK8Qur3glbIkeF/bJw+gjVAdUw==
 
-angular-route@^1.7.8:
-  version "1.7.8"
-  resolved "https://registry.yarnpkg.com/angular-route/-/angular-route-1.7.8.tgz#d502aa605dcbb253a93e844c0adf51c9bc36b9fa"
-  integrity sha512-VVk89PH0fsY5kfbx+N7IVX1IwnaPWYhMGY0uA+rjej2v1sjvrTx1SLkxUK4E0UpW1hXeLJhN7ncBcwoBiPtAtA==
+angular-route@^1.7.9:
+  version "1.7.9"
+  resolved "https://registry.yarnpkg.com/angular-route/-/angular-route-1.7.9.tgz#f9910a2af0ba3ad7a969c5dd369b8360d0d5e4ef"
+  integrity sha512-vRoj5hzdQtWbODhWJqDzD1iNOEfCKshO6GFBuPVV7RHlPjzIc4R2dHCc7Qiv/8F3LDxJDohc6vSnTDMLHuaqeA==
 
-angular-sanitize@1.7.8, angular-sanitize@^1.7.8:
-  version "1.7.8"
-  resolved "https://registry.yarnpkg.com/angular-sanitize/-/angular-sanitize-1.7.8.tgz#87d59f754bb18d286dfd9d6ce867299c094c6719"
-  integrity sha512-sVq51is1cVNiPytH4JIEd7iRW0OBIRQGNETWkz1c/jnLv2sBf9oDxEd8enwDz/W2ULBIpqJPK/3AsIxmZyh9pA==
+angular-sanitize@1.7.9, angular-sanitize@^1.7.9:
+  version "1.7.9"
+  resolved "https://registry.yarnpkg.com/angular-sanitize/-/angular-sanitize-1.7.9.tgz#6b4d5e826abdabd352b13a7c65c8c74daf6a7b15"
+  integrity sha512-nB/xe7JQWF9nLvhHommAICQ3eWrfRETo0EVGFESi952CDzDa+GAJ/2BFBNw44QqQPxj1Xua/uYKrbLsOGWZdbQ==
 
 angular-sortable-view@^0.0.17:
   version "0.0.17"
@@ -8341,7 +8360,7 @@ cacache@^12.0.2:
     unique-filename "^1.1.1"
     y18n "^4.0.0"
 
-cacache@^13.0.0:
+cacache@^13.0.1:
   version "13.0.1"
   resolved "https://registry.yarnpkg.com/cacache/-/cacache-13.0.1.tgz#a8000c21697089082f85287a1aec6e382024a71c"
   integrity sha512-5ZvAxd05HDDU+y9BVvcqYu2LLXmPnQ0hW62h32g4xBTgL/MppR4/04NHfj/ycM2y6lmTnbw6HVi+1eN0Psba6w==
@@ -9021,9 +9040,9 @@ clean-stack@^1.0.0, clean-stack@^1.3.0:
   integrity sha1-noIVAa6XmYbEax1m0tQy2y/UrjE=
 
 clean-stack@^2.0.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/clean-stack/-/clean-stack-2.1.0.tgz#9e7fec7f3f8340a2ab4f127c80273085e8fbbdd0"
-  integrity sha512-uQWrpRm+iZZUCAp7ZZJQbd4Za9I3AjR/3YTjmcnAtkauaIm/T5CT6U8zVI6e60T6OANqBFAzuR9/HB3NzuZCRA==
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/clean-stack/-/clean-stack-2.2.0.tgz#ee8472dbb129e727b31e8a10a427dee9dfe4008b"
+  integrity sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==
 
 cli-boxes@^1.0.0:
   version "1.0.0"
@@ -9461,12 +9480,12 @@ commander@3.0.2:
   resolved "https://registry.yarnpkg.com/commander/-/commander-3.0.2.tgz#6837c3fb677ad9933d1cfba42dd14d5117d6b39e"
   integrity sha512-Gar0ASD4BDyKC4hl4DwHqDrmvjoxWKZigVnAbn5H1owvm4CxCPdb0HQDehwNYMJpla5+M2tPmPARzhtYuwpHow==
 
-commander@^2.13.0, commander@^2.15.1, commander@^2.16.0, commander@^2.19.0, commander@^2.20.0:
+commander@^2.13.0, commander@^2.15.1, commander@^2.16.0, commander@^2.19.0:
   version "2.20.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.0.tgz#d58bb2b5c1ee8f87b0d340027e9e94e222c5a422"
   integrity sha512-7j2y+40w61zy6YC2iRNpUe/NwhNyoXrYpHMrSunaMG64nRnaf96zO/KMQR4OyN/UnE5KLyEBnKHd4aG3rskjpQ==
 
