From eb71e599ce2dbdb2062389257d64f7761e9e6e08 Mon Sep 17 00:00:00 2001
From: Clint Andrew Hall <clint.hall@elastic.co>
Date: Tue, 21 Jul 2020 14:12:56 -0400
Subject: [PATCH 01/34] [pre-req] Convert Page Manager, Page Preview, DOM
 Preview (#70370)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Corey Robertson <corey.robertson@elastic.co>
---
 x-pack/plugins/canvas/i18n/components.ts      |  16 ++
 .../{dom_preview.js => dom_preview.tsx}       |  53 +++++--
 .../public/components/dom_preview/index.js    |   9 --
 .../index.js => dom_preview/index.ts}         |   2 +-
 .../components/link/{index.js => index.ts}    |   0
 .../canvas/public/components/link/link.js     |  63 --------
 .../canvas/public/components/link/link.tsx    |  72 +++++++++
 .../public/components/page_manager/index.js   |  37 -----
 .../public/components/page_manager/index.ts   |  31 ++++
 .../{page_manager.js => page_manager.tsx}     | 148 ++++++++++--------
 .../public/components/page_preview/index.ts   |  24 +++
 .../{page_controls.js => page_controls.tsx}   |  21 ++-
 .../{page_preview.js => page_preview.tsx}     |  35 ++---
 .../public/components/toolbar/toolbar.tsx     |   3 +-
 .../canvas/public/lib/create_handlers.ts      |   2 +-
 15 files changed, 292 insertions(+), 224 deletions(-)
 rename x-pack/plugins/canvas/public/components/dom_preview/{dom_preview.js => dom_preview.tsx} (71%)
 delete mode 100644 x-pack/plugins/canvas/public/components/dom_preview/index.js
 rename x-pack/plugins/canvas/public/components/{page_preview/index.js => dom_preview/index.ts} (84%)
 rename x-pack/plugins/canvas/public/components/link/{index.js => index.ts} (100%)
 delete mode 100644 x-pack/plugins/canvas/public/components/link/link.js
 create mode 100644 x-pack/plugins/canvas/public/components/link/link.tsx
 delete mode 100644 x-pack/plugins/canvas/public/components/page_manager/index.js
 create mode 100644 x-pack/plugins/canvas/public/components/page_manager/index.ts
 rename x-pack/plugins/canvas/public/components/page_manager/{page_manager.js => page_manager.tsx} (63%)
 create mode 100644 x-pack/plugins/canvas/public/components/page_preview/index.ts
 rename x-pack/plugins/canvas/public/components/page_preview/{page_controls.js => page_controls.tsx} (75%)
 rename x-pack/plugins/canvas/public/components/page_preview/{page_preview.js => page_preview.tsx} (56%)

diff --git a/x-pack/plugins/canvas/i18n/components.ts b/x-pack/plugins/canvas/i18n/components.ts
index 78083f26a38b1..acc55d50ae19a 100644
--- a/x-pack/plugins/canvas/i18n/components.ts
+++ b/x-pack/plugins/canvas/i18n/components.ts
@@ -567,6 +567,22 @@ export const ComponentStrings = {
           pageNumber,
         },
       }),
+    getAddPageTooltip: () =>
+      i18n.translate('xpack.canvas.pageManager.addPageTooltip', {
+        defaultMessage: 'Add a new page to this workpad',
+      }),
+    getConfirmRemoveTitle: () =>
+      i18n.translate('xpack.canvas.pageManager.confirmRemoveTitle', {
+        defaultMessage: 'Remove Page',
+      }),
+    getConfirmRemoveDescription: () =>
+      i18n.translate('xpack.canvas.pageManager.confirmRemoveDescription', {
+        defaultMessage: 'Are you sure you want to remove this page?',
+      }),
+    getConfirmRemoveButtonLabel: () =>
+      i18n.translate('xpack.canvas.pageManager.removeButtonLabel', {
+        defaultMessage: 'Remove',
+      }),
   },
   PagePreviewPageControls: {
     getClonePageAriaLabel: () =>
diff --git a/x-pack/plugins/canvas/public/components/dom_preview/dom_preview.js b/x-pack/plugins/canvas/public/components/dom_preview/dom_preview.tsx
similarity index 71%
rename from x-pack/plugins/canvas/public/components/dom_preview/dom_preview.js
rename to x-pack/plugins/canvas/public/components/dom_preview/dom_preview.tsx
index f74862af8d105..6ec0276c2f49f 100644
--- a/x-pack/plugins/canvas/public/components/dom_preview/dom_preview.js
+++ b/x-pack/plugins/canvas/public/components/dom_preview/dom_preview.tsx
@@ -4,30 +4,38 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { PureComponent } from 'react';
 import PropTypes from 'prop-types';
 import { debounce } from 'lodash';
 
-export class DomPreview extends React.Component {
+interface Props {
+  elementId: string;
+  height: number;
+}
+
+export class DomPreview extends PureComponent<Props> {
   static propTypes = {
     elementId: PropTypes.string.isRequired,
     height: PropTypes.number.isRequired,
   };
 
+  _container: HTMLDivElement | null = null;
+  _content: HTMLDivElement | null = null;
+  _observer: MutationObserver | null = null;
+  _original: Element | null = null;
+  _updateTimeout: number = 0;
+
   componentDidMount() {
     this.update();
   }
 
   componentWillUnmount() {
     clearTimeout(this._updateTimeout);
-    this._observer && this._observer.disconnect(); // observer not guaranteed to exist
-  }
 
-  _container = null;
-  _content = null;
-  _observer = null;
-  _original = null;
-  _updateTimeout = null;
+    if (this._observer) {
+      this._observer.disconnect(); // observer not guaranteed to exist
+    }
+  }
 
   update = () => {
     if (!this._content || !this._container) {
@@ -38,7 +46,10 @@ export class DomPreview extends React.Component {
     const originalChanged = currentOriginal !== this._original;
 
     if (originalChanged) {
-      this._observer && this._observer.disconnect();
+      if (this._observer) {
+        this._observer.disconnect();
+      }
+
       this._original = currentOriginal;
 
       if (this._original) {
@@ -50,12 +61,16 @@ export class DomPreview extends React.Component {
         this._observer.observe(this._original, config);
       } else {
         clearTimeout(this._updateTimeout); // to avoid the assumption that we fully control when `update` is called
-        this._updateTimeout = setTimeout(this.update, 30);
+        this._updateTimeout = window.setTimeout(this.update, 30);
         return;
       }
     }
 
-    const thumb = this._original.cloneNode(true);
+    if (!this._original) {
+      return;
+    }
+
+    const thumb = this._original.cloneNode(true) as HTMLDivElement;
     thumb.id += '-thumb';
 
     const originalStyle = window.getComputedStyle(this._original, null);
@@ -66,9 +81,10 @@ export class DomPreview extends React.Component {
     const scale = thumbHeight / originalHeight;
     const thumbWidth = originalWidth * scale;
 
-    if (this._content.hasChildNodes()) {
+    if (this._content.firstChild) {
       this._content.removeChild(this._content.firstChild);
     }
+
     this._content.appendChild(thumb);
 
     this._content.style.cssText = `transform: scale(${scale}); transform-origin: top left;`;
@@ -76,13 +92,16 @@ export class DomPreview extends React.Component {
 
     // Copy canvas data
     const originalCanvas = this._original.querySelectorAll('canvas');
-    const thumbCanvas = thumb.querySelectorAll('canvas');
+    const thumbCanvas = (thumb as Element).querySelectorAll('canvas');
 
     // Cloned canvas elements are blank and need to be explicitly redrawn
     if (originalCanvas.length > 0) {
-      Array.from(originalCanvas).map((img, i) =>
-        thumbCanvas[i].getContext('2d').drawImage(img, 0, 0)
-      );
+      Array.from(originalCanvas).map((img, i) => {
+        const context = thumbCanvas[i].getContext('2d');
+        if (context) {
+          context.drawImage(img, 0, 0);
+        }
+      });
     }
   };
 
diff --git a/x-pack/plugins/canvas/public/components/dom_preview/index.js b/x-pack/plugins/canvas/public/components/dom_preview/index.js
deleted file mode 100644
index 283f92c7ecd9b..0000000000000
--- a/x-pack/plugins/canvas/public/components/dom_preview/index.js
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { DomPreview as Component } from './dom_preview';
-
-export const DomPreview = Component;
diff --git a/x-pack/plugins/canvas/public/components/page_preview/index.js b/x-pack/plugins/canvas/public/components/dom_preview/index.ts
similarity index 84%
rename from x-pack/plugins/canvas/public/components/page_preview/index.js
rename to x-pack/plugins/canvas/public/components/dom_preview/index.ts
index d72d6403dd5be..19980b7c2cfe5 100644
--- a/x-pack/plugins/canvas/public/components/page_preview/index.js
+++ b/x-pack/plugins/canvas/public/components/dom_preview/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { PagePreview } from './page_preview';
+export { DomPreview } from './dom_preview';
diff --git a/x-pack/plugins/canvas/public/components/link/index.js b/x-pack/plugins/canvas/public/components/link/index.ts
similarity index 100%
rename from x-pack/plugins/canvas/public/components/link/index.js
rename to x-pack/plugins/canvas/public/components/link/index.ts
diff --git a/x-pack/plugins/canvas/public/components/link/link.js b/x-pack/plugins/canvas/public/components/link/link.js
deleted file mode 100644
index d973164190592..0000000000000
--- a/x-pack/plugins/canvas/public/components/link/link.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import PropTypes from 'prop-types';
-import { EuiLink } from '@elastic/eui';
-
-import { ComponentStrings } from '../../../i18n';
-
-const { Link: strings } = ComponentStrings;
-
-const isModifiedEvent = (ev) => !!(ev.metaKey || ev.altKey || ev.ctrlKey || ev.shiftKey);
-
-export class Link extends React.PureComponent {
-  static propTypes = {
-    target: PropTypes.string,
-    onClick: PropTypes.func,
-    name: PropTypes.string.isRequired,
-    params: PropTypes.object,
-    children: PropTypes.oneOfType([PropTypes.string, PropTypes.number, PropTypes.node]).isRequired,
-  };
-
-  static contextTypes = {
-    router: PropTypes.object,
-  };
-
-  navigateTo = (name, params) => (ev) => {
-    if (this.props.onClick) {
-      this.props.onClick(ev);
-    }
-
-    if (
-      !ev.defaultPrevented && // onClick prevented default
-      ev.button === 0 && // ignore everything but left clicks
-      !this.props.target && // let browser handle "target=_blank" etc.
-      !isModifiedEvent(ev) // ignore clicks with modifier keys
-    ) {
-      ev.preventDefault();
-      this.context.router.navigateTo(name, params);
-    }
-  };
-
-  render() {
-    try {
-      const { name, params, children, ...linkArgs } = this.props;
-      const { router } = this.context;
-      const href = router.getFullPath(router.create(name, params));
-      const props = {
-        ...linkArgs,
-        href,
-        onClick: this.navigateTo(name, params),
-      };
-
-      return <EuiLink {...props}>{children}</EuiLink>;
-    } catch (e) {
-      console.error(e);
-      return <div>{strings.getErrorMessage(e.message)}</div>;
-    }
-  }
-}
diff --git a/x-pack/plugins/canvas/public/components/link/link.tsx b/x-pack/plugins/canvas/public/components/link/link.tsx
new file mode 100644
index 0000000000000..b0289fba842d1
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/link/link.tsx
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, MouseEvent, useContext } from 'react';
+import PropTypes from 'prop-types';
+import { EuiLink, EuiLinkProps } from '@elastic/eui';
+import { RouterContext } from '../router';
+
+import { ComponentStrings } from '../../../i18n';
+
+const { Link: strings } = ComponentStrings;
+
+const isModifiedEvent = (ev: MouseEvent) =>
+  !!(ev.metaKey || ev.altKey || ev.ctrlKey || ev.shiftKey);
+
+interface Props {
+  name: string;
+  params: Record<string, any>;
+}
+
+export const Link: FC<Props & EuiLinkProps> = ({
+  onClick,
+  target,
+  name,
+  params,
+  children,
+  ...linkArgs
+}) => {
+  const router = useContext(RouterContext);
+
+  if (router) {
+    const navigateTo = (ev: MouseEvent<HTMLButtonElement, globalThis.MouseEvent>) => {
+      if (onClick) {
+        onClick(ev);
+      }
+
+      if (
+        !ev.defaultPrevented && // onClick prevented default
+        ev.button === 0 && // ignore everything but left clicks
+        !target && // let browser handle "target=_blank" etc.
+        !isModifiedEvent(ev) // ignore clicks with modifier keys
+      ) {
+        ev.preventDefault();
+        router.navigateTo(name, params);
+      }
+    };
+
+    try {
+      return (
+        <EuiLink {...linkArgs} target={target} onClick={navigateTo}>
+          {children}
+        </EuiLink>
+      );
+    } catch (e) {
+      return <div>{strings.getErrorMessage(e.message)}</div>;
+    }
+  }
+
+  return <div>{strings.getErrorMessage('Router Undefined')}</div>;
+};
+
+Link.contextTypes = {
+  router: PropTypes.object,
+};
+
+Link.propTypes = {
+  name: PropTypes.string.isRequired,
+  params: PropTypes.object,
+};
diff --git a/x-pack/plugins/canvas/public/components/page_manager/index.js b/x-pack/plugins/canvas/public/components/page_manager/index.js
deleted file mode 100644
index a198b7b8c3d8c..0000000000000
--- a/x-pack/plugins/canvas/public/components/page_manager/index.js
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { connect } from 'react-redux';
-import { compose, withState } from 'recompose';
-import * as pageActions from '../../state/actions/pages';
-import { canUserWrite } from '../../state/selectors/app';
-import { getSelectedPage, getWorkpad, getPages, isWriteable } from '../../state/selectors/workpad';
-import { DEFAULT_WORKPAD_CSS } from '../../../common/lib/constants';
-import { PageManager as Component } from './page_manager';
-
-const mapStateToProps = (state) => {
-  const { id, css } = getWorkpad(state);
-
-  return {
-    isWriteable: isWriteable(state) && canUserWrite(state),
-    pages: getPages(state),
-    selectedPage: getSelectedPage(state),
-    workpadId: id,
-    workpadCSS: css || DEFAULT_WORKPAD_CSS,
-  };
-};
-
-const mapDispatchToProps = (dispatch) => ({
-  addPage: () => dispatch(pageActions.addPage()),
-  movePage: (id, position) => dispatch(pageActions.movePage(id, position)),
-  duplicatePage: (id) => dispatch(pageActions.duplicatePage(id)),
-  removePage: (id) => dispatch(pageActions.removePage(id)),
-});
-
-export const PageManager = compose(
-  connect(mapStateToProps, mapDispatchToProps),
-  withState('deleteId', 'setDeleteId', null)
-)(Component);
diff --git a/x-pack/plugins/canvas/public/components/page_manager/index.ts b/x-pack/plugins/canvas/public/components/page_manager/index.ts
new file mode 100644
index 0000000000000..d19540cd6a687
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/page_manager/index.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Dispatch } from 'redux';
+import { connect } from 'react-redux';
+// @ts-expect-error untyped local
+import * as pageActions from '../../state/actions/pages';
+import { canUserWrite } from '../../state/selectors/app';
+import { getSelectedPage, getWorkpad, getPages, isWriteable } from '../../state/selectors/workpad';
+import { DEFAULT_WORKPAD_CSS } from '../../../common/lib/constants';
+import { PageManager as Component } from './page_manager';
+import { State } from '../../../types';
+
+const mapStateToProps = (state: State) => ({
+  isWriteable: isWriteable(state) && canUserWrite(state),
+  pages: getPages(state),
+  selectedPage: getSelectedPage(state),
+  workpadId: getWorkpad(state).id,
+  workpadCSS: getWorkpad(state).css || DEFAULT_WORKPAD_CSS,
+});
+
+const mapDispatchToProps = (dispatch: Dispatch) => ({
+  onAddPage: () => dispatch(pageActions.addPage()),
+  onMovePage: (id: string, position: number) => dispatch(pageActions.movePage(id, position)),
+  onRemovePage: (id: string) => dispatch(pageActions.removePage(id)),
+});
+
+export const PageManager = connect(mapStateToProps, mapDispatchToProps)(Component);
diff --git a/x-pack/plugins/canvas/public/components/page_manager/page_manager.js b/x-pack/plugins/canvas/public/components/page_manager/page_manager.tsx
similarity index 63%
rename from x-pack/plugins/canvas/public/components/page_manager/page_manager.js
rename to x-pack/plugins/canvas/public/components/page_manager/page_manager.tsx
index 3e2ff9dfe2b22..edc0d6201495b 100644
--- a/x-pack/plugins/canvas/public/components/page_manager/page_manager.js
+++ b/x-pack/plugins/canvas/public/components/page_manager/page_manager.tsx
@@ -4,38 +4,63 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Fragment } from 'react';
+import React, { Fragment, Component } from 'react';
 import PropTypes from 'prop-types';
 import { EuiIcon, EuiFlexGroup, EuiFlexItem, EuiText, EuiToolTip } from '@elastic/eui';
-import { DragDropContext, Droppable, Draggable } from 'react-beautiful-dnd';
+import { DragDropContext, Droppable, Draggable, DragDropContextProps } from 'react-beautiful-dnd';
+// @ts-expect-error untyped dependency
 import Style from 'style-it';
+
 import { ConfirmModal } from '../confirm_modal';
 import { Link } from '../link';
 import { PagePreview } from '../page_preview';
 
 import { ComponentStrings } from '../../../i18n';
+import { CanvasPage } from '../../../types';
 
 const { PageManager: strings } = ComponentStrings;
 
-export class PageManager extends React.PureComponent {
+export interface Props {
+  isWriteable: boolean;
+  onAddPage: () => void;
+  onMovePage: (pageId: string, position: number) => void;
+  onPreviousPage: () => void;
+  onRemovePage: (pageId: string) => void;
+  pages: CanvasPage[];
+  selectedPage?: string;
+  workpadCSS?: string;
+  workpadId: string;
+}
+
+interface State {
+  showTrayPop: boolean;
+  removeId: string | null;
+}
+
+export class PageManager extends Component<Props, State> {
   static propTypes = {
     isWriteable: PropTypes.bool.isRequired,
+    onAddPage: PropTypes.func.isRequired,
+    onMovePage: PropTypes.func.isRequired,
+    onPreviousPage: PropTypes.func.isRequired,
+    onRemovePage: PropTypes.func.isRequired,
     pages: PropTypes.array.isRequired,
-    workpadId: PropTypes.string.isRequired,
-    addPage: PropTypes.func.isRequired,
-    movePage: PropTypes.func.isRequired,
-    previousPage: PropTypes.func.isRequired,
-    duplicatePage: PropTypes.func.isRequired,
-    removePage: PropTypes.func.isRequired,
     selectedPage: PropTypes.string,
-    deleteId: PropTypes.string,
-    setDeleteId: PropTypes.func.isRequired,
     workpadCSS: PropTypes.string,
+    workpadId: PropTypes.string.isRequired,
   };
 
-  state = {
-    showTrayPop: true,
-  };
+  constructor(props: Props) {
+    super(props);
+    this.state = {
+      showTrayPop: true,
+      removeId: null,
+    };
+  }
+
+  _isMounted: boolean = false;
+  _activePageRef: HTMLDivElement | null = null;
+  _pageListRef: HTMLDivElement | null = null;
 
   componentDidMount() {
     // keep track of whether or not the component is mounted, to prevent rogue setState calls
@@ -44,11 +69,13 @@ export class PageManager extends React.PureComponent {
     // gives the tray pop animation time to finish
     setTimeout(() => {
       this.scrollToActivePage();
-      this._isMounted && this.setState({ showTrayPop: false });
+      if (this._isMounted) {
+        this.setState({ showTrayPop: false });
+      }
     }, 1000);
   }
 
-  componentDidUpdate(prevProps) {
+  componentDidUpdate(prevProps: Props) {
     // scrolls to the active page on the next tick, otherwise new pages don't scroll completely into view
     if (prevProps.selectedPage !== this.props.selectedPage) {
       setTimeout(this.scrollToActivePage, 0);
@@ -60,33 +87,33 @@ export class PageManager extends React.PureComponent {
   }
 
   scrollToActivePage = () => {
-    if (this.activePageRef && this.pageListRef) {
+    if (this._activePageRef && this._pageListRef) {
       // not all target browsers support element.scrollTo
       // TODO: replace this with something more cross-browser, maybe scrollIntoView
-      if (!this.pageListRef.scrollTo) {
+      if (!this._pageListRef.scrollTo) {
         return;
       }
 
-      const pageOffset = this.activePageRef.offsetLeft;
+      const pageOffset = this._activePageRef.offsetLeft;
       const {
         left: pageLeft,
         right: pageRight,
         width: pageWidth,
-      } = this.activePageRef.getBoundingClientRect();
+      } = this._activePageRef.getBoundingClientRect();
       const {
         left: listLeft,
         right: listRight,
         width: listWidth,
-      } = this.pageListRef.getBoundingClientRect();
+      } = this._pageListRef.getBoundingClientRect();
 
       if (pageLeft < listLeft) {
-        this.pageListRef.scrollTo({
+        this._pageListRef.scrollTo({
           left: pageOffset,
           behavior: 'smooth',
         });
       }
       if (pageRight > listRight) {
-        this.pageListRef.scrollTo({
+        this._pageListRef.scrollTo({
           left: pageOffset - listWidth + pageWidth,
           behavior: 'smooth',
         });
@@ -94,22 +121,29 @@ export class PageManager extends React.PureComponent {
     }
   };
 
-  confirmDelete = (pageId) => {
-    this._isMounted && this.props.setDeleteId(pageId);
+  onConfirmRemove = (removeId: string) => {
+    if (this._isMounted) {
+      this.setState({ removeId });
+    }
   };
 
-  resetDelete = () => this._isMounted && this.props.setDeleteId(null);
+  resetRemove = () => this._isMounted && this.setState({ removeId: null });
+
+  doRemove = () => {
+    const { onPreviousPage, onRemovePage, selectedPage } = this.props;
+    const { removeId } = this.state;
+    this.resetRemove();
+
+    if (removeId === selectedPage) {
+      onPreviousPage();
+    }
 
-  doDelete = () => {
-    const { previousPage, removePage, deleteId, selectedPage } = this.props;
-    this.resetDelete();
-    if (deleteId === selectedPage) {
-      previousPage();
+    if (removeId !== null) {
+      onRemovePage(removeId);
     }
-    removePage(deleteId);
   };
 
-  onDragEnd = ({ draggableId: pageId, source, destination }) => {
+  onDragEnd: DragDropContextProps['onDragEnd'] = ({ draggableId: pageId, source, destination }) => {
     // dropped outside the list
     if (!destination) {
       return;
@@ -117,18 +151,11 @@ export class PageManager extends React.PureComponent {
 
     const position = destination.index - source.index;
 
-    this.props.movePage(pageId, position);
+    this.props.onMovePage(pageId, position);
   };
 
-  renderPage = (page, i) => {
-    const {
-      isWriteable,
-      selectedPage,
-      workpadId,
-      movePage,
-      duplicatePage,
-      workpadCSS,
-    } = this.props;
+  renderPage = (page: CanvasPage, i: number) => {
+    const { isWriteable, selectedPage, workpadId, workpadCSS } = this.props;
     const pageNumber = i + 1;
 
     return (
@@ -141,7 +168,7 @@ export class PageManager extends React.PureComponent {
             }`}
             ref={(el) => {
               if (page.id === selectedPage) {
-                this.activePageRef = el;
+                this._activePageRef = el;
               }
               provided.innerRef(el);
             }}
@@ -163,16 +190,7 @@ export class PageManager extends React.PureComponent {
                   {Style.it(
                     workpadCSS,
                     <div>
-                      <PagePreview
-                        isWriteable={isWriteable}
-                        page={page}
-                        height={100}
-                        pageNumber={pageNumber}
-                        movePage={movePage}
-                        selectedPage={selectedPage}
-                        duplicatePage={duplicatePage}
-                        confirmDelete={this.confirmDelete}
-                      />
+                      <PagePreview height={100} page={page} onRemove={this.onConfirmRemove} />
                     </div>
                   )}
                 </Link>
@@ -185,8 +203,8 @@ export class PageManager extends React.PureComponent {
   };
 
   render() {
-    const { pages, addPage, deleteId, isWriteable } = this.props;
-    const { showTrayPop } = this.state;
+    const { pages, onAddPage, isWriteable } = this.props;
+    const { showTrayPop, removeId } = this.state;
 
     return (
       <Fragment>
@@ -200,7 +218,7 @@ export class PageManager extends React.PureComponent {
                       showTrayPop ? 'canvasPageManager--trayPop' : ''
                     }`}
                     ref={(el) => {
-                      this.pageListRef = el;
+                      this._pageListRef = el;
                       provided.innerRef(el);
                     }}
                     {...provided.droppableProps}
@@ -216,11 +234,11 @@ export class PageManager extends React.PureComponent {
             <EuiFlexItem grow={false}>
               <EuiToolTip
                 anchorClassName="canvasPageManager__addPageTip"
-                content="Add a new page to this workpad"
+                content={strings.getAddPageTooltip()}
                 position="left"
               >
                 <button
-                  onClick={addPage}
+                  onClick={onAddPage}
                   className="canvasPageManager__addPage kbn-resetFocusState"
                 >
                   <EuiIcon color="ghost" type="plusInCircle" size="l" />
@@ -230,12 +248,12 @@ export class PageManager extends React.PureComponent {
           )}
         </EuiFlexGroup>
         <ConfirmModal
-          isOpen={deleteId != null}
-          title="Remove Page"
-          message="Are you sure you want to remove this page?"
-          confirmButtonText="Remove"
-          onConfirm={this.doDelete}
-          onCancel={this.resetDelete}
+          isOpen={removeId !== null}
+          title={strings.getConfirmRemoveTitle()}
+          message={strings.getConfirmRemoveDescription()}
+          confirmButtonText={strings.getConfirmRemoveButtonLabel()}
+          onConfirm={this.doRemove}
+          onCancel={this.resetRemove}
         />
       </Fragment>
     );
diff --git a/x-pack/plugins/canvas/public/components/page_preview/index.ts b/x-pack/plugins/canvas/public/components/page_preview/index.ts
new file mode 100644
index 0000000000000..25d3254595d2e
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/page_preview/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Dispatch } from 'redux';
+import { connect } from 'react-redux';
+// @ts-expect-error untyped local
+import * as pageActions from '../../state/actions/pages';
+import { canUserWrite } from '../../state/selectors/app';
+import { isWriteable } from '../../state/selectors/workpad';
+import { PagePreview as Component } from './page_preview';
+import { State } from '../../../types';
+
+const mapStateToProps = (state: State) => ({
+  isWriteable: isWriteable(state) && canUserWrite(state),
+});
+
+const mapDispatchToProps = (dispatch: Dispatch) => ({
+  onDuplicate: (id: string) => dispatch(pageActions.duplicatePage(id)),
+});
+
+export const PagePreview = connect(mapStateToProps, mapDispatchToProps)(Component);
diff --git a/x-pack/plugins/canvas/public/components/page_preview/page_controls.js b/x-pack/plugins/canvas/public/components/page_preview/page_controls.tsx
similarity index 75%
rename from x-pack/plugins/canvas/public/components/page_preview/page_controls.js
rename to x-pack/plugins/canvas/public/components/page_preview/page_controls.tsx
index 1251f441f1082..d61367d390830 100644
--- a/x-pack/plugins/canvas/public/components/page_preview/page_controls.js
+++ b/x-pack/plugins/canvas/public/components/page_preview/page_controls.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { FC, ReactEventHandler } from 'react';
 import PropTypes from 'prop-types';
 import { EuiFlexGroup, EuiFlexItem, EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 
@@ -12,15 +12,21 @@ import { ComponentStrings } from '../../../i18n';
 
 const { PagePreviewPageControls: strings } = ComponentStrings;
 
-export const PageControls = ({ pageId, onDelete, onDuplicate }) => {
-  const handleDuplicate = (ev) => {
+interface Props {
+  pageId: string;
+  onRemove: (pageId: string) => void;
+  onDuplicate: (pageId: string) => void;
+}
+
+export const PageControls: FC<Props> = ({ pageId, onRemove, onDuplicate }) => {
+  const handleDuplicate: ReactEventHandler = (ev) => {
     ev.preventDefault();
     onDuplicate(pageId);
   };
 
-  const handleDelete = (ev) => {
+  const handleRemove: ReactEventHandler = (ev) => {
     ev.preventDefault();
-    onDelete(pageId);
+    onRemove(pageId);
   };
 
   return (
@@ -44,7 +50,7 @@ export const PageControls = ({ pageId, onDelete, onDuplicate }) => {
             color="danger"
             iconType="trash"
             aria-label={strings.getDeletePageAriaLabel()}
-            onClick={handleDelete}
+            onClick={handleRemove}
           />
         </EuiToolTip>
       </EuiFlexItem>
@@ -54,7 +60,6 @@ export const PageControls = ({ pageId, onDelete, onDuplicate }) => {
 
 PageControls.propTypes = {
   pageId: PropTypes.string.isRequired,
-  pageNumber: PropTypes.number.isRequired,
-  onDelete: PropTypes.func.isRequired,
+  onRemove: PropTypes.func.isRequired,
   onDuplicate: PropTypes.func.isRequired,
 };
diff --git a/x-pack/plugins/canvas/public/components/page_preview/page_preview.js b/x-pack/plugins/canvas/public/components/page_preview/page_preview.tsx
similarity index 56%
rename from x-pack/plugins/canvas/public/components/page_preview/page_preview.js
rename to x-pack/plugins/canvas/public/components/page_preview/page_preview.tsx
index a69e25e115c33..fd1dc869d60ec 100644
--- a/x-pack/plugins/canvas/public/components/page_preview/page_preview.js
+++ b/x-pack/plugins/canvas/public/components/page_preview/page_preview.tsx
@@ -4,32 +4,26 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { FC } from 'react';
 import PropTypes from 'prop-types';
 import { DomPreview } from '../dom_preview';
 import { PageControls } from './page_controls';
+import { CanvasPage } from '../../../types';
 
-export const PagePreview = ({
-  isWriteable,
-  page,
-  pageNumber,
-  height,
-  duplicatePage,
-  confirmDelete,
-}) => (
+interface Props {
+  isWriteable: boolean;
+  page: Pick<CanvasPage, 'id' | 'style'>;
+  height: number;
+  onDuplicate: (pageId: string) => void;
+  onRemove: (pageId: string) => void;
+}
+export const PagePreview: FC<Props> = ({ isWriteable, page, height, onDuplicate, onRemove }) => (
   <div
     className="canvasPageManager__pagePreview"
     style={{ backgroundColor: page.style.background }}
   >
-    <DomPreview elementId={page.id} pageNumber={pageNumber} height={height} />
-    {isWriteable && (
-      <PageControls
-        pageId={page.id}
-        pageNumber={pageNumber}
-        onDuplicate={duplicatePage}
-        onDelete={confirmDelete}
-      />
-    )}
+    <DomPreview elementId={page.id} height={height} />
+    {isWriteable && <PageControls pageId={page.id} onDuplicate={onDuplicate} onRemove={onRemove} />}
   </div>
 );
 
@@ -42,7 +36,6 @@ PagePreview.propTypes = {
     }).isRequired,
   }).isRequired,
   height: PropTypes.number.isRequired,
-  pageNumber: PropTypes.number.isRequired,
-  duplicatePage: PropTypes.func.isRequired,
-  confirmDelete: PropTypes.func.isRequired,
+  onDuplicate: PropTypes.func.isRequired,
+  onRemove: PropTypes.func.isRequired,
 };
diff --git a/x-pack/plugins/canvas/public/components/toolbar/toolbar.tsx b/x-pack/plugins/canvas/public/components/toolbar/toolbar.tsx
index 9a26b438e17c3..c5475b2559444 100644
--- a/x-pack/plugins/canvas/public/components/toolbar/toolbar.tsx
+++ b/x-pack/plugins/canvas/public/components/toolbar/toolbar.tsx
@@ -24,7 +24,6 @@ import { ComponentStrings } from '../../../i18n';
 import { Navbar } from '../navbar';
 // @ts-expect-error untyped local
 import { WorkpadManager } from '../workpad_manager';
-// @ts-expect-error untyped local
 import { PageManager } from '../page_manager';
 // @ts-expect-error untyped local
 import { Expression } from '../expression';
@@ -102,7 +101,7 @@ export const Toolbar = (props: Props) => {
   );
 
   const trays = {
-    pageManager: <PageManager previousPage={previousPage} />,
+    pageManager: <PageManager onPreviousPage={previousPage} />,
     expression: !elementIsSelected ? null : <Expression done={done} />,
   };
 
diff --git a/x-pack/plugins/canvas/public/lib/create_handlers.ts b/x-pack/plugins/canvas/public/lib/create_handlers.ts
index 4e0c7b217d5b7..ae0956ee21283 100644
--- a/x-pack/plugins/canvas/public/lib/create_handlers.ts
+++ b/x-pack/plugins/canvas/public/lib/create_handlers.ts
@@ -5,7 +5,7 @@
  */
 
 import { isEqual } from 'lodash';
-// @ts-ignore untyped local
+// @ts-expect-error untyped local
 import { setFilter } from '../state/actions/elements';
 import { updateEmbeddableExpression, fetchEmbeddableRenderable } from '../state/actions/embeddable';
 import { RendererHandlers, CanvasElement } from '../../types';

From 13ec56db8bf64621298c30693000dd68eb9a272c Mon Sep 17 00:00:00 2001
From: Alex Kahan <alexander.kahan@elastic.co>
Date: Tue, 21 Jul 2020 15:18:01 -0400
Subject: [PATCH 02/34] Limit concurrent access to  download API + Replace with
 LRU cache (#72503)