-commander@^2.7.1:
+commander@^2.20.0, commander@^2.7.1:
   version "2.20.3"
   resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33"
   integrity sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==
@@ -10571,6 +10590,11 @@ d3-color@^1.0.3:
   resolved "https://registry.yarnpkg.com/d3-color/-/d3-color-1.0.3.tgz#bc7643fca8e53a8347e2fbdaffa236796b58509b"
   integrity sha1-vHZD/KjlOoNH4vva/6I2eWtYUJs=
 
+d3-color@^1.4.0:
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/d3-color/-/d3-color-1.4.0.tgz#89c45a995ed773b13314f06460df26d60ba0ecaf"
+  integrity sha512-TzNPeJy2+iEepfiL92LAAB7fvnp/dV2YwANPVHdDWmYMm23qIJBYww3qT8I8C1wXrmrg4UWs7BKc2tKIgyjzHg==
+
 d3-contour@^1.1.0:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/d3-contour/-/d3-contour-1.1.2.tgz#21f5456fcf57645922d69a27a58e782c91f842b3"
@@ -13363,9 +13387,9 @@ fast-glob@^3.0.3:
     micromatch "^4.0.2"
 
 fast-json-stable-stringify@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.0.0.tgz#d5142c0caee6b1189f87d3a76111064f86c8bbf2"
-  integrity sha1-1RQsDK7msRifh9OnYREGT4bIu/I=
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz#874bf69c6f404c2b5d99c481341399fd55892633"
+  integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
 
 fast-levenshtein@^2.0.6, fast-levenshtein@~2.0.4, fast-levenshtein@~2.0.6:
   version "2.0.6"
@@ -13724,10 +13748,10 @@ find-cache-dir@^2.1.0:
     make-dir "^2.0.0"
     pkg-dir "^3.0.0"
 
-find-cache-dir@^3.0.0:
-  version "3.0.0"
-  resolved "https://registry.yarnpkg.com/find-cache-dir/-/find-cache-dir-3.0.0.tgz#cd4b7dd97b7185b7e17dbfe2d6e4115ee3eeb8fc"
-  integrity sha512-t7ulV1fmbxh5G9l/492O1p5+EBbr3uwpt6odhFTMc+nWyhmbloe+ja9BZ8pIBtqFWhOmCWVjx+pTW4zDkFoclw==
+find-cache-dir@^3.0.0, find-cache-dir@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/find-cache-dir/-/find-cache-dir-3.2.0.tgz#e7fe44c1abc1299f516146e563108fd1006c1874"
+  integrity sha512-1JKclkYYsf1q9WIJKLZa9S9muC+08RIjzAlLrK4QcYLJMS6mk9yombQ9qf+zJ7H9LS800k0s44L4sDq9VYzqyg==
   dependencies:
     commondir "^1.0.1"
     make-dir "^3.0.0"
@@ -14204,9 +14228,9 @@ fs-minipass@^1.2.5:
     minipass "^2.2.1"
 
 fs-minipass@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-2.0.0.tgz#a6415edab02fae4b9e9230bc87ee2e4472003cd1"
-  integrity sha512-40Qz+LFXmd9tzYVnnBmZvFfvAADfUA14TXPK1s7IfElJTIZ97rA8w4Kin7Wt5JBrC3ShnnFJO/5vPjPEeJIq9A==
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-2.1.0.tgz#7f5036fdbf12c63c169190cbe4199c852271f9fb"
+  integrity sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==
   dependencies:
     minipass "^3.0.0"
 
@@ -14675,7 +14699,7 @@ glob-watcher@5.0.3, glob-watcher@^5.0.3:
     just-debounce "^1.0.0"
     object.defaults "^1.1.0"
 
-glob@7.1.3, glob@^7.0.0, glob@^7.0.3, glob@^7.0.5, glob@^7.1.1, glob@^7.1.2, glob@^7.1.3, glob@~7.1.1:
+glob@7.1.3, glob@^7.0.0, glob@^7.0.3, glob@^7.1.1, glob@^7.1.2, glob@~7.1.1:
   version "7.1.3"
   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.3.tgz#3960832d3f1574108342dafd3a67b332c0969df1"
   integrity sha512-vcfuiIxogLV4DlGBHIUOwI0IbrJ8HWPc4MU7HzviGeNho/UJDfi6B5p3sHeWIQ0KGIU0Jpxi5ZHxemQfLkkAwQ==
@@ -14687,7 +14711,7 @@ glob@7.1.3, glob@^7.0.0, glob@^7.0.3, glob@^7.0.5, glob@^7.1.1, glob@^7.1.2, glo
     once "^1.3.0"
     path-is-absolute "^1.0.0"
 
-glob@7.1.4, glob@^7.1.4, glob@~7.1.4:
+glob@7.1.4, glob@~7.1.4:
   version "7.1.4"
   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.4.tgz#aa608a2f6c577ad357e1ae5a5c26d9a8d1969255"
   integrity sha512-hkLPepehmnKk41pUGm3sYxoFs/umurYfYJCerbXEyFIWcAzvpipAgVkBqqT9RBKMGjnq6kMuyYwha6csxbiM1A==
@@ -14721,7 +14745,7 @@ glob@^6.0.1, glob@^6.0.4:
     once "^1.3.0"
     path-is-absolute "^1.0.0"
 
-glob@^7.1.6:
+glob@^7.0.5, glob@^7.1.3, glob@^7.1.4, glob@^7.1.6:
   version "7.1.6"
   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.6.tgz#141f33b81a7c2492e125594307480c46679278a6"
   integrity sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==
@@ -15090,12 +15114,12 @@ graceful-fs@^4.1.15, graceful-fs@^4.1.9:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.1.15.tgz#ffb703e1066e8a0eeaa4c8b80ba9253eeefbfb00"
   integrity sha512-6uHUhOPEBgQ24HM+r6b/QwWfZq+yiFcipKFrOFiBEnWdy5sdzYoi+pJeQaPI5qOLRFqWmAXUPQNsielzdLoecA==
 
-graceful-fs@^4.1.2, graceful-fs@^4.1.6:
+graceful-fs@^4.1.2, graceful-fs@^4.1.6, graceful-fs@^4.2.2:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.3.tgz#4a12ff1b60376ef09862c2093edd908328be8423"
   integrity sha512-a30VEBm4PEdx1dRB7MFK7BejejvCvBronbLjht+sHuGYj8PHs7M/5Z+rt5lw551vZ7yfTCj4Vuyy3mSJytDWRQ==
 
-graceful-fs@^4.2.0, graceful-fs@^4.2.2:
+graceful-fs@^4.2.0:
   version "4.2.2"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.2.tgz#6f0952605d0140c1cfdb138ed005775b92d67b02"
   integrity sha512-IItsdsea19BoLC7ELy13q1iJFNmd7ofZH5+X/pJr90/nRoPEX0DJo1dHDbgtYWOhJhcCgMDTOw84RZ72q6lB+Q==
@@ -16330,12 +16354,12 @@ icss-replace-symbols@^1.1.0:
   resolved "https://registry.yarnpkg.com/icss-replace-symbols/-/icss-replace-symbols-1.1.0.tgz#06ea6f83679a7749e386cfe1fe812ae5db223ded"
   integrity sha1-Bupvg2ead0njhs/h/oEq5dsiPe0=
 
-icss-utils@^4.0.0, icss-utils@^4.1.1:
-  version "4.1.1"
-  resolved "https://registry.yarnpkg.com/icss-utils/-/icss-utils-4.1.1.tgz#21170b53789ee27447c2f47dd683081403f9a467"
-  integrity sha512-4aFq7wvWyMHKgxsH8QQtGpvbASCf+eM3wPRLI6R+MgAnTCZ6STYsRvttLvRWK0Nfif5piF394St3HeJDaljGPA==
+icss-utils@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/icss-utils/-/icss-utils-4.0.0.tgz#d52cf4bcdcfa1c45c2dbefb4ffdf6b00ef608098"
+  integrity sha512-bA/xGiwWM17qjllIs9X/y0EjsB7e0AV08F3OL8UPsoNkNRibIuu8f1eKTnQ8QO1DteKKTxTUAn+IEWUToIwGOA==
   dependencies:
-    postcss "^7.0.14"
+    postcss "^7.0.5"
 
 icss-utils@^4.1.0:
   version "4.1.0"
@@ -16344,6 +16368,13 @@ icss-utils@^4.1.0:
   dependencies:
     postcss "^7.0.14"
 
+icss-utils@^4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/icss-utils/-/icss-utils-4.1.1.tgz#21170b53789ee27447c2f47dd683081403f9a467"
+  integrity sha512-4aFq7wvWyMHKgxsH8QQtGpvbASCf+eM3wPRLI6R+MgAnTCZ6STYsRvttLvRWK0Nfif5piF394St3HeJDaljGPA==
+  dependencies:
+    postcss "^7.0.14"
+
 idx@^2.5.6:
   version "2.5.6"
   resolved "https://registry.yarnpkg.com/idx/-/idx-2.5.6.tgz#1f824595070100ae9ad585c86db08dc74f83a59d"
@@ -16551,16 +16582,21 @@ inflight@^1.0.4:
     once "^1.3.0"
     wrappy "1"
 