* Limit concurrent access to  download API

* Replacing cache with LRU Cache

* Configure the LRU cache

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../common/endpoint/constants.ts              |  2 +
 .../endpoint/lib/artifacts/cache.test.ts      | 48 -------------
 .../server/endpoint/lib/artifacts/cache.ts    | 37 ----------
 .../server/endpoint/lib/artifacts/index.ts    |  1 -
 .../artifacts/download_exception_list.test.ts |  8 +--
 .../artifacts/download_exception_list.ts      |  7 +-
 .../endpoint/routes/limited_concurrency.ts    | 72 +++++++++++++++++++
 .../manifest_manager/manifest_manager.mock.ts |  6 +-
 .../manifest_manager/manifest_manager.test.ts | 11 ++-
 .../manifest_manager/manifest_manager.ts      |  6 +-
 .../security_solution/server/plugin.ts        | 10 ++-
 11 files changed, 100 insertions(+), 108 deletions(-)
 delete mode 100644 x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.test.ts
 delete mode 100644 x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.ts
 create mode 100644 x-pack/plugins/security_solution/server/endpoint/routes/limited_concurrency.ts

diff --git a/x-pack/plugins/security_solution/common/endpoint/constants.ts b/x-pack/plugins/security_solution/common/endpoint/constants.ts
index e311e358e6146..6ea0c36328eed 100644
--- a/x-pack/plugins/security_solution/common/endpoint/constants.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/constants.ts
@@ -9,3 +9,5 @@ export const alertsIndexPattern = 'logs-endpoint.alerts-*';
 export const metadataIndexPattern = 'metrics-endpoint.metadata-*';
 export const policyIndexPattern = 'metrics-endpoint.policy-*';
 export const telemetryIndexPattern = 'metrics-endpoint.telemetry-*';
+export const LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG = 'endpoint:limited-concurrency';
+export const LIMITED_CONCURRENCY_ENDPOINT_COUNT = 100;
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.test.ts
deleted file mode 100644
index 00c764d0b912e..0000000000000
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.test.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ExceptionsCache } from './cache';
-
-describe('ExceptionsCache tests', () => {
-  let cache: ExceptionsCache;
-  const body = Buffer.from('body');
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    cache = new ExceptionsCache(3);
-  });
-
-  test('it should cache', async () => {
-    cache.set('test', body);
-    const cacheResp = cache.get('test');
-    expect(cacheResp).toEqual(body);
-  });
-
-  test('it should handle cache miss', async () => {
-    cache.set('test', body);
-    const cacheResp = cache.get('not test');
-    expect(cacheResp).toEqual(undefined);
-  });
-
-  test('it should handle cache eviction', async () => {
-    const a = Buffer.from('a');
-    const b = Buffer.from('b');
-    const c = Buffer.from('c');
-    const d = Buffer.from('d');
-    cache.set('1', a);
-    cache.set('2', b);
-    cache.set('3', c);
-    const cacheResp = cache.get('1');
-    expect(cacheResp).toEqual(a);
-
-    cache.set('4', d);
-    const secondResp = cache.get('1');
-    expect(secondResp).toEqual(undefined);
-    expect(cache.get('2')).toEqual(b);
-    expect(cache.get('3')).toEqual(c);
-    expect(cache.get('4')).toEqual(d);
-  });
-});
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.ts
deleted file mode 100644
index b9d3bae4e6ef9..0000000000000
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/cache.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-const DEFAULT_MAX_SIZE = 10;
-
-/**
- * FIFO cache implementation for artifact downloads.
- */
-export class ExceptionsCache {
-  private cache: Map<string, Buffer>;
-  private queue: string[];
-  private maxSize: number;
-
-  constructor(maxSize: number) {
-    this.cache = new Map();
-    this.queue = [];
-    this.maxSize = maxSize || DEFAULT_MAX_SIZE;
-  }
-
-  set(id: string, body: Buffer) {
-    if (this.queue.length + 1 > this.maxSize) {
-      const entry = this.queue.shift();
-      if (entry !== undefined) {
-        this.cache.delete(entry);
-      }
-    }
-    this.queue.push(id);
-    this.cache.set(id, body);
-  }
-
-  get(id: string): Buffer | undefined {
-    return this.cache.get(id);
-  }
-}
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/index.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/index.ts
index ee7d44459aa38..21a9047a04299 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/index.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/index.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './cache';
 export * from './common';
 export * from './lists';
 export * from './manifest';
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.test.ts
index 8c6faee7f7a5d..4454da855569b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { deflateSync, inflateSync } from 'zlib';
+import LRU from 'lru-cache';
 import {
   ILegacyClusterClient,
   IRouter,
@@ -22,7 +23,6 @@ import {
   httpServerMock,
   loggingSystemMock,
 } from 'src/core/server/mocks';
-import { ExceptionsCache } from '../../lib/artifacts/cache';
 import { ArtifactConstants } from '../../lib/artifacts';
 import { registerDownloadExceptionListRoute } from './download_exception_list';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
@@ -97,7 +97,7 @@ describe('test alerts route', () => {
   let routeConfig: RouteConfig<unknown, unknown, unknown, never>;
   let routeHandler: RequestHandler<unknown, unknown, unknown>;
   let endpointAppContextService: EndpointAppContextService;
-  let cache: ExceptionsCache;
+  let cache: LRU<string, Buffer>;
   let ingestSavedObjectClient: jest.Mocked<SavedObjectsClientContract>;
 
   beforeEach(() => {
@@ -108,7 +108,7 @@ describe('test alerts route', () => {
     mockClusterClient.asScoped.mockReturnValue(mockScopedClient);
     routerMock = httpServiceMock.createRouter();
     endpointAppContextService = new EndpointAppContextService();
-    cache = new ExceptionsCache(5);
+    cache = new LRU<string, Buffer>({ max: 10, maxAge: 1000 * 60 * 60 });
     const startContract = createMockEndpointAppContextServiceStartContract();
 
     // The authentication with the Fleet Plugin needs a separate scoped SO Client
@@ -164,7 +164,7 @@ describe('test alerts route', () => {
       path.startsWith('/api/endpoint/artifacts/download')
     )!;
 
-    expect(routeConfig.options).toEqual(undefined);
+    expect(routeConfig.options).toEqual({ tags: ['endpoint:limited-concurrency'] });
 
     await routeHandler(
       ({
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.ts b/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.ts
index 218f7c059da48..38e900c4d5015 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/artifacts/download_exception_list.ts
@@ -11,11 +11,13 @@ import {
   IKibanaResponse,
   SavedObject,
 } from 'src/core/server';
+import LRU from 'lru-cache';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { authenticateAgentWithAccessToken } from '../../../../../ingest_manager/server/services/agents/authenticate';
 import { validate } from '../../../../common/validate';
+import { LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG } from '../../../../common/endpoint/constants';
 import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
-import { ArtifactConstants, ExceptionsCache } from '../../lib/artifacts';
+import { ArtifactConstants } from '../../lib/artifacts';
 import {
   DownloadArtifactRequestParamsSchema,
   downloadArtifactRequestParamsSchema,
@@ -32,7 +34,7 @@ const allowlistBaseRoute: string = '/api/endpoint/artifacts';
 export function registerDownloadExceptionListRoute(
   router: IRouter,
   endpointContext: EndpointAppContext,
-  cache: ExceptionsCache
+  cache: LRU<string, Buffer>
 ) {
   router.get(
     {
@@ -43,6 +45,7 @@ export function registerDownloadExceptionListRoute(
           DownloadArtifactRequestParamsSchema
         >(downloadArtifactRequestParamsSchema),
       },
+      options: { tags: [LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG] },
     },
     async (context, req, res) => {
       let scopedSOClient: SavedObjectsClientContract;
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/limited_concurrency.ts b/x-pack/plugins/security_solution/server/endpoint/routes/limited_concurrency.ts
new file mode 100644
index 0000000000000..767ba31311a77
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/limited_concurrency.ts
@@ -0,0 +1,72 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  CoreSetup,
+  KibanaRequest,
+  LifecycleResponseFactory,
+  OnPreAuthToolkit,
+} from 'kibana/server';
+import {
+  LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG,
+  LIMITED_CONCURRENCY_ENDPOINT_COUNT,
+} from '../../../common/endpoint/constants';
+
+class MaxCounter {
+  constructor(private readonly max: number = 1) {}
+  private counter = 0;
+  valueOf() {
+    return this.counter;
+  }
+  increase() {
+    if (this.counter < this.max) {
+      this.counter += 1;
+    }
+  }
+  decrease() {
+    if (this.counter > 0) {
+      this.counter -= 1;
+    }
+  }
+  lessThanMax() {
+    return this.counter < this.max;
+  }
+}
+
+function shouldHandleRequest(request: KibanaRequest) {
+  const tags = request.route.options.tags;
+  return tags.includes(LIMITED_CONCURRENCY_ENDPOINT_ROUTE_TAG);
+}
+
+export function registerLimitedConcurrencyRoutes(core: CoreSetup) {
+  const counter = new MaxCounter(LIMITED_CONCURRENCY_ENDPOINT_COUNT);
+  core.http.registerOnPreAuth(function preAuthHandler(
+    request: KibanaRequest,
+    response: LifecycleResponseFactory,
+    toolkit: OnPreAuthToolkit
+  ) {
+    if (!shouldHandleRequest(request)) {
+      return toolkit.next();
+    }
+
+    if (!counter.lessThanMax()) {
+      return response.customError({
+        body: 'Too Many Requests',
+        statusCode: 429,
+      });
+    }
+
+    counter.increase();
+
+    // requests.events.aborted$ has a bug (but has test which explicitly verifies) where it's fired even when the request completes
+    // https://github.com/elastic/kibana/pull/70495#issuecomment-656288766
+    request.events.aborted$.toPromise().then(() => {
+      counter.decrease();
+    });
+
+    return toolkit.next();
+  });
+}
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
index 2ebffa6fb3ad8..592ffb0eae62a 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
@@ -9,7 +9,7 @@ import { Logger } from 'src/core/server';
 import { PackageConfigServiceInterface } from '../../../../../../ingest_manager/server';
 import { createPackageConfigServiceMock } from '../../../../../../ingest_manager/server/mocks';
 import { listMock } from '../../../../../../lists/server/mocks';
-import { ExceptionsCache } from '../../../lib/artifacts';
+import LRU from 'lru-cache';
 import { getArtifactClientMock } from '../artifact_client.mock';
 import { getManifestClientMock } from '../manifest_client.mock';
 import { ManifestManager } from './manifest_manager';
@@ -28,11 +28,11 @@ export enum ManifestManagerMockType {
 
 export const getManifestManagerMock = (opts?: {
   mockType?: ManifestManagerMockType;
-  cache?: ExceptionsCache;
+  cache?: LRU<string, Buffer>;
   packageConfigService?: jest.Mocked<PackageConfigServiceInterface>;
   savedObjectsClient?: ReturnType<typeof savedObjectsClientMock.create>;
 }): ManifestManager => {
-  let cache = new ExceptionsCache(5);
+  let cache = new LRU<string, Buffer>({ max: 10, maxAge: 1000 * 60 * 60 });
   if (opts?.cache !== undefined) {
     cache = opts.cache;
   }
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
index ff331f7d017f4..c838f772fb66b 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
@@ -7,13 +7,10 @@
 import { inflateSync } from 'zlib';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import { createPackageConfigServiceMock } from '../../../../../../ingest_manager/server/mocks';
-import {
-  ArtifactConstants,
-  ManifestConstants,
-  ExceptionsCache,
-  isCompleteArtifact,
-} from '../../../lib/artifacts';
+import { ArtifactConstants, ManifestConstants, isCompleteArtifact } from '../../../lib/artifacts';
+
 import { getManifestManagerMock } from './manifest_manager.mock';
+import LRU from 'lru-cache';
 
 describe('manifest_manager', () => {
   describe('ManifestManager sanity checks', () => {
@@ -41,7 +38,7 @@ describe('manifest_manager', () => {
     });
 
     test('ManifestManager populates cache properly', async () => {
-      const cache = new ExceptionsCache(5);
+      const cache = new LRU<string, Buffer>({ max: 10, maxAge: 1000 * 60 * 60 });
       const manifestManager = getManifestManagerMock({ cache });
       const oldManifest = await manifestManager.getLastComputedManifest(
         ManifestConstants.SCHEMA_VERSION
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
index 2501f07cb26e0..13ca51e1f2b39 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -5,6 +5,7 @@
  */
 
 import { Logger, SavedObjectsClientContract } from 'src/core/server';
+import LRU from 'lru-cache';
 import { PackageConfigServiceInterface } from '../../../../../../ingest_manager/server';
 import { ExceptionListClient } from '../../../../../../lists/server';
 import { ManifestSchemaVersion } from '../../../../../common/endpoint/schema/common';
@@ -16,7 +17,6 @@ import {
   Manifest,
   buildArtifact,
   getFullEndpointExceptionList,
-  ExceptionsCache,
   ManifestDiff,
   getArtifactId,
 } from '../../../lib/artifacts';
@@ -33,7 +33,7 @@ export interface ManifestManagerContext {
   exceptionListClient: ExceptionListClient;
   packageConfigService: PackageConfigServiceInterface;
   logger: Logger;
-  cache: ExceptionsCache;
+  cache: LRU<string, Buffer>;
 }
 
 export interface ManifestSnapshotOpts {
@@ -51,7 +51,7 @@ export class ManifestManager {
   protected packageConfigService: PackageConfigServiceInterface;
   protected savedObjectsClient: SavedObjectsClientContract;
   protected logger: Logger;
-  protected cache: ExceptionsCache;
+  protected cache: LRU<string, Buffer>;
 
   constructor(context: ManifestManagerContext) {
     this.artifactClient = context.artifactClient;
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 22b55c64a1657..611f35c6d402a 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -7,6 +7,7 @@
 import { Observable } from 'rxjs';
 import { first } from 'rxjs/operators';
 import { i18n } from '@kbn/i18n';
+import LRU from 'lru-cache';
 
 import {
   CoreSetup,
@@ -34,13 +35,14 @@ import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
 import { rulesNotificationAlertType } from './lib/detection_engine/notifications/rules_notification_alert_type';
 import { isNotificationAlertExecutor } from './lib/detection_engine/notifications/types';
-import { ManifestTask, ExceptionsCache } from './endpoint/lib/artifacts';
+import { ManifestTask } from './endpoint/lib/artifacts';
 import { initSavedObjects, savedObjectTypes } from './saved_objects';
 import { AppClientFactory } from './client';
 import { createConfig$, ConfigType } from './config';
 import { initUiSettings } from './ui_settings';
 import { APP_ID, APP_ICON, SERVER_APP_ID, SecurityPageName } from '../common/constants';
 import { registerEndpointRoutes } from './endpoint/routes/metadata';
+import { registerLimitedConcurrencyRoutes } from './endpoint/routes/limited_concurrency';
 import { registerResolverRoutes } from './endpoint/routes/resolver';
 import { registerPolicyRoutes } from './endpoint/routes/policy';
 import { ArtifactClient, ManifestManager } from './endpoint/services';
@@ -94,14 +96,15 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
   private lists: ListPluginSetup | undefined; // TODO: can we create ListPluginStart?
 
   private manifestTask: ManifestTask | undefined;
-  private exceptionsCache: ExceptionsCache;
+  private exceptionsCache: LRU<string, Buffer>;
 
   constructor(context: PluginInitializerContext) {
     this.context = context;
     this.logger = context.logger.get('plugins', APP_ID);
     this.config$ = createConfig$(context);
     this.appClientFactory = new AppClientFactory();
-    this.exceptionsCache = new ExceptionsCache(5); // TODO
+    // Cache up to three artifacts with a max retention of 5 mins each
+    this.exceptionsCache = new LRU<string, Buffer>({ max: 3, maxAge: 1000 * 60 * 5 });
 
     this.logger.debug('plugin initialized');
   }
@@ -149,6 +152,7 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       plugins.ml
     );
     registerEndpointRoutes(router, endpointContext);
+    registerLimitedConcurrencyRoutes(core);
     registerResolverRoutes(router, endpointContext);
     registerPolicyRoutes(router, endpointContext);
     registerDownloadExceptionListRoute(router, endpointContext, this.exceptionsCache);

From b05d3d114e9319a07977b74f5d157515632ad8a9 Mon Sep 17 00:00:00 2001
From: Clint Andrew Hall <clint.hall@elastic.co>
Date: Tue, 21 Jul 2020 15:29:15 -0400
Subject: [PATCH 03/34] Optimize Functions and Renderers for Webpack builds
 (#72683)

---
 .../functions/browser/index.ts                |  3 +-
 .../functions/common/index.ts                 |  8 ---
 .../functions/external/index.ts               | 12 +++++
 .../{common => external}/saved_lens.test.ts   |  0
 .../{common => external}/saved_lens.ts        |  0
 .../{common => external}/saved_map.test.ts    |  0
 .../{common => external}/saved_map.ts         |  0
 .../{common => external}/saved_search.test.ts |  0
 .../{common => external}/saved_search.ts      |  0
 .../saved_visualization.test.ts               |  0
 .../saved_visualization.ts                    |  0
 .../canvas_plugin_src/renderers/core.js       | 37 ++++++++++++++
 .../renderers/embeddable/index.ts             |  9 ++++
 .../input_type_to_expression/lens.test.ts     |  2 +-
 .../input_type_to_expression/lens.ts          |  2 +-
 .../advanced_filter.stories.storyshot         |  0
 .../__examples__/advanced_filter.stories.tsx  |  0
 .../component/advanced_filter.scss            |  0
 .../component/advanced_filter.tsx             |  2 +-
 .../advanced_filter/component/index.ts        |  0
 .../{ => filters}/advanced_filter/index.tsx   |  4 +-
 .../dropdown_filter.stories.storyshot         |  0
 .../__examples__/dropdown_filter.stories.tsx  |  0
 .../component/dropdown_filter.scss            |  0
 .../component/dropdown_filter.tsx             |  2 +-
 .../dropdown_filter/component/index.ts        |  0
 .../{ => filters}/dropdown_filter/index.tsx   |  6 +--
 .../renderers/filters/index.js                | 12 +++++
 .../time_filter.stories.storyshot             |  0
 .../__examples__/time_filter.stories.tsx      |  0
 .../time_filter/components/index.tsx          |  4 +-
 .../time_filter/components/time_filter.tsx    |  2 +-
 .../{ => filters}/time_filter/index.tsx       | 14 ++---
 .../time_filter/time_filter.scss              |  0
 .../canvas_plugin_src/renderers/index.js      | 51 ++++++-------------
 .../canvas/i18n/functions/dict/saved_lens.ts  |  2 +-
 .../canvas/i18n/functions/dict/saved_map.ts   |  2 +-
 .../i18n/functions/dict/saved_search.ts       |  2 +-
 .../functions/dict/saved_visualization.ts     |  2 +-
 x-pack/plugins/canvas/public/style/index.scss |  6 +--
 x-pack/plugins/canvas/types/functions.ts      |  9 +++-
 41 files changed, 121 insertions(+), 72 deletions(-)
 create mode 100644 x-pack/plugins/canvas/canvas_plugin_src/functions/external/index.ts
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_lens.test.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_lens.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_map.test.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_map.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_search.test.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_search.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_visualization.test.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/functions/{common => external}/saved_visualization.ts (100%)
 create mode 100644 x-pack/plugins/canvas/canvas_plugin_src/renderers/core.js
 create mode 100644 x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/index.ts
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/component/__examples__/__snapshots__/advanced_filter.stories.storyshot (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/component/__examples__/advanced_filter.stories.tsx (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/component/advanced_filter.scss (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/component/advanced_filter.tsx (96%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/component/index.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/advanced_filter/index.tsx (89%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/component/__examples__/__snapshots__/dropdown_filter.stories.storyshot (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/component/__examples__/dropdown_filter.stories.tsx (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/component/dropdown_filter.scss (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/component/dropdown_filter.tsx (97%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/component/index.ts (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/dropdown_filter/index.tsx (93%)
 create mode 100644 x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/index.js
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/components/__examples__/__snapshots__/time_filter.stories.storyshot (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/components/__examples__/time_filter.stories.tsx (100%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/components/index.tsx (78%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/components/time_filter.tsx (98%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/index.tsx (82%)
 rename x-pack/plugins/canvas/canvas_plugin_src/renderers/{ => filters}/time_filter/time_filter.scss (100%)

diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/index.ts
index 1d1df54d62f70..479770a9d0a81 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/index.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/browser/index.ts
@@ -5,8 +5,9 @@
  */
 
 import { functions as commonFunctions } from '../common';
+import { functions as externalFunctions } from '../external';
 import { location } from './location';
 import { markdown } from './markdown';
 import { urlparam } from './urlparam';
 
-export const functions = [location, markdown, urlparam, ...commonFunctions];
+export const functions = [location, markdown, urlparam, ...commonFunctions, ...externalFunctions];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/common/index.ts
index 36fa6497ab6f3..79538941bbbfa 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/index.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/common/index.ts
@@ -48,10 +48,6 @@ import { rounddate } from './rounddate';
 import { rowCount } from './rowCount';
 import { repeatImage } from './repeatImage';
 import { revealImage } from './revealImage';
-import { savedLens } from './saved_lens';
-import { savedMap } from './saved_map';
-import { savedSearch } from './saved_search';
-import { savedVisualization } from './saved_visualization';
 import { seriesStyle } from './seriesStyle';
 import { shape } from './shape';
 import { sort } from './sort';
@@ -110,10 +106,6 @@ export const functions = [
   revealImage,
   rounddate,
   rowCount,
-  savedLens,
-  savedMap,
-  savedSearch,
-  savedVisualization,
   seriesStyle,
   shape,
   sort,
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/external/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/index.ts
new file mode 100644
index 0000000000000..17682c5a72074
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/index.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { savedLens } from './saved_lens';
+import { savedMap } from './saved_map';
+import { savedSearch } from './saved_search';
+import { savedVisualization } from './saved_visualization';
+
+export const functions = [savedLens, savedMap, savedSearch, savedVisualization];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_lens.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_lens.test.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.test.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_lens.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_lens.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_lens.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_map.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_map.test.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.test.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_map.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_map.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_map.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_search.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_search.test.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.test.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_search.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_search.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_search.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_visualization.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_visualization.test.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.test.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_visualization.ts b/x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/functions/common/saved_visualization.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/functions/external/saved_visualization.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/core.js b/x-pack/plugins/canvas/canvas_plugin_src/renderers/core.js
new file mode 100644
index 0000000000000..ba4a564848788
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/core.js
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { debug } from './debug';
+import { error } from './error';
+import { image } from './image';
+import { markdown } from './markdown';
+import { metric } from './metric';
+import { pie } from './pie';
+import { plot } from './plot';
+import { progress } from './progress';
+import { repeatImage } from './repeat_image';
+import { revealImage } from './reveal_image';
+import { shape } from './shape';
+import { table } from './table';
+import { text } from './text';
+
+export const renderFunctions = [
+  debug,
+  error,
+  image,
+  markdown,
+  metric,
+  pie,
+  plot,
+  progress,
+  repeatImage,
+  revealImage,
+  shape,
+  table,
+  text,
+];
+
+export const renderFunctionFactories = [];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/index.ts
new file mode 100644
index 0000000000000..fb47d61484c47
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { embeddableRendererFactory } from './embeddable';
+
+export const renderFunctions = [];
+export const renderFunctionFactories = [embeddableRendererFactory];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.test.ts b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.test.ts
index c4a9a22be3202..7bcfd6bef4620 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.test.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { toExpression } from './lens';
-import { SavedLensInput } from '../../../functions/common/saved_lens';
+import { SavedLensInput } from '../../../functions/external/saved_lens';
 import { fromExpression, Ast } from '@kbn/interpreter/common';
 
 const baseEmbeddableInput = {
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.ts b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.ts
index 445cb7480ff80..5bb45c5ca129e 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/embeddable/input_type_to_expression/lens.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SavedLensInput } from '../../../functions/common/saved_lens';
+import { SavedLensInput } from '../../../functions/external/saved_lens';
 
 export function toExpression(input: SavedLensInput): string {
   const expressionParts = [] as string[];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/__examples__/__snapshots__/advanced_filter.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/__examples__/__snapshots__/advanced_filter.stories.storyshot
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/__examples__/__snapshots__/advanced_filter.stories.storyshot
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/__examples__/__snapshots__/advanced_filter.stories.storyshot
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/__examples__/advanced_filter.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/__examples__/advanced_filter.stories.tsx
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/__examples__/advanced_filter.stories.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/__examples__/advanced_filter.stories.tsx
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.scss b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.scss
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.scss
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.scss
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.tsx
similarity index 96%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.tsx
index e4d4510d40f53..8cb8b53ab6976 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.tsx
@@ -7,7 +7,7 @@
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import PropTypes from 'prop-types';
 import React, { FunctionComponent } from 'react';
-import { ComponentStrings } from '../../../../i18n';
+import { ComponentStrings } from '../../../../../i18n';
 
 const { AdvancedFilter: strings } = ComponentStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/index.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/component/index.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/component/index.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/index.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/index.tsx
similarity index 89%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/index.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/index.tsx
index 29692b0c02a41..b481a4b498928 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/advanced_filter/index.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/advanced_filter/index.tsx
@@ -6,9 +6,9 @@
 
 import React from 'react';
 import ReactDOM from 'react-dom';
-import { RendererFactory } from '../../../types';
+import { RendererFactory } from '../../../../types';
 import { AdvancedFilter } from './component';
-import { RendererStrings } from '../../../i18n';
+import { RendererStrings } from '../../../../i18n';
 
 const { advancedFilter: strings } = RendererStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/__examples__/__snapshots__/dropdown_filter.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/__examples__/__snapshots__/dropdown_filter.stories.storyshot
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/__examples__/__snapshots__/dropdown_filter.stories.storyshot
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/__examples__/__snapshots__/dropdown_filter.stories.storyshot
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/__examples__/dropdown_filter.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/__examples__/dropdown_filter.stories.tsx
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/__examples__/dropdown_filter.stories.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/__examples__/dropdown_filter.stories.tsx
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.scss b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.scss
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.scss
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.scss
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.tsx
similarity index 97%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.tsx
index 9cade90bd5870..ac08d3dd25d85 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.tsx
@@ -7,7 +7,7 @@
 import { EuiIcon } from '@elastic/eui';
 import PropTypes from 'prop-types';
 import React, { ChangeEvent, FocusEvent, FunctionComponent } from 'react';
-import { ComponentStrings } from '../../../../i18n';
+import { ComponentStrings } from '../../../../../i18n';
 
 const { DropdownFilter: strings } = ComponentStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/index.ts b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/index.ts
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/component/index.ts
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/component/index.ts
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/index.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/index.tsx
similarity index 93%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/index.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/index.tsx
index ee07f7d4402f4..bfc36932a8a07 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/dropdown_filter/index.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/dropdown_filter/index.tsx
@@ -8,10 +8,10 @@ import { fromExpression, toExpression, Ast } from '@kbn/interpreter/common';
 import { get } from 'lodash';
 import React from 'react';
 import ReactDOM from 'react-dom';
-import { syncFilterExpression } from '../../../public/lib/sync_filter_expression';
-import { RendererFactory } from '../../../types';
+import { syncFilterExpression } from '../../../../public/lib/sync_filter_expression';
+import { RendererFactory } from '../../../../types';
 import { DropdownFilter } from './component';
-import { RendererStrings } from '../../../i18n';
+import { RendererStrings } from '../../../../i18n';
 
 const { dropdownFilter: strings } = RendererStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/index.js b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/index.js
new file mode 100644
index 0000000000000..0654bf0f704e9
--- /dev/null
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/index.js
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { advancedFilter } from './advanced_filter';
+import { dropdownFilter } from './dropdown_filter';
+import { timeFilterFactory } from './time_filter';
+
+export const renderFunctions = [advancedFilter, dropdownFilter];
+export const renderFunctionFactories = [timeFilterFactory];
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/__examples__/__snapshots__/time_filter.stories.storyshot b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__examples__/__snapshots__/time_filter.stories.storyshot
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/__examples__/__snapshots__/time_filter.stories.storyshot
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__examples__/__snapshots__/time_filter.stories.storyshot
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/__examples__/time_filter.stories.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__examples__/time_filter.stories.tsx
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/__examples__/time_filter.stories.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/__examples__/time_filter.stories.tsx
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/index.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/index.tsx
similarity index 78%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/index.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/index.tsx
index 85ea754de670d..cdea7d6591592 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/index.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/index.tsx
@@ -4,6 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { TimeFilter } from './time_filter';
-
-export { TimeFilter };
+export { TimeFilter } from './time_filter';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/time_filter.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/time_filter.tsx
similarity index 98%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/time_filter.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/time_filter.tsx
index 487f17fb89d12..3cb192cedde83 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/components/time_filter.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/components/time_filter.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import { get } from 'lodash';
 import { fromExpression } from '@kbn/interpreter/common';
-import { UnitStrings } from '../../../../i18n/units';
+import { UnitStrings } from '../../../../../i18n/units';
 
 const { quickRanges: strings } = UnitStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/index.tsx b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/index.tsx
similarity index 82%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/index.tsx
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/index.tsx
index 25278adcf4529..03bf18830a761 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/index.tsx
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/index.tsx
@@ -7,14 +7,14 @@
 import ReactDOM from 'react-dom';
 import React from 'react';
 import { toExpression } from '@kbn/interpreter/common';
-import { UI_SETTINGS } from '../../../../../../src/plugins/data/public';
-import { syncFilterExpression } from '../../../public/lib/sync_filter_expression';
-import { RendererStrings } from '../../../i18n';
+import { UI_SETTINGS } from '../../../../../../../src/plugins/data/public';
+import { syncFilterExpression } from '../../../../public/lib/sync_filter_expression';
+import { RendererStrings } from '../../../../i18n';
 import { TimeFilter } from './components';
-import { StartInitializer } from '../../plugin';
-import { RendererHandlers } from '../../../types';
-import { Arguments } from '../../functions/common/timefilterControl';
-import { RendererFactory } from '../../../types';
+import { StartInitializer } from '../../../plugin';
+import { RendererHandlers } from '../../../../types';
+import { Arguments } from '../../../functions/common/timefilterControl';
+import { RendererFactory } from '../../../../types';
 
 const { timeFilter: strings } = RendererStrings;
 
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/time_filter.scss b/x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/time_filter.scss
similarity index 100%
rename from x-pack/plugins/canvas/canvas_plugin_src/renderers/time_filter/time_filter.scss
rename to x-pack/plugins/canvas/canvas_plugin_src/renderers/filters/time_filter/time_filter.scss
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/renderers/index.js b/x-pack/plugins/canvas/canvas_plugin_src/renderers/index.js
index 263f2d8ec30b5..38f10afd50cf9 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/renderers/index.js
+++ b/x-pack/plugins/canvas/canvas_plugin_src/renderers/index.js
@@ -4,40 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { advancedFilter } from './advanced_filter';
-import { debug } from './debug';
-import { dropdownFilter } from './dropdown_filter';
-import { embeddableRendererFactory } from './embeddable/embeddable';
-import { error } from './error';
-import { image } from './image';
-import { markdown } from './markdown';
-import { metric } from './metric';
-import { pie } from './pie';
-import { plot } from './plot';
-import { progress } from './progress';
-import { repeatImage } from './repeat_image';
-import { revealImage } from './reveal_image';
-import { shape } from './shape';
-import { table } from './table';
-import { text } from './text';
-import { timeFilterFactory } from './time_filter';
+import {
+  renderFunctions as embeddableFunctions,
+  renderFunctionFactories as embeddableFactories,
+} from './embeddable';
 
-export const renderFunctions = [
-  advancedFilter,
-  debug,
-  dropdownFilter,
-  error,
-  image,
-  markdown,
-  metric,
-  pie,
-  plot,
-  progress,
-  repeatImage,
-  revealImage,
-  shape,
-  table,
-  text,
-];
+import {
+  renderFunctions as filterFunctions,
+  renderFunctionFactories as filterFactories,
+} from './filters';
+
+import { renderFunctions as coreFunctions, renderFunctionFactories as coreFactories } from './core';
 
-export const renderFunctionFactories = [embeddableRendererFactory, timeFilterFactory];
+export const renderFunctions = [...coreFunctions, ...filterFunctions, ...embeddableFunctions];
+export const renderFunctionFactories = [
+  ...coreFactories,
+  ...embeddableFactories,
+  ...filterFactories,
+];
diff --git a/x-pack/plugins/canvas/i18n/functions/dict/saved_lens.ts b/x-pack/plugins/canvas/i18n/functions/dict/saved_lens.ts
index 1efcbc9d3a18e..e146a6ca68449 100644
--- a/x-pack/plugins/canvas/i18n/functions/dict/saved_lens.ts
+++ b/x-pack/plugins/canvas/i18n/functions/dict/saved_lens.ts
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { savedLens } from '../../../canvas_plugin_src/functions/common/saved_lens';
+import { savedLens } from '../../../canvas_plugin_src/functions/external/saved_lens';
 import { FunctionHelp } from '../function_help';
 import { FunctionFactory } from '../../../types';
 
diff --git a/x-pack/plugins/canvas/i18n/functions/dict/saved_map.ts b/x-pack/plugins/canvas/i18n/functions/dict/saved_map.ts
index 53bcd481f185f..8615565897434 100644
--- a/x-pack/plugins/canvas/i18n/functions/dict/saved_map.ts
+++ b/x-pack/plugins/canvas/i18n/functions/dict/saved_map.ts
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { savedMap } from '../../../canvas_plugin_src/functions/common/saved_map';
+import { savedMap } from '../../../canvas_plugin_src/functions/external/saved_map';
 import { FunctionHelp } from '../function_help';
 import { FunctionFactory } from '../../../types';
 
diff --git a/x-pack/plugins/canvas/i18n/functions/dict/saved_search.ts b/x-pack/plugins/canvas/i18n/functions/dict/saved_search.ts
index 718deea5df788..865a7753d9818 100644
--- a/x-pack/plugins/canvas/i18n/functions/dict/saved_search.ts
+++ b/x-pack/plugins/canvas/i18n/functions/dict/saved_search.ts
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { savedSearch } from '../../../canvas_plugin_src/functions/common/saved_search';
+import { savedSearch } from '../../../canvas_plugin_src/functions/external/saved_search';
 import { FunctionHelp } from '../function_help';
 import { FunctionFactory } from '../../../types';
 
diff --git a/x-pack/plugins/canvas/i18n/functions/dict/saved_visualization.ts b/x-pack/plugins/canvas/i18n/functions/dict/saved_visualization.ts
index 21a2e1c1b8800..30f88b51e7576 100644
--- a/x-pack/plugins/canvas/i18n/functions/dict/saved_visualization.ts
+++ b/x-pack/plugins/canvas/i18n/functions/dict/saved_visualization.ts
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { savedVisualization } from '../../../canvas_plugin_src/functions/common/saved_visualization';
+import { savedVisualization } from '../../../canvas_plugin_src/functions/external/saved_visualization';
 import { FunctionHelp } from '../function_help';
 import { FunctionFactory } from '../../../types';
 
diff --git a/x-pack/plugins/canvas/public/style/index.scss b/x-pack/plugins/canvas/public/style/index.scss
index 9cd2bdabd3f45..ccaf6f1c1a478 100644
--- a/x-pack/plugins/canvas/public/style/index.scss
+++ b/x-pack/plugins/canvas/public/style/index.scss
@@ -56,10 +56,10 @@
 @import '../components/workpad_page/workpad_interactive_page/workpad_interactive_page';
 @import '../components/workpad_page/workpad_static_page/workpad_static_page';
 
-@import '../../canvas_plugin_src/renderers/advanced_filter/component/advanced_filter.scss';
-@import '../../canvas_plugin_src/renderers/dropdown_filter/component/dropdown_filter.scss';
+@import '../../canvas_plugin_src/renderers/filters/advanced_filter/component/advanced_filter.scss';
+@import '../../canvas_plugin_src/renderers/filters/dropdown_filter/component/dropdown_filter.scss';
 @import '../../canvas_plugin_src/renderers/embeddable/embeddable.scss';
 @import '../../canvas_plugin_src/renderers/plot/plot.scss';
 @import '../../canvas_plugin_src/renderers/reveal_image/reveal_image.scss';
-@import '../../canvas_plugin_src/renderers/time_filter/time_filter.scss';
+@import '../../canvas_plugin_src/renderers/filters/time_filter/time_filter.scss';
 @import '../../canvas_plugin_src/uis/arguments/image_upload/image_upload.scss';
diff --git a/x-pack/plugins/canvas/types/functions.ts b/x-pack/plugins/canvas/types/functions.ts
index afe5614ac6e5a..b995354e8e9d2 100644
--- a/x-pack/plugins/canvas/types/functions.ts
+++ b/x-pack/plugins/canvas/types/functions.ts
@@ -8,6 +8,7 @@ import { ExpressionFunctionDefinition } from 'src/plugins/expressions/common';
 import { functions as commonFunctions } from '../canvas_plugin_src/functions/common';
 import { functions as browserFunctions } from '../canvas_plugin_src/functions/browser';
 import { functions as serverFunctions } from '../canvas_plugin_src/functions/server';
+import { functions as externalFunctions } from '../canvas_plugin_src/functions/external';
 import { initFunctions } from '../public/functions';
 
 /**
@@ -87,6 +88,7 @@ export type FunctionFactory<FnFactory> =
 type CommonFunction = FunctionFactory<typeof commonFunctions[number]>;
 type BrowserFunction = FunctionFactory<typeof browserFunctions[number]>;
 type ServerFunction = FunctionFactory<typeof serverFunctions[number]>;
+type ExternalFunction = FunctionFactory<typeof externalFunctions[number]>;
 type ClientFunctions = FunctionFactory<
   ReturnType<typeof initFunctions> extends Array<infer U> ? U : never
 >;
@@ -95,7 +97,12 @@ type ClientFunctions = FunctionFactory<
  * A collection of all Canvas Functions.
  */
 
-export type CanvasFunction = CommonFunction | BrowserFunction | ServerFunction | ClientFunctions;
+export type CanvasFunction =
+  | CommonFunction
+  | BrowserFunction
+  | ServerFunction
+  | ExternalFunction
+  | ClientFunctions;
 
 /**
  * Represents a function called by the `case` Function.