-inherits@2, inherits@2.0.3, inherits@^2.0.1, inherits@^2.0.3, inherits@~2.0.0, inherits@~2.0.1, inherits@~2.0.3:
-  version "2.0.3"
-  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.3.tgz#633c2c83e3da42a502f52466022480f4208261de"
-  integrity sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=
+inherits@2, inherits@~2.0.3:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz#0fa2c64f932917c3433a0ded55363aae37416b7c"
+  integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
 
 inherits@2.0.1:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.1.tgz#b17d08d326b4423e568eff719f91b0b1cbdf69f1"
   integrity sha1-sX0I0ya0Qj5Wjv9xn5GwscvfafE=
 
+inherits@2.0.3, inherits@^2.0.1, inherits@^2.0.3, inherits@~2.0.0, inherits@~2.0.1:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/inherits/-/inherits-2.0.3.tgz#633c2c83e3da42a502f52466022480f4208261de"
+  integrity sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=
+
 ini@^1.2.0, ini@^1.3.4, ini@^1.3.5, ini@~1.3.0:
   version "1.3.5"
   resolved "https://registry.yarnpkg.com/ini/-/ini-1.3.5.tgz#eee25f56db1c9ec6085e0c22778083f596abf927"
@@ -18203,6 +18239,14 @@ jest-worker@^24.9.0:
     merge-stream "^2.0.0"
     supports-color "^6.1.0"
 
+jest-worker@^25.1.0:
+  version "25.1.0"
+  resolved "https://registry.yarnpkg.com/jest-worker/-/jest-worker-25.1.0.tgz#75d038bad6fdf58eba0d2ec1835856c497e3907a"
+  integrity sha512-ZHhHtlxOWSxCoNOKHGbiLzXnl42ga9CxDr27H36Qn+15pQZd3R/F24jrmjDelw9j/iHUIWMWs08/u2QN50HHOg==
+  dependencies:
+    merge-stream "^2.0.0"
+    supports-color "^7.0.0"
+
 jest@^24.9.0:
   version "24.9.0"
   resolved "https://registry.yarnpkg.com/jest/-/jest-24.9.0.tgz#987d290c05a08b52c56188c1002e368edb007171"
@@ -20602,10 +20646,10 @@ minipass@^2.8.6:
     safe-buffer "^5.1.2"
     yallist "^3.0.0"
 
-minipass@^3.0.0:
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/minipass/-/minipass-3.0.1.tgz#b4fec73bd61e8a40f0b374ddd04260ade2c8ec20"
-  integrity sha512-2y5okJ4uBsjoD2vAbLKL9EUQPPkC0YMIp+2mZOXG3nBba++pdfJWRxx2Ewirc0pwAJYu4XtWg2EkVo1nRXuO/w==
+minipass@^3.0.0, minipass@^3.1.1:
+  version "3.1.1"
+  resolved "https://registry.yarnpkg.com/minipass/-/minipass-3.1.1.tgz#7607ce778472a185ad6d89082aa2070f79cedcd5"
+  integrity sha512-UFqVihv6PQgwj8/yTGvl9kPz7xIAY+R5z6XYjRInD3Gk3qx6QGSD6zEcpeG4Dy/lQnv1J6zv8ejV90hyYIKf3w==
   dependencies:
     yallist "^4.0.0"
 
@@ -22215,10 +22259,10 @@ p-limit@^2.0.0:
   dependencies:
     p-try "^2.0.0"
 
-p-limit@^2.2.0:
-  version "2.2.0"
-  resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.2.0.tgz#417c9941e6027a9abcba5092dd2904e255b5fbc2"
-  integrity sha512-pZbTJpoUsCzV48Mc9Nh51VbwO0X9cuPFE8gYwx9BTCt9SF8/b7Zljd2fVgOxhIF/HDTKgpVzs+GPhyKfjLLFRQ==
+p-limit@^2.2.0, p-limit@^2.2.2:
+  version "2.2.2"
+  resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.2.2.tgz#61279b67721f5287aa1c13a9a7fbbc48c9291b1e"
+  integrity sha512-WGR+xHecKTr7EbUEhyLSh5Dube9JtdiG78ufaeLxTgpudf/20KqyMioIUZJAezlTIi6evxuoUs9YXc11cU+yzQ==
   dependencies:
     p-try "^2.0.0"
 