From 3f2913b5b81c5b8394a7c80e1e2ca88549c8a86d Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Tue, 21 Jul 2020 13:46:05 -0600
Subject: [PATCH 04/34] [Security Solution] Full screen Timeline CSS fixes
 (#72559)

## [Security Solution] Full screen Timeline CSS fixes

Fixes CSS issues related to the [Full screen timeline, Collapse event](https://github.com/elastic/kibana/pull/71786) feature:

- Sometimes, Timeline's left padding is missing in Full screen mode
- The `Attach to new case` and `Attach to existing case...` actions should be centered in Full screen mode
- The Timeline flyout button is not opaque when the alerts table is in Full screen mode

### Sometimes, Timeline's left padding is missing in Full screen mode

To reproduce:

1) Drag anything to the Timeline
2) Click the `Full screen` button

**Expected result**
- [x] The timeline has left padding in full screen mode

**Actual result**
- [x] Sometimes, the left padding of the Timeline is missing, per the screenshot below:

![timeline-full-screen-before](https://user-images.githubusercontent.com/4459398/87998223-8acf8000-cab4-11ea-91a1-6b5644856b44.png)

### Fix: screenshot

![timeline-full-screen-after](https://user-images.githubusercontent.com/4459398/87998363-e3068200-cab4-11ea-8484-41d87ba4c97e.png)

### The `Attach to new case` and `Attach to existing case...` actions should be centered in full screen mode

1) Create a new timeline with the following KQL query: `agent.type : endpoint`
2) Click the `Analyze event` button on any enabled event to view Resolver

**Expected result**
- [x] The `Attach to new case` and `Attach to existing case...` actions should be centered between the horizontal lines

**Actual result**
- [x] The `Attach to new case` and `Attach to existing case...` actions are **NOT** centered, per the screenshot below:

![attach-to-case-before](https://user-images.githubusercontent.com/4459398/87998636-b9018f80-cab5-11ea-87e8-a54355386519.png)

### Fix: screenshot

![attach-to-case-after](https://user-images.githubusercontent.com/4459398/87998553-82c41000-cab5-11ea-9e33-fcffce11e4b4.png)

### The Timeline flyout button is not opaque when the alerts table is in Full screen mode

To reproduce:

1) Navigate to Security > Detections
2) Click on the `Full screen` button

**Expected result**
- [x] The Timeline flyout button is opaque when the alerts table is in Full screen mode

**Actual result**
- [x] The Timeline flyout button is **NOT** opaque when the alerts table is in Full screen mode, per the screenshot below:

![flyout-button-before](https://user-images.githubusercontent.com/4459398/87998761-0d0c7400-cab6-11ea-9cd3-0c091e0291c9.png)

## Fix: screenshot (light theme)

![flyout-button-after-light](https://user-images.githubusercontent.com/4459398/87998784-231a3480-cab6-11ea-8fc9-17c28cf25202.png)

## Fix: screenshot (dark theme)

![flyout-button-after-dark](https://user-images.githubusercontent.com/4459398/87998824-45ac4d80-cab6-11ea-96ef-6242b8494f84.png)

### Desk testing

Desk tested in :
- Chrome `84.0.4147.89`
- Firefox `78.0.2`
- Safari `13.1.2`
---
 .../public/timelines/components/flyout/button/index.tsx   | 1 +
 .../public/timelines/components/flyout/pane/index.tsx     | 8 +++++---
 .../public/timelines/components/graph_overlay/index.tsx   | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
index 5896a02b82023..c0a59fd07e348 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/button/index.tsx
@@ -39,6 +39,7 @@ const Container = styled.div`
   }
 
   .${FLYOUT_BUTTON_CLASS_NAME} {
+    background: ${({ theme }) => rgba(theme.eui.euiPageBackgroundColor, 1)};
     border-radius: 4px 4px 0 0;
     box-shadow: none;
     height: 46px;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
index f41d318ba9587..3f842bcc2eb68 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/pane/index.tsx
@@ -44,6 +44,8 @@ const StyledResizable = styled(Resizable)`
 
 const RESIZABLE_ENABLE = { left: true };
 
+const RESIZABLE_DISABLED = { left: false };
+
 const FlyoutPaneComponent: React.FC<FlyoutPaneComponentProps> = ({
   children,
   onClose,
@@ -98,10 +100,10 @@ const FlyoutPaneComponent: React.FC<FlyoutPaneComponentProps> = ({
         size="l"
       >
         <StyledResizable
-          enable={RESIZABLE_ENABLE}
+          enable={timelineFullScreen ? RESIZABLE_DISABLED : RESIZABLE_ENABLE}
           defaultSize={resizableDefaultSize}
-          minWidth={timelineFullScreen ? '100vw' : minWidthPixels}
-          maxWidth={timelineFullScreen ? '100vw' : `${maxWidthPercent}vw`}
+          minWidth={timelineFullScreen ? 'calc(100vw - 8px)' : minWidthPixels}
+          maxWidth={timelineFullScreen ? 'calc(100vw - 8px)' : `${maxWidthPercent}vw`}
           handleComponent={resizableHandleComponent}
           onResizeStop={onResizeStop}
         >
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
index 9f20c7f6c1571..54b30aca44a1f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
@@ -181,7 +181,7 @@ const GraphOverlayComponent = ({
         </EuiFlexItem>
         {timelineId === TimelineId.active && timelineType === TimelineType.default && (
           <EuiFlexItem grow={false}>
-            <EuiFlexGroup gutterSize="none">
+            <EuiFlexGroup alignItems="center" gutterSize="none">
               <EuiFlexItem grow={false}>
                 <NewCase
                   compact={true}

From 33a9604800a9df7153df0181167dd3ac39557442 Mon Sep 17 00:00:00 2001
From: Tyler Smalley <tyler.smalley@elastic.co>
Date: Tue, 21 Jul 2020 12:57:29 -0700
Subject: [PATCH 05/34] [test] Skips flaky bulk operation buffer tests

Signed-off-by: Tyler Smalley <tyler.smalley@elastic.co>
---
 .../task_manager/server/lib/bulk_operation_buffer.test.ts       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
index 9293656233026..1994e5f749371 100644
--- a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
+++ b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
@@ -33,7 +33,7 @@ function errorAttempts(task: TaskInstance): Err<OperationError<TaskInstance, Err
   });
 }
 
-describe('Bulk Operation Buffer', () => {
+describe.skip('Bulk Operation Buffer', () => {
   describe('createBuffer()', () => {
     test('batches up multiple Operation calls', async () => {
       const bulkUpdate: jest.Mocked<BulkOperation<TaskInstance, Error>> = jest.fn(

From 8d5a5d0860c7747802720030f91b7658196d7e88 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Tue, 21 Jul 2020 15:26:51 -0500
Subject: [PATCH 06/34] [Security Solution][Detections] Adds loading states to
 export/delete on modal (#72562)

* Add loading spinners to Value Lists modal

While export or a delete is pending, we display a loading spinner
instead of the button that was clicked.

Since state is controlled in the parent, we must pass this additional
state in the same way; the table component simply reacts to this state.

* Fix bug with useAsync and multiple calls

Multiple calls to start() would not previously reset the hook's state,
where useEffect on the hook's state would fire improperly as subsequent
calls would not travel the same undefined -> result path.

* Fix style of loading spinner

This fits the size of the button it's replacing, so no shifting occurs
when replacing elements.

* Better styling of spinner

Keep it roughly the same size as the icons themselves, and fill the
space with margin.

* Fix circular dependency in value lists modal

Moves our shared types into a separate module to prevent a circular
dependency.
---
 .../public/common/hooks/use_async.test.ts     | 32 ++++++
 .../lists/public/common/hooks/use_async.ts    |  2 +
 .../value_lists_management_modal/modal.tsx    | 17 +++-
 .../table.test.tsx                            | 20 +++-
 .../value_lists_management_modal/table.tsx    | 67 ++-----------
 .../table_helpers.tsx                         | 98 +++++++++++++++++++
 .../value_lists_management_modal/types.ts     | 16 +++
 7 files changed, 185 insertions(+), 67 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table_helpers.tsx
 create mode 100644 x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/types.ts

diff --git a/x-pack/plugins/lists/public/common/hooks/use_async.test.ts b/x-pack/plugins/lists/public/common/hooks/use_async.test.ts
index 6f115929c3f67..33f28cfc97291 100644
--- a/x-pack/plugins/lists/public/common/hooks/use_async.test.ts
+++ b/x-pack/plugins/lists/public/common/hooks/use_async.test.ts
@@ -95,4 +95,36 @@ describe('useAsync', () => {
 
     expect(result.current.loading).toBe(false);
   });
+
+  it('multiple start calls reset state', async () => {
+    let resolve: (result: string) => void;
+    fn.mockImplementation(() => new Promise((_resolve) => (resolve = _resolve)));
+
+    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+
+    act(() => {
+      result.current.start(args);
+    });
+
+    expect(result.current.loading).toBe(true);
+
+    act(() => resolve('result'));
+    await waitForNextUpdate();
+
+    expect(result.current.loading).toBe(false);
+    expect(result.current.result).toBe('result');
+
+    act(() => {
+      result.current.start(args);
+    });
+
+    expect(result.current.loading).toBe(true);
+    expect(result.current.result).toBe(undefined);
+
+    act(() => resolve('result'));
+    await waitForNextUpdate();
+
+    expect(result.current.loading).toBe(false);
+    expect(result.current.result).toBe('result');
+  });
 });
diff --git a/x-pack/plugins/lists/public/common/hooks/use_async.ts b/x-pack/plugins/lists/public/common/hooks/use_async.ts
index 362cad069b7ea..2f4d611a4a73a 100644
--- a/x-pack/plugins/lists/public/common/hooks/use_async.ts
+++ b/x-pack/plugins/lists/public/common/hooks/use_async.ts
@@ -32,6 +32,8 @@ export const useAsync = <Args extends unknown[], Result>(
   const start = useCallback(
     (...args: Args) => {
       setLoading(true);
+      setResult(undefined);
+      setError(undefined);
       fn(...args)
         .then((r) => isMounted() && setResult(r))
         .catch((e) => isMounted() && setError(e))
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
index d7d4be6d951b8..dc72260439090 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
@@ -46,6 +46,7 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
   const { start: findLists, ...lists } = useFindLists();
   const { start: deleteList, result: deleteResult } = useDeleteList();
   const [exportListId, setExportListId] = useState<string>();
+  const [deletingListIds, setDeletingListIds] = useState<string[]>([]);
   const { addError, addSuccess } = useAppToasts();
 
   const fetchLists = useCallback(() => {
@@ -54,16 +55,18 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
 
   const handleDelete = useCallback(
     ({ id }: { id: string }) => {
+      setDeletingListIds([...deletingListIds, id]);
       deleteList({ http, id });
     },
-    [deleteList, http]
+    [deleteList, deletingListIds, http]
   );
 
   useEffect(() => {
-    if (deleteResult != null) {
+    if (deleteResult != null && deletingListIds.length > 0) {
+      setDeletingListIds([...deletingListIds.filter((id) => id !== deleteResult.id)]);
       fetchLists();
     }
-  }, [deleteResult, fetchLists]);
+  }, [deleteResult, deletingListIds, fetchLists]);
 
   const handleExport = useCallback(
     async ({ ids }: { ids: string[] }) =>
@@ -116,6 +119,12 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
     return null;
   }
 
+  const tableItems = (lists.result?.data ?? []).map((item) => ({
+    ...item,
+    isExporting: item.id === exportListId,
+    isDeleting: deletingListIds.includes(item.id),
+  }));
+
   const pagination = {
     pageIndex,
     pageSize,
@@ -133,7 +142,7 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
           <ValueListsForm onSuccess={handleUploadSuccess} onError={handleUploadError} />
           <EuiSpacer />
           <ValueListsTable
-            lists={lists.result?.data ?? []}
+            items={tableItems}
             loading={lists.loading}
             onDelete={handleDelete}
             onExport={handleExportClick}
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.test.tsx
index d0ed41ea58588..2724c0a0696b6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.test.tsx
@@ -12,14 +12,23 @@ import { getListResponseMock } from '../../../../../lists/common/schemas/respons
 import { ListSchema } from '../../../../../lists/common/schemas/response';
 import { TestProviders } from '../../../common/mock';
 import { ValueListsTable } from './table';
+import { TableItem } from './types';
+
+const buildItems = (lists: ListSchema[]): TableItem[] =>
+  lists.map((list) => ({
+    ...list,
+    isDeleting: false,
+    isExporting: false,
+  }));
 
 describe('ValueListsTable', () => {
   it('renders a row for each list', () => {
     const lists = Array<ListSchema>(3).fill(getListResponseMock());
+    const items = buildItems(lists);
     const container = mount(
       <TestProviders>
         <ValueListsTable
-          lists={lists}
+          items={items}
           onChange={jest.fn()}
           loading={false}
           onExport={jest.fn()}
@@ -34,11 +43,12 @@ describe('ValueListsTable', () => {
 
   it('calls onChange when pagination is modified', () => {
     const lists = Array<ListSchema>(6).fill(getListResponseMock());
+    const items = buildItems(lists);
     const onChange = jest.fn();
     const container = mount(
       <TestProviders>
         <ValueListsTable
-          lists={lists}
+          items={items}
           onChange={onChange}
           loading={false}
           onExport={jest.fn()}
@@ -59,11 +69,12 @@ describe('ValueListsTable', () => {
 
   it('calls onExport when export is clicked', () => {
     const lists = Array<ListSchema>(3).fill(getListResponseMock());
+    const items = buildItems(lists);
     const onExport = jest.fn();
     const container = mount(
       <TestProviders>
         <ValueListsTable
-          lists={lists}
+          items={items}
           onChange={jest.fn()}
           loading={false}
           onExport={onExport}
@@ -86,11 +97,12 @@ describe('ValueListsTable', () => {
 
   it('calls onDelete when delete is clicked', () => {
     const lists = Array<ListSchema>(3).fill(getListResponseMock());
+    const items = buildItems(lists);
     const onDelete = jest.fn();
     const container = mount(
       <TestProviders>
         <ValueListsTable
-          lists={lists}
+          items={items}
           onChange={jest.fn()}
           loading={false}
           onExport={jest.fn()}
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.tsx
index 07d52603a6fd1..850716ce54e26 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table.tsx
@@ -5,74 +5,23 @@
  */
 
 import React from 'react';
-import { EuiBasicTable, EuiBasicTableProps, EuiText, EuiPanel } from '@elastic/eui';
+import { EuiBasicTable, EuiText, EuiPanel } from '@elastic/eui';
 
-import { ListSchema } from '../../../../../lists/common/schemas/response';
-import { FormattedDate } from '../../../common/components/formatted_date';
 import * as i18n from './translations';
-
-type TableProps = EuiBasicTableProps<ListSchema>;
-type ActionCallback = (item: ListSchema) => void;
+import { buildColumns } from './table_helpers';
+import { TableProps, TableItemCallback } from './types';
 
 export interface ValueListsTableProps {
-  lists: TableProps['items'];
+  items: TableProps['items'];
   loading: boolean;
   onChange: TableProps['onChange'];
-  onExport: ActionCallback;
-  onDelete: ActionCallback;
+  onExport: TableItemCallback;
+  onDelete: TableItemCallback;
   pagination: Exclude<TableProps['pagination'], undefined>;
 }
 
-const buildColumns = (
-  onExport: ActionCallback,
-  onDelete: ActionCallback
-): TableProps['columns'] => [
-  {
-    field: 'name',
-    name: i18n.COLUMN_FILE_NAME,
-    truncateText: true,
-  },
-  {
-    field: 'created_at',
-    name: i18n.COLUMN_UPLOAD_DATE,
-    /* eslint-disable-next-line react/display-name */
-    render: (value: ListSchema['created_at']) => (
-      <FormattedDate value={value} fieldName="created_at" />
-    ),
-    width: '30%',
-  },
-  {
-    field: 'created_by',
-    name: i18n.COLUMN_CREATED_BY,
-    truncateText: true,
-    width: '20%',
-  },
-  {
-    name: i18n.COLUMN_ACTIONS,
-    actions: [
-      {
-        name: i18n.ACTION_EXPORT_NAME,
-        description: i18n.ACTION_EXPORT_DESCRIPTION,
-        icon: 'exportAction',
-        type: 'icon',
-        onClick: onExport,
-        'data-test-subj': 'action-export-value-list',
-      },
-      {
-        name: i18n.ACTION_DELETE_NAME,
-        description: i18n.ACTION_DELETE_DESCRIPTION,
-        icon: 'trash',
-        type: 'icon',
-        onClick: onDelete,
-        'data-test-subj': 'action-delete-value-list',
-      },
-    ],
-    width: '15%',
-  },
-];
-
 export const ValueListsTableComponent: React.FC<ValueListsTableProps> = ({
-  lists,
+  items,
   loading,
   onChange,
   onExport,
@@ -87,7 +36,7 @@ export const ValueListsTableComponent: React.FC<ValueListsTableProps> = ({
       </EuiText>
       <EuiBasicTable
         columns={columns}
-        items={lists}
+        items={items}
         loading={loading}
         onChange={onChange}
         pagination={pagination}
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table_helpers.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table_helpers.tsx
new file mode 100644
index 0000000000000..e90d106636e63
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/table_helpers.tsx
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable react/display-name */
+
+import React from 'react';
+import styled from 'styled-components';
+import { EuiButtonIcon, IconType, EuiLoadingSpinner, EuiToolTip } from '@elastic/eui';
+
+import { ListSchema } from '../../../../../lists/common/schemas/response';
+import { FormattedDate } from '../../../common/components/formatted_date';
+import * as i18n from './translations';
+import { TableItem, TableItemCallback, TableProps } from './types';
+
+const AlignedSpinner = styled(EuiLoadingSpinner)`
+  margin: ${({ theme }) => theme.eui.euiSizeXS};
+  vertical-align: middle;
+`;
+
+const ActionButton: React.FC<{
+  content: string;
+  dataTestSubj: string;
+  icon: IconType;
+  isLoading: boolean;
+  item: TableItem;
+  onClick: TableItemCallback;
+}> = ({ content, dataTestSubj, icon, item, onClick, isLoading }) => (
+  <EuiToolTip content={content}>
+    {isLoading ? (
+      <AlignedSpinner size="m" />
+    ) : (
+      <EuiButtonIcon
+        aria-label={content}
+        data-test-subj={dataTestSubj}
+        iconType={icon}
+        onClick={() => onClick(item)}
+      />
+    )}
+  </EuiToolTip>
+);
+
+export const buildColumns = (
+  onExport: TableItemCallback,
+  onDelete: TableItemCallback
+): TableProps['columns'] => [
+  {
+    field: 'name',
+    name: i18n.COLUMN_FILE_NAME,
+    truncateText: true,
+  },
+  {
+    field: 'created_at',
+    name: i18n.COLUMN_UPLOAD_DATE,
+    render: (value: ListSchema['created_at']) => (
+      <FormattedDate value={value} fieldName="created_at" />
+    ),
+    width: '30%',
+  },
+  {
+    field: 'created_by',
+    name: i18n.COLUMN_CREATED_BY,
+    truncateText: true,
+    width: '20%',
+  },
+  {
+    name: i18n.COLUMN_ACTIONS,
+    actions: [
+      {
+        render: (item) => (
+          <ActionButton
+            content={i18n.ACTION_EXPORT_DESCRIPTION}
+            dataTestSubj="action-export-value-list"
+            icon="exportAction"
+            item={item}
+            onClick={onExport}
+            isLoading={item.isExporting}
+          />
+        ),
+      },
+      {
+        render: (item) => (
+          <ActionButton
+            content={i18n.ACTION_DELETE_DESCRIPTION}
+            dataTestSubj="action-delete-value-list"
+            icon="trash"
+            item={item}
+            onClick={onDelete}
+            isLoading={item.isDeleting}
+          />
+        ),
+      },
+    ],
+    width: '15%',
+  },
+];
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/types.ts b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/types.ts
new file mode 100644
index 0000000000000..f85e275247728
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/types.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiBasicTableProps } from '@elastic/eui';
+
+import { ListSchema } from '../../../../../lists/common/schemas/response';
+
+export interface TableItem extends ListSchema {
+  isDeleting: boolean;
+  isExporting: boolean;
+}
+export type TableProps = EuiBasicTableProps<TableItem>;
+export type TableItemCallback = (item: TableItem) => void;

From b0ef3e958033bc9ce8ab0de32c3024aa26b6dc60 Mon Sep 17 00:00:00 2001
From: Nick Partridge <nick.ryan.partridge@gmail.com>
Date: Tue, 21 Jul 2020 15:31:49 -0500
Subject: [PATCH 07/34] Fix sorting of scripted string fields (#72681)

---
 .../normalize_sort_request.test.ts            | 62 ++++++++++++++++++-
 .../search_source/normalize_sort_request.ts   |  2 +-
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/src/plugins/data/public/search/search_source/normalize_sort_request.test.ts b/src/plugins/data/public/search/search_source/normalize_sort_request.test.ts
index d47aab80ee0bc..10004b87ca690 100644
--- a/src/plugins/data/public/search/search_source/normalize_sort_request.test.ts
+++ b/src/plugins/data/public/search/search_source/normalize_sort_request.test.ts
@@ -23,13 +23,23 @@ import { IIndexPattern } from '../..';
 
 describe('SearchSource#normalizeSortRequest', function () {
   const scriptedField = {
-    name: 'script string',
+    name: 'script number',
     type: 'number',
     scripted: true,
     sortable: true,
     script: 'foo',
     lang: 'painless',
   };
+  const stringScriptedField = {
+    ...scriptedField,
+    name: 'script string',
+    type: 'string',
+  };
+  const booleanScriptedField = {
+    ...scriptedField,
+    name: 'script boolean',
+    type: 'boolean',
+  };
   const murmurScriptedField = {
     ...scriptedField,
     sortable: false,
@@ -37,7 +47,7 @@ describe('SearchSource#normalizeSortRequest', function () {
     type: 'murmur3',
   };
   const indexPattern = {
-    fields: [scriptedField, murmurScriptedField],
+    fields: [scriptedField, stringScriptedField, booleanScriptedField, murmurScriptedField],
   } as IIndexPattern;
 
   it('should return an array', function () {
@@ -106,6 +116,54 @@ describe('SearchSource#normalizeSortRequest', function () {
     ]);
   });
 
+  it('should use script based sorting with string type', function () {
+    const result = normalizeSortRequest(
+      [
+        {
+          [stringScriptedField.name]: SortDirection.asc,
+        },
+      ],
+      indexPattern
+    );
+
+    expect(result).toEqual([
+      {
+        _script: {
+          script: {
+            source: stringScriptedField.script,
+            lang: stringScriptedField.lang,
+          },
+          type: 'string',
+          order: SortDirection.asc,
+        },
+      },
+    ]);
+  });
+
+  it('should use script based sorting with boolean type as string type', function () {
+    const result = normalizeSortRequest(
+      [
+        {
+          [booleanScriptedField.name]: SortDirection.asc,
+        },
+      ],
+      indexPattern
+    );
+
+    expect(result).toEqual([
+      {
+        _script: {
+          script: {
+            source: booleanScriptedField.script,
+            lang: booleanScriptedField.lang,
+          },
+          type: 'string',
+          order: SortDirection.asc,
+        },
+      },
+    ]);
+  });
+
   it('should use script based sorting only on sortable types', function () {
     const result = normalizeSortRequest(
       [
diff --git a/src/plugins/data/public/search/search_source/normalize_sort_request.ts b/src/plugins/data/public/search/search_source/normalize_sort_request.ts
index 9a0cf371ce81d..b00d28b38d670 100644
--- a/src/plugins/data/public/search/search_source/normalize_sort_request.ts
+++ b/src/plugins/data/public/search/search_source/normalize_sort_request.ts
@@ -69,7 +69,7 @@ function normalize(
 
 // The ES API only supports sort scripts of type 'number' and 'string'
 function castSortType(type: string) {
-  if (['number', 'string'].includes(type)) {
+  if (['number'].includes(type)) {
     return 'number';
   } else if (['string', 'boolean'].includes(type)) {
     return 'string';

From 2437db63efabcd60b6a0cb5864711178f63fd505 Mon Sep 17 00:00:00 2001
From: Brian Seeders <brian.seeders@elastic.co>
Date: Tue, 21 Jul 2020 16:51:58 -0400
Subject: [PATCH 08/34] [CI] In-progress PR comments (#72211)

---
 vars/githubPr.groovy       | 95 +++++++++++++++++++++++++++++++-------
 vars/jenkinsApi.groovy     |  2 +-
 vars/kibanaPipeline.groovy | 30 +++++++-----
 vars/workers.groovy        |  4 +-
 4 files changed, 101 insertions(+), 30 deletions(-)

diff --git a/vars/githubPr.groovy b/vars/githubPr.groovy
index 9dad2f88de2ec..da5348749f668 100644
--- a/vars/githubPr.groovy
+++ b/vars/githubPr.groovy
@@ -15,25 +15,43 @@
 */
 def withDefaultPrComments(closure) {
   catchErrors {
+    // sendCommentOnError() needs to know if comments are enabled, so lets track it with a global
+    // isPr() just ensures this functionality is skipped for non-PR builds
+    buildState.set('PR_COMMENTS_ENABLED', isPr())
     catchErrors {
       closure()
     }
+    sendComment(true)
+  }
+}
 
-    if (!params.ENABLE_GITHUB_PR_COMMENTS || !isPr()) {
-      return
-    }
+def sendComment(isFinal = false) {
+  if (!buildState.get('PR_COMMENTS_ENABLED')) {
+    return
+  }
 
-    def status = buildUtils.getBuildStatus()
-    if (status == "ABORTED") {
-      return;
-    }
+  def status = buildUtils.getBuildStatus()
+  if (status == "ABORTED") {
+    return
+  }
+
+  def lastComment = getLatestBuildComment()
+  def info = getLatestBuildInfo(lastComment) ?: [:]
+  info.builds = (info.builds ?: []).takeRight(5) // Rotate out old builds
+
+  // If two builds are running at the same time, the first one should not post a comment after the second one
+  if (info.number && info.number.toInteger() > env.BUILD_NUMBER.toInteger()) {
+    return
+  }
+
+  def shouldUpdateComment = !!info.builds.find { it.number == env.BUILD_NUMBER }
 
-    def lastComment = getLatestBuildComment()
-    def info = getLatestBuildInfo(lastComment) ?: [:]
-    info.builds = (info.builds ?: []).takeRight(5) // Rotate out old builds
+  def message = getNextCommentMessage(info, isFinal)
 
-    def message = getNextCommentMessage(info)
-    postComment(message)
+  if (shouldUpdateComment) {
+    updateComment(lastComment.id, message)
+  } else {
+    createComment(message)
 
     if (lastComment && lastComment.user.login == 'kibanamachine') {
       deleteComment(lastComment.id)
@@ -41,6 +59,19 @@ def withDefaultPrComments(closure) {
   }
 }
 
+def sendCommentOnError(Closure closure) {
+  try {
+    closure()
+  } catch (ex) {
+    // If this is the first failed step, it's likely that the error hasn't propagated up far enough to mark the build as a failure
+    currentBuild.result = 'FAILURE'
+    catchErrors {
+      sendComment(false)
+    }
+    throw ex
+  }
+}
+
 // Checks whether or not this currently executing build was triggered via a PR in the elastic/kibana repo
 def isPr() {
   return !!(env.ghprbPullId && env.ghprbPullLink && env.ghprbPullLink =~ /\/elastic\/kibana\//)
@@ -66,7 +97,7 @@ def getLatestBuildInfo() {
 }
 
 def getLatestBuildInfo(comment) {
-  return comment ? getBuildInfoFromComment(comment) : null
+  return comment ? getBuildInfoFromComment(comment.body) : null
 }
 
 def createBuildInfo() {
@@ -137,14 +168,25 @@ def getTestFailuresMessage() {
   return messages.join("\n")
 }
 
-def getNextCommentMessage(previousCommentInfo = [:]) {
+def getNextCommentMessage(previousCommentInfo = [:], isFinal = false) {
   def info = previousCommentInfo ?: [:]
   info.builds = previousCommentInfo.builds ?: []
 
+  // When we update an in-progress comment, we need to remove the old version from the history
+  info.builds = info.builds.findAll { it.number != env.BUILD_NUMBER }
+
   def messages = []
   def status = buildUtils.getBuildStatus()
 
-  if (status == 'SUCCESS') {
+  if (!isFinal) {
+    def failuresPart = status != 'SUCCESS' ? ', with failures' : ''
+    messages << """
+      ## :hourglass_flowing_sand: Build in-progress${failuresPart}
+      * [continuous-integration/kibana-ci/pull-request](${env.BUILD_URL})
+      * Commit: ${getCommitHash()}
+      * This comment will update when the build is complete
+    """
+  } else if (status == 'SUCCESS') {
     messages << """
       ## :green_heart: Build Succeeded
       * [continuous-integration/kibana-ci/pull-request](${env.BUILD_URL})
@@ -172,7 +214,9 @@ def getNextCommentMessage(previousCommentInfo = [:]) {
       * [Pipeline Steps](${env.BUILD_URL}flowGraphTable) (look for red circles / failed steps)
       * [Interpreting CI Failures](https://www.elastic.co/guide/en/kibana/current/interpreting-ci-failures.html)
     """
+  }
 
+  if (status != 'SUCCESS' && status != 'UNSTABLE') {
     try {
       def steps = getFailedSteps()
       if (steps?.size() > 0) {
@@ -186,7 +230,10 @@ def getNextCommentMessage(previousCommentInfo = [:]) {
   }
 
   messages << getTestFailuresMessage()
-  messages << ciStats.getMetricsReport()
+
+  if (isFinal) {
+    messages << ciStats.getMetricsReport()
+  }
 
   if (info.builds && info.builds.size() > 0) {
     messages << getHistoryText(info.builds)
@@ -208,7 +255,7 @@ def getNextCommentMessage(previousCommentInfo = [:]) {
     .join("\n\n")
 }
 
-def postComment(message) {
+def createComment(message) {
   if (!isPr()) {
     error "Trying to post a GitHub PR comment on a non-PR or non-elastic PR build"
   }
@@ -224,6 +271,20 @@ def getComments() {
   }
 }
 
+def updateComment(commentId, message) {
+  if (!isPr()) {
+    error "Trying to post a GitHub PR comment on a non-PR or non-elastic PR build"
+  }
+
+  withGithubCredentials {
+    def path = "repos/elastic/kibana/issues/comments/${commentId}"
+    def json = toJSON([ body: message ]).toString()
+
+    def resp = githubApi([ path: path ], [ method: "POST", data: json, headers: [ "X-HTTP-Method-Override": "PATCH" ] ])
+    return toJSON(resp)
+  }
+}
+
 def deleteComment(commentId) {
   withGithubCredentials {
     def path = "repos/elastic/kibana/issues/comments/${commentId}"
diff --git a/vars/jenkinsApi.groovy b/vars/jenkinsApi.groovy
index 1ea4c3dd76b8d..57818593ffeb2 100644
--- a/vars/jenkinsApi.groovy
+++ b/vars/jenkinsApi.groovy
@@ -10,7 +10,7 @@ def getSteps() {
 
 def getFailedSteps() {
   def steps = getSteps()
-  def failedSteps = steps?.findAll { it.iconColor == "red" && it._class == "org.jenkinsci.plugins.workflow.cps.nodes.StepAtomNode" }
+  def failedSteps = steps?.findAll { (it.iconColor == "red" || it.iconColor == "red_anime") && it._class == "org.jenkinsci.plugins.workflow.cps.nodes.StepAtomNode" }
   failedSteps.each { step ->
     step.logs = "${env.BUILD_URL}execution/node/${step.id}/log".toString()
   }
diff --git a/vars/kibanaPipeline.groovy b/vars/kibanaPipeline.groovy
index f43fe9f96c3ef..410578886a01d 100644
--- a/vars/kibanaPipeline.groovy
+++ b/vars/kibanaPipeline.groovy
@@ -35,7 +35,9 @@ def functionalTestProcess(String name, Closure closure) {
       "JOB=${name}",
       "KBN_NP_PLUGINS_BUILT=true",
     ]) {
-      closure()
+      githubPr.sendCommentOnError {
+        closure()
+      }
     }
   }
 }
@@ -180,26 +182,32 @@ def bash(script, label) {
 }
 
 def doSetup() {
-  retryWithDelay(2, 15) {
-    try {
-      runbld("./test/scripts/jenkins_setup.sh", "Setup Build Environment and Dependencies")
-    } catch (ex) {
+  githubPr.sendCommentOnError {
+    retryWithDelay(2, 15) {
       try {
-        // Setup expects this directory to be missing, so we need to remove it before we do a retry
-        bash("rm -rf ../elasticsearch", "Remove elasticsearch sibling directory, if it exists")
-      } finally {
-        throw ex
+        runbld("./test/scripts/jenkins_setup.sh", "Setup Build Environment and Dependencies")
+      } catch (ex) {
+        try {
+          // Setup expects this directory to be missing, so we need to remove it before we do a retry
+          bash("rm -rf ../elasticsearch", "Remove elasticsearch sibling directory, if it exists")
+        } finally {
+          throw ex
+        }
       }
     }
   }
 }
 
 def buildOss() {
-  runbld("./test/scripts/jenkins_build_kibana.sh", "Build OSS/Default Kibana")
+  githubPr.sendCommentOnError {
+    runbld("./test/scripts/jenkins_build_kibana.sh", "Build OSS/Default Kibana")
+  }
 }
 
 def buildXpack() {
-  runbld("./test/scripts/jenkins_xpack_build_kibana.sh", "Build X-Pack Kibana")
+  githubPr.sendCommentOnError {
+    runbld("./test/scripts/jenkins_xpack_build_kibana.sh", "Build X-Pack Kibana")
+  }
 }
 
 def runErrorReporter() {
diff --git a/vars/workers.groovy b/vars/workers.groovy
index 8b7e8525a7ce3..74ce86516e863 100644
--- a/vars/workers.groovy
+++ b/vars/workers.groovy
@@ -126,7 +126,9 @@ def intake(jobName, String script) {
   return {
     ci(name: jobName, size: 's-highmem', ramDisk: true) {
       withEnv(["JOB=${jobName}"]) {
-        runbld(script, "Execute ${jobName}")
+        githubPr.sendCommentOnError {
+          runbld(script, "Execute ${jobName}")
+        }
       }
     }
   }