@@ -22299,9 +22343,9 @@ p-try@^1.0.0:
   integrity sha1-y8ec26+P1CKOE/Yh8rGiN8GyB7M=
 
 p-try@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.0.0.tgz#85080bb87c64688fa47996fe8f7dfbe8211760b1"
-  integrity sha512-hMp0onDKIajHfIkdRk3P4CdCmErkYAxxDtP3Wx/4nZ3aGlau2VKh3mZpcuFkH27WQkL/3WBCPOktzA9ZOAnMQQ==
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz#cb2868540e313d61de58fafbe35ce9004d5540e6"
+  integrity sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==
 
 package-hash@^3.0.0:
   version "3.0.0"
@@ -23292,7 +23336,7 @@ private@^0.1.6, private@^0.1.8, private@~0.1.5:
   resolved "https://registry.yarnpkg.com/private/-/private-0.1.8.tgz#2381edb3689f7a53d653190060fcf822d2f368ff"
   integrity sha512-VvivMrbvd2nKkiG38qjULzlc+4Vx4wm/whI9pQD35YrARNnhxeiRktSOhSukRLFNlzg6Br/cJPet5J/u19r/mg==
 
-process-nextick-args@^2.0.0, process-nextick-args@~2.0.0:
+process-nextick-args@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.0.tgz#a37d732f4271b4ab1ad070d35508e8290788ffaa"
   integrity sha512-MtEC1TqN0EU5nephaJ4rAtThHtC86dNN9qCuEhtshvpVBkAW5ZO7BASN9REnF9eoXGcRub+pFuKEpOHE+HbEMw==
@@ -23302,6 +23346,11 @@ process-nextick-args@~1.0.6:
   resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-1.0.7.tgz#150e20b756590ad3f91093f25a4f2ad8bff30ba3"
   integrity sha1-FQ4gt1ZZCtP5EJPyWk8q2L/zC6M=
 
+process-nextick-args@~2.0.0:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.1.tgz#7820d9b16120cc55ca9ae7792680ae7dba6d7fe2"
+  integrity sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==
+
 process@^0.11.10:
   version "0.11.10"
   resolved "https://registry.yarnpkg.com/process/-/process-0.11.10.tgz#7332300e840161bda3e69a1d1d91a7d4bc16f182"
@@ -24931,10 +24980,10 @@ read-pkg@^5.1.1, read-pkg@^5.2.0:
     parse-json "^5.0.0"
     type-fest "^0.6.0"
 
-"readable-stream@1 || 2", readable-stream@^2.0.0, readable-stream@^2.0.1, readable-stream@^2.0.2, readable-stream@^2.0.4, readable-stream@^2.0.5, readable-stream@^2.0.6, readable-stream@^2.1.5, readable-stream@^2.2.2, readable-stream@^2.3.0, readable-stream@^2.3.3, readable-stream@^2.3.5, readable-stream@^2.3.6, readable-stream@~2.3.3, readable-stream@~2.3.6:
-  version "2.3.6"
-  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.6.tgz#b11c27d88b8ff1fbe070643cf94b0c79ae1b0aaf"
-  integrity sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==
+"readable-stream@1 || 2":
+  version "2.3.7"
+  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.7.tgz#1eca1cf711aef814c04f62252a36a62f6cb23b57"
+  integrity sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==
   dependencies:
     core-util-is "~1.0.0"
     inherits "~2.0.3"
@@ -24963,6 +25012,19 @@ readable-stream@1.0:
     string_decoder "^1.1.1"
     util-deprecate "^1.0.1"
 
+readable-stream@^2.0.0, readable-stream@^2.0.1, readable-stream@^2.0.2, readable-stream@^2.0.4, readable-stream@^2.0.5, readable-stream@^2.0.6, readable-stream@^2.1.5, readable-stream@^2.2.2, readable-stream@^2.3.0, readable-stream@^2.3.3, readable-stream@^2.3.5, readable-stream@^2.3.6, readable-stream@~2.3.3, readable-stream@~2.3.6:
+  version "2.3.6"
+  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.6.tgz#b11c27d88b8ff1fbe070643cf94b0c79ae1b0aaf"
+  integrity sha512-tQtKA9WIAhBF3+VLAseyMqZeBjW0AHJoxOtYqSUZNJxauErmLbVm2FW1y+J/YA9dUrAC39ITejlZWhVIwawkKw==
+  dependencies:
+    core-util-is "~1.0.0"
+    inherits "~2.0.3"
+    isarray "~1.0.0"
+    process-nextick-args "~2.0.0"
+    safe-buffer "~5.1.1"
+    string_decoder "~1.1.1"
+    util-deprecate "~1.0.1"
+
 readable-stream@~1.1.0:
   version "1.1.14"
   resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-1.1.14.tgz#7cf4c54ef648e3813084c636dd2079e166c081d9"
@@ -25993,7 +26055,7 @@ right-align@^0.1.1:
   dependencies:
     align-text "^0.1.1"
 
-rimraf@2, rimraf@^2.2.0, rimraf@^2.2.8, rimraf@^2.5.1, rimraf@^2.5.4, rimraf@^2.6.0, rimraf@^2.6.1, rimraf@^2.6.2:
+rimraf@2, rimraf@^2.2.0, rimraf@^2.2.8, rimraf@^2.5.1, rimraf@^2.6.0, rimraf@^2.6.1, rimraf@^2.6.2:
   version "2.6.2"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.6.2.tgz#2ed8150d24a16ea8651e6d6ef0f47c4158ce7a36"
   integrity sha512-lreewLK/BlghmxtfH36YYVg1i8IAce4TI7oao75I1g245+6BctqTVQiBP3YUJ9C6DQOXJmkYR9X9fCLtCOJc5w==
@@ -26014,7 +26076,7 @@ rimraf@3.0.0, rimraf@^3.0.0:
   dependencies:
     glob "^7.1.3"
 
-rimraf@^2.7.1:
+rimraf@^2.5.4, rimraf@^2.7.1:
   version "2.7.1"
   resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz#35797f13a7fdadc566142c29d4f07ccad483e3ec"
   integrity sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==
@@ -26397,10 +26459,10 @@ schema-utils@^2.0.0, schema-utils@^2.0.1:
     ajv "^6.1.0"
     ajv-keywords "^3.1.0"
 
-schema-utils@^2.4.1:
-  version "2.4.1"
-  resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-2.4.1.tgz#e89ade5d056dc8bcaca377574bb4a9c4e1b8be56"
-  integrity sha512-RqYLpkPZX5Oc3fw/kHHHyP56fg5Y+XBpIpV8nCg0znIALfq3OH+Ea9Hfeac9BAMwG5IICltiZ0vxFvJQONfA5w==
+schema-utils@^2.4.1, schema-utils@^2.6.4:
+  version "2.6.4"
+  resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-2.6.4.tgz#a27efbf6e4e78689d91872ee3ccfa57d7bdd0f53"
+  integrity sha512-VNjcaUxVnEeun6B2fiiUDjXXBtD4ZSH7pdbfIu1pOFwgptDPLMo/z9jr4sUfsjFVPqDCEin/F7IYlq7/E6yDbQ==
   dependencies:
     ajv "^6.10.2"
     ajv-keywords "^3.4.1"
@@ -26532,21 +26594,16 @@ semver@^5.5.1:
   resolved "https://registry.yarnpkg.com/semver/-/semver-5.5.1.tgz#7dfdd8814bdb7cabc7be0fb1d734cfb66c940477"
   integrity sha512-PqpAxfrEhlSUWge8dwIp4tZnQ25DIOthpiaHNIthsjEFQD6EvqUKUDM7L8O2rShkFccYo1VjJR0coWfNkCubRw==
 
-semver@^6.0.0:
-  version "6.1.2"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-6.1.2.tgz#079960381376a3db62eb2edc8a3bfb10c7cfe318"
-  integrity sha512-z4PqiCpomGtWj8633oeAdXm1Kn1W++3T8epkZYnwiVgIYIJ0QHszhInYSJTYxebByQH7KVCEAn8R9duzZW2PhQ==
+semver@^6.0.0, semver@^6.1.1, semver@^6.1.2, semver@^6.2.0, semver@^6.3.0:
+  version "6.3.0"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d"
+  integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==
 
 semver@^6.1.0:
   version "6.1.1"
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.1.1.tgz#53f53da9b30b2103cd4f15eab3a18ecbcb210c9b"
   integrity sha512-rWYq2e5iYW+fFe/oPPtYJxYgjBm8sC4rmoGdUOgBB7VnwKt6HrL793l2voH1UlsyYZpJ4g0wfjnTEO1s1NP2eQ==
 
-semver@^6.1.1, semver@^6.1.2, semver@^6.2.0, semver@^6.3.0:
-  version "6.3.0"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz#ee0a64c8af5e8ceea67687b133761e1becbd1d3d"
-  integrity sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==
-
 semver@~5.3.0:
   version "5.3.0"
   resolved "https://registry.yarnpkg.com/semver/-/semver-5.3.0.tgz#9b2ce5d3de02d17c6012ad326aa6b4d0cf54f94f"
@@ -26598,7 +26655,7 @@ sentence-case@^2.1.0:
     no-case "^2.2.0"
     upper-case-first "^1.1.2"
 