From b32f72d370eb0d2c8ccfed01ff92ee915f2a1c5c Mon Sep 17 00:00:00 2001
From: Spencer <email@spalger.com>
Date: Tue, 21 Jul 2020 14:00:19 -0700
Subject: [PATCH 09/34] skip 6.8 branch when triggering baseline-capture builds
 (#72706)

Co-authored-by: spalger <spalger@users.noreply.github.com>
---
 .ci/Jenkinsfile_baseline_trigger | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.ci/Jenkinsfile_baseline_trigger b/.ci/Jenkinsfile_baseline_trigger
index cc9fb47ca4993..221b7a44e30df 100644
--- a/.ci/Jenkinsfile_baseline_trigger
+++ b/.ci/Jenkinsfile_baseline_trigger
@@ -16,6 +16,12 @@ kibanaLibrary.load()
 
 withGithubCredentials {
   branches.each { branch ->
+    if (branch == '6.8') {
+      // skip 6.8, it is tracked but we don't need snapshots for it and haven't backported
+      // the baseline capture scripts to it.
+      return;
+    }
+
     stage(branch) {
       def commits = getCommits(branch, MAXIMUM_COMMITS_TO_CHECK, MAXIMUM_COMMITS_TO_BUILD)
 

From bb7d12864f8c8c87c52d7328b72865a1b97d2be6 Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Date: Tue, 21 Jul 2020 17:34:19 -0400
Subject: [PATCH 10/34] [Ingest Manager] Allow to force unenroll from the UI
 (#72386)

---
 .../common/services/agent_status.ts           |  6 +--
 .../components/context_menu_actions.tsx       | 24 ++++++++---
 .../components/actions_menu.tsx               | 18 +++++---
 .../sections/fleet/agent_list_page/index.tsx  | 22 +++++++---
 .../components/agent_unenroll_provider.tsx    | 43 +++++++++++++------
 5 files changed, 82 insertions(+), 31 deletions(-)

diff --git a/x-pack/plugins/ingest_manager/common/services/agent_status.ts b/x-pack/plugins/ingest_manager/common/services/agent_status.ts
index 536003b0f743d..fe4e094e1bb22 100644
--- a/x-pack/plugins/ingest_manager/common/services/agent_status.ts
+++ b/x-pack/plugins/ingest_manager/common/services/agent_status.ts
@@ -13,12 +13,12 @@ export function getAgentStatus(agent: Agent, now: number = Date.now()): AgentSta
   if (!agent.active) {
     return 'inactive';
   }
-  if (!agent.last_checkin) {
-    return 'enrolling';
-  }
   if (agent.unenrollment_started_at && !agent.unenrolled_at) {
     return 'unenrolling';
   }
+  if (!agent.last_checkin) {
+    return 'enrolling';
+  }
 
   const msLastCheckIn = new Date(lastCheckIn || 0).getTime();
   const msSinceLastCheckIn = new Date().getTime() - msLastCheckIn;
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/context_menu_actions.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/context_menu_actions.tsx
index 8a9f0553895a1..7d1f12447340f 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/context_menu_actions.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/context_menu_actions.tsx
@@ -22,6 +22,8 @@ type Props = {
     props: EuiButtonProps;
     children: JSX.Element;
   };
+  isOpen?: boolean;
+  onChange?: (isOpen: boolean) => void;
 } & (
   | {
       items: EuiContextMenuPanelProps['items'];
@@ -31,10 +33,22 @@ type Props = {
     }
 );
 
-export const ContextMenuActions = React.memo<Props>(({ button, ...props }) => {
-  const [isOpen, setIsOpen] = useState(false);
-  const handleCloseMenu = useCallback(() => setIsOpen(false), [setIsOpen]);
-  const handleToggleMenu = useCallback(() => setIsOpen(!isOpen), [isOpen]);
+export const ContextMenuActions = React.memo<Props>(({ button, onChange, isOpen, ...props }) => {
+  const [isOpenState, setIsOpenState] = useState(false);
+  const handleCloseMenu = useCallback(() => {
+    if (onChange) {
+      onChange(false);
+    } else {
+      setIsOpenState(false);
+    }
+  }, [setIsOpenState, onChange]);
+  const handleToggleMenu = useCallback(() => {
+    if (onChange) {
+      onChange(!isOpen);
+    } else {
+      setIsOpenState(!isOpenState);
+    }
+  }, [isOpenState, onChange, isOpen]);
 
   return (
     <EuiPopover
@@ -55,7 +69,7 @@ export const ContextMenuActions = React.memo<Props>(({ button, ...props }) => {
           />
         )
       }
-      isOpen={isOpen}
+      isOpen={isOpen === undefined ? isOpenState : isOpen}
       closePopover={handleCloseMenu}
     >
       {'items' in props ? (
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/actions_menu.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/actions_menu.tsx
index 75a67fb9288e5..7afc57b30cef4 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/actions_menu.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_details_page/components/actions_menu.tsx
@@ -20,6 +20,7 @@ export const AgentDetailsActionMenu: React.FunctionComponent<{
   const hasWriteCapabilites = useCapabilities().write;
   const refreshAgent = useAgentRefresh();
   const [isReassignFlyoutOpen, setIsReassignFlyoutOpen] = useState(assignFlyoutOpenByDefault);
+  const isUnenrolling = agent.status === 'unenrolling';
 
   const onClose = useMemo(() => {
     if (onCancelReassign) {
@@ -59,7 +60,7 @@ export const AgentDetailsActionMenu: React.FunctionComponent<{
               defaultMessage="Assign new agent config"
             />
           </EuiContextMenuItem>,
-          <AgentUnenrollProvider key="unenrollAgent">
+          <AgentUnenrollProvider key="unenrollAgent" forceUnenroll={isUnenrolling}>
             {(unenrollAgentsPrompt) => (
               <EuiContextMenuItem
                 icon="cross"
@@ -68,10 +69,17 @@ export const AgentDetailsActionMenu: React.FunctionComponent<{
                   unenrollAgentsPrompt([agent.id], 1, refreshAgent);
                 }}
               >
-                <FormattedMessage
-                  id="xpack.ingestManager.agentList.unenrollOneButton"
-                  defaultMessage="Unenroll"
-                />
+                {isUnenrolling ? (
+                  <FormattedMessage
+                    id="xpack.ingestManager.agentList.forceUnenrollOneButton"
+                    defaultMessage="Force unenroll"
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="xpack.ingestManager.agentList.unenrollOneButton"
+                    defaultMessage="Unenroll"
+                  />
+                )}
               </EuiContextMenuItem>
             )}
           </AgentUnenrollProvider>,
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
index 034482c4cf9b5..3743f9b39191b 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/index.tsx
@@ -74,8 +74,12 @@ const RowActions = React.memo<{ agent: Agent; onReassignClick: () => void; refre
     const { getHref } = useLink();
     const hasWriteCapabilites = useCapabilities().write;
 
+    const isUnenrolling = agent.status === 'unenrolling';
+    const [isMenuOpen, setIsMenuOpen] = useState(false);
     return (
       <ContextMenuActions
+        isOpen={isMenuOpen}
+        onChange={(isOpen) => setIsMenuOpen(isOpen)}
         items={[
           <EuiContextMenuItem
             icon="inspect"
@@ -100,7 +104,7 @@ const RowActions = React.memo<{ agent: Agent; onReassignClick: () => void; refre
             />
           </EuiContextMenuItem>,
 
-          <AgentUnenrollProvider>
+          <AgentUnenrollProvider forceUnenroll={isUnenrolling}>
             {(unenrollAgentsPrompt) => (
               <EuiContextMenuItem
                 disabled={!hasWriteCapabilites}
@@ -108,13 +112,21 @@ const RowActions = React.memo<{ agent: Agent; onReassignClick: () => void; refre
                 onClick={() => {
                   unenrollAgentsPrompt([agent.id], 1, () => {
                     refresh();
+                    setIsMenuOpen(false);
                   });
                 }}
               >
-                <FormattedMessage
-                  id="xpack.ingestManager.agentList.unenrollOneButton"
-                  defaultMessage="Unenroll"
-                />
+                {isUnenrolling ? (
+                  <FormattedMessage
+                    id="xpack.ingestManager.agentList.forceUnenrollOneButton"
+                    defaultMessage="Force unenroll"
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="xpack.ingestManager.agentList.unenrollOneButton"
+                    defaultMessage="Unenroll"
+                  />
+                )}
               </EuiContextMenuItem>
             )}
           </AgentUnenrollProvider>,
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_unenroll_provider.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_unenroll_provider.tsx
index 90d8ff545341d..6f1cba70bbcee 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_unenroll_provider.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/components/agent_unenroll_provider.tsx
@@ -14,6 +14,7 @@ import { agentRouteService } from '../../../services';
 
 interface Props {
   children: (unenrollAgents: UnenrollAgents) => React.ReactElement;
+  forceUnenroll?: boolean;
 }
 
 export type UnenrollAgents = (
@@ -24,7 +25,10 @@ export type UnenrollAgents = (
 
 type OnSuccessCallback = (agentsUnenrolled: string[]) => void;
 
-export const AgentUnenrollProvider: React.FunctionComponent<Props> = ({ children }) => {
+export const AgentUnenrollProvider: React.FunctionComponent<Props> = ({
+  children,
+  forceUnenroll = false,
+}) => {
   const core = useCore();
   const [agents, setAgents] = useState<string[] | string>([]);
   const [agentsCount, setAgentsCount] = useState<number>(0);
@@ -65,19 +69,24 @@ export const AgentUnenrollProvider: React.FunctionComponent<Props> = ({ children
       const { error } = await sendRequest<PostAgentUnenrollResponse>({
         path: agentRouteService.getUnenrollPath(agentId),
         method: 'post',
+        body: {
+          force: forceUnenroll,
+        },
       });
 
       if (error) {
         throw new Error(error.message);
       }
 
-      const successMessage = i18n.translate(
-        'xpack.ingestManager.unenrollAgents.successSingleNotificationTitle',
-        {
-          defaultMessage: "Unenrolling agent '{id}'",
-          values: { id: agentId },
-        }
-      );
+      const successMessage = forceUnenroll
+        ? i18n.translate('xpack.ingestManager.unenrollAgents.successForceSingleNotificationTitle', {
+            defaultMessage: "Agent '{id}' unenrolled",
+            values: { id: agentId },
+          })
+        : i18n.translate('xpack.ingestManager.unenrollAgents.successSingleNotificationTitle', {
+            defaultMessage: "Unenrolling agent '{id}'",
+            values: { id: agentId },
+          });
       core.notifications.toasts.addSuccess(successMessage);
 
       if (onSuccessCallback.current) {
@@ -107,11 +116,19 @@ export const AgentUnenrollProvider: React.FunctionComponent<Props> = ({ children
         <EuiConfirmModal
           title={
             isSingle && !unenrollByKuery ? (
-              <FormattedMessage
-                id="xpack.ingestManager.unenrollAgents.confirmModal.deleteSingleTitle"
-                defaultMessage="Unenroll agent '{id}'?"
-                values={{ id: agents[0] }}
-              />
+              forceUnenroll ? (
+                <FormattedMessage
+                  id="xpack.ingestManager.unenrollAgents.confirmModal.forceDeleteSingleTitle"
+                  defaultMessage="Force unenroll agent '{id}'?"
+                  values={{ id: agents[0] }}
+                />
+              ) : (
+                <FormattedMessage
+                  id="xpack.ingestManager.unenrollAgents.confirmModal.deleteSingleTitle"
+                  defaultMessage="Unenroll agent '{id}'?"
+                  values={{ id: agents[0] }}
+                />
+              )
             ) : (
               <FormattedMessage
                 id="xpack.ingestManager.unenrollAgents.confirmModal.deleteMultipleTitle"

From b930cef489dfc320e5c3e55778656a971f2df511 Mon Sep 17 00:00:00 2001
From: Robert Austin <robert.austin@elastic.co>
Date: Tue, 21 Jul 2020 17:47:22 -0400
Subject: [PATCH 11/34] [Resolver] Origin process (#72382)

Co-authored-by: Brent Kimmel <brent.kimmel@elastic.co>

* Center the origin node
* Nodes appear selected when they are selected. also the aria attributes are working.
* Reposition the submenu when the user pans.
---
 .../isometric_taxi_layout.test.ts             |  4 +-
 .../isometric_taxi_layout.ts                  | 61 ++++++++++++++----
 .../public/resolver/store/actions.ts          | 23 ++-----
 .../public/resolver/store/data/selectors.ts   | 64 ++++++++++++++++---
 .../public/resolver/store/reducer.ts          | 50 ++++++---------
 .../public/resolver/store/selectors.ts        | 27 ++++----
 .../public/resolver/store/ui/selectors.ts     | 23 ++-----
 .../public/resolver/types.ts                  | 12 ++--
 .../public/resolver/view/assets.tsx           | 12 ++--
 .../public/resolver/view/map.tsx              |  3 +-
 .../public/resolver/view/panel.tsx            |  6 +-
 .../resolver/view/process_event_dot.tsx       | 34 +++++-----
 .../public/resolver/view/submenu.tsx          | 34 +++++++++-
 13 files changed, 214 insertions(+), 139 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
index bd534dcb989e3..40be175c9fdbb 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
@@ -5,7 +5,7 @@
  */
 import { IsometricTaxiLayout } from '../../types';
 import { LegacyEndpointEvent } from '../../../../common/endpoint/types';
-import { isometricTaxiLayout } from './isometric_taxi_layout';
+import { isometricTaxiLayoutFactory } from './isometric_taxi_layout';
 import { mockProcessEvent } from '../../models/process_event_test_helpers';
 import { factory } from './index';
 
@@ -107,7 +107,7 @@ describe('resolver graph layout', () => {
         unique_ppid: 0,
       },
     });
-    layout = () => isometricTaxiLayout(factory(events));
+    layout = () => isometricTaxiLayoutFactory(factory(events));
     events = [];
   });
   describe('when rendering no nodes', () => {
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
index 11c888d1462f8..1fc2ea0150aee 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
@@ -3,7 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import * as vector2 from '../../models/vector2';
 import {
   IndexedProcessTree,
   Vector2,
@@ -17,14 +16,17 @@ import {
 } from '../../types';
 import * as event from '../../../../common/endpoint/models/event';
 import { ResolverEvent } from '../../../../common/endpoint/types';
-import * as model from './index';
+import * as vector2 from '../vector2';
+import * as indexedProcessTreeModel from './index';
 import { getFriendlyElapsedTime as elapsedTime } from '../../lib/date';
 import { uniquePidForProcess } from '../process_event';
 
 /**
  * Graph the process tree
  */
-export function isometricTaxiLayout(indexedProcessTree: IndexedProcessTree): IsometricTaxiLayout {
+export function isometricTaxiLayoutFactory(
+  indexedProcessTree: IndexedProcessTree
+): IsometricTaxiLayout {
   /**
    * Walk the tree in reverse level order, calculating the 'width' of subtrees.
    */
@@ -83,8 +85,8 @@ export function isometricTaxiLayout(indexedProcessTree: IndexedProcessTree): Iso
  */
 function ariaLevels(indexedProcessTree: IndexedProcessTree): Map<ResolverEvent, number> {
   const map: Map<ResolverEvent, number> = new Map();
-  for (const node of model.levelOrder(indexedProcessTree)) {
-    const parentNode = model.parent(indexedProcessTree, node);
+  for (const node of indexedProcessTreeModel.levelOrder(indexedProcessTree)) {
+    const parentNode = indexedProcessTreeModel.parent(indexedProcessTree, node);
     if (parentNode === undefined) {
       // nodes at the root have a level of 1
       map.set(node, 1);
@@ -143,16 +145,19 @@ function ariaLevels(indexedProcessTree: IndexedProcessTree): Map<ResolverEvent,
 function widthsOfProcessSubtrees(indexedProcessTree: IndexedProcessTree): ProcessWidths {
   const widths = new Map<ResolverEvent, number>();
 
-  if (model.size(indexedProcessTree) === 0) {
+  if (indexedProcessTreeModel.size(indexedProcessTree) === 0) {
     return widths;
   }
 
   const processesInReverseLevelOrder: ResolverEvent[] = [
-    ...model.levelOrder(indexedProcessTree),
+    ...indexedProcessTreeModel.levelOrder(indexedProcessTree),
   ].reverse();
 
   for (const process of processesInReverseLevelOrder) {
-    const children = model.children(indexedProcessTree, uniquePidForProcess(process));
+    const children = indexedProcessTreeModel.children(
+      indexedProcessTree,
+      uniquePidForProcess(process)
+    );
 
     const sumOfWidthOfChildren = function sumOfWidthOfChildren() {
       return children.reduce(function sum(currentValue, child) {
@@ -229,7 +234,10 @@ function processEdgeLineSegments(
       metadata: edgeLineMetadata,
     };
 
-    const siblings = model.children(indexedProcessTree, uniquePidForProcess(parent));
+    const siblings = indexedProcessTreeModel.children(
+      indexedProcessTree,
+      uniquePidForProcess(parent)
+    );
     const isFirstChild = process === siblings[0];
 
     if (metadata.isOnlyChild) {
@@ -384,8 +392,8 @@ function* levelOrderWithWidths(
   tree: IndexedProcessTree,
   widths: ProcessWidths
 ): Iterable<ProcessWithWidthMetadata> {
-  for (const process of model.levelOrder(tree)) {
-    const parent = model.parent(tree, process);
+  for (const process of indexedProcessTreeModel.levelOrder(tree)) {
+    const parent = indexedProcessTreeModel.parent(tree, process);
     const width = widths.get(process);
 
     if (width === undefined) {
@@ -423,7 +431,7 @@ function* levelOrderWithWidths(
         parentWidth,
       };
 
-      const siblings = model.children(tree, uniquePidForProcess(parent));
+      const siblings = indexedProcessTreeModel.children(tree, uniquePidForProcess(parent));
       if (siblings.length === 1) {
         metadata.isOnlyChild = true;
         metadata.lastChildWidth = width;
@@ -479,3 +487,32 @@ const distanceBetweenNodesInUnits = 2;
  * The distance in pixels (at scale 1) between nodes. Change this to space out nodes more
  */
 const distanceBetweenNodes = distanceBetweenNodesInUnits * unit;
+
+export function nodePosition(model: IsometricTaxiLayout, node: ResolverEvent): Vector2 | undefined {
+  return model.processNodePositions.get(node);
+}
+
+/**
+ * Return a clone of `model` with all positions incremented by `translation`.
+ * Use this to move the layout around.
+ * e.g.
+ * ```
+ * translated(layout, [100, -200]) // return a copy of `layout`, thats been moved 100 to the right and 200 up
+ * ```
+ */
+export function translated(model: IsometricTaxiLayout, translation: Vector2): IsometricTaxiLayout {
+  return {
+    processNodePositions: new Map(
+      [...model.processNodePositions.entries()].map(([node, position]) => [
+        node,
+        vector2.add(position, translation),
+      ])
+    ),
+    edgeLineSegments: model.edgeLineSegments.map(({ points, metadata }) => ({
+      points: points.map((point) => vector2.add(point, translation)),
+      metadata,
+    })),
+    // these are unchanged
+    ariaLevels: model.ariaLevels,
+  };
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/actions.ts b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
index ac11ab8c88681..418eb0d837276 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/actions.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/actions.ts
@@ -69,12 +69,9 @@ interface AppDetectedMissingEventData {
  */
 interface UserFocusedOnResolverNode {
   readonly type: 'userFocusedOnResolverNode';
-  readonly payload: {
-    /**
-     * Used to identify the process node that the user focused on (in the DOM)
-     */
-    readonly nodeId: string;
-  };
+
+  /** focused nodeID */
+  readonly payload: string;
 }
 
 /**
@@ -85,16 +82,10 @@ interface UserFocusedOnResolverNode {
  */
 interface UserSelectedResolverNode {
   readonly type: 'userSelectedResolverNode';
-  readonly payload: {
-    /**
-     * The HTML ID used to identify the process node's element that the user selected
-     */
-    readonly nodeId: string;
-    /**
-     * The process entity_id for the process the node represents
-     */
-    readonly selectedProcessId: string;
-  };
+  /**
+   * The nodeID (aka entity_id) that was select.
+   */
+  readonly payload: string;
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index 4098c6fc6c5dd..40138d3f2fd3c 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -30,8 +30,9 @@ import {
   ResolverRelatedEvents,
 } from '../../../../common/endpoint/types';
 import * as resolverTreeModel from '../../models/resolver_tree';
-import { isometricTaxiLayout } from '../../models/indexed_process_tree/isometric_taxi_layout';
+import * as isometricTaxiLayoutModel from '../../models/indexed_process_tree/isometric_taxi_layout';
 import { allEventCategories } from '../../../../common/endpoint/models/event';
+import * as vector2 from '../../models/vector2';
 
 /**
  * If there is currently a request.
@@ -70,6 +71,21 @@ const resolverTreeResponse = (state: DataState): ResolverTree | undefined => {
   }
 };
 
+/**
+ * the node ID of the node representing the databaseDocumentID.
+ * NB: this could be stale if the last response is stale
+ */
+export const originID: (state: DataState) => string | undefined = createSelector(
+  resolverTreeResponse,
+  function (resolverTree?) {
+    if (resolverTree) {
+      // This holds the entityID (aka nodeID) of the node related to the last fetched `_id`
+      return resolverTree.entityID;
+    }
+    return undefined;
+  }
+);
+
 /**
  * Process events that will be displayed as terminated.
  */
@@ -317,13 +333,45 @@ export function databaseDocumentIDToFetch(state: DataState): string | null {
   }
 }
 
-export const layout = createSelector(tree, function processNodePositionsAndEdgeLineSegments(
-  /* eslint-disable no-shadow */
-  indexedProcessTree
-  /* eslint-enable no-shadow */
-) {
-  return isometricTaxiLayout(indexedProcessTree);
-});
+export const layout = createSelector(
+  tree,
+  originID,
+  function processNodePositionsAndEdgeLineSegments(
+    /* eslint-disable no-shadow */
+    indexedProcessTree,
+    originID
+    /* eslint-enable no-shadow */
+  ) {
+    // use the isometric taxi layout as a base
+    const taxiLayout = isometricTaxiLayoutModel.isometricTaxiLayoutFactory(indexedProcessTree);
+
+    if (!originID) {
+      // no data has loaded.
+      return taxiLayout;
+    }
+
+    // find the origin node
+    const originNode = indexedProcessTreeModel.processEvent(indexedProcessTree, originID);
+
+    if (!originNode) {
+      // this should only happen if the `ResolverTree` from the server has an entity ID with no matching lifecycle events.
+      throw new Error('Origin node not found in ResolverTree');
+    }
+
+    // Find the position of the origin, we'll center the map on it intrinsically
+    const originPosition = isometricTaxiLayoutModel.nodePosition(taxiLayout, originNode);
+    // adjust the position of everything so that the origin node is at `(0, 0)`
+
+    if (originPosition === undefined) {
+      // not sure how this could happen.
+      return taxiLayout;
+    }
+
+    // Take the origin position, and multipy it by -1, then move the layout by that amount.
+    // This should center the layout around the origin.
+    return isometricTaxiLayoutModel.translated(taxiLayout, vector2.scale(originPosition, -1));
+  }
+);
 
 /**
  * Given a nodeID (aka entity_id) get the indexed process event.
diff --git a/x-pack/plugins/security_solution/public/resolver/store/reducer.ts b/x-pack/plugins/security_solution/public/resolver/store/reducer.ts
index fc4c4de5819f3..028c28d94a41b 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/reducer.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { Reducer, combineReducers } from 'redux';
-import { htmlIdGenerator } from '@elastic/eui';
 import { animateProcessIntoView } from './methods';
 import { cameraReducer } from './camera/reducer';
 import { dataReducer } from './data/reducer';
@@ -12,51 +11,38 @@ import { ResolverAction } from './actions';
 import { ResolverState, ResolverUIState } from '../types';
 import { uniquePidForProcess } from '../models/process_event';
 
-/**
- * Despite the name "generator", this function is entirely determinant
- * (i.e. it will return the same html id given the same prefix 'resolverNode'
- * and nodeId)
- */
-const resolverNodeIdGenerator = htmlIdGenerator('resolverNode');
-
 const uiReducer: Reducer<ResolverUIState, ResolverAction> = (
-  uiState = {
-    activeDescendantId: null,
-    selectedDescendantId: null,
-    processEntityIdOfSelectedDescendant: null,
+  state = {
+    ariaActiveDescendant: null,
+    selectedNode: null,
   },
   action
 ) => {
   if (action.type === 'userFocusedOnResolverNode') {
-    return {
-      ...uiState,
-      activeDescendantId: action.payload.nodeId,
+    const next: ResolverUIState = {
+      ...state,
+      ariaActiveDescendant: action.payload,
     };
+    return next;
   } else if (action.type === 'userSelectedResolverNode') {
-    return {
-      ...uiState,
-      selectedDescendantId: action.payload.nodeId,
-      processEntityIdOfSelectedDescendant: action.payload.selectedProcessId,
+    const next: ResolverUIState = {
+      ...state,
+      selectedNode: action.payload,
     };
+    return next;
   } else if (
     action.type === 'userBroughtProcessIntoView' ||
     action.type === 'appDetectedNewIdFromQueryParams'
   ) {
-    /**
-     * This action has a process payload (instead of a processId), so we use
-     * `uniquePidForProcess` and `resolverNodeIdGenerator` to resolve the determinant
-     * html id of the node being brought into view.
-     */
-    const processEntityId = uniquePidForProcess(action.payload.process);
-    const processNodeId = resolverNodeIdGenerator(processEntityId);
-    return {
-      ...uiState,
-      activeDescendantId: processNodeId,
-      selectedDescendantId: processNodeId,
-      processEntityIdOfSelectedDescendant: processEntityId,
+    const nodeID = uniquePidForProcess(action.payload.process);
+    const next: ResolverUIState = {
+      ...state,
+      ariaActiveDescendant: nodeID,
+      selectedNode: nodeID,
     };
+    return next;
   } else {
-    return uiState;
+    return state;
   }
 };
 
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 09293d0b3b683..66d7e04d118ed 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -144,26 +144,15 @@ export const relatedEventInfoByEntityId = composeSelectors(
 /**
  * Returns the id of the "current" tree node (fake-focused)
  */
-export const uiActiveDescendantId = composeSelectors(
+export const ariaActiveDescendant = composeSelectors(
   uiStateSelector,
-  uiSelectors.activeDescendantId
+  uiSelectors.ariaActiveDescendant
 );
 
 /**
- * Returns the id of the "selected" tree node (the node that is currently "pressed" and possibly controlling other popups / components)
+ * Returns the nodeID of the selected node
  */
-export const uiSelectedDescendantId = composeSelectors(
-  uiStateSelector,
-  uiSelectors.selectedDescendantId
-);
-
-/**
- * Returns the entity_id of the "selected" tree node's process
- */
-export const uiSelectedDescendantProcessId = composeSelectors(
-  uiStateSelector,
-  uiSelectors.selectedDescendantProcessId
-);
+export const selectedNode = composeSelectors(uiStateSelector, uiSelectors.selectedNode);
 
 /**
  * Returns the camera state from within ResolverState
@@ -251,6 +240,14 @@ export const ariaLevel: (
   dataSelectors.ariaLevel
 );
 
+/**
+ * the node ID of the node representing the databaseDocumentID
+ */
+export const originID: (state: ResolverState) => string | undefined = composeSelectors(
+  dataStateSelector,
+  dataSelectors.originID
+);
+
 /**
  * Takes a nodeID (aka entity_id) and returns the node ID of the node that aria should 'flowto' or null
  * If the node has a flowto candidate that is currently visible, that will be returned, otherwise null.
diff --git a/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
index 494d8884329c6..91a2cbecbc04c 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/ui/selectors.ts
@@ -10,32 +10,21 @@ import { ResolverUIState } from '../../types';
 /**
  * id of the "current" tree node (fake-focused)
  */
-export const activeDescendantId = createSelector(
+export const ariaActiveDescendant = createSelector(
   (uiState: ResolverUIState) => uiState,
   /* eslint-disable no-shadow */
-  ({ activeDescendantId }) => {
-    return activeDescendantId;
+  ({ ariaActiveDescendant }) => {
+    return ariaActiveDescendant;
   }
 );
 
 /**
  * id of the currently "selected" tree node
  */
-export const selectedDescendantId = createSelector(
+export const selectedNode = createSelector(
   (uiState: ResolverUIState) => uiState,
   /* eslint-disable no-shadow */
-  ({ selectedDescendantId }) => {
-    return selectedDescendantId;
-  }
-);
-
-/**
- * id of the currently "selected" tree node
- */
-export const selectedDescendantProcessId = createSelector(
-  (uiState: ResolverUIState) => uiState,
-  /* eslint-disable no-shadow */
-  ({ processEntityIdOfSelectedDescendant }: ResolverUIState) => {
-    return processEntityIdOfSelectedDescendant;
+  ({ selectedNode }: ResolverUIState) => {
+    return selectedNode;
   }
 );
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index 0272de0d8fd2a..856ae2d6240e3 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -34,17 +34,13 @@ export interface ResolverState {
  */
 export interface ResolverUIState {
   /**
-   * The ID attribute of the resolver's aria-activedescendent.
+   * The nodeID for the process that is selected (in the aria-activedescendent sense of being selected.)
    */
-  readonly activeDescendantId: string | null;
+  readonly ariaActiveDescendant: string | null;
   /**
-   * The ID attribute of the resolver's currently selected descendant.
+   * nodeID of the selected node
    */
-  readonly selectedDescendantId: string | null;
-  /**
-   * The entity_id of the process for the resolver's currently selected descendant.
-   */
-  readonly processEntityIdOfSelectedDescendant: string | null;
+  readonly selectedNode: string | null;
 }
 
 /**
diff --git a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
index 42f9634238e6a..fc4a9daf17ad1 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/assets.tsx
@@ -422,7 +422,7 @@ const processTypeToCube: Record<ResolverProcessType, keyof NodeStyleMap> = {
 export const useResolverTheme = (): {
   colorMap: ColorMap;
   nodeAssets: NodeStyleMap;
-  cubeAssetsForNode: (isProcessTerimnated: boolean, isProcessOrigin: boolean) => NodeStyleConfig;
+  cubeAssetsForNode: (isProcessTerimnated: boolean, isProcessTrigger: boolean) => NodeStyleConfig;
 } => {
   const isDarkMode = useUiSetting<boolean>(DEFAULT_DARK_MODE);
   const theme = isDarkMode ? euiThemeAmsterdamDark : euiThemeAmsterdamLight;
@@ -497,10 +497,14 @@ export const useResolverTheme = (): {
     },
   };
 
-  function cubeAssetsForNode(isProcessTerminated: boolean, isProcessOrigin: boolean) {
+  function cubeAssetsForNode(isProcessTerminated: boolean, isProcessTrigger: boolean) {
     if (isProcessTerminated) {
-      return nodeAssets[processTypeToCube.processTerminated];
-    } else if (isProcessOrigin) {
+      if (isProcessTrigger) {
+        return nodeAssets.terminatedTriggerCube;
+      } else {
+        return nodeAssets[processTypeToCube.processTerminated];
+      }
+    } else if (isProcessTrigger) {
       return nodeAssets[processTypeToCube.processCausedAlert];
     } else {
       return nodeAssets[processTypeToCube.processRan];
diff --git a/x-pack/plugins/security_solution/public/resolver/view/map.tsx b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
index 930e96c3f3e40..69ff9c8e2351b 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/map.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
@@ -64,7 +64,7 @@ export const ResolverMap = React.memo(function ({
   const { projectionMatrix, ref, onMouseDown } = useCamera();
   const isLoading = useSelector(selectors.isLoading);
   const hasError = useSelector(selectors.hasError);
-  const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
+  const activeDescendantId = useSelector(selectors.ariaActiveDescendant);
   const { colorMap } = useResolverTheme();
 
   return (
@@ -110,7 +110,6 @@ export const ResolverMap = React.memo(function ({
                 projectionMatrix={projectionMatrix}
                 event={processEvent}
                 isProcessTerminated={terminatedProcesses.has(processEntityId)}
-                isProcessOrigin={false}
                 timeAtRender={timeAtRender}
               />
             );
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panel.tsx b/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
index efb2d95396ef5..cb0acdc29ceb1 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panel.tsx
@@ -60,10 +60,10 @@ const PanelContent = memo(function PanelContent() {
   // The "selected" node (and its corresponding event) in the tree control.
   // It may need to be synchronized with the ID indicated as selected via the `idFromParams`
   // memo above. When this is the case, it is handled by the layout effect below.
-  const selectedDescendantProcessId = useSelector(selectors.uiSelectedDescendantProcessId);
+  const selectedNode = useSelector(selectors.selectedNode);
   const uiSelectedEvent = useMemo(() => {
-    return graphableProcesses.find((evt) => event.entityId(evt) === selectedDescendantProcessId);
-  }, [graphableProcesses, selectedDescendantProcessId]);
+    return graphableProcesses.find((evt) => event.entityId(evt) === selectedNode);
+  }, [graphableProcesses, selectedNode]);
 
   // Until an event is dispatched during update, the event indicated as selected by params may
   // be different than the one in state.
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index 1f4952f15119d..05f2e0cbfcfa9 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -72,7 +72,6 @@ const UnstyledProcessEventDot = React.memo(
     event,
     projectionMatrix,
     isProcessTerminated,
-    isProcessOrigin,
     timeAtRender,
   }: {
     /**
@@ -95,10 +94,6 @@ const UnstyledProcessEventDot = React.memo(
      * Whether or not to show the process as terminated.
      */
     isProcessTerminated: boolean;
-    /**
-     * Whether or not to show the process as the originating event.
-     */
-    isProcessOrigin: boolean;
 
     /**
      * The time (unix epoch) at render.
@@ -117,8 +112,8 @@ const UnstyledProcessEventDot = React.memo(
     const [xScale] = projectionMatrix;
 
     // Node (html id=) IDs
-    const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
-    const selectedDescendantId = useSelector(selectors.uiSelectedDescendantId);
+    const ariaActiveDescendant = useSelector(selectors.ariaActiveDescendant);
+    const selectedNode = useSelector(selectors.selectedNode);
     const nodeID = processEventModel.uniquePidForProcess(event);
     const relatedEventStats = useSelector(selectors.relatedEventsStats)(nodeID);
 