-serialize-javascript@^1.7.0, serialize-javascript@^2.1.0, serialize-javascript@^2.1.1, serialize-javascript@^2.1.2:
+serialize-javascript@^1.7.0, serialize-javascript@^2.1.1, serialize-javascript@^2.1.2:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-2.1.1.tgz#952907a04a3e3a75af7f73d92d15e233862048b2"
   integrity sha512-MPLPRpD4FNqWq9tTIjYG5LesFouDhdyH0EPY3gVK4DRD5+g4aDqdNSzLIwceulo3Yj+PL1bPh6laE5+H6LTcrQ==
@@ -27123,9 +27180,9 @@ sort-on@^3.0.0:
     dot-prop "^4.1.1"
 
 source-list-map@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.0.tgz#aaa47403f7b245a92fbc97ea08f250d6087ed085"
-  integrity sha512-I2UmuJSRr/T8jisiROLU3A3ltr+swpniSmNPI4Ml3ZCX6tVnDsuZzK7F2hl5jTqbZBWCEKlj5HRQiPExXLgE8A==
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.1.tgz#3993bd873bfc48479cca9ea3a547835c7c154b34"
+  integrity sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==
 
 source-map-resolve@^0.5.0, source-map-resolve@^0.5.2:
   version "0.5.2"
@@ -27395,12 +27452,12 @@ ssri@^6.0.1:
     figgy-pudding "^3.5.1"
 
 ssri@^7.0.0:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/ssri/-/ssri-7.0.1.tgz#b0cab7bbb11ac9ea07f003453e2011f8cbed9f34"
-  integrity sha512-FfndBvkXL9AHyGLNzU3r9AvYIBBZ7gm+m+kd0p8cT3/v4OliMAyipZAhLVEv1Zi/k4QFq9CstRGVd9pW/zcHFQ==
+  version "7.1.0"
+  resolved "https://registry.yarnpkg.com/ssri/-/ssri-7.1.0.tgz#92c241bf6de82365b5c7fb4bd76e975522e1294d"
+  integrity sha512-77/WrDZUWocK0mvA5NTRQyveUf+wsrIc6vyrxpS8tVvYBcX215QbafrJR3KtkpskIzoFLqqNuuYQvxaMjXJ/0g==
   dependencies:
     figgy-pudding "^3.5.1"
-    minipass "^3.0.0"
+    minipass "^3.1.1"
 
 stable@^0.1.8:
   version "0.1.8"
@@ -28491,21 +28548,22 @@ terser-webpack-plugin@^1.2.4, terser-webpack-plugin@^1.4.1:
     webpack-sources "^1.4.0"
     worker-farm "^1.7.0"
 
-terser-webpack-plugin@^2.1.2:
-  version "2.1.2"
-  resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-2.1.2.tgz#2b9b8147a6f18918348200800cf9560c50f701bb"
-  integrity sha512-MF/C4KABwqYOfRDi87f7gG07GP7Wj/kyiX938UxIGIO6l5mkh8XJL7xtS0hX/CRdVQaZI7ThGUPZbznrCjsGpg==
-  dependencies:
-    cacache "^13.0.0"
-    find-cache-dir "^3.0.0"
-    jest-worker "^24.9.0"
-    schema-utils "^2.4.1"
-    serialize-javascript "^2.1.0"
+terser-webpack-plugin@^2.3.4:
+  version "2.3.4"
+  resolved "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-2.3.4.tgz#ac045703bd8da0936ce910d8fb6350d0e1dee5fe"
+  integrity sha512-Nv96Nws2R2nrFOpbzF6IxRDpIkkIfmhvOws+IqMvYdFLO7o6wAILWFKONFgaYy8+T4LVz77DQW0f7wOeDEAjrg==
+  dependencies:
+    cacache "^13.0.1"
+    find-cache-dir "^3.2.0"
+    jest-worker "^25.1.0"
+    p-limit "^2.2.2"
+    schema-utils "^2.6.4"
+    serialize-javascript "^2.1.2"
     source-map "^0.6.1"
-    terser "^4.3.4"
+    terser "^4.4.3"
     webpack-sources "^1.4.3"
 
-terser@^4.1.2, terser@^4.3.4:
+terser@^4.1.2:
   version "4.6.1"
   resolved "https://registry.yarnpkg.com/terser/-/terser-4.6.1.tgz#913e35e0d38a75285a7913ba01d753c4089ebdbd"
   integrity sha512-w0f2OWFD7ka3zwetgVAhNMeyzEbj39ht2Tb0qKflw9PmW9Qbo5tjTh01QJLkhO9t9RDDQYvk+WXqpECI2C6i2A==
@@ -28514,6 +28572,15 @@ terser@^4.1.2, terser@^4.3.4:
     source-map "~0.6.1"
     source-map-support "~0.5.12"
 
+terser@^4.4.3:
+  version "4.6.3"
+  resolved "https://registry.yarnpkg.com/terser/-/terser-4.6.3.tgz#e33aa42461ced5238d352d2df2a67f21921f8d87"
+  integrity sha512-Lw+ieAXmY69d09IIc/yqeBqXpEQIpDGZqT34ui1QWXIUpR2RjbqEkT8X7Lgex19hslSqcWM5iMN2kM11eMsESQ==
+  dependencies:
+    commander "^2.20.0"
+    source-map "~0.6.1"
+    source-map-support "~0.5.12"
+
 test-exclude@^5.0.0, test-exclude@^5.2.3:
   version "5.2.3"
   resolved "https://registry.yarnpkg.com/test-exclude/-/test-exclude-5.2.3.tgz#c3d3e1e311eb7ee405e092dac10aefd09091eac0"
@@ -28954,10 +29021,10 @@ traverse@0.6.6, traverse@^0.6.6, traverse@~0.6.6:
   resolved "https://registry.yarnpkg.com/traverse/-/traverse-0.6.6.tgz#cbdf560fd7b9af632502fed40f918c157ea97137"
   integrity sha1-y99WD9e5r2MlAv7UD5GMFX6pcTc=
 
-tree-kill@^1.2.1:
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/tree-kill/-/tree-kill-1.2.1.tgz#5398f374e2f292b9dcc7b2e71e30a5c3bb6c743a"
-  integrity sha512-4hjqbObwlh2dLyW4tcz0Ymw0ggoaVDMveUB9w8kFSQScdRLo0gxO9J7WFcUBo+W3C1TLdFIEwNOWebgZZ0RH9Q==
+tree-kill@^1.2.2:
+  version "1.2.2"
+  resolved "https://registry.yarnpkg.com/tree-kill/-/tree-kill-1.2.2.tgz#4ca09a9092c88b73a7cdc5e8a01b507b0790a0cc"
+  integrity sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==
 
 treeify@^1.0.1, treeify@^1.1.0:
   version "1.1.0"
@@ -29906,9 +29973,9 @@ unique-filename@^1.1.1:
     unique-slug "^2.0.0"
 
 unique-slug@^2.0.0:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/unique-slug/-/unique-slug-2.0.1.tgz#5e9edc6d1ce8fb264db18a507ef9bd8544451ca6"
-  integrity sha512-n9cU6+gITaVu7VGj1Z8feKMmfAjEAQGhwD9fE3zvpRRa0wEIx8ODYkVGfSc94M2OX00tUFV8wH3zYbm1I8mxFg==
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/unique-slug/-/unique-slug-2.0.2.tgz#baabce91083fc64e945b0f3ad613e264f7cd4e6c"
+  integrity sha512-zoWr9ObaxALD3DOPfjPSqxt4fnZiWblxHIgeWqW8x7UqDzEtHEQLzji2cuJYQFCU6KmoJikOYAZlrTHHebjx2w==
   dependencies:
     imurmurhash "^0.1.4"
 
@@ -30242,7 +30309,7 @@ utila@^0.4.0, utila@~0.4:
   resolved "https://registry.yarnpkg.com/utila/-/utila-0.4.0.tgz#8a16a05d445657a3aea5eecc5b12a4fa5379772c"
   integrity sha1-ihagXURWV6Oupe7MWxKk+lN5dyw=
 
-utility-types@^3.10.0, utility-types@^3.9.0:
+utility-types@^3.10.0:
   version "3.10.0"
   resolved "https://registry.yarnpkg.com/utility-types/-/utility-types-3.10.0.tgz#ea4148f9a741015f05ed74fd615e1d20e6bed82b"
   integrity sha512-O11mqxmi7wMKCo6HKFt5AhO4BwY3VV68YU07tgxfz8zJTIxr4BpsezN49Ffwy9j3ZpwwJp4fkRwjRzq3uWE6Rg==
@@ -31825,11 +31892,16 @@ yallist@^2.1.2:
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-2.1.2.tgz#1c11f9218f076089a47dd512f93c6699a6a81d52"
   integrity sha1-HBH5IY8HYImkfdUS+TxmmaaoHVI=
 
-yallist@^3.0.0, yallist@^3.0.2:
+yallist@^3.0.0:
   version "3.0.2"
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.0.2.tgz#8452b4bb7e83c7c188d8041c1a837c773d6d8bb9"
   integrity sha1-hFK0u36Dx8GI2AQcGoN8dz1ti7k=
 
+yallist@^3.0.2:
+  version "3.1.1"
+  resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.1.1.tgz#dbb7daf9bfd8bac9ab45ebf602b8cbad0d5d08fd"
+  integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==
+
 yallist@^3.0.3:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.0.3.tgz#b4b049e314be545e3ce802236d6cd22cd91c3de9"