@@ -212,23 +207,26 @@ const UnstyledProcessEventDot = React.memo(
       isLabelFilled,
       labelButtonFill,
       strokeColor,
-    } = cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
+    } = cubeAssetsForNode(
+      isProcessTerminated,
+      /**
+       * There is no definition for 'trigger process' yet. return false.
+       */ false
+    );
 
     const labelHTMLID = htmlIdGenerator('resolver')(`${nodeID}:label`);
 
-    const isAriaCurrent = nodeID === activeDescendantId;
-    const isAriaSelected = nodeID === selectedDescendantId;
+    const isAriaCurrent = nodeID === ariaActiveDescendant;
+    const isAriaSelected = nodeID === selectedNode;
 
     const dispatch = useResolverDispatch();
 
     const handleFocus = useCallback(() => {
       dispatch({
         type: 'userFocusedOnResolverNode',
-        payload: {
-          nodeId: nodeHTMLID(nodeID),
-        },
+        payload: nodeID,
       });
-    }, [dispatch, nodeHTMLID, nodeID]);
+    }, [dispatch, nodeID]);
 
     const handleRelatedEventRequest = useCallback(() => {
       dispatch({
@@ -247,13 +245,10 @@ const UnstyledProcessEventDot = React.memo(
       }
       dispatch({
         type: 'userSelectedResolverNode',
-        payload: {
-          nodeId: nodeHTMLID(nodeID),
-          selectedProcessId: nodeID,
-        },
+        payload: nodeID,
       });
       pushToQueryParams({ crumbId: nodeID, crumbEvent: '' });
-    }, [animationTarget, dispatch, pushToQueryParams, nodeID, nodeHTMLID]);
+    }, [animationTarget, dispatch, pushToQueryParams, nodeID]);
 
     /**
      * Enumerates the stats for related events to display with the node as options,
@@ -422,6 +417,7 @@ const UnstyledProcessEventDot = React.memo(
                   buttonFill={colorMap.resolverBackground}
                   menuAction={handleRelatedEventRequest}
                   menuTitle={subMenuAssets.relatedEvents.title}
+                  projectionMatrix={projectionMatrix}
                   optionsWithActions={relatedEventStatusOrOptions}
                 />
               )}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
index ce126bf695559..2499a451b9c8c 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/submenu.tsx
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import React, { ReactNode, useState, useMemo, useCallback } from 'react';
+import React, { ReactNode, useState, useMemo, useCallback, useRef, useLayoutEffect } from 'react';
 import {
   EuiI18nNumber,
   EuiSelectable,
@@ -15,6 +15,7 @@ import {
   htmlIdGenerator,
 } from '@elastic/eui';
 import styled from 'styled-components';
+import { Matrix3 } from '../types';
 
 /**
  * i18n-translated titles for submenus and identifiers for display of states:
@@ -133,6 +134,7 @@ const NodeSubMenuComponents = React.memo(
     menuAction,
     optionsWithActions,
     className,
+    projectionMatrix,
   }: {
     menuTitle: string;
     className?: string;
@@ -140,9 +142,16 @@ const NodeSubMenuComponents = React.memo(
     buttonBorderColor: ButtonColor;
     buttonFill: string;
     count?: number;
+    /**
+     * Receive the projection matrix, so we can see when the camera position changed, so we can force the submenu to reposition itself.
+     */
+    projectionMatrix: Matrix3;
   } & {
     optionsWithActions?: ResolverSubmenuOptionList | string | undefined;
   }) => {
+    // keep a ref to the popover so we can call its reposition method
+    const popoverRef = useRef<EuiPopover>(null);
+
     const [menuIsOpen, setMenuOpen] = useState(false);
     const handleMenuOpenClick = useCallback(
       (clickEvent: React.MouseEvent<HTMLButtonElement, MouseEvent>) => {
@@ -169,6 +178,28 @@ const NodeSubMenuComponents = React.memo(
 
     const isMenuLoading = optionsWithActions === 'waitingForRelatedEventData';
 
+    // The last projection matrix that was used to position the popover
+    const projectionMatrixAtLastRender = useRef<Matrix3>();
+
+    useLayoutEffect(() => {
+      if (
+        /**
+         * If there is a popover component reference,
+         * and this isn't the first render,
+         * and the projectionMatrix has changed since last render,
+         * then force the popover to reposition itself.
+         */
+        popoverRef.current &&
+        !projectionMatrixAtLastRender.current &&
+        projectionMatrixAtLastRender.current !== projectionMatrix
+      ) {
+        popoverRef.current.positionPopoverFixed();
+      }
+
+      // no matter what, keep track of the last project matrix that was used to size the popover
+      projectionMatrixAtLastRender.current = projectionMatrix;
+    }, [projectionMatrixAtLastRender, projectionMatrix]);
+
     if (!optionsWithActions) {
       /**
        * When called with a `menuAction`
@@ -216,6 +247,7 @@ const NodeSubMenuComponents = React.memo(
           isOpen={menuIsOpen}
           closePopover={closePopover}
           repositionOnScroll
+          ref={popoverRef}
         >
           {menuIsOpen && typeof optionsWithActions === 'object' && (
             <OptionList isLoading={isMenuLoading} subMenuOptions={optionsWithActions} />

From b3f15953316f63ac986f8e75369b75c2d4817042 Mon Sep 17 00:00:00 2001
From: Dima Arnautov <dmitrii.arnautov@elastic.co>
Date: Wed, 22 Jul 2020 01:03:27 +0200
Subject: [PATCH 12/34] [ML] do not throw an error when agg is not supported by
 UI (#72685)

---
 x-pack/plugins/transform/public/app/common/pivot_aggs.test.ts | 4 ----
 x-pack/plugins/transform/public/app/common/pivot_aggs.ts      | 4 ++--
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/transform/public/app/common/pivot_aggs.test.ts b/x-pack/plugins/transform/public/app/common/pivot_aggs.test.ts
index 9e748068742f3..48a0951e906e9 100644
--- a/x-pack/plugins/transform/public/app/common/pivot_aggs.test.ts
+++ b/x-pack/plugins/transform/public/app/common/pivot_aggs.test.ts
@@ -11,10 +11,6 @@ import {
 } from '../sections/create_transform/components/step_define/common/filter_agg/components';
 
 describe('getAggConfigFromEsAgg', () => {
-  test('should throw an error for unsupported agg', () => {
-    expect(() => getAggConfigFromEsAgg({ terms: {} }, 'test')).toThrowError();
-  });
-
   test('should return a common config if the agg does not have a custom config defined', () => {
     expect(getAggConfigFromEsAgg({ avg: { field: 'region' } }, 'test_1')).toEqual({
       agg: 'avg',
diff --git a/x-pack/plugins/transform/public/app/common/pivot_aggs.ts b/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
index 54dfd9ecda7b1..ec52de4b9da92 100644
--- a/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
+++ b/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
@@ -110,8 +110,8 @@ export function getAggConfigFromEsAgg(
   // Find the main aggregation key
   const agg = aggKeys.find((aggKey) => aggKey !== 'aggs');
 
-  if (!isPivotSupportedAggs(agg)) {
-    throw new Error(`Aggregation "${agg}" is not supported`);
+  if (agg === undefined) {
+    throw new Error(`Aggregation key is required`);
   }
 
   const commonConfig: PivotAggsConfigBase = {

From a4957e65c2102b0710ab6672f7590f8925cc43fe Mon Sep 17 00:00:00 2001
From: Clint Andrew Hall <clint.hall@elastic.co>
Date: Tue, 21 Jul 2020 19:18:57 -0400
Subject: [PATCH 13/34] [pre-req] New Component Layout proposal (#72385)

* New Component Layout proposal

* Add contribution guidelines; remove dead i18n

* Re-adding i18n... ugh

* Fix i18n files to reflect changes

* Addressing feedback

* Fix merge issue

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 x-pack/plugins/canvas/CONTRIBUTING.md         | 139 +++++
 x-pack/plugins/canvas/i18n/components.ts      |  25 +-
 .../__snapshots__/asset.stories.storyshot     | 178 ++++++
 .../asset_manager.stories.storyshot           | 539 ++++++++++++++++++
 .../__examples__/asset.stories.tsx            |  46 --
 .../__examples__/asset_manager.stories.tsx    |  52 +-
 .../asset_manager/__examples__/provider.tsx   | 110 ++++
 .../asset_manager/asset.component.tsx         | 147 +++++
 .../public/components/asset_manager/asset.tsx | 177 ++----
 ..._modal.tsx => asset_manager.component.tsx} |  76 +--
 .../components/asset_manager/asset_manager.ts |  70 +++
 .../asset_manager/asset_manager.tsx           | 111 ----
 .../public/components/asset_manager/index.ts  | 108 +---
 .../canvas/storybook/storyshots.test.js       |   1 +
 .../canvas/storybook/webpack.config.js        |  17 +
 .../translations/translations/ja-JP.json      |   6 +-
 .../translations/translations/zh-CN.json      |   6 +-
 17 files changed, 1334 insertions(+), 474 deletions(-)
 create mode 100644 x-pack/plugins/canvas/CONTRIBUTING.md
 delete mode 100644 x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset.stories.tsx
 create mode 100644 x-pack/plugins/canvas/public/components/asset_manager/__examples__/provider.tsx
 create mode 100644 x-pack/plugins/canvas/public/components/asset_manager/asset.component.tsx
 rename x-pack/plugins/canvas/public/components/asset_manager/{asset_modal.tsx => asset_manager.component.tsx} (69%)
 create mode 100644 x-pack/plugins/canvas/public/components/asset_manager/asset_manager.ts
 delete mode 100644 x-pack/plugins/canvas/public/components/asset_manager/asset_manager.tsx

diff --git a/x-pack/plugins/canvas/CONTRIBUTING.md b/x-pack/plugins/canvas/CONTRIBUTING.md
new file mode 100644
index 0000000000000..538cc1592c3bc
--- /dev/null
+++ b/x-pack/plugins/canvas/CONTRIBUTING.md
@@ -0,0 +1,139 @@
+# Contributing to Canvas
+
+Canvas is a plugin for Kibana, therefore its [contribution guidelines](../../../CONTRIBUTING.md) apply to Canvas development, as well.  This document contains Canvas-specific guidelines that extend from the Kibana guidelines.
+
+- [Active Migrations](#active_migrations)
+- [i18n](#i18n)
+- [Component Code Structure](#component_code_structure)
+- [Storybook](#storybook)
+
+## Active Migrations
+
+When editing code in Canvas, be aware of the following active migrations, (generally, taken when a file is touched):
+
+- Convert file(s) to Typescript.
+- Convert React classes to Functional components, (where applicable).
+- Add Storybook stories for components, (and thus Storyshots).
+- Remove `recompose` in favor of React hooks.
+- Apply improved component structure.
+- Write tests.
+
+## i18n
+
+i18n syntax in Kibana can be a bit verbose in code:
+
+```js
+  i18n('pluginNamespace.messageId', {
+    defaultMessage: 'Default message string literal, {key}',
+    values: {
+      key: 'value',
+    },
+    description: 'Message context or description',
+  });
+```
+
+To keep the code terse, Canvas uses i18n "dictionaries": abstracted, static singletons of accessor methods which return a given string:
+
+```js
+
+// i18n/components.ts
+export const ComponentStrings = {
+  // ...
+  AssetManager: {
+    getCopyAssetMessage: (id: string) =>
+      i18n.translate('xpack.canvas.assetModal.copyAssetMessage', {
+        defaultMessage: `Copied '{id}' to clipboard`,
+        values: {
+          id,
+        },
+      }),
+      // ...
+  },
+  // ...
+};
+
+// asset_manager.tsx
+import { ComponentStrings } from '../../../i18n';
+const { AssetManager: strings } = ComponentStrings;
+
+const text = (
+  <EuiText>
+    {strings.getSpaceUsedText(percentageUsed)}
+  </EuiText>
+);
+
+```
+
+These singletons can then be changed at will, as well as audited for unused methods, (and therefore unused i18n strings).
+
+## Component Code Structure
+
+Canvas uses Redux.  Component code is divided into React components and Redux containers.  This way, components can be reused, their containers can be edited, and both can be tested independently.
+
+Canvas is actively migrating to a structure which uses the `index.ts` file as a thin exporting index, rather than functional code:
+
+```
+- components
+  - foo                       <- directory representing the component
+    - foo.ts                  <- redux container
+    - foo.component.tsx       <- react component
+    - foo.scss
+    - index.ts                <- thin exporting index, (no redux)
+  - bar                       <- directory representing the component
+    - bar.ts
+    - bar.component.tsx
+    - bar.scss
+    - bar_dep.ts              <- redux sub container
+    - bar_dep.component.tsx   <- sub component
+    - index.ts
+```
+
+The exporting file would be:
+
+```
+export { Foo } from './foo';
+export { Foo as FooComponent } from './foo.component';
+```
+
+### Why?
+
+Canvas has been using an "index-export" structure that has served it well, until recently.  In this structure, the `index.ts` file serves as the primary export of the Redux component, (and holds that code).  The component is then named-- `component.tsx`-- and consumed in the `index` file.
+
+The problem we've run into is when you have sub-components which are also connected to Redux.  To maintain this structure, each sub-component and its Redux container would then be stored in a subdirectory, (with only two files in it).
+
+> NOTE: if a PR touches component code that is in the older structure, it should be migrated to the structure above.
+
+## Storybook
+
+Canvas uses [Storybook](https://storybook.js.org) to test and develop components.  This has a number of benefits:
+
+- Developing components without needing to start ES + Kibana.
+- Testing components interactively without starting ES + Kibana.
+- Automatic Storyshot integration with Jest
+
+### Using Storybook
+
+The Canvas Storybook instance can be started by running `node scripts/storybook` from the Canvas root directory.  It has a number of options:
+
+```
+node scripts/storybook
+
+  Storybook runner for Canvas.
+
+  Options:
+    --clean            Forces a clean of the Storybook DLL and exits.
+    --dll              Cleans and builds the Storybook dependency DLL and exits.
+    --stats            Produces a Webpack stats file.
+    --site             Produces a site deployment of this Storybook.
+    --verbose, -v      Log verbosely
+    --debug            Log debug messages (less than verbose)
+    --quiet            Only log errors
+    --silent           Don't log anything
+    --help             Show this message
+```
+
+### What about `kbn-storybook`?
+
+Canvas wants to move to the Kibana Storybook instance as soon as feasible.  There are few tweaks Canvas makes to Storybook, so we're actively working with the maintainers to make that migration successful.
+
+In the meantime, people can test our progress by running `node scripts/storybook_new` from the Canvas root.
diff --git a/x-pack/plugins/canvas/i18n/components.ts b/x-pack/plugins/canvas/i18n/components.ts
index acc55d50ae19a..9b1d60f38eb5e 100644
--- a/x-pack/plugins/canvas/i18n/components.ts
+++ b/x-pack/plugins/canvas/i18n/components.ts
@@ -110,26 +110,24 @@ export const ComponentStrings = {
       i18n.translate('xpack.canvas.asset.thumbnailAltText', {
         defaultMessage: 'Asset thumbnail',
       }),
-  },
-  AssetManager: {
-    getButtonLabel: () =>
-      i18n.translate('xpack.canvas.assetManager.manageButtonLabel', {
-        defaultMessage: 'Manage assets',
-      }),
     getConfirmModalButtonLabel: () =>
-      i18n.translate('xpack.canvas.assetManager.confirmModalButtonLabel', {
+      i18n.translate('xpack.canvas.asset.confirmModalButtonLabel', {
         defaultMessage: 'Remove',
       }),
     getConfirmModalMessageText: () =>
-      i18n.translate('xpack.canvas.assetManager.confirmModalDetail', {
+      i18n.translate('xpack.canvas.asset.confirmModalDetail', {
         defaultMessage: 'Are you sure you want to remove this asset?',
       }),
     getConfirmModalTitle: () =>
-      i18n.translate('xpack.canvas.assetManager.confirmModalTitle', {
+      i18n.translate('xpack.canvas.asset.confirmModalTitle', {
         defaultMessage: 'Remove Asset',
       }),
   },
-  AssetModal: {
+  AssetManager: {
+    getButtonLabel: () =>
+      i18n.translate('xpack.canvas.assetManager.manageButtonLabel', {
+        defaultMessage: 'Manage assets',
+      }),
     getDescription: () =>
       i18n.translate('xpack.canvas.assetModal.modalDescription', {
         defaultMessage:
@@ -162,6 +160,13 @@ export const ComponentStrings = {
           percentageUsed,
         },
       }),
+    getCopyAssetMessage: (id: string) =>
+      i18n.translate('xpack.canvas.assetModal.copyAssetMessage', {
+        defaultMessage: `Copied '{id}' to clipboard`,
+        values: {
+          id,
+        },
+      }),
   },
   AssetPicker: {
     getAssetAltText: () =>
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset.stories.storyshot b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset.stories.storyshot
index 14791cd3d8b25..87205b363e697 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset.stories.storyshot
@@ -355,3 +355,181 @@ exports[`Storyshots components/Assets/Asset marker 1`] = `
   </div>
 </div>
 `;
+
+exports[`Storyshots components/Assets/Asset redux 1`] = `
+<div
+  style={
+    Object {
+      "width": "215px",
+    }
+  }
+>
+  <div
+    className="euiFlexItem"
+  >
+    <div
+      className="euiPanel euiPanel--paddingSmall canvasAsset"
+    >
+      <div
+        className="canvasAsset__thumb canvasCheckered"
+      >
+        <figure
+          className="euiImage canvasAsset__img "
+        >
+          <img
+            alt="Asset thumbnail"
+            className="euiImage__img"
+            src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1Ni4zMSA1Ni4zMSI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMDc4YTA7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPlBsYW5lIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNDkuNTEsNDguOTMsNDEuMjYsMjIuNTIsNTMuNzYsMTBhNS4yOSw1LjI5LDAsMCwwLTcuNDgtNy40N2wtMTIuNSwxMi41TDcuMzgsNi43OUEuNy43LDAsMCwwLDYuNjksN0wxLjIsMTIuNDVhLjcuNywwLDAsMCwwLDFMMTkuODUsMjlsLTcuMjQsNy4yNC03Ljc0LS42YS43MS43MSwwLDAsMC0uNTMuMkwxLjIxLDM5YS42Ny42NywwLDAsMCwuMDgsMUw5LjQ1LDQ2bC4wNywwYy4xMS4xMy4yMi4yNi4zNC4zOHMuMjUuMjMuMzguMzRhLjM2LjM2LDAsMCwwLDAsLjA3TDE2LjMzLDU1YS42OC42OCwwLDAsMCwxLC4wN0wyMC40OSw1MmEuNjcuNjcsMCwwLDAsLjE5LS41NGwtLjU5LTcuNzQsNy4yNC03LjI0TDQyLjg1LDU1LjA2YS42OC42OCwwLDAsMCwxLDBsNS41LTUuNUEuNjYuNjYsMCwwLDAsNDkuNTEsNDguOTNaIi8+PC9nPjwvZz48L3N2Zz4="
+            style={Object {}}
+          />
+        </figure>
+      </div>
+      <div
+        className="euiSpacer euiSpacer--s"
+      />
+      <div
+        className="euiText euiText--extraSmall eui-textBreakAll"
+      >
+        <p
+          className="eui-textBreakAll"
+        >
+          <strong>
+            airplane
+          </strong>
+          <br />
+          <span
+            className="euiTextColor euiTextColor--subdued"
+          >
+            <small>
+              (
+              1
+               kb)
+            </small>
+          </span>
+        </p>
+      </div>
+      <div
+        className="euiSpacer euiSpacer--s"
+      />
+      <div
+        className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow"
+      >
+        <div
+          className="euiFlexItem euiFlexItem--flexGrowZero asset-create-image"
+        >
+          <span
+            className="euiToolTipAnchor"
+            onKeyUp={[Function]}
+            onMouseOut={[Function]}
+            onMouseOver={[Function]}
+          >
+            <button
+              aria-label="Create image element"
+              className="euiButtonIcon euiButtonIcon--primary"
+              onBlur={[Function]}
+              onClick={[Function]}
+              onFocus={[Function]}
+              type="button"
+            >
+              <div
+                aria-hidden="true"
+                className="euiButtonIcon__icon"
+                data-euiicon-type="vector"
+                size="m"
+              />
+            </button>
+          </span>
+        </div>
+        <div
+          className="euiFlexItem euiFlexItem--flexGrowZero asset-download"
+        >
+          <span
+            className="euiToolTipAnchor"
+            onKeyUp={[Function]}
+            onMouseOut={[Function]}
+            onMouseOver={[Function]}
+          >
+            <div
+              className="canvasDownload"
+              onClick={[Function]}
+              onKeyPress={[Function]}
+              role="button"
+              tabIndex={0}
+            >
+              <button
+                aria-label="Download"
+                className="euiButtonIcon euiButtonIcon--primary"
+                type="button"
+              >
+                <div
+                  aria-hidden="true"
+                  className="euiButtonIcon__icon"
+                  data-euiicon-type="sortDown"
+                  size="m"
+                />
+              </button>
+            </div>
+          </span>
+        </div>
+        <div
+          className="euiFlexItem euiFlexItem--flexGrowZero"
+        >
+          <span
+            className="euiToolTipAnchor"
+            onKeyUp={[Function]}
+            onMouseOut={[Function]}
+            onMouseOver={[Function]}
+          >
+            <div
+              className="canvasClipboard"
+              onClick={[Function]}
+              onKeyPress={[Function]}
+              role="button"
+              tabIndex={0}
+            >
+              <button
+                aria-label="Copy id to clipboard"
+                className="euiButtonIcon euiButtonIcon--primary"
+                type="button"
+              >
+                <div
+                  aria-hidden="true"
+                  className="euiButtonIcon__icon"
+                  data-euiicon-type="copyClipboard"
+                  size="m"
+                />
+              </button>
+            </div>
+          </span>
+        </div>
+        <div
+          className="euiFlexItem euiFlexItem--flexGrowZero"
+        >
+          <span
+            className="euiToolTipAnchor"
+            onKeyUp={[Function]}
+            onMouseOut={[Function]}
+            onMouseOver={[Function]}
+          >
+            <button
+              aria-label="Delete"
+              className="euiButtonIcon euiButtonIcon--danger"
+              onBlur={[Function]}
+              onClick={[Function]}
+              onFocus={[Function]}
+              type="button"
+            >
+              <div
+                aria-hidden="true"
+                className="euiButtonIcon__icon"
+                data-euiicon-type="trash"
+                size="m"
+              />
+            </button>
+          </span>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+`;
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset_manager.stories.storyshot b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset_manager.stories.storyshot
index 1b8f1480759f6..11c5681ebf79e 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset_manager.stories.storyshot
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/__snapshots__/asset_manager.stories.storyshot
@@ -229,6 +229,545 @@ Array [
 ]
 `;
 
+exports[`Storyshots components/Assets/AssetManager redux 1`] = `
+Array [
+  <div
+    data-focus-guard={true}
+    style={
+      Object {
+        "height": "0px",
+        "left": "1px",
+        "overflow": "hidden",
+        "padding": 0,
+        "position": "fixed",
+        "top": "1px",
+        "width": "1px",
+      }
+    }
+    tabIndex={0}
+  />,
+  <div
+    data-focus-guard={true}
+    style={
+      Object {
+        "height": "0px",
+        "left": "1px",
+        "overflow": "hidden",
+        "padding": 0,
+        "position": "fixed",
+        "top": "1px",
+        "width": "1px",
+      }
+    }
+    tabIndex={1}
+  />,
+  <div
+    data-focus-lock-disabled={false}
+    onBlur={[Function]}
+    onFocus={[Function]}
+  >
+    <div
+      className="euiModal canvasAssetManager canvasModal--fixedSize"
+      onKeyDown={[Function]}
+      style={
+        Object {
+          "maxWidth": "1000px",
+        }
+      }
+      tabIndex={0}
+    >
+      <button
+        aria-label="Closes this modal window"
+        className="euiButtonIcon euiButtonIcon--text euiModal__closeIcon"
+        onClick={[Function]}
+        type="button"
+      >
+        <div
+          aria-hidden="true"
+          className="euiButtonIcon__icon"
+          data-euiicon-type="cross"
+          size="m"
+        />
+      </button>
+      <div
+        className="euiModal__flex"
+      >
+        <div
+          className="euiModalHeader canvasAssetManager__modalHeader"
+        >
+          <div
+            className="euiModalHeader__title canvasAssetManager__modalHeaderTitle"
+          >
+            Manage workpad assets
+          </div>
+          <div
+            className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive canvasAssetManager__fileUploadWrapper"
+          >
+            <div
+              className="euiFlexItem euiFlexItem--flexGrowZero"
+            >
+              <div
+                className="euiFilePicker euiFilePicker--compressed"
+              >
+                <div
+                  className="euiFilePicker__wrap"
+                >
+                  <input
+                    accept="image/*"
+                    aria-describedby="generated-id"
+                    className="euiFilePicker__input"
+                    multiple={true}
+                    onChange={[Function]}
+                    onDragLeave={[Function]}
+                    onDragOver={[Function]}
+                    onDrop={[Function]}
+                    type="file"
+                  />
+                  <div
+                    className="euiFilePicker__prompt"
+                    id="generated-id"
+                  >
+                    <div
+                      aria-hidden="true"
+                      className="euiFilePicker__icon"
+                      data-euiicon-type="importAction"
+                      size="m"
+                    />
+                    <div
+                      className="euiFilePicker__promptText"
+                    >
+                      Select or drag and drop images
+                    </div>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div
+          className="euiModalBody"
+        >
+          <div
+            className="euiModalBody__overflow"
+          >
+            <div
+              className="euiText euiText--small"
+            >
+              <div
+                className="euiTextColor euiTextColor--subdued"
+              >
+                <p>
+                  Below are the image assets in this workpad. Any assets that are currently in use cannot be determined at this time. To reclaim space, delete assets.
+                </p>
+              </div>
+            </div>
+            <div
+              className="euiSpacer euiSpacer--l"
+            />
+            <div
+              className="euiFlexGrid euiFlexGrid--gutterLarge euiFlexGrid--fourths euiFlexGrid--responsive"
+            >
+              <div
+                className="euiFlexItem"
+              >
+                <div
+                  className="euiPanel euiPanel--paddingSmall canvasAsset"
+                >
+                  <div
+                    className="canvasAsset__thumb canvasCheckered"
+                  >
+                    <figure
+                      className="euiImage canvasAsset__img "
+                    >
+                      <img
+                        alt="Asset thumbnail"
+                        className="euiImage__img"
+                        src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1Ni4zMSA1Ni4zMSI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMDc4YTA7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPlBsYW5lIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNDkuNTEsNDguOTMsNDEuMjYsMjIuNTIsNTMuNzYsMTBhNS4yOSw1LjI5LDAsMCwwLTcuNDgtNy40N2wtMTIuNSwxMi41TDcuMzgsNi43OUEuNy43LDAsMCwwLDYuNjksN0wxLjIsMTIuNDVhLjcuNywwLDAsMCwwLDFMMTkuODUsMjlsLTcuMjQsNy4yNC03Ljc0LS42YS43MS43MSwwLDAsMC0uNTMuMkwxLjIxLDM5YS42Ny42NywwLDAsMCwuMDgsMUw5LjQ1LDQ2bC4wNywwYy4xMS4xMy4yMi4yNi4zNC4zOHMuMjUuMjMuMzguMzRhLjM2LjM2LDAsMCwwLDAsLjA3TDE2LjMzLDU1YS42OC42OCwwLDAsMCwxLC4wN0wyMC40OSw1MmEuNjcuNjcsMCwwLDAsLjE5LS41NGwtLjU5LTcuNzQsNy4yNC03LjI0TDQyLjg1LDU1LjA2YS42OC42OCwwLDAsMCwxLDBsNS41LTUuNUEuNjYuNjYsMCwwLDAsNDkuNTEsNDguOTNaIi8+PC9nPjwvZz48L3N2Zz4="
+                        style={Object {}}
+                      />
+                    </figure>
+                  </div>
+                  <div
+                    className="euiSpacer euiSpacer--s"
+                  />
+                  <div
+                    className="euiText euiText--extraSmall eui-textBreakAll"
+                  >
+                    <p
+                      className="eui-textBreakAll"
+                    >
+                      <strong>
+                        airplane
+                      </strong>
+                      <br />
+                      <span
+                        className="euiTextColor euiTextColor--subdued"
+                      >
+                        <small>
+                          (
+                          1
+                           kb)
+                        </small>
+                      </span>
+                    </p>
+                  </div>
+                  <div
+                    className="euiSpacer euiSpacer--s"
+                  />
+                  <div
+                    className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow"
+                  >
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero asset-create-image"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <button
+                          aria-label="Create image element"
+                          className="euiButtonIcon euiButtonIcon--primary"
+                          onBlur={[Function]}
+                          onClick={[Function]}
+                          onFocus={[Function]}
+                          type="button"
+                        >
+                          <div
+                            aria-hidden="true"
+                            className="euiButtonIcon__icon"
+                            data-euiicon-type="vector"
+                            size="m"
+                          />
+                        </button>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero asset-download"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <div
+                          className="canvasDownload"
+                          onClick={[Function]}
+                          onKeyPress={[Function]}
+                          role="button"
+                          tabIndex={0}
+                        >
+                          <button
+                            aria-label="Download"
+                            className="euiButtonIcon euiButtonIcon--primary"
+                            type="button"
+                          >
+                            <div
+                              aria-hidden="true"
+                              className="euiButtonIcon__icon"
+                              data-euiicon-type="sortDown"
+                              size="m"
+                            />
+                          </button>
+                        </div>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <div
+                          className="canvasClipboard"
+                          onClick={[Function]}
+                          onKeyPress={[Function]}
+                          role="button"
+                          tabIndex={0}
+                        >
+                          <button
+                            aria-label="Copy id to clipboard"
+                            className="euiButtonIcon euiButtonIcon--primary"
+                            type="button"
+                          >
+                            <div
+                              aria-hidden="true"
+                              className="euiButtonIcon__icon"
+                              data-euiicon-type="copyClipboard"
+                              size="m"
+                            />
+                          </button>
+                        </div>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <button
+                          aria-label="Delete"
+                          className="euiButtonIcon euiButtonIcon--danger"
+                          onBlur={[Function]}
+                          onClick={[Function]}
+                          onFocus={[Function]}
+                          type="button"
+                        >
+                          <div
+                            aria-hidden="true"
+                            className="euiButtonIcon__icon"
+                            data-euiicon-type="trash"
+                            size="m"
+                          />
+                        </button>
+                      </span>
+                    </div>
+                  </div>
+                </div>
+              </div>
+              <div
+                className="euiFlexItem"
+              >
+                <div
+                  className="euiPanel euiPanel--paddingSmall canvasAsset"
+                >
+                  <div
+                    className="canvasAsset__thumb canvasCheckered"
+                  >
+                    <figure
+                      className="euiImage canvasAsset__img "
+                    >
+                      <img
+                        alt="Asset thumbnail"
+                        className="euiImage__img"
+                        src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzOC4zOSA1Ny41NyI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMTliOGY7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPkxvY2F0aW9uIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMTkuMTksMUExOC4xOSwxOC4xOSwwLDAsMCwyLjk0LDI3LjM2aDBhMTkuNTEsMTkuNTEsMCwwLDAsMSwxLjc4TDE5LjE5LDU1LjU3LDM0LjM4LDI5LjIxQTE4LjE5LDE4LjE5LDAsMCwwLDE5LjE5LDFabTAsMjMuMjlhNS41Myw1LjUzLDAsMSwxLDUuNTMtNS41M0E1LjUzLDUuNTMsMCwwLDEsMTkuMTksMjQuMjlaIi8+PC9nPjwvZz48L3N2Zz4="
+                        style={Object {}}
+                      />
+                    </figure>
+                  </div>
+                  <div
+                    className="euiSpacer euiSpacer--s"
+                  />
+                  <div
+                    className="euiText euiText--extraSmall eui-textBreakAll"
+                  >
+                    <p
+                      className="eui-textBreakAll"
+                    >
+                      <strong>
+                        marker
+                      </strong>
+                      <br />
+                      <span
+                        className="euiTextColor euiTextColor--subdued"
+                      >
+                        <small>
+                          (
+                          1
+                           kb)
+                        </small>
+                      </span>
+                    </p>
+                  </div>
+                  <div
+                    className="euiSpacer euiSpacer--s"
+                  />
+                  <div
+                    className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsBaseline euiFlexGroup--justifyContentCenter euiFlexGroup--directionRow"
+                  >
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero asset-create-image"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <button
+                          aria-label="Create image element"
+                          className="euiButtonIcon euiButtonIcon--primary"
+                          onBlur={[Function]}
+                          onClick={[Function]}
+                          onFocus={[Function]}
+                          type="button"
+                        >
+                          <div
+                            aria-hidden="true"
+                            className="euiButtonIcon__icon"
+                            data-euiicon-type="vector"
+                            size="m"
+                          />
+                        </button>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero asset-download"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <div
+                          className="canvasDownload"
+                          onClick={[Function]}
+                          onKeyPress={[Function]}
+                          role="button"
+                          tabIndex={0}
+                        >
+                          <button
+                            aria-label="Download"
+                            className="euiButtonIcon euiButtonIcon--primary"
+                            type="button"
+                          >
+                            <div
+                              aria-hidden="true"
+                              className="euiButtonIcon__icon"
+                              data-euiicon-type="sortDown"
+                              size="m"
+                            />
+                          </button>
+                        </div>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <div
+                          className="canvasClipboard"
+                          onClick={[Function]}
+                          onKeyPress={[Function]}
+                          role="button"
+                          tabIndex={0}
+                        >
+                          <button
+                            aria-label="Copy id to clipboard"
+                            className="euiButtonIcon euiButtonIcon--primary"
+                            type="button"
+                          >
+                            <div
+                              aria-hidden="true"
+                              className="euiButtonIcon__icon"
+                              data-euiicon-type="copyClipboard"
+                              size="m"
+                            />
+                          </button>
+                        </div>
+                      </span>
+                    </div>
+                    <div
+                      className="euiFlexItem euiFlexItem--flexGrowZero"
+                    >
+                      <span
+                        className="euiToolTipAnchor"
+                        onKeyUp={[Function]}
+                        onMouseOut={[Function]}
+                        onMouseOver={[Function]}
+                      >
+                        <button
+                          aria-label="Delete"
+                          className="euiButtonIcon euiButtonIcon--danger"
+                          onBlur={[Function]}
+                          onClick={[Function]}
+                          onFocus={[Function]}
+                          type="button"
+                        >
+                          <div
+                            aria-hidden="true"
+                            className="euiButtonIcon__icon"
+                            data-euiicon-type="trash"
+                            size="m"
+                          />
+                        </button>
+                      </span>
+                    </div>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div
+          className="euiModalFooter canvasAssetManager__modalFooter"
+        >
+          <div
+            className="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow canvasAssetManager__meterWrapper"
+          >
+            <div
+              className="euiFlexItem"
+            >
+              <progress
+                aria-labelledby="CanvasAssetManagerLabel"
+                className="euiProgress euiProgress--native euiProgress--s euiProgress--secondary"
+                max={25000}
+                value={2}
+              />
+            </div>
+            <div
+              className="euiFlexItem euiFlexItem--flexGrowZero eui-textNoWrap"
+            >
+              <div
+                className="euiText euiText--medium"
+                id="CanvasAssetManagerLabel"
+              >
+                0% space used
+              </div>
+            </div>
+          </div>
+          <button
+            className="euiButton euiButton--primary euiButton--small"
+            onClick={[Function]}
+            type="button"
+          >
+            <span
+              className="euiButton__content"
+            >
+              <span
+                className="euiButton__text"
+              >
+                Close
+              </span>
+            </span>
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>,
+  <div
+    data-focus-guard={true}
+    style={
+      Object {
+        "height": "0px",
+        "left": "1px",
+        "overflow": "hidden",
+        "padding": 0,
+        "position": "fixed",
+        "top": "1px",
+        "width": "1px",
+      }
+    }
+    tabIndex={0}
+  />,
+]
+`;
+
 exports[`Storyshots components/Assets/AssetManager two assets 1`] = `
 Array [
   <div
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset.stories.tsx b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset.stories.tsx
deleted file mode 100644
index 9a6147050bdbb..0000000000000
--- a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset.stories.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { action } from '@storybook/addon-actions';
-import { storiesOf } from '@storybook/react';
-import React from 'react';
-import { Asset } from '../asset';
-import { AssetType } from '../../../../types';
-
-const AIRPLANE: AssetType = {
-  '@created': '2018-10-13T16:44:44.648Z',
-  id: 'airplane',
-  type: 'dataurl',
-  value:
-    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1Ni4zMSA1Ni4zMSI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMDc4YTA7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPlBsYW5lIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNDkuNTEsNDguOTMsNDEuMjYsMjIuNTIsNTMuNzYsMTBhNS4yOSw1LjI5LDAsMCwwLTcuNDgtNy40N2wtMTIuNSwxMi41TDcuMzgsNi43OUEuNy43LDAsMCwwLDYuNjksN0wxLjIsMTIuNDVhLjcuNywwLDAsMCwwLDFMMTkuODUsMjlsLTcuMjQsNy4yNC03Ljc0LS42YS43MS43MSwwLDAsMC0uNTMuMkwxLjIxLDM5YS42Ny42NywwLDAsMCwuMDgsMUw5LjQ1LDQ2bC4wNywwYy4xMS4xMy4yMi4yNi4zNC4zOHMuMjUuMjMuMzguMzRhLjM2LjM2LDAsMCwwLDAsLjA3TDE2LjMzLDU1YS42OC42OCwwLDAsMCwxLC4wN0wyMC40OSw1MmEuNjcuNjcsMCwwLDAsLjE5LS41NGwtLjU5LTcuNzQsNy4yNC03LjI0TDQyLjg1LDU1LjA2YS42OC42OCwwLDAsMCwxLDBsNS41LTUuNUEuNjYuNjYsMCwwLDAsNDkuNTEsNDguOTNaIi8+PC9nPjwvZz48L3N2Zz4=',
-};
-
-const MARKER: AssetType = {
-  '@created': '2018-10-13T16:44:44.648Z',
-  id: 'marker',
-  type: 'dataurl',
-  value:
-    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzOC4zOSA1Ny41NyI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMTliOGY7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPkxvY2F0aW9uIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMTkuMTksMUExOC4xOSwxOC4xOSwwLDAsMCwyLjk0LDI3LjM2aDBhMTkuNTEsMTkuNTEsMCwwLDAsMSwxLjc4TDE5LjE5LDU1LjU3LDM0LjM4LDI5LjIxQTE4LjE5LDE4LjE5LDAsMCwwLDE5LjE5LDFabTAsMjMuMjlhNS41Myw1LjUzLDAsMSwxLDUuNTMtNS41M0E1LjUzLDUuNTMsMCwwLDEsMTkuMTksMjQuMjlaIi8+PC9nPjwvZz48L3N2Zz4=',
-};
-
-storiesOf('components/Assets/Asset', module)
-  .addDecorator((story) => <div style={{ width: '215px' }}>{story()}</div>)
-  .add('airplane', () => (
-    <Asset
-      asset={AIRPLANE}
-      onCreate={action('onCreate')}
-      onCopy={action('onCopy')}
-      onDelete={action('onDelete')}
-    />
-  ))
-  .add('marker', () => (
-    <Asset
-      asset={MARKER}
-      onCreate={action('onCreate')}
-      onCopy={action('onCopy')}
-      onDelete={action('onDelete')}
-    />
-  ));
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset_manager.stories.tsx b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset_manager.stories.tsx
index cb42823ccab7b..1434ef60cf0d8 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset_manager.stories.tsx
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/asset_manager.stories.tsx
@@ -7,42 +7,32 @@
 import { action } from '@storybook/addon-actions';
 import { storiesOf } from '@storybook/react';
 import React from 'react';
-import { AssetType } from '../../../../types';
-import { AssetManager } from '../asset_manager';
 
-const AIRPLANE: AssetType = {
-  '@created': '2018-10-13T16:44:44.648Z',
-  id: 'airplane',
-  type: 'dataurl',
-  value:
-    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1Ni4zMSA1Ni4zMSI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMDc4YTA7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPlBsYW5lIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNDkuNTEsNDguOTMsNDEuMjYsMjIuNTIsNTMuNzYsMTBhNS4yOSw1LjI5LDAsMCwwLTcuNDgtNy40N2wtMTIuNSwxMi41TDcuMzgsNi43OUEuNy43LDAsMCwwLDYuNjksN0wxLjIsMTIuNDVhLjcuNywwLDAsMCwwLDFMMTkuODUsMjlsLTcuMjQsNy4yNC03Ljc0LS42YS43MS43MSwwLDAsMC0uNTMuMkwxLjIxLDM5YS42Ny42NywwLDAsMCwuMDgsMUw5LjQ1LDQ2bC4wNywwYy4xMS4xMy4yMi4yNi4zNC4zOHMuMjUuMjMuMzguMzRhLjM2LjM2LDAsMCwwLDAsLjA3TDE2LjMzLDU1YS42OC42OCwwLDAsMCwxLC4wN0wyMC40OSw1MmEuNjcuNjcsMCwwLDAsLjE5LS41NGwtLjU5LTcuNzQsNy4yNC03LjI0TDQyLjg1LDU1LjA2YS42OC42OCwwLDAsMCwxLDBsNS41LTUuNUEuNjYuNjYsMCwwLDAsNDkuNTEsNDguOTNaIi8+PC9nPjwvZz48L3N2Zz4=',
-};
+import { AssetManager, AssetManagerComponent } from '../';
 
-const MARKER: AssetType = {
-  '@created': '2018-10-13T16:44:44.648Z',
-  id: 'marker',
-  type: 'dataurl',
-  value:
-    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzOC4zOSA1Ny41NyI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMTliOGY7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPkxvY2F0aW9uIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMTkuMTksMUExOC4xOSwxOC4xOSwwLDAsMCwyLjk0LDI3LjM2aDBhMTkuNTEsMTkuNTEsMCwwLDAsMSwxLjc4TDE5LjE5LDU1LjU3LDM0LjM4LDI5LjIxQTE4LjE5LDE4LjE5LDAsMCwwLDE5LjE5LDFabTAsMjMuMjlhNS41Myw1LjUzLDAsMSwxLDUuNTMtNS41M0E1LjUzLDUuNTMsMCwwLDEsMTkuMTksMjQuMjlaIi8+PC9nPjwvZz48L3N2Zz4=',
-};
+import { Provider, AIRPLANE, MARKER } from './provider';
 
 storiesOf('components/Assets/AssetManager', module)
+  .add('redux: AssetManager', () => (
+    <Provider>
+      <AssetManager onClose={action('onClose')} />
+    </Provider>
+  ))
   .add('no assets', () => (
-    <AssetManager
-      onAddImageElement={action('onAddImageElement')}
-      onAssetAdd={action('onAssetAdd')}
-      onAssetCopy={action('onAssetCopy')}
-      onAssetDelete={action('onAssetDelete')}
-      onClose={action('onClose')}
-    />
+    <Provider>
+      <AssetManagerComponent
+        assets={[]}
+        onClose={action('onClose')}
+        onAddAsset={action('onAddAsset')}
+      />
+    </Provider>
   ))
   .add('two assets', () => (
-    <AssetManager
-      assetValues={[AIRPLANE, MARKER]}
-      onAddImageElement={action('onAddImageElement')}
-      onAssetAdd={action('onAssetAdd')}
-      onAssetCopy={action('onAssetCopy')}
-      onAssetDelete={action('onAssetDelete')}
-      onClose={action('onClose')}
-    />
+    <Provider>
+      <AssetManagerComponent
+        assets={[AIRPLANE, MARKER]}
+        onClose={action('onClose')}
+        onAddAsset={action('onAddAsset')}
+      />
+    </Provider>
   ));
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/__examples__/provider.tsx b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/provider.tsx
new file mode 100644
index 0000000000000..1cd7562b59c47
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/asset_manager/__examples__/provider.tsx
@@ -0,0 +1,110 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable no-console */
+
+/*
+  This Provider is temporary.  See https://github.com/elastic/kibana/pull/69357
+*/
+
+import React, { FC } from 'react';
+import { applyMiddleware, createStore, Dispatch, Store } from 'redux';
+import thunkMiddleware from 'redux-thunk';
+import { Provider as ReduxProvider } from 'react-redux';
+
+// @ts-expect-error untyped local
+import { appReady } from '../../../../public/state/middleware/app_ready';
+// @ts-expect-error untyped local
+import { resolvedArgs } from '../../../../public/state/middleware/resolved_args';
+
+// @ts-expect-error untyped local
+import { getRootReducer } from '../../../../public/state/reducers';
+
+// @ts-expect-error Untyped local
+import { getDefaultWorkpad } from '../../../../public/state/defaults';
+import { State, AssetType } from '../../../../types';
+
+export const AIRPLANE: AssetType = {
+  '@created': '2018-10-13T16:44:44.648Z',
+  id: 'airplane',
+  type: 'dataurl',
+  value:
+    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1Ni4zMSA1Ni4zMSI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMDc4YTA7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPlBsYW5lIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNNDkuNTEsNDguOTMsNDEuMjYsMjIuNTIsNTMuNzYsMTBhNS4yOSw1LjI5LDAsMCwwLTcuNDgtNy40N2wtMTIuNSwxMi41TDcuMzgsNi43OUEuNy43LDAsMCwwLDYuNjksN0wxLjIsMTIuNDVhLjcuNywwLDAsMCwwLDFMMTkuODUsMjlsLTcuMjQsNy4yNC03Ljc0LS42YS43MS43MSwwLDAsMC0uNTMuMkwxLjIxLDM5YS42Ny42NywwLDAsMCwuMDgsMUw5LjQ1LDQ2bC4wNywwYy4xMS4xMy4yMi4yNi4zNC4zOHMuMjUuMjMuMzguMzRhLjM2LjM2LDAsMCwwLDAsLjA3TDE2LjMzLDU1YS42OC42OCwwLDAsMCwxLC4wN0wyMC40OSw1MmEuNjcuNjcsMCwwLDAsLjE5LS41NGwtLjU5LTcuNzQsNy4yNC03LjI0TDQyLjg1LDU1LjA2YS42OC42OCwwLDAsMCwxLDBsNS41LTUuNUEuNjYuNjYsMCwwLDAsNDkuNTEsNDguOTNaIi8+PC9nPjwvZz48L3N2Zz4=',
+};
+
+export const MARKER: AssetType = {
+  '@created': '2018-10-13T16:44:44.648Z',
+  id: 'marker',
+  type: 'dataurl',
+  value:
+    'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAzOC4zOSA1Ny41NyI+PGRlZnM+PHN0eWxlPi5jbHMtMXtmaWxsOiNmZmY7c3Ryb2tlOiMwMTliOGY7c3Ryb2tlLW1pdGVybGltaXQ6MTA7c3Ryb2tlLXdpZHRoOjJweDt9PC9zdHlsZT48L2RlZnM+PHRpdGxlPkxvY2F0aW9uIEljb248L3RpdGxlPjxnIGlkPSJMYXllcl8yIiBkYXRhLW5hbWU9IkxheWVyIDIiPjxnIGlkPSJMYXllcl8xLTIiIGRhdGEtbmFtZT0iTGF5ZXIgMSI+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMTkuMTksMUExOC4xOSwxOC4xOSwwLDAsMCwyLjk0LDI3LjM2aDBhMTkuNTEsMTkuNTEsMCwwLDAsMSwxLjc4TDE5LjE5LDU1LjU3LDM0LjM4LDI5LjIxQTE4LjE5LDE4LjE5LDAsMCwwLDE5LjE5LDFabTAsMjMuMjlhNS41Myw1LjUzLDAsMSwxLDUuNTMtNS41M0E1LjUzLDUuNTMsMCwwLDEsMTkuMTksMjQuMjlaIi8+PC9nPjwvZz48L3N2Zz4=',
+};
+
+export const state: State = {
+  app: {
+    basePath: '/',
+    ready: true,
+    serverFunctions: [],
+  },
+  assets: {
+    AIRPLANE,
+    MARKER,
+  },
+  transient: {
+    canUserWrite: true,
+    zoomScale: 1,
+    elementStats: {
+      total: 0,
+      ready: 0,
+      pending: 0,
+      error: 0,
+    },
+    inFlight: false,
+    fullScreen: false,
+    selectedTopLevelNodes: [],
+    resolvedArgs: {},
+    refresh: {
+      interval: 0,
+    },
+    autoplay: {
+      enabled: false,
+      interval: 10000,
+    },
+  },
+  persistent: {
+    schemaVersion: 2,
+    workpad: getDefaultWorkpad(),
+  },
+};
+
+// @ts-expect-error untyped local
+import { elementsRegistry } from '../../../lib/elements_registry';
+import { image } from '../../../../canvas_plugin_src/elements/image';
+elementsRegistry.register(image);
+
+export const patchDispatch: (store: Store, dispatch: Dispatch) => Dispatch = (store, dispatch) => (
+  action
+) => {
+  const previousState = store.getState();
+  const returnValue = dispatch(action);
+  const newState = store.getState();
+
+  console.group(action.type || '(thunk)');
+  console.log('Previous State', previousState);
+  console.log('New State', newState);
+  console.groupEnd();
+
+  return returnValue;
+};
+
+export const Provider: FC = ({ children }) => {
+  const middleware = applyMiddleware(thunkMiddleware);
+  const reducer = getRootReducer(state);
+  const store = createStore(reducer, state, middleware);
+  store.dispatch = patchDispatch(store, store.dispatch);
+
+  return <ReduxProvider store={store}>{children}</ReduxProvider>;
+};
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/asset.component.tsx b/x-pack/plugins/canvas/public/components/asset_manager/asset.component.tsx
new file mode 100644
index 0000000000000..a04d37cf7f9fc
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/asset_manager/asset.component.tsx
@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FC, useState } from 'react';
+import {
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiImage,
+  EuiPanel,
+  EuiSpacer,
+  EuiText,
+  EuiTextColor,
+  EuiToolTip,
+} from '@elastic/eui';
+
+import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
+
+import { ConfirmModal } from '../confirm_modal';
+import { Clipboard } from '../clipboard';
+import { Download } from '../download';
+import { AssetType } from '../../../types';
+
+import { ComponentStrings } from '../../../i18n';
+
+const { Asset: strings } = ComponentStrings;
+
+interface Props {
+  /** The asset to be rendered */
+  asset: AssetType;
+  /** The function to execute when the user clicks 'Create' */
+  onCreate: (assetId: string) => void;
+  /** The function to execute when the user clicks 'Delete' */
+  onDelete: (asset: AssetType) => void;
+}
+
+export const Asset: FC<Props> = ({ asset, onCreate, onDelete }) => {
+  const { services } = useKibana();
+  const [isConfirmModalVisible, setIsConfirmModalVisible] = useState(false);
+
+  const onCopy = (result: boolean) =>
+    result && services.canvas.notify.success(`Copied '${asset.id}' to clipboard`);
+
+  const confirmModal = (
+    <ConfirmModal
+      isOpen={isConfirmModalVisible}
+      title={strings.getConfirmModalTitle()}
+      message={strings.getConfirmModalMessageText()}
+      confirmButtonText={strings.getConfirmModalButtonLabel()}
+      onConfirm={() => {
+        setIsConfirmModalVisible(false);
+        onDelete(asset);
+      }}
+      onCancel={() => setIsConfirmModalVisible(false)}
+    />
+  );
+
+  const createImage = (
+    <EuiFlexItem className="asset-create-image" grow={false}>
+      <EuiToolTip content={strings.getCreateImageTooltip()}>
+        <EuiButtonIcon
+          iconType="vector"
+          aria-label={strings.getCreateImageTooltip()}
+          onClick={() => onCreate(asset.id)}
+        />
+      </EuiToolTip>
+    </EuiFlexItem>
+  );
+
+  const downloadAsset = (
+    <EuiFlexItem className="asset-download" grow={false}>
+      <EuiToolTip content={strings.getDownloadAssetTooltip()}>
+        <Download fileName={asset.id} content={asset.value}>
+          <EuiButtonIcon iconType="sortDown" aria-label={strings.getDownloadAssetTooltip()} />
+        </Download>
+      </EuiToolTip>
+    </EuiFlexItem>
+  );
+
+  const copyAsset = (
+    <EuiFlexItem grow={false}>
+      <EuiToolTip content={strings.getCopyAssetTooltip()}>
+        <Clipboard content={asset.id} onCopy={onCopy}>
+          <EuiButtonIcon iconType="copyClipboard" aria-label={strings.getCopyAssetTooltip()} />
+        </Clipboard>
+      </EuiToolTip>
+    </EuiFlexItem>
+  );
+
+  const deleteAsset = (
+    <EuiFlexItem grow={false}>
+      <EuiToolTip content={strings.getDeleteAssetTooltip()}>
+        <EuiButtonIcon
+          color="danger"
+          iconType="trash"
+          aria-label={strings.getDeleteAssetTooltip()}
+          onClick={() => setIsConfirmModalVisible(true)}
+        />
+      </EuiToolTip>
+    </EuiFlexItem>
+  );
+
+  const thumbnail = (
+    <div className="canvasAsset__thumb canvasCheckered">
+      <EuiImage
+        className="canvasAsset__img"
+        size="original"
+        url={asset.value}
+        fullScreenIconColor="dark"
+        alt={strings.getThumbnailAltText()}
+      />
+    </div>
+  );
+
+  const assetLabel = (
+    <EuiText size="xs" className="eui-textBreakAll">
+      <p className="eui-textBreakAll">
+        <strong>{asset.id}</strong>
+        <br />
+        <EuiTextColor color="subdued">
+          <small>({Math.round(asset.value.length / 1024)} kb)</small>
+        </EuiTextColor>
+      </p>
+    </EuiText>
+  );
+
+  return (
+    <EuiFlexItem key={asset.id}>
+      <EuiPanel className="canvasAsset" paddingSize="s">
+        {thumbnail}
+        <EuiSpacer size="s" />
+        {assetLabel}
+        <EuiSpacer size="s" />
+        <EuiFlexGroup alignItems="baseline" justifyContent="center" responsive={false}>
+          {createImage}
+          {downloadAsset}
+          {copyAsset}
+          {deleteAsset}
+        </EuiFlexGroup>
+      </EuiPanel>
+      {isConfirmModalVisible ? confirmModal : null}
+    </EuiFlexItem>
+  );
+};
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/asset.tsx b/x-pack/plugins/canvas/public/components/asset_manager/asset.tsx
index b0eaecc7b5203..1a3ce8419aff6 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/asset.tsx
+++ b/x-pack/plugins/canvas/public/components/asset_manager/asset.tsx
@@ -3,124 +3,59 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import {
-  EuiButtonIcon,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiImage,
-  EuiPanel,
-  EuiSpacer,
-  EuiText,
-  EuiTextColor,
-  EuiToolTip,
-} from '@elastic/eui';
-import React, { FunctionComponent } from 'react';
-
-import { ComponentStrings } from '../../../i18n';
-
-import { Clipboard } from '../clipboard';
-import { Download } from '../download';
-import { AssetType } from '../../../types';
-
-const { Asset: strings } = ComponentStrings;
-
-interface Props {
-  /** The asset to be rendered */
-  asset: AssetType;
-  /** The function to execute when the user clicks 'Create' */
-  onCreate: (asset: AssetType) => void;
-  /** The function to execute when the user clicks 'Copy' */
-  onCopy: (asset: AssetType) => void;
-  /** The function to execute when the user clicks 'Delete' */
-  onDelete: (asset: AssetType) => void;
-}
-
-export const Asset: FunctionComponent<Props> = (props) => {
-  const { asset, onCreate, onCopy, onDelete } = props;
-
-  const createImage = (
-    <EuiFlexItem className="asset-create-image" grow={false}>
-      <EuiToolTip content={strings.getCreateImageTooltip()}>
-        <EuiButtonIcon
-          iconType="vector"
-          aria-label={strings.getCreateImageTooltip()}
-          onClick={() => onCreate(asset)}
-        />
-      </EuiToolTip>
-    </EuiFlexItem>
-  );
-
-  const downloadAsset = (
-    <EuiFlexItem className="asset-download" grow={false}>
-      <EuiToolTip content={strings.getDownloadAssetTooltip()}>
-        <Download fileName={asset.id} content={asset.value}>
-          <EuiButtonIcon iconType="sortDown" aria-label={strings.getDownloadAssetTooltip()} />
-        </Download>
-      </EuiToolTip>
-    </EuiFlexItem>
-  );
-
-  const copyAsset = (
-    <EuiFlexItem grow={false}>
-      <EuiToolTip content={strings.getCopyAssetTooltip()}>
-        <Clipboard content={asset.id} onCopy={(result: boolean) => result && onCopy(asset)}>
-          <EuiButtonIcon iconType="copyClipboard" aria-label={strings.getCopyAssetTooltip()} />
-        </Clipboard>
-      </EuiToolTip>
-    </EuiFlexItem>
-  );
-
-  const deleteAsset = (
-    <EuiFlexItem grow={false}>
-      <EuiToolTip content={strings.getDeleteAssetTooltip()}>
-        <EuiButtonIcon
-          color="danger"
-          iconType="trash"
-          aria-label={strings.getDeleteAssetTooltip()}
-          onClick={() => onDelete(asset)}
-        />
-      </EuiToolTip>
-    </EuiFlexItem>
-  );
-
-  const thumbnail = (
-    <div className="canvasAsset__thumb canvasCheckered">
-      <EuiImage
-        className="canvasAsset__img"
-        size="original"
-        url={props.asset.value}
-        fullScreenIconColor="dark"
-        alt={strings.getThumbnailAltText()}
-      />
-    </div>
-  );
-
-  const assetLabel = (
-    <EuiText size="xs" className="eui-textBreakAll">
-      <p className="eui-textBreakAll">
-        <strong>{asset.id}</strong>
-        <br />
-        <EuiTextColor color="subdued">
-          <small>({Math.round(asset.value.length / 1024)} kb)</small>
-        </EuiTextColor>
-      </p>
-    </EuiText>
-  );
-
-  return (
-    <EuiFlexItem key={props.asset.id}>
-      <EuiPanel className="canvasAsset" paddingSize="s">
-        {thumbnail}
-        <EuiSpacer size="s" />
-        {assetLabel}
-        <EuiSpacer size="s" />
-        <EuiFlexGroup alignItems="baseline" justifyContent="center" responsive={false}>
-          {createImage}
-          {downloadAsset}
-          {copyAsset}
-          {deleteAsset}
-        </EuiFlexGroup>
-      </EuiPanel>
-    </EuiFlexItem>
-  );
-};
+import { Dispatch } from 'redux';
+import { connect } from 'react-redux';
+import { set } from '@elastic/safer-lodash-set';
+
+import { fromExpression, toExpression } from '@kbn/interpreter/common';
+
+// @ts-expect-error untyped local
+import { elementsRegistry } from '../../lib/elements_registry';
+// @ts-expect-error untyped local
+import { addElement } from '../../state/actions/elements';
+import { getSelectedPage } from '../../state/selectors/workpad';
+// @ts-expect-error untyped local
+import { removeAsset } from '../../state/actions/assets';
+import { State, ExpressionAstExpression, AssetType } from '../../../types';
+
+import { Asset as Component } from './asset.component';
+
+export const Asset = connect(
+  (state: State) => ({
+    selectedPage: getSelectedPage(state),
+  }),
+  (dispatch: Dispatch) => ({
+    onCreate: (pageId: string) => (assetId: string) => {
+      const imageElement = elementsRegistry.get('image');
+      const elementAST = fromExpression(imageElement.expression);
+      const selector = ['chain', '0', 'arguments', 'dataurl'];
+      const subExp: ExpressionAstExpression[] = [
+        {
+          type: 'expression',
+          chain: [
+            {
+              type: 'function',
+              function: 'asset',
+              arguments: {
+                _: [assetId],
+              },
+            },
+          ],
+        },
+      ];
+      const newAST = set<ExpressionAstExpression>(elementAST, selector, subExp);
+      imageElement.expression = toExpression(newAST);
+      dispatch(addElement(pageId, imageElement));
+    },
+    onDelete: (asset: AssetType) => dispatch(removeAsset(asset.id)),
+  }),
+  (stateProps, dispatchProps, ownProps) => {
+    const { onCreate, onDelete } = dispatchProps;
+
+    return {
+      ...ownProps,
+      onCreate: onCreate(stateProps.selectedPage),
+      onDelete,
+    };
+  }
+)(Component);
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/asset_modal.tsx b/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.component.tsx
similarity index 69%
rename from x-pack/plugins/canvas/public/components/asset_manager/asset_modal.tsx
rename to x-pack/plugins/canvas/public/components/asset_manager/asset_manager.component.tsx
index cb61bf1dc26c4..98f3d8b48829d 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/asset_modal.tsx
+++ b/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.component.tsx
@@ -3,6 +3,9 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
+import React, { FC, useState } from 'react';
+import PropTypes from 'prop-types';
 import {
   EuiButton,
   EuiEmptyPrompt,
@@ -21,48 +24,29 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
-import PropTypes from 'prop-types';
-import React, { FunctionComponent } from 'react';
-
-import { ComponentStrings } from '../../../i18n';
 
 import { ASSET_MAX_SIZE } from '../../../common/lib/constants';
 import { Loading } from '../loading';
 import { Asset } from './asset';
 import { AssetType } from '../../../types';
+import { ComponentStrings } from '../../../i18n';
 
-const { AssetModal: strings } = ComponentStrings;
+const { AssetManager: strings } = ComponentStrings;
 
 interface Props {
   /** The assets to display within the modal */
-  assetValues: AssetType[];
-  /** Indicates if assets are being loaded */
-  isLoading: boolean;
+  assets: AssetType[];
   /** Function to invoke when the modal is closed */
   onClose: () => void;
-  /** Function to invoke when a file is uploaded */
-  onFileUpload: (assets: FileList | null) => void;
-  /** Function to invoke when an asset is copied */
-  onAssetCopy: (asset: AssetType) => void;
-  /** Function to invoke when an asset is created */
-  onAssetCreate: (asset: AssetType) => void;
-  /** Function to invoke when an asset is deleted */
-  onAssetDelete: (asset: AssetType) => void;
+  onAddAsset: (file: File) => void;
 }
 
-export const AssetModal: FunctionComponent<Props> = (props) => {
-  const {
-    assetValues,
-    isLoading,
-    onAssetCopy,
-    onAssetCreate,
-    onAssetDelete,
-    onClose,
-    onFileUpload,
-  } = props;
+export const AssetManager: FC<Props> = (props) => {
+  const { assets, onClose, onAddAsset } = props;
+  const [isLoading, setIsLoading] = useState(false);
 
   const assetsTotal = Math.round(
-    assetValues.reduce((total, { value }) => total + value.length, 0) / 1024
+    assets.reduce((total, { value }) => total + value.length, 0) / 1024
   );
 
   const percentageUsed = Math.round((assetsTotal / ASSET_MAX_SIZE) * 100);
@@ -77,10 +61,22 @@ export const AssetModal: FunctionComponent<Props> = (props) => {
     </EuiPanel>
   );
 
+  const onFileUpload = (files: FileList | null) => {
+    if (files === null) {
+      return;
+    }
+
+    setIsLoading(true);
+
+    Promise.all(Array.from(files).map((file) => onAddAsset(file))).finally(() => {
+      setIsLoading(false);
+    });
+  };
+
   return (
     <EuiOverlayMask>
       <EuiModal
-        onClose={onClose}
+        onClose={() => onClose()}
         className="canvasAssetManager canvasModal--fixedSize"
         maxWidth="1000px"
       >
@@ -110,16 +106,10 @@ export const AssetModal: FunctionComponent<Props> = (props) => {
             <p>{strings.getDescription()}</p>
           </EuiText>
           <EuiSpacer />
-          {assetValues.length ? (
+          {assets.length ? (
             <EuiFlexGrid columns={4}>
-              {assetValues.map((asset) => (
-                <Asset
-                  asset={asset}
-                  key={asset.id}
-                  onCopy={onAssetCopy}
-                  onCreate={onAssetCreate}
-                  onDelete={onAssetDelete}
-                />
+              {assets.map((asset) => (
+                <Asset asset={asset} key={asset.id} />
               ))}
             </EuiFlexGrid>
           ) : (
@@ -143,7 +133,7 @@ export const AssetModal: FunctionComponent<Props> = (props) => {
               </EuiText>
             </EuiFlexItem>
           </EuiFlexGroup>
-          <EuiButton size="s" onClick={onClose}>
+          <EuiButton size="s" onClick={() => onClose()}>
             {strings.getModalCloseButtonLabel()}
           </EuiButton>
         </EuiModalFooter>
@@ -152,12 +142,8 @@ export const AssetModal: FunctionComponent<Props> = (props) => {
   );
 };
 
-AssetModal.propTypes = {
-  assetValues: PropTypes.array,
-  isLoading: PropTypes.bool,
+AssetManager.propTypes = {
+  assets: PropTypes.arrayOf(PropTypes.object).isRequired,
   onClose: PropTypes.func.isRequired,
-  onFileUpload: PropTypes.func.isRequired,
-  onAssetCopy: PropTypes.func.isRequired,
-  onAssetCreate: PropTypes.func.isRequired,
-  onAssetDelete: PropTypes.func.isRequired,
+  onAddAsset: PropTypes.func.isRequired,
 };
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.ts b/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.ts
new file mode 100644
index 0000000000000..f9bcfb266006c
--- /dev/null
+++ b/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Dispatch } from 'redux';
+import { connect } from 'react-redux';
+import { get } from 'lodash';
+
+import { getId } from '../../lib/get_id';
+// @ts-expect-error untyped local
+import { findExistingAsset } from '../../lib/find_existing_asset';
+import { VALID_IMAGE_TYPES } from '../../../common/lib/constants';
+import { encode } from '../../../common/lib/dataurl';
+// @ts-expect-error untyped local
+import { elementsRegistry } from '../../lib/elements_registry';
+// @ts-expect-error untyped local
+import { addElement } from '../../state/actions/elements';
+import { getAssets } from '../../state/selectors/assets';
+// @ts-expect-error untyped local
+import { removeAsset, createAsset } from '../../state/actions/assets';
+import { State, AssetType } from '../../../types';
+
+import { AssetManager as Component } from './asset_manager.component';
+
+export const AssetManager = connect(
+  (state: State) => ({
+    assets: getAssets(state),
+  }),
+  (dispatch: Dispatch) => ({
+    onAddAsset: (type: string, content: string) => {
+      // make the ID here and pass it into the action
+      const assetId = getId('asset');
+      dispatch(createAsset(type, content, assetId));
+
+      // then return the id, so the caller knows the id that will be created
+      return assetId;
+    },
+  }),
+  (stateProps, dispatchProps, ownProps) => {
+    const { assets } = stateProps;
+    const { onAddAsset } = dispatchProps;
+
+    // pull values out of assets object
+    // have to cast to AssetType[] because TS doesn't know about filtering
+    const assetValues = Object.values(assets).filter((asset) => !!asset) as AssetType[];
+
+    return {
+      ...ownProps,
+      assets: assetValues,
+      onAddAsset: (file: File) => {
+        const [type, subtype] = get(file, 'type', '').split('/');
+        if (type === 'image' && VALID_IMAGE_TYPES.indexOf(subtype) >= 0) {
+          return encode(file).then((dataurl) => {
+            const dataurlType = 'dataurl';
+            const existingId = findExistingAsset(dataurlType, dataurl, assetValues);
+
+            if (existingId) {
+              return existingId;
+            }
+
+            return onAddAsset(dataurlType, dataurl);
+          });
+        }
+
+        return false;
+      },
+    };
+  }
+)(Component);
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.tsx b/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.tsx
deleted file mode 100644
index cb177591fd650..0000000000000
--- a/x-pack/plugins/canvas/public/components/asset_manager/asset_manager.tsx
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import PropTypes from 'prop-types';
-import React, { Fragment, PureComponent } from 'react';
-
-import { ComponentStrings } from '../../../i18n';
-
-import { ConfirmModal } from '../confirm_modal';
-import { AssetType } from '../../../types';
-import { AssetModal } from './asset_modal';
-
-const { AssetManager: strings } = ComponentStrings;
-
-export interface Props {
-  /** A list of assets, if available */
-  assetValues: AssetType[];
-  /** Function to invoke when an asset is selected to be added as an element to the workpad */
-  onAddImageElement: (id: string) => void;
-  /** Function to invoke when an asset is deleted */
-  onAssetDelete: (id: string | null) => void;
-  /** Function to invoke when an asset is copied */
-  onAssetCopy: () => void;
-  /** Function to invoke when an asset is added */
-  onAssetAdd: (asset: File) => void;
-  /** Function to invoke when an asset modal is closed */
-  onClose: () => void;
-}
-
-interface State {
-  /** The id of the asset to delete, if applicable.  Is set if the viewer clicks the delete icon */
-  deleteId: string | null;
-  /** Indicates if the modal is currently loading */
-  isLoading: boolean;
-}
-
-export class AssetManager extends PureComponent<Props, State> {
-  public static propTypes = {
-    assetValues: PropTypes.array,
-    onAddImageElement: PropTypes.func.isRequired,
-    onAssetAdd: PropTypes.func.isRequired,
-    onAssetCopy: PropTypes.func.isRequired,
-    onAssetDelete: PropTypes.func.isRequired,
-    onClose: PropTypes.func.isRequired,
-  };
-
-  public static defaultProps = {
-    assetValues: [],
-  };
-
-  public state = {
-    deleteId: null,
-    isLoading: false,
-  };
-
-  public render() {
-    const { isLoading } = this.state;
-    const { assetValues, onAssetCopy, onAddImageElement, onClose } = this.props;
-
-    const assetModal = (
-      <AssetModal
-        assetValues={assetValues}
-        isLoading={isLoading}
-        onAssetCopy={onAssetCopy}
-        onAssetCreate={(createdAsset: AssetType) => {
-          onAddImageElement(createdAsset.id);
-          onClose();
-        }}
-        onAssetDelete={(asset: AssetType) => this.setState({ deleteId: asset.id })}
-        onClose={onClose}
-        onFileUpload={this.handleFileUpload}
-      />
-    );
-
-    const confirmModal = (
-      <ConfirmModal
-        isOpen={this.state.deleteId !== null}
-        title={strings.getConfirmModalTitle()}
-        message={strings.getConfirmModalMessageText()}
-        confirmButtonText={strings.getConfirmModalButtonLabel()}
-        onConfirm={this.doDelete}
-        onCancel={this.resetDelete}
-      />
-    );
-
-    return (
-      <Fragment>
-        {assetModal}
-        {confirmModal}
-      </Fragment>
-    );
-  }
-
-  private resetDelete = () => this.setState({ deleteId: null });
-
-  private doDelete = () => {
-    this.resetDelete();
-    this.props.onAssetDelete(this.state.deleteId);
-  };
-
-  private handleFileUpload = (files: FileList | null) => {
-    if (files == null) return;
-    this.setState({ isLoading: true });
-    Promise.all(Array.from(files).map((file) => this.props.onAssetAdd(file))).finally(() => {
-      this.setState({ isLoading: false });
-    });
-  };
-}
diff --git a/x-pack/plugins/canvas/public/components/asset_manager/index.ts b/x-pack/plugins/canvas/public/components/asset_manager/index.ts
index 9b4406f607867..5d586c07f4e4e 100644
--- a/x-pack/plugins/canvas/public/components/asset_manager/index.ts
+++ b/x-pack/plugins/canvas/public/components/asset_manager/index.ts
@@ -4,107 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { connect } from 'react-redux';
-import { compose, withProps } from 'recompose';
-import { set } from '@elastic/safer-lodash-set';
-import { get } from 'lodash';
-import { fromExpression, toExpression } from '@kbn/interpreter/common';
-import { getAssets } from '../../state/selectors/assets';
-// @ts-expect-error untyped local
-import { removeAsset, createAsset } from '../../state/actions/assets';
-// @ts-expect-error untyped local
-import { elementsRegistry } from '../../lib/elements_registry';
-// @ts-expect-error untyped local
-import { addElement } from '../../state/actions/elements';
-import { getSelectedPage } from '../../state/selectors/workpad';
-import { encode } from '../../../common/lib/dataurl';
-import { getId } from '../../lib/get_id';
-// @ts-expect-error untyped local
-import { findExistingAsset } from '../../lib/find_existing_asset';
-import { VALID_IMAGE_TYPES } from '../../../common/lib/constants';
-import { withKibana } from '../../../../../../src/plugins/kibana_react/public';
-import { WithKibanaProps } from '../../';
-import { AssetManager as Component, Props as AssetManagerProps } from './asset_manager';
-
-import { State, ExpressionAstExpression, AssetType } from '../../../types';
-
-const mapStateToProps = (state: State) => ({
-  assets: getAssets(state),
-  selectedPage: getSelectedPage(state),
-});
-
-const mapDispatchToProps = (dispatch: (action: any) => void) => ({
-  onAddImageElement: (pageId: string) => (assetId: string) => {
-    const imageElement = elementsRegistry.get('image');
-    const elementAST = fromExpression(imageElement.expression);
-    const selector = ['chain', '0', 'arguments', 'dataurl'];
-    const subExp: ExpressionAstExpression[] = [
-      {
-        type: 'expression',
-        chain: [
-          {
-            type: 'function',
-            function: 'asset',
-            arguments: {
-              _: [assetId],
-            },
-          },
-        ],
-      },
-    ];
-    const newAST = set<ExpressionAstExpression>(elementAST, selector, subExp);
-    imageElement.expression = toExpression(newAST);
-    dispatch(addElement(pageId, imageElement));
-  },
-  onAssetAdd: (type: string, content: string) => {
-    // make the ID here and pass it into the action
-    const assetId = getId('asset');
-    dispatch(createAsset(type, content, assetId));
-
-    // then return the id, so the caller knows the id that will be created
-    return assetId;
-  },
-  onAssetDelete: (assetId: string) => dispatch(removeAsset(assetId)),
-});
-
-const mergeProps = (
-  stateProps: ReturnType<typeof mapStateToProps>,
-  dispatchProps: ReturnType<typeof mapDispatchToProps>,
-  ownProps: AssetManagerProps
-) => {
-  const { assets, selectedPage } = stateProps;
-  const { onAssetAdd } = dispatchProps;
-  const assetValues = Object.values(assets); // pull values out of assets object
-
-  return {
-    ...ownProps,
-    ...dispatchProps,
-    onAddImageElement: dispatchProps.onAddImageElement(stateProps.selectedPage),
-    selectedPage,
-    assetValues,
-    onAssetAdd: (file: File) => {
-      const [type, subtype] = get(file, 'type', '').split('/');
-      if (type === 'image' && VALID_IMAGE_TYPES.indexOf(subtype) >= 0) {
-        return encode(file).then((dataurl) => {
-          const dataurlType = 'dataurl';
-          const existingId = findExistingAsset(dataurlType, dataurl, assetValues);
-          if (existingId) {
-            return existingId;
-          }
-          return onAssetAdd(dataurlType, dataurl);
-        });
-      }
-
-      return false;
-    },
-  };
-};
-
-export const AssetManager = compose<any, any>(
-  connect(mapStateToProps, mapDispatchToProps, mergeProps),
-  withKibana,
-  withProps(({ kibana }: WithKibanaProps) => ({
-    onAssetCopy: (asset: AssetType) =>
-      kibana.services.canvas.notify.success(`Copied '${asset.id}' to clipboard`),
-  }))
-)(Component);
+export { Asset } from './asset';
+export { Asset as AssetComponent } from './asset.component';
+export { AssetManager } from './asset_manager';
+export { AssetManager as AssetManagerComponent } from './asset_manager.component';
diff --git a/x-pack/plugins/canvas/storybook/storyshots.test.js b/x-pack/plugins/canvas/storybook/storyshots.test.js
index ba4013f7cc816..e3a9654bb49fa 100644
--- a/x-pack/plugins/canvas/storybook/storyshots.test.js
+++ b/x-pack/plugins/canvas/storybook/storyshots.test.js
@@ -94,4 +94,5 @@ addSerializer(styleSheetSerializer);
 initStoryshots({
   configPath: path.resolve(__dirname, './../storybook'),
   test: multiSnapshotWithOptions({}),
+  storyNameRegex: /^((?!.*?redux).)*$/,
 });
diff --git a/x-pack/plugins/canvas/storybook/webpack.config.js b/x-pack/plugins/canvas/storybook/webpack.config.js
index 1e0e36f796128..927f71b832ba0 100644
--- a/x-pack/plugins/canvas/storybook/webpack.config.js
+++ b/x-pack/plugins/canvas/storybook/webpack.config.js
@@ -47,6 +47,12 @@ module.exports = async ({ config }) => {
     ],
   });
 
+  config.module.rules.push({
+    test: /\.mjs$/,
+    include: /node_modules/,
+    type: 'javascript/auto',
+  });
+
   // Parse props data for .tsx files
   // This is notoriously slow, and is making Storybook unusable.  Disabling for now.
   // See: https://github.com/storybookjs/storybook/issues/7998
@@ -117,6 +123,15 @@ module.exports = async ({ config }) => {
     ],
   });
 
+  // Exclude large-dependency modules that need not be included in Storybook.
+  config.module.rules.push({
+    test: [
+      path.resolve(__dirname, '../public/components/embeddable_flyout'),
+      path.resolve(__dirname, '../../reporting/public'),
+    ],
+    use: 'null-loader',
+  });
+
   // Ensure jQuery is global for Storybook, specifically for the runtime.
   config.plugins.push(
     new webpack.ProvidePlugin({
@@ -216,5 +231,7 @@ module.exports = async ({ config }) => {
   config.resolve.alias.ui = path.resolve(KIBANA_ROOT, 'src/legacy/ui/public');
   config.resolve.alias.ng_mock$ = path.resolve(KIBANA_ROOT, 'src/test_utils/public/ng_mock');
 
+  config.resolve.extensions.push('.mjs');
+
   return config;
 };
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 4175f76ad7ba8..451557ff93092 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4685,14 +4685,14 @@
     "xpack.canvas.argFormArgSimpleForm.requiredTooltip": "この引数は必須です。数値を入力してください。",
     "xpack.canvas.argFormPendingArgValue.loadingMessage": "読み込み中",
     "xpack.canvas.argFormSimpleFailure.failureTooltip": "この引数のインターフェースが値を解析できなかったため、フォールバックインプットが使用されています",
+    "xpack.canvas.asset.confirmModalButtonLabel": "削除",
+    "xpack.canvas.asset.confirmModalDetail": "このアセットを削除してよろしいですか？",
+    "xpack.canvas.asset.confirmModalTitle": "アセットの削除",
     "xpack.canvas.asset.copyAssetTooltip": "ID をクリップボードにコピー",
     "xpack.canvas.asset.createImageTooltip": "画像エレメントを作成",
     "xpack.canvas.asset.deleteAssetTooltip": "削除",
     "xpack.canvas.asset.downloadAssetTooltip": "ダウンロード",
     "xpack.canvas.asset.thumbnailAltText": "アセットのサムネイル",
-    "xpack.canvas.assetManager.confirmModalButtonLabel": "削除",
-    "xpack.canvas.assetManager.confirmModalDetail": "このアセットを削除してよろしいですか？",
-    "xpack.canvas.assetManager.confirmModalTitle": "アセットの削除",
     "xpack.canvas.assetManager.manageButtonLabel": "アセットの管理",
     "xpack.canvas.assetModal.emptyAssetsDescription": "アセットをインポートして開始します",
     "xpack.canvas.assetModal.filePickerPromptText": "画像を選択するかドラッグ &amp;amp; ドロップしてください",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 33d60dbd17700..3a2ef39d49ece 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4689,14 +4689,14 @@
     "xpack.canvas.argFormArgSimpleForm.requiredTooltip": "此参数为必需，应指定值。",
     "xpack.canvas.argFormPendingArgValue.loadingMessage": "正在加载",
     "xpack.canvas.argFormSimpleFailure.failureTooltip": "此参数的接口无法解析该值，因此将使用回退输入",
+    "xpack.canvas.asset.confirmModalButtonLabel": "删除",
+    "xpack.canvas.asset.confirmModalDetail": "确定要删除此资产？",
+    "xpack.canvas.asset.confirmModalTitle": "删除资产",
     "xpack.canvas.asset.copyAssetTooltip": "将 ID 复制到剪贴板",
     "xpack.canvas.asset.createImageTooltip": "创建图像元素",
     "xpack.canvas.asset.deleteAssetTooltip": "删除",
     "xpack.canvas.asset.downloadAssetTooltip": "下载",
     "xpack.canvas.asset.thumbnailAltText": "资产缩略图",
-    "xpack.canvas.assetManager.confirmModalButtonLabel": "删除",
-    "xpack.canvas.assetManager.confirmModalDetail": "确定要删除此资产？",
-    "xpack.canvas.assetManager.confirmModalTitle": "删除资产",
     "xpack.canvas.assetManager.manageButtonLabel": "管理资产",
     "xpack.canvas.assetModal.emptyAssetsDescription": "导入您的资产以开始",
     "xpack.canvas.assetModal.filePickerPromptText": "选择或拖放图像",

From ba643bd2984fddba32b9dfbab762de1ae13683e8 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Tue, 21 Jul 2020 18:31:54 -0500
Subject: [PATCH 14/34] [Security Solution][Detections] Validate file type of
 value lists (#72746)

* UI validates file type of uploaded value list

* file picker itself is restricted to text/csv and text/plain
* if they drag/drop an invalid file, we disable the upload button and
display an error message
* refactors form state to be a File instead of a FileList

* Refactor validation and error message in terms of file type

Instead of maintaining lists of both valid extensions and valid mime
types, we simply use the latter.
---
 .../form.test.tsx                             | 27 +++++++++++++--
 .../value_lists_management_modal/form.tsx     | 33 ++++++++++++++-----
 .../translations.ts                           |  6 ++++
 3 files changed, 55 insertions(+), 11 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
index e2e793b34eaf9..591e1c81cd2ad 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
@@ -16,7 +16,7 @@ const mockUseImportList = useImportList as jest.Mock;
 
 const mockFile = ({
   name: 'foo.csv',
-  path: '/home/foo.csv',
+  type: 'text/csv',
 } as unknown) as File;
 
 const mockSelectFile: <P>(container: ReactWrapper<P>, file: File) => Promise<void> = async (
@@ -26,7 +26,7 @@ const mockSelectFile: <P>(container: ReactWrapper<P>, file: File) => Promise<voi
   const fileChange = container.find('EuiFilePicker').prop('onChange');
   act(() => {
     if (fileChange) {
-      fileChange(([file] as unknown) as FormEvent);
+      fileChange(({ item: () => file } as unknown) as FormEvent);
     }
   });
 };
@@ -83,6 +83,29 @@ describe('ValueListsForm', () => {
     expect(onError).toHaveBeenCalledWith('whoops');
   });
 
+  it('disables upload and displays an error if file has invalid extension', async () => {
+    const badMockFile = ({
+      name: 'foo.pdf',
+      type: 'application/pdf',
+    } as unknown) as File;
+
+    const container = mount(
+      <TestProviders>
+        <ValueListsForm onError={jest.fn()} onSuccess={jest.fn()} />
+      </TestProviders>
+    );
+
+    await mockSelectFile(container, badMockFile);
+
+    expect(
+      container.find('button[data-test-subj="value-lists-form-import-action"]').prop('disabled')
+    ).toEqual(true);
+
+    expect(container.find('div[data-test-subj="value-list-file-picker-row"]').text()).toContain(
+      'File must be one of the following types: [text/csv, text/plain]'
+    );
+  });
+
   it('calls onSuccess if import succeeds', async () => {
     mockUseImportList.mockImplementation(() => ({
       start: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.tsx
index b8416c3242e4a..aab665289e80d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.tsx
@@ -46,6 +46,7 @@ const options: ListTypeOptions[] = [
 ];
 
 const defaultListType: Type = 'keyword';
+const validFileTypes = ['text/csv', 'text/plain'];
 
 export interface ValueListsFormProps {
   onError: (error: Error) => void;
@@ -54,23 +55,29 @@ export interface ValueListsFormProps {
 
 export const ValueListsFormComponent: React.FC<ValueListsFormProps> = ({ onError, onSuccess }) => {
   const ctrl = useRef(new AbortController());
-  const [files, setFiles] = useState<FileList | null>(null);
+  const [file, setFile] = useState<File | null>(null);
   const [type, setType] = useState<Type>(defaultListType);
   const filePickerRef = useRef<EuiFilePicker | null>(null);
   const { http } = useKibana().services;
   const { start: importList, ...importState } = useImportList();
 
+  const fileIsValid = !file || validFileTypes.some((fileType) => file.type === fileType);
+
   // EuiRadioGroup's onChange only infers 'string' from our options
   const handleRadioChange = useCallback((t: string) => setType(t as Type), [setType]);
 
+  const handleFileChange = useCallback((files: FileList | null) => {
+    setFile(files?.item(0) ?? null);
+  }, []);
+
   const resetForm = useCallback(() => {
     if (filePickerRef.current?.fileInput) {
       filePickerRef.current.fileInput.value = '';
       filePickerRef.current.handleChange();
     }
-    setFiles(null);
+    setFile(null);
     setType(defaultListType);
-  }, [setType]);
+  }, []);
 
   const handleCancel = useCallback(() => {
     ctrl.current.abort();
@@ -91,17 +98,17 @@ export const ValueListsFormComponent: React.FC<ValueListsFormProps> = ({ onError
   );
 
   const handleImport = useCallback(() => {
-    if (!importState.loading && files && files.length) {
+    if (!importState.loading && file) {
       ctrl.current = new AbortController();
       importList({
-        file: files[0],
+        file,
         listId: undefined,
         http,
         signal: ctrl.current.signal,
         type,
       });
     }
-  }, [importState.loading, files, importList, http, type]);
+  }, [importState.loading, file, importList, http, type]);
 
   useEffect(() => {
     if (!importState.loading && importState.result) {
@@ -117,14 +124,22 @@ export const ValueListsFormComponent: React.FC<ValueListsFormProps> = ({ onError
 
   return (
     <EuiForm>
-      <EuiFormRow label={i18n.FILE_PICKER_LABEL} fullWidth>
+      <EuiFormRow
+        data-test-subj="value-list-file-picker-row"
+        label={i18n.FILE_PICKER_LABEL}
+        fullWidth
+        isInvalid={!fileIsValid}
+        error={[i18n.FILE_PICKER_INVALID_FILE_TYPE(validFileTypes.join(', '))]}
+      >
         <EuiFilePicker
+          accept={validFileTypes.join()}
           id="value-list-file-picker"
           initialPromptText={i18n.FILE_PICKER_PROMPT}
           ref={filePickerRef}
-          onChange={setFiles}
+          onChange={handleFileChange}
           fullWidth={true}
           isLoading={importState.loading}
+          isInvalid={!fileIsValid}
         />
       </EuiFormRow>
       <EuiFormRow fullWidth>
@@ -151,7 +166,7 @@ export const ValueListsFormComponent: React.FC<ValueListsFormProps> = ({ onError
                   <EuiButton
                     data-test-subj="value-lists-form-import-action"
                     onClick={handleImport}
-                    disabled={!files?.length || importState.loading}
+                    disabled={file == null || !fileIsValid || importState.loading}
                   >
                     {i18n.UPLOAD_BUTTON}
                   </EuiButton>
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/translations.ts b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/translations.ts
index dca6e43a98143..91f3f3797f422 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/translations.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/translations.ts
@@ -24,6 +24,12 @@ export const FILE_PICKER_PROMPT = i18n.translate(
   }
 );
 
+export const FILE_PICKER_INVALID_FILE_TYPE = (fileTypes: string): string =>
+  i18n.translate('xpack.securitySolution.lists.uploadValueListExtensionValidationMessage', {
+    values: { fileTypes },
+    defaultMessage: 'File must be one of the following types: [{fileTypes}]',
+  });
+
 export const CLOSE_BUTTON = i18n.translate(
   'xpack.securitySolution.lists.closeValueListsModalTitle',
   {

From eddc62ad4b9aad30121624e90223e85821f47d3d Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Tue, 21 Jul 2020 17:50:25 -0600
Subject: [PATCH 15/34] [SIEM][Detection Engine][Lists] Adds version and
 immutability data structures (#72730)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

###  Summary

The intent is to get the data structures in similar to rules so that we can have eventually immutable and versioned lists in later releases without too much hassle of upgrading the list and list item data structures.

* Adds version and immutability data structures to the exception lists and the value lists.
* Adds an optional version number to the update route of each so that you can modify the number either direction or you can omit it and it works like the detection rules where it will auto-increment the number.
* Does _not_ add a version and immutability to the exception list items and value list items.
* Does _not_ update the version number when you add a new exception list item or value list item.

**Examples:**

❯ ./post_list.sh
```json
{
  "_version": "WzAsMV0=",
  "id": "ip_list",
  "created_at": "2020-07-21T20:31:11.679Z",
  "created_by": "yo",
  "description": "This list describes bad internet ip",
  "immutable": false,
  "name": "Simple list with an ip",
  "tie_breaker_id": "d6bd7552-84d1-4f95-88c4-cc504517b4e5",
  "type": "ip",
  "updated_at": "2020-07-21T20:31:11.679Z",
  "updated_by": "yo",
  "version": 1
}
```
❯ ./post_exception_list.sh
```json
{
  "_tags": [
    "endpoint",
    "process",
    "malware",
    "os:linux"
  ],
  "_version": "WzMzOTgsMV0=",
  "created_at": "2020-07-21T20:31:35.933Z",
  "created_by": "yo",
  "description": "This is a sample endpoint type exception",
  "id": "2c24b100-cb91-11ea-a872-adfddf68361e",
  "immutable": false,
  "list_id": "simple_list",
  "name": "Sample Endpoint Exception List",
  "namespace_type": "single",
  "tags": [
    "user added string for a tag",
    "malware"
  ],
  "tie_breaker_id": "c11c4d53-d0be-4904-870e-d33ec7ca387f",
  "type": "detection",
  "updated_at": "2020-07-21T20:31:35.952Z",
  "updated_by": "yo",
  "version": 1
}
```

```json
❯ ./update_list.sh
{
  "_version": "WzEsMV0=",
  "created_at": "2020-07-21T20:31:11.679Z",
  "created_by": "yo",
  "description": "Some other description here for you",
  "id": "ip_list",
  "immutable": false,
  "name": "Changed the name here to something else",
  "tie_breaker_id": "d6bd7552-84d1-4f95-88c4-cc504517b4e5",
  "type": "ip",
  "updated_at": "2020-07-21T20:31:47.089Z",
  "updated_by": "yo",
  "version": 2
}
```

```json
❯ ./update_exception_list.sh
{
  "_tags": [
    "endpoint",
    "process",
    "malware",
    "os:linux"
  ],
  "_version": "WzMzOTksMV0=",
  "created_at": "2020-07-21T20:31:35.933Z",
  "created_by": "yo",
  "description": "Different description",
  "id": "2c24b100-cb91-11ea-a872-adfddf68361e",
  "immutable": false,
  "list_id": "simple_list",
  "name": "Sample Endpoint Exception List",
  "namespace_type": "single",
  "tags": [
    "user added string for a tag",
    "malware"
  ],
  "tie_breaker_id": "c11c4d53-d0be-4904-870e-d33ec7ca387f",
  "type": "endpoint",
  "updated_at": "2020-07-21T20:31:56.628Z",
  "updated_by": "yo",
  "version": 2
}
```

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios
---
 x-pack/plugins/lists/common/constants.mock.ts |  2 ++
 .../lists/common/schemas/common/schemas.ts    | 12 ++++++++++++
 .../index_es_list_schema.mock.ts              |  4 ++++
 .../elastic_query/index_es_list_schema.ts     |  4 ++++
 .../search_es_list_schema.mock.ts             |  4 ++++
 .../elastic_response/search_es_list_schema.ts |  4 ++++
 .../create_exception_list_schema.mock.ts      | 10 +++++++++-
 .../request/create_exception_list_schema.ts   |  8 +++++++-
 .../request/create_list_schema.mock.ts        |  3 ++-
 .../schemas/request/create_list_schema.ts     | 15 +++++++++++++--
 .../schemas/request/patch_list_schema.ts      | 12 ++++++++++--
 .../request/update_exception_list_schema.ts   |  2 ++
 .../schemas/request/update_list_schema.ts     |  3 ++-
 .../create_endpoint_list_schema.test.ts       |  2 +-
 .../response/exception_list_schema.mock.ts    |  4 ++++
 .../schemas/response/exception_list_schema.ts |  4 ++++
 .../schemas/response/list_schema.mock.ts      |  4 ++++
 .../common/schemas/response/list_schema.ts    |  4 ++++
 .../exceptions_list_so_schema.ts              |  7 +++++++
 x-pack/plugins/lists/common/shared_imports.ts |  2 ++
 .../routes/create_exception_list_route.ts     |  3 +++
 .../lists/server/routes/create_list_route.ts  | 19 ++++++++++++++++---
 .../server/routes/import_list_item_route.ts   |  2 ++
 .../lists/server/routes/patch_list_route.ts   |  4 ++--
 .../routes/update_exception_list_route.ts     |  2 ++
 .../lists/server/routes/update_list_route.ts  |  4 ++--
 .../server/saved_objects/exception_list.ts    |  6 ++++++
 .../exception_lists/create_endpoint_list.ts   |  6 +++++-
 .../exception_lists/create_exception_list.ts  |  8 ++++++++
 .../create_exception_list_item.ts             |  2 ++
 .../exception_lists/exception_list_client.ts  |  7 +++++++
 .../exception_list_client_types.ts            |  6 ++++++
 .../exception_lists/update_exception_list.ts  |  5 +++++
 .../server/services/exception_lists/utils.ts  | 18 +++++++++++++++++-
 .../write_lines_to_bulk_list_items.mock.ts    |  2 ++
 .../items/write_lines_to_bulk_list_items.ts   |  5 +++++
 .../server/services/lists/create_list.mock.ts |  4 ++++
 .../server/services/lists/create_list.ts      |  8 ++++++++
 .../lists/create_list_if_it_does_not_exist.ts |  8 ++++++++
 .../server/services/lists/list_client.ts      | 12 ++++++++++++
 .../services/lists/list_client_types.ts       |  9 +++++++++
 .../server/services/lists/list_mappings.json  |  6 ++++++
 .../server/services/lists/update_list.mock.ts |  2 ++
 .../server/services/lists/update_list.ts      |  6 ++++++
 .../schemas/types/default_version_number.ts   |  2 ++
 .../common/shared_exports.ts                  |  4 ++++
 .../autocomplete/field_value_lists.test.tsx   |  4 +++-
 47 files changed, 255 insertions(+), 19 deletions(-)

diff --git a/x-pack/plugins/lists/common/constants.mock.ts b/x-pack/plugins/lists/common/constants.mock.ts
index 6ed1d19611c68..4f01d43f47ecd 100644
--- a/x-pack/plugins/lists/common/constants.mock.ts
+++ b/x-pack/plugins/lists/common/constants.mock.ts
@@ -61,3 +61,5 @@ export const COMMENTS = [];
 export const FILTER = 'name:Nicolas Bourbaki';
 export const CURSOR = 'c29tZXN0cmluZ2ZvcnlvdQ==';
 export const _VERSION = 'WzI5NywxXQ==';
+export const VERSION = 1;
+export const IMMUTABLE = false;
diff --git a/x-pack/plugins/lists/common/schemas/common/schemas.ts b/x-pack/plugins/lists/common/schemas/common/schemas.ts
index 8f1666bb542d9..26511f89c32b8 100644
--- a/x-pack/plugins/lists/common/schemas/common/schemas.ts
+++ b/x-pack/plugins/lists/common/schemas/common/schemas.ts
@@ -311,3 +311,15 @@ export type DeserializerOrUndefined = t.TypeOf<typeof deserializerOrUndefined>;
 export const _version = t.string;
 export const _versionOrUndefined = t.union([_version, t.undefined]);
 export type _VersionOrUndefined = t.TypeOf<typeof _versionOrUndefined>;
+
+export const version = t.number;
+export type Version = t.TypeOf<typeof version>;
+
+export const versionOrUndefined = t.union([version, t.undefined]);
+export type VersionOrUndefined = t.TypeOf<typeof versionOrUndefined>;
+
+export const immutable = t.boolean;
+export type Immutable = t.TypeOf<typeof immutable>;
+
+export const immutableOrUndefined = t.union([immutable, t.undefined]);
+export type ImmutableOrUndefined = t.TypeOf<typeof immutableOrUndefined>;
diff --git a/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.mock.ts
index 85a6b1362a582..81cbaea21d6f6 100644
--- a/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.mock.ts
@@ -8,11 +8,13 @@ import { IndexEsListSchema } from '../../../common/schemas';
 import {
   DATE_NOW,
   DESCRIPTION,
+  IMMUTABLE,
   META,
   NAME,
   TIE_BREAKER,
   TYPE,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 
 export const getIndexESListMock = (): IndexEsListSchema => ({
@@ -20,6 +22,7 @@ export const getIndexESListMock = (): IndexEsListSchema => ({
   created_by: USER,
   description: DESCRIPTION,
   deserializer: undefined,
+  immutable: IMMUTABLE,
   meta: META,
   name: NAME,
   serializer: undefined,
@@ -27,4 +30,5 @@ export const getIndexESListMock = (): IndexEsListSchema => ({
   type: TYPE,
   updated_at: DATE_NOW,
   updated_by: USER,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.ts b/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.ts
index 3ee598291149f..be41e57f99421 100644
--- a/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/elastic_query/index_es_list_schema.ts
@@ -13,6 +13,7 @@ import {
   created_by,
   description,
   deserializerOrUndefined,
+  immutable,
   metaOrUndefined,
   name,
   serializerOrUndefined,
@@ -20,6 +21,7 @@ import {
   type,
   updated_at,
   updated_by,
+  version,
 } from '../common/schemas';
 
 export const indexEsListSchema = t.exact(
@@ -28,6 +30,7 @@ export const indexEsListSchema = t.exact(
     created_by,
     description,
     deserializer: deserializerOrUndefined,
+    immutable,
     meta: metaOrUndefined,
     name,
     serializer: serializerOrUndefined,
@@ -35,6 +38,7 @@ export const indexEsListSchema = t.exact(
     type,
     updated_at,
     updated_by,
+    version,
   })
 );
 
diff --git a/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.mock.ts
index 703d0d0f654a8..1562a2192a173 100644
--- a/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.mock.ts
@@ -10,6 +10,7 @@ import { SearchEsListSchema } from '../../../common/schemas';
 import {
   DATE_NOW,
   DESCRIPTION,
+  IMMUTABLE,
   LIST_ID,
   LIST_INDEX,
   META,
@@ -17,6 +18,7 @@ import {
   TIE_BREAKER,
   TYPE,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 import { getShardMock } from '../../get_shard.mock';
 
@@ -25,6 +27,7 @@ export const getSearchEsListMock = (): SearchEsListSchema => ({
   created_by: USER,
   description: DESCRIPTION,
   deserializer: undefined,
+  immutable: IMMUTABLE,
   meta: META,
   name: NAME,
   serializer: undefined,
@@ -32,6 +35,7 @@ export const getSearchEsListMock = (): SearchEsListSchema => ({
   type: TYPE,
   updated_at: DATE_NOW,
   updated_by: USER,
+  version: VERSION,
 });
 
 export const getSearchListMock = (): SearchResponse<SearchEsListSchema> => ({
diff --git a/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.ts b/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.ts
index 46005b81ef680..6807201cf18d9 100644
--- a/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/elastic_response/search_es_list_schema.ts
@@ -13,6 +13,7 @@ import {
   created_by,
   description,
   deserializerOrUndefined,
+  immutable,
   metaOrUndefined,
   name,
   serializerOrUndefined,
@@ -20,6 +21,7 @@ import {
   type,
   updated_at,
   updated_by,
+  version,
 } from '../common/schemas';
 
 export const searchEsListSchema = t.exact(
@@ -28,6 +30,7 @@ export const searchEsListSchema = t.exact(
     created_by,
     description,
     deserializer: deserializerOrUndefined,
+    immutable,
     meta: metaOrUndefined,
     name,
     serializer: serializerOrUndefined,
@@ -35,6 +38,7 @@ export const searchEsListSchema = t.exact(
     type,
     updated_at,
     updated_by,
+    version,
   })
 );
 
diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.mock.ts
index 22a56f7d42b70..d9c0474610369 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.mock.ts
@@ -4,7 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DESCRIPTION, ENDPOINT_TYPE, META, NAME, NAMESPACE_TYPE } from '../../constants.mock';
+import {
+  DESCRIPTION,
+  ENDPOINT_TYPE,
+  META,
+  NAME,
+  NAMESPACE_TYPE,
+  VERSION,
+} from '../../constants.mock';
 
 import { CreateExceptionListSchema } from './create_exception_list_schema';
 
@@ -17,4 +24,5 @@ export const getCreateExceptionListSchemaMock = (): CreateExceptionListSchema =>
   namespace_type: NAMESPACE_TYPE,
   tags: [],
   type: ENDPOINT_TYPE,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts
index 8f714760621ff..94a4e1588f5ab 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_schema.ts
@@ -21,7 +21,11 @@ import {
   tags,
 } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
-import { DefaultUuid } from '../../siem_common_deps';
+import {
+  DefaultUuid,
+  DefaultVersionNumber,
+  DefaultVersionNumberDecoded,
+} from '../../siem_common_deps';
 import { NamespaceType } from '../types';
 
 export const createExceptionListSchema = t.intersection([
@@ -39,6 +43,7 @@ export const createExceptionListSchema = t.intersection([
       meta, // defaults to undefined if not set during decode
       namespace_type, // defaults to 'single' if not set during decode
       tags, // defaults to empty array if not set during decode
+      version: DefaultVersionNumber, // defaults to numerical 1 if not set during decode
     })
   ),
 ]);
@@ -54,4 +59,5 @@ export type CreateExceptionListSchemaDecoded = Omit<
   tags: Tags;
   list_id: ListId;
   namespace_type: NamespaceType;
+  version: DefaultVersionNumberDecoded;
 };
diff --git a/x-pack/plugins/lists/common/schemas/request/create_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/request/create_list_schema.mock.ts
index 482fabb3b997f..461890b944bfa 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_list_schema.mock.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { DESCRIPTION, LIST_ID, META, NAME, TYPE } from '../../constants.mock';
+import { DESCRIPTION, LIST_ID, META, NAME, TYPE, VERSION } from '../../constants.mock';
 
 import { CreateListSchema } from './create_list_schema';
 
@@ -16,4 +16,5 @@ export const getCreateListSchemaMock = (): CreateListSchema => ({
   name: NAME,
   serializer: undefined,
   type: TYPE,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts
index 38d6167ea63f3..18ed0f42ccd6f 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_list_schema.ts
@@ -8,6 +8,7 @@ import * as t from 'io-ts';
 
 import { description, deserializer, id, meta, name, serializer, type } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
+import { DefaultVersionNumber, DefaultVersionNumberDecoded } from '../../siem_common_deps';
 
 export const createListSchema = t.intersection([
   t.exact(
@@ -17,8 +18,18 @@ export const createListSchema = t.intersection([
       type,
     })
   ),
-  t.exact(t.partial({ deserializer, id, meta, serializer })),
+  t.exact(
+    t.partial({
+      deserializer, // defaults to undefined if not set during decode
+      id, // defaults to undefined if not set during decode
+      meta, // defaults to undefined if not set during decode
+      serializer, // defaults to undefined if not set during decode
+      version: DefaultVersionNumber, // defaults to a numerical 1 if not set during decode
+    })
+  ),
 ]);
 
 export type CreateListSchema = t.OutputOf<typeof createListSchema>;
-export type CreateListSchemaDecoded = RequiredKeepUndefined<t.TypeOf<typeof createListSchema>>;
+export type CreateListSchemaDecoded = RequiredKeepUndefined<
+  Omit<t.TypeOf<typeof createListSchema>, 'version'>
+> & { version: DefaultVersionNumberDecoded };
diff --git a/x-pack/plugins/lists/common/schemas/request/patch_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/patch_list_schema.ts
index e0cd1571afc81..c92abd2e912eb 100644
--- a/x-pack/plugins/lists/common/schemas/request/patch_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/patch_list_schema.ts
@@ -8,7 +8,7 @@
 
 import * as t from 'io-ts';
 
-import { _version, description, id, meta, name } from '../common/schemas';
+import { _version, description, id, meta, name, version } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
 
 export const patchListSchema = t.intersection([
@@ -17,7 +17,15 @@ export const patchListSchema = t.intersection([
       id,
     })
   ),
-  t.exact(t.partial({ _version, description, meta, name })),
+  t.exact(
+    t.partial({
+      _version, // is undefined if not set during decode
+      description, // is undefined if not set during decode
+      meta, // is undefined if not set during decode
+      name, // is undefined if not set during decode
+      version, // is undefined if not set during decode
+    })
+  ),
 ]);
 
 export type PatchListSchema = t.OutputOf<typeof patchListSchema>;
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.ts
index 5d7294ae27af2..dd1bc65d18230 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_schema.ts
@@ -21,6 +21,7 @@ import {
   name,
   namespace_type,
   tags,
+  version,
 } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
 import { NamespaceType } from '../types';
@@ -42,6 +43,7 @@ export const updateExceptionListSchema = t.intersection([
       meta, // defaults to undefined if not set during decode
       namespace_type, // defaults to 'single' if not set during decode
       tags, // defaults to empty array if not set during decode
+      version, // defaults to undefined if not set during decode
     })
   ),
 ]);
diff --git a/x-pack/plugins/lists/common/schemas/request/update_list_schema.ts b/x-pack/plugins/lists/common/schemas/request/update_list_schema.ts
index 19a39d362c241..a9778f23f1302 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_list_schema.ts
@@ -8,7 +8,7 @@
 
 import * as t from 'io-ts';
 
-import { _version, description, id, meta, name } from '../common/schemas';
+import { _version, description, id, meta, name, version } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
 
 export const updateListSchema = t.intersection([
@@ -23,6 +23,7 @@ export const updateListSchema = t.intersection([
     t.partial({
       _version, // defaults to undefined if not set during decode
       meta, // defaults to undefined if not set during decode
+      version, // defaults to undefined if not set during decode
     })
   ),
 ]);
diff --git a/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts b/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
index 646cc3d97f8ee..5fccaaac22e3a 100644
--- a/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/response/create_endpoint_list_schema.test.ts
@@ -41,7 +41,7 @@ describe('create_endpoint_list_schema', () => {
     const message = pipe(checked, foldLeftRight);
 
     expect(getPaths(left(message.errors))).toEqual([
-      'invalid keys "_tags,["endpoint","process","malware","os:linux"],_version,created_at,created_by,description,id,meta,{},name,namespace_type,tags,["user added string for a tag","malware"],tie_breaker_id,type,updated_at,updated_by"',
+      'invalid keys "_tags,["endpoint","process","malware","os:linux"],_version,created_at,created_by,description,id,immutable,meta,{},name,namespace_type,tags,["user added string for a tag","malware"],tie_breaker_id,type,updated_at,updated_by,version"',
     ]);
     expect(message.schema).toEqual({});
   });
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
index f790ad9544d53..2655b09631b23 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.mock.ts
@@ -8,9 +8,11 @@ import {
   DATE_NOW,
   DESCRIPTION,
   ENDPOINT_TYPE,
+  IMMUTABLE,
   META,
   TIE_BREAKER,
   USER,
+  VERSION,
   _VERSION,
 } from '../../constants.mock';
 import { ENDPOINT_LIST_ID } from '../..';
@@ -23,6 +25,7 @@ export const getExceptionListSchemaMock = (): ExceptionListSchema => ({
   created_by: USER,
   description: DESCRIPTION,
   id: '1',
+  immutable: IMMUTABLE,
   list_id: ENDPOINT_LIST_ID,
   meta: META,
   name: 'Sample Endpoint Exception List',
@@ -32,4 +35,5 @@ export const getExceptionListSchemaMock = (): ExceptionListSchema => ({
   type: ENDPOINT_TYPE,
   updated_at: DATE_NOW,
   updated_by: 'user_name',
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
index 11c23bc2ff354..2dbabb0e2bc3b 100644
--- a/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/response/exception_list_schema.ts
@@ -16,6 +16,7 @@ import {
   description,
   exceptionListType,
   id,
+  immutable,
   list_id,
   metaOrUndefined,
   name,
@@ -24,6 +25,7 @@ import {
   tie_breaker_id,
   updated_at,
   updated_by,
+  version,
 } from '../common/schemas';
 
 export const exceptionListSchema = t.exact(
@@ -34,6 +36,7 @@ export const exceptionListSchema = t.exact(
     created_by,
     description,
     id,
+    immutable,
     list_id,
     meta: metaOrUndefined,
     name,
@@ -43,6 +46,7 @@ export const exceptionListSchema = t.exact(
     type: exceptionListType,
     updated_at,
     updated_by,
+    version,
   })
 );
 
diff --git a/x-pack/plugins/lists/common/schemas/response/list_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/list_schema.mock.ts
index 339beddb00f8e..900c7ea4322a3 100644
--- a/x-pack/plugins/lists/common/schemas/response/list_schema.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/response/list_schema.mock.ts
@@ -8,12 +8,14 @@ import { ListSchema } from '../../../common/schemas';
 import {
   DATE_NOW,
   DESCRIPTION,
+  IMMUTABLE,
   LIST_ID,
   META,
   NAME,
   TIE_BREAKER,
   TYPE,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 
 export const getListResponseMock = (): ListSchema => ({
@@ -23,6 +25,7 @@ export const getListResponseMock = (): ListSchema => ({
   description: DESCRIPTION,
   deserializer: undefined,
   id: LIST_ID,
+  immutable: IMMUTABLE,
   meta: META,
   name: NAME,
   serializer: undefined,
@@ -30,4 +33,5 @@ export const getListResponseMock = (): ListSchema => ({
   type: TYPE,
   updated_at: DATE_NOW,
   updated_by: USER,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/common/schemas/response/list_schema.ts b/x-pack/plugins/lists/common/schemas/response/list_schema.ts
index 7e2bc202a6520..539c6221fcb0f 100644
--- a/x-pack/plugins/lists/common/schemas/response/list_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/response/list_schema.ts
@@ -15,6 +15,7 @@ import {
   description,
   deserializerOrUndefined,
   id,
+  immutable,
   metaOrUndefined,
   name,
   serializerOrUndefined,
@@ -22,6 +23,7 @@ import {
   type,
   updated_at,
   updated_by,
+  version,
 } from '../common/schemas';
 
 export const listSchema = t.exact(
@@ -32,6 +34,7 @@ export const listSchema = t.exact(
     description,
     deserializer: deserializerOrUndefined,
     id,
+    immutable,
     meta: metaOrUndefined,
     name,
     serializer: serializerOrUndefined,
@@ -39,6 +42,7 @@ export const listSchema = t.exact(
     type,
     updated_at,
     updated_by,
+    version,
   })
 );
 
diff --git a/x-pack/plugins/lists/common/schemas/saved_objects/exceptions_list_so_schema.ts b/x-pack/plugins/lists/common/schemas/saved_objects/exceptions_list_so_schema.ts
index 0b61f122463f3..2bd2a51ca8c74 100644
--- a/x-pack/plugins/lists/common/schemas/saved_objects/exceptions_list_so_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/saved_objects/exceptions_list_so_schema.ts
@@ -16,6 +16,7 @@ import {
   description,
   exceptionListItemType,
   exceptionListType,
+  immutableOrUndefined,
   itemIdOrUndefined,
   list_id,
   list_type,
@@ -24,8 +25,12 @@ import {
   tags,
   tie_breaker_id,
   updated_by,
+  versionOrUndefined,
 } from '../common/schemas';
 
+/**
+ * Superset saved object of both lists and list items since they share the same saved object type.
+ */
 export const exceptionListSoSchema = t.exact(
   t.type({
     _tags,
@@ -34,6 +39,7 @@ export const exceptionListSoSchema = t.exact(
     created_by,
     description,
     entries: entriesArrayOrUndefined,
+    immutable: immutableOrUndefined,
     item_id: itemIdOrUndefined,
     list_id,
     list_type,
@@ -43,6 +49,7 @@ export const exceptionListSoSchema = t.exact(
     tie_breaker_id,
     type: t.union([exceptionListType, exceptionListItemType]),
     updated_by,
+    version: versionOrUndefined,
   })
 );
 
diff --git a/x-pack/plugins/lists/common/shared_imports.ts b/x-pack/plugins/lists/common/shared_imports.ts
index ad7c24b3db610..e5302b5cd5d88 100644
--- a/x-pack/plugins/lists/common/shared_imports.ts
+++ b/x-pack/plugins/lists/common/shared_imports.ts
@@ -8,6 +8,8 @@ export {
   NonEmptyString,
   DefaultUuid,
   DefaultStringArray,
+  DefaultVersionNumber,
+  DefaultVersionNumberDecoded,
   exactCheck,
   getPaths,
   foldLeftRight,
diff --git a/x-pack/plugins/lists/server/routes/create_exception_list_route.ts b/x-pack/plugins/lists/server/routes/create_exception_list_route.ts
index 897d82d6a9ba0..fbe9c6ec9d83b 100644
--- a/x-pack/plugins/lists/server/routes/create_exception_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/create_exception_list_route.ts
@@ -43,6 +43,7 @@ export const createExceptionListRoute = (router: IRouter): void => {
           description,
           list_id: listId,
           type,
+          version,
         } = request.body;
         const exceptionLists = getExceptionListClient(context);
         const exceptionList = await exceptionLists.getExceptionList({
@@ -59,12 +60,14 @@ export const createExceptionListRoute = (router: IRouter): void => {
           const createdList = await exceptionLists.createExceptionList({
             _tags,
             description,
+            immutable: false,
             listId,
             meta,
             name,
             namespaceType,
             tags,
             type,
+            version,
           });
           const [validated, errors] = validate(createdList, exceptionListSchema);
           if (errors != null) {
diff --git a/x-pack/plugins/lists/server/routes/create_list_route.ts b/x-pack/plugins/lists/server/routes/create_list_route.ts
index ff041699054c9..297dcfc49db34 100644
--- a/x-pack/plugins/lists/server/routes/create_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/create_list_route.ts
@@ -9,7 +9,7 @@ import { IRouter } from 'kibana/server';
 import { LIST_URL } from '../../common/constants';
 import { buildRouteValidation, buildSiemResponse, transformError } from '../siem_server_deps';
 import { validate } from '../../common/siem_common_deps';
-import { createListSchema, listSchema } from '../../common/schemas';
+import { CreateListSchemaDecoded, createListSchema, listSchema } from '../../common/schemas';
 
 import { getListClient } from '.';
 
@@ -21,13 +21,24 @@ export const createListRoute = (router: IRouter): void => {
       },
       path: LIST_URL,
       validate: {
-        body: buildRouteValidation(createListSchema),
+        body: buildRouteValidation<typeof createListSchema, CreateListSchemaDecoded>(
+          createListSchema
+        ),
       },
     },
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
       try {
-        const { name, description, deserializer, id, serializer, type, meta } = request.body;
+        const {
+          name,
+          description,
+          deserializer,
+          id,
+          serializer,
+          type,
+          meta,
+          version,
+        } = request.body;
         const lists = getListClient(context);
         const listExists = await lists.getListIndexExists();
         if (!listExists) {
@@ -49,10 +60,12 @@ export const createListRoute = (router: IRouter): void => {
             description,
             deserializer,
             id,
+            immutable: false,
             meta,
             name,
             serializer,
             type,
+            version,
           });
           const [validated, errors] = validate(list, listSchema);
           if (errors != null) {
diff --git a/x-pack/plugins/lists/server/routes/import_list_item_route.ts b/x-pack/plugins/lists/server/routes/import_list_item_route.ts
index 5e88ca0f2569a..1003a0c52a794 100644
--- a/x-pack/plugins/lists/server/routes/import_list_item_route.ts
+++ b/x-pack/plugins/lists/server/routes/import_list_item_route.ts
@@ -55,6 +55,7 @@ export const importListItemRoute = (router: IRouter, config: ConfigType): void =
             serializer: list.serializer,
             stream,
             type: list.type,
+            version: 1,
           });
 
           const [validated, errors] = validate(list, listSchema);
@@ -71,6 +72,7 @@ export const importListItemRoute = (router: IRouter, config: ConfigType): void =
             serializer,
             stream,
             type,
+            version: 1,
           });
           if (importedList == null) {
             return siemResponse.error({
diff --git a/x-pack/plugins/lists/server/routes/patch_list_route.ts b/x-pack/plugins/lists/server/routes/patch_list_route.ts
index 681581c6ff6bd..421f1279f2619 100644
--- a/x-pack/plugins/lists/server/routes/patch_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/patch_list_route.ts
@@ -27,9 +27,9 @@ export const patchListRoute = (router: IRouter): void => {
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
       try {
-        const { name, description, id, meta, _version } = request.body;
+        const { name, description, id, meta, _version, version } = request.body;
         const lists = getListClient(context);
-        const list = await lists.updateList({ _version, description, id, meta, name });
+        const list = await lists.updateList({ _version, description, id, meta, name, version });
         if (list == null) {
           return siemResponse.error({
             body: `list id: "${id}" found found`,
diff --git a/x-pack/plugins/lists/server/routes/update_exception_list_route.ts b/x-pack/plugins/lists/server/routes/update_exception_list_route.ts
index 403a9f6db934f..6fcee81ed573f 100644
--- a/x-pack/plugins/lists/server/routes/update_exception_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/update_exception_list_route.ts
@@ -45,6 +45,7 @@ export const updateExceptionListRoute = (router: IRouter): void => {
           meta,
           namespace_type: namespaceType,
           type,
+          version,
         } = request.body;
         const exceptionLists = getExceptionListClient(context);
         if (id == null && listId == null) {
@@ -64,6 +65,7 @@ export const updateExceptionListRoute = (router: IRouter): void => {
             namespaceType,
             tags,
             type,
+            version,
           });
           if (list == null) {
             return siemResponse.error({
diff --git a/x-pack/plugins/lists/server/routes/update_list_route.ts b/x-pack/plugins/lists/server/routes/update_list_route.ts
index 78aed23db13fc..6206c0943a8f3 100644
--- a/x-pack/plugins/lists/server/routes/update_list_route.ts
+++ b/x-pack/plugins/lists/server/routes/update_list_route.ts
@@ -27,9 +27,9 @@ export const updateListRoute = (router: IRouter): void => {
     async (context, request, response) => {
       const siemResponse = buildSiemResponse(response);
       try {
-        const { name, description, id, meta, _version } = request.body;
+        const { name, description, id, meta, _version, version } = request.body;
         const lists = getListClient(context);
-        const list = await lists.updateList({ _version, description, id, meta, name });
+        const list = await lists.updateList({ _version, description, id, meta, name, version });
         if (list == null) {
           return siemResponse.error({
             body: `list id: "${id}" found found`,
diff --git a/x-pack/plugins/lists/server/saved_objects/exception_list.ts b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
index fc04c5e278d64..3bde3545837cf 100644
--- a/x-pack/plugins/lists/server/saved_objects/exception_list.ts
+++ b/x-pack/plugins/lists/server/saved_objects/exception_list.ts
@@ -30,6 +30,9 @@ export const commonMapping: SavedObjectsType['mappings'] = {
     description: {
       type: 'keyword',
     },
+    immutable: {
+      type: 'boolean',
+    },
     list_id: {
       type: 'keyword',
     },
@@ -54,6 +57,9 @@ export const commonMapping: SavedObjectsType['mappings'] = {
     updated_by: {
       type: 'keyword',
     },
+    version: {
+      type: 'keyword',
+    },
   },
 };
 
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
index b9a0194e20074..b596b831f2d68 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts
@@ -12,7 +12,7 @@ import {
   ENDPOINT_LIST_ID,
   ENDPOINT_LIST_NAME,
 } from '../../../common/constants';
-import { ExceptionListSchema, ExceptionListSoSchema } from '../../../common/schemas';
+import { ExceptionListSchema, ExceptionListSoSchema, Version } from '../../../common/schemas';
 
 import { getSavedObjectType, transformSavedObjectToExceptionList } from './utils';
 
@@ -20,12 +20,14 @@ interface CreateEndpointListOptions {
   savedObjectsClient: SavedObjectsClientContract;
   user: string;
   tieBreaker?: string;
+  version: Version;
 }
 
 export const createEndpointList = async ({
   savedObjectsClient,
   user,
   tieBreaker,
+  version,
 }: CreateEndpointListOptions): Promise<ExceptionListSchema | null> => {
   const savedObjectType = getSavedObjectType({ namespaceType: 'agnostic' });
   const dateNow = new Date().toISOString();
@@ -39,6 +41,7 @@ export const createEndpointList = async ({
         created_by: user,
         description: ENDPOINT_LIST_DESCRIPTION,
         entries: undefined,
+        immutable: false,
         item_id: undefined,
         list_id: ENDPOINT_LIST_ID,
         list_type: 'list',
@@ -48,6 +51,7 @@ export const createEndpointList = async ({
         tie_breaker_id: tieBreaker ?? uuid.v4(),
         type: 'endpoint',
         updated_by: user,
+        version,
       },
       {
         // We intentionally hard coding the id so that there can only be one exception list within the space
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
index 4da74c7df48bf..c8d709ca340ad 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list.ts
@@ -12,11 +12,13 @@ import {
   ExceptionListSchema,
   ExceptionListSoSchema,
   ExceptionListType,
+  Immutable,
   ListId,
   MetaOrUndefined,
   Name,
   NamespaceType,
   Tags,
+  Version,
   _Tags,
 } from '../../../common/schemas';
 
@@ -29,16 +31,19 @@ interface CreateExceptionListOptions {
   namespaceType: NamespaceType;
   name: Name;
   description: Description;
+  immutable: Immutable;
   meta: MetaOrUndefined;
   user: string;
   tags: Tags;
   tieBreaker?: string;
   type: ExceptionListType;
+  version: Version;
 }
 
 export const createExceptionList = async ({
   _tags,
   listId,
+  immutable,
   savedObjectsClient,
   namespaceType,
   name,
@@ -48,6 +53,7 @@ export const createExceptionList = async ({
   tags,
   tieBreaker,
   type,
+  version,
 }: CreateExceptionListOptions): Promise<ExceptionListSchema> => {
   const savedObjectType = getSavedObjectType({ namespaceType });
   const dateNow = new Date().toISOString();
@@ -58,6 +64,7 @@ export const createExceptionList = async ({
     created_by: user,
     description,
     entries: undefined,
+    immutable,
     item_id: undefined,
     list_id: listId,
     list_type: 'list',
@@ -67,6 +74,7 @@ export const createExceptionList = async ({
     tie_breaker_id: tieBreaker ?? uuid.v4(),
     type,
     updated_by: user,
+    version,
   });
   return transformSavedObjectToExceptionList({ savedObject });
 };
diff --git a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
index 1acc880c851a6..a90ec61aef4af 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/create_exception_list_item.ts
@@ -72,6 +72,7 @@ export const createExceptionListItem = async ({
     created_by: user,
     description,
     entries,
+    immutable: undefined,
     item_id: itemId,
     list_id: listId,
     list_type: 'item',
@@ -81,6 +82,7 @@ export const createExceptionListItem = async ({
     tie_breaker_id: tieBreaker ?? uuid.v4(),
     type,
     updated_by: user,
+    version: undefined,
   });
   return transformSavedObjectToExceptionListItem({ savedObject });
 };
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
index 08b1f517036a9..11302e64b3538 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts
@@ -85,6 +85,7 @@ export class ExceptionListClient {
     return createEndpointList({
       savedObjectsClient,
       user,
+      version: 1,
     });
   };
 
@@ -176,17 +177,20 @@ export class ExceptionListClient {
   public createExceptionList = async ({
     _tags,
     description,
+    immutable,
     listId,
     meta,
     name,
     namespaceType,
     tags,
     type,
+    version,
   }: CreateExceptionListOptions): Promise<ExceptionListSchema> => {
     const { savedObjectsClient, user } = this;
     return createExceptionList({
       _tags,
       description,
+      immutable,
       listId,
       meta,
       name,
@@ -195,6 +199,7 @@ export class ExceptionListClient {
       tags,
       type,
       user,
+      version,
     });
   };
 
@@ -209,6 +214,7 @@ export class ExceptionListClient {
     namespaceType,
     tags,
     type,
+    version,
   }: UpdateExceptionListOptions): Promise<ExceptionListSchema | null> => {
     const { savedObjectsClient, user } = this;
     return updateExceptionList({
@@ -224,6 +230,7 @@ export class ExceptionListClient {
       tags,
       type,
       user,
+      version,
     });
   };
 
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
index b972b6564bb8a..51e3a7ee8046f 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
@@ -21,6 +21,7 @@ import {
   ExceptionListTypeOrUndefined,
   FilterOrUndefined,
   IdOrUndefined,
+  Immutable,
   ItemId,
   ItemIdOrUndefined,
   ListId,
@@ -36,6 +37,8 @@ import {
   Tags,
   TagsOrUndefined,
   UpdateCommentsArray,
+  Version,
+  VersionOrUndefined,
   _Tags,
   _TagsOrUndefined,
   _VersionOrUndefined,
@@ -61,6 +64,8 @@ export interface CreateExceptionListOptions {
   meta: MetaOrUndefined;
   tags: Tags;
   type: ExceptionListType;
+  immutable: Immutable;
+  version: Version;
 }
 
 export interface UpdateExceptionListOptions {
@@ -74,6 +79,7 @@ export interface UpdateExceptionListOptions {
   meta: MetaOrUndefined;
   tags: TagsOrUndefined;
   type: ExceptionListTypeOrUndefined;
+  version: VersionOrUndefined;
 }
 
 export interface DeleteExceptionListOptions {
diff --git a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list.ts b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list.ts
index 99c42e56f4888..c26ff1bca4484 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list.ts
@@ -17,6 +17,7 @@ import {
   NameOrUndefined,
   NamespaceType,
   TagsOrUndefined,
+  VersionOrUndefined,
   _TagsOrUndefined,
   _VersionOrUndefined,
 } from '../../../common/schemas';
@@ -38,6 +39,7 @@ interface UpdateExceptionListOptions {
   tags: TagsOrUndefined;
   tieBreaker?: string;
   type: ExceptionListTypeOrUndefined;
+  version: VersionOrUndefined;
 }
 
 export const updateExceptionList = async ({
@@ -53,12 +55,14 @@ export const updateExceptionList = async ({
   user,
   tags,
   type,
+  version,
 }: UpdateExceptionListOptions): Promise<ExceptionListSchema | null> => {
   const savedObjectType = getSavedObjectType({ namespaceType });
   const exceptionList = await getExceptionList({ id, listId, namespaceType, savedObjectsClient });
   if (exceptionList == null) {
     return null;
   } else {
+    const calculatedVersion = version == null ? exceptionList.version + 1 : version;
     const savedObject = await savedObjectsClient.update<ExceptionListSoSchema>(
       savedObjectType,
       exceptionList.id,
@@ -70,6 +74,7 @@ export const updateExceptionList = async ({
         tags,
         type,
         updated_by: user,
+        version: calculatedVersion,
       },
       {
         version: _version,
diff --git a/x-pack/plugins/lists/server/services/exception_lists/utils.ts b/x-pack/plugins/lists/server/services/exception_lists/utils.ts
index d5e1965efcc89..b168fae741822 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/utils.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/utils.ts
@@ -78,6 +78,7 @@ export const transformSavedObjectToExceptionList = ({
       created_at,
       created_by,
       description,
+      immutable,
       list_id,
       meta,
       name,
@@ -85,6 +86,7 @@ export const transformSavedObjectToExceptionList = ({
       tie_breaker_id,
       type,
       updated_by,
+      version,
     },
     id,
     updated_at: updatedAt,
@@ -99,6 +101,7 @@ export const transformSavedObjectToExceptionList = ({
     created_by,
     description,
     id,
+    immutable: immutable ?? false, // This should never be undefined for a list (only a list item)
     list_id,
     meta,
     name,
@@ -108,6 +111,7 @@ export const transformSavedObjectToExceptionList = ({
     type: exceptionListType.is(type) ? type : 'detection',
     updated_at: updatedAt ?? dateNow,
     updated_by,
+    version: version ?? 1, // This should never be undefined for a list (only a list item)
   };
 };
 
@@ -121,7 +125,17 @@ export const transformSavedObjectUpdateToExceptionList = ({
   const dateNow = new Date().toISOString();
   const {
     version: _version,
-    attributes: { _tags, description, meta, name, tags, type, updated_by: updatedBy },
+    attributes: {
+      _tags,
+      description,
+      immutable,
+      meta,
+      name,
+      tags,
+      type,
+      updated_by: updatedBy,
+      version,
+    },
     id,
     updated_at: updatedAt,
   } = savedObject;
@@ -135,6 +149,7 @@ export const transformSavedObjectUpdateToExceptionList = ({
     created_by: exceptionList.created_by,
     description: description ?? exceptionList.description,
     id,
+    immutable: immutable ?? exceptionList.immutable,
     list_id: exceptionList.list_id,
     meta: meta ?? exceptionList.meta,
     name: name ?? exceptionList.name,
@@ -144,6 +159,7 @@ export const transformSavedObjectUpdateToExceptionList = ({
     type: exceptionListType.is(type) ? type : exceptionList.type,
     updated_at: updatedAt ?? dateNow,
     updated_by: updatedBy ?? exceptionList.updated_by,
+    version: version ?? exceptionList.version,
   };
 };
 
diff --git a/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.mock.ts b/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.mock.ts
index d868351fc4b33..758fabf3d97df 100644
--- a/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.mock.ts
+++ b/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.mock.ts
@@ -12,6 +12,7 @@ import {
   META,
   TYPE,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 import { getConfigMockDecoded } from '../../config.mock';
 
@@ -29,6 +30,7 @@ export const getImportListItemsToStreamOptionsMock = (): ImportListItemsToStream
   stream: new TestReadable(),
   type: TYPE,
   user: USER,
+  version: VERSION,
 });
 
 export const getWriteBufferToItemsOptionsMock = (): WriteBufferToItemsOptions => ({
diff --git a/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.ts b/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.ts
index 2bffe338e9075..c026b247a90a1 100644
--- a/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.ts
+++ b/x-pack/plugins/lists/server/services/items/write_lines_to_bulk_list_items.ts
@@ -16,6 +16,7 @@ import {
   MetaOrUndefined,
   SerializerOrUndefined,
   Type,
+  Version,
 } from '../../../common/schemas';
 import { ConfigType } from '../../config';
 
@@ -34,6 +35,7 @@ export interface ImportListItemsToStreamOptions {
   type: Type;
   user: string;
   meta: MetaOrUndefined;
+  version: Version;
 }
 
 export const importListItemsToStream = ({
@@ -48,6 +50,7 @@ export const importListItemsToStream = ({
   type,
   user,
   meta,
+  version,
 }: ImportListItemsToStreamOptions): Promise<ListSchema | null> => {
   return new Promise<ListSchema | null>((resolve) => {
     const readBuffer = new BufferLines({ bufferSize: config.importBufferSize, input: stream });
@@ -62,12 +65,14 @@ export const importListItemsToStream = ({
           description: `File uploaded from file system of ${fileNameEmitted}`,
           deserializer,
           id: fileNameEmitted,
+          immutable: false,
           listIndex,
           meta,
           name: fileNameEmitted,
           serializer,
           type,
           user,
+          version,
         });
       }
       readBuffer.resume();
diff --git a/x-pack/plugins/lists/server/services/lists/create_list.mock.ts b/x-pack/plugins/lists/server/services/lists/create_list.mock.ts
index 84273ff4cf814..befbe095f2d19 100644
--- a/x-pack/plugins/lists/server/services/lists/create_list.mock.ts
+++ b/x-pack/plugins/lists/server/services/lists/create_list.mock.ts
@@ -9,6 +9,7 @@ import { CreateListOptions } from '../lists';
 import {
   DATE_NOW,
   DESCRIPTION,
+  IMMUTABLE,
   LIST_ID,
   LIST_INDEX,
   META,
@@ -16,6 +17,7 @@ import {
   TIE_BREAKER,
   TYPE,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 
 export const getCreateListOptionsMock = (): CreateListOptions => ({
@@ -24,6 +26,7 @@ export const getCreateListOptionsMock = (): CreateListOptions => ({
   description: DESCRIPTION,
   deserializer: undefined,
   id: LIST_ID,
+  immutable: IMMUTABLE,
   listIndex: LIST_INDEX,
   meta: META,
   name: NAME,
@@ -31,4 +34,5 @@ export const getCreateListOptionsMock = (): CreateListOptions => ({
   tieBreaker: TIE_BREAKER,
   type: TYPE,
   user: USER,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/server/services/lists/create_list.ts b/x-pack/plugins/lists/server/services/lists/create_list.ts
index f97399e6dc131..85214ffb27842 100644
--- a/x-pack/plugins/lists/server/services/lists/create_list.ts
+++ b/x-pack/plugins/lists/server/services/lists/create_list.ts
@@ -13,12 +13,14 @@ import {
   Description,
   DeserializerOrUndefined,
   IdOrUndefined,
+  Immutable,
   IndexEsListSchema,
   ListSchema,
   MetaOrUndefined,
   Name,
   SerializerOrUndefined,
   Type,
+  Version,
 } from '../../../common/schemas';
 
 export interface CreateListOptions {
@@ -34,6 +36,8 @@ export interface CreateListOptions {
   meta: MetaOrUndefined;
   dateNow?: string;
   tieBreaker?: string;
+  immutable: Immutable;
+  version: Version;
 }
 
 export const createList = async ({
@@ -49,6 +53,8 @@ export const createList = async ({
   meta,
   dateNow,
   tieBreaker,
+  immutable,
+  version,
 }: CreateListOptions): Promise<ListSchema> => {
   const createdAt = dateNow ?? new Date().toISOString();
   const body: IndexEsListSchema = {
@@ -56,6 +62,7 @@ export const createList = async ({
     created_by: user,
     description,
     deserializer,
+    immutable,
     meta,
     name,
     serializer,
@@ -63,6 +70,7 @@ export const createList = async ({
     type,
     updated_at: createdAt,
     updated_by: user,
+    version,
   };
   const response = await callCluster<CreateDocumentResponse>('index', {
     body,
diff --git a/x-pack/plugins/lists/server/services/lists/create_list_if_it_does_not_exist.ts b/x-pack/plugins/lists/server/services/lists/create_list_if_it_does_not_exist.ts
index 84f5ac0308191..03a59940641c6 100644
--- a/x-pack/plugins/lists/server/services/lists/create_list_if_it_does_not_exist.ts
+++ b/x-pack/plugins/lists/server/services/lists/create_list_if_it_does_not_exist.ts
@@ -10,11 +10,13 @@ import {
   Description,
   DeserializerOrUndefined,
   Id,
+  Immutable,
   ListSchema,
   MetaOrUndefined,
   Name,
   SerializerOrUndefined,
   Type,
+  Version,
 } from '../../../common/schemas';
 
 import { getList } from './get_list';
@@ -27,12 +29,14 @@ export interface CreateListIfItDoesNotExistOptions {
   deserializer: DeserializerOrUndefined;
   serializer: SerializerOrUndefined;
   description: Description;
+  immutable: Immutable;
   callCluster: LegacyAPICaller;
   listIndex: string;
   user: string;
   meta: MetaOrUndefined;
   dateNow?: string;
   tieBreaker?: string;
+  version: Version;
 }
 
 export const createListIfItDoesNotExist = async ({
@@ -48,6 +52,8 @@ export const createListIfItDoesNotExist = async ({
   serializer,
   dateNow,
   tieBreaker,
+  version,
+  immutable,
 }: CreateListIfItDoesNotExistOptions): Promise<ListSchema> => {
   const list = await getList({ callCluster, id, listIndex });
   if (list == null) {
@@ -57,6 +63,7 @@ export const createListIfItDoesNotExist = async ({
       description,
       deserializer,
       id,
+      immutable,
       listIndex,
       meta,
       name,
@@ -64,6 +71,7 @@ export const createListIfItDoesNotExist = async ({
       tieBreaker,
       type,
       user,
+      version,
     });
   } else {
     return list;
diff --git a/x-pack/plugins/lists/server/services/lists/list_client.ts b/x-pack/plugins/lists/server/services/lists/list_client.ts
index 9bece64fa943f..590bfef6625f5 100644
--- a/x-pack/plugins/lists/server/services/lists/list_client.ts
+++ b/x-pack/plugins/lists/server/services/lists/list_client.ts
@@ -110,11 +110,13 @@ export class ListClient {
   public createList = async ({
     id,
     deserializer,
+    immutable,
     serializer,
     name,
     description,
     type,
     meta,
+    version,
   }: CreateListOptions): Promise<ListSchema> => {
     const { callCluster, user } = this;
     const listIndex = this.getListIndex();
@@ -123,12 +125,14 @@ export class ListClient {
       description,
       deserializer,
       id,
+      immutable,
       listIndex,
       meta,
       name,
       serializer,
       type,
       user,
+      version,
     });
   };
 
@@ -138,8 +142,10 @@ export class ListClient {
     serializer,
     name,
     description,
+    immutable,
     type,
     meta,
+    version,
   }: CreateListIfItDoesNotExistOptions): Promise<ListSchema> => {
     const { callCluster, user } = this;
     const listIndex = this.getListIndex();
@@ -148,12 +154,14 @@ export class ListClient {
       description,
       deserializer,
       id,
+      immutable,
       listIndex,
       meta,
       name,
       serializer,
       type,
       user,
+      version,
     });
   };
 
@@ -334,6 +342,7 @@ export class ListClient {
     listId,
     stream,
     meta,
+    version,
   }: ImportListItemsToStreamOptions): Promise<ListSchema | null> => {
     const { callCluster, user, config } = this;
     const listItemIndex = this.getListItemIndex();
@@ -350,6 +359,7 @@ export class ListClient {
       stream,
       type,
       user,
+      version,
     });
   };
 
@@ -419,6 +429,7 @@ export class ListClient {
     name,
     description,
     meta,
+    version,
   }: UpdateListOptions): Promise<ListSchema | null> => {
     const { callCluster, user } = this;
     const listIndex = this.getListIndex();
@@ -431,6 +442,7 @@ export class ListClient {
       meta,
       name,
       user,
+      version,
     });
   };
 
diff --git a/x-pack/plugins/lists/server/services/lists/list_client_types.ts b/x-pack/plugins/lists/server/services/lists/list_client_types.ts
index 7fa1727be118b..ea983b38c7e5d 100644
--- a/x-pack/plugins/lists/server/services/lists/list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/lists/list_client_types.ts
@@ -15,6 +15,7 @@ import {
   Filter,
   Id,
   IdOrUndefined,
+  Immutable,
   ListId,
   ListIdOrUndefined,
   MetaOrUndefined,
@@ -26,6 +27,8 @@ import {
   SortFieldOrUndefined,
   SortOrderOrUndefined,
   Type,
+  Version,
+  VersionOrUndefined,
   _VersionOrUndefined,
 } from '../../../common/schemas';
 import { ConfigType } from '../../config';
@@ -52,11 +55,13 @@ export interface DeleteListItemOptions {
 export interface CreateListOptions {
   id: IdOrUndefined;
   deserializer: DeserializerOrUndefined;
+  immutable: Immutable;
   serializer: SerializerOrUndefined;
   name: Name;
   description: Description;
   type: Type;
   meta: MetaOrUndefined;
+  version: Version;
 }
 
 export interface CreateListIfItDoesNotExistOptions {
@@ -67,6 +72,8 @@ export interface CreateListIfItDoesNotExistOptions {
   description: Description;
   type: Type;
   meta: MetaOrUndefined;
+  version: Version;
+  immutable: Immutable;
 }
 
 export interface DeleteListItemByValueOptions {
@@ -94,6 +101,7 @@ export interface ImportListItemsToStreamOptions {
   type: Type;
   stream: Readable;
   meta: MetaOrUndefined;
+  version: Version;
 }
 
 export interface CreateListItemOptions {
@@ -119,6 +127,7 @@ export interface UpdateListOptions {
   name: NameOrUndefined;
   description: DescriptionOrUndefined;
   meta: MetaOrUndefined;
+  version: VersionOrUndefined;
 }
 
 export interface GetListItemOptions {
diff --git a/x-pack/plugins/lists/server/services/lists/list_mappings.json b/x-pack/plugins/lists/server/services/lists/list_mappings.json
index da9cfec18719a..d00b00b6469a3 100644
--- a/x-pack/plugins/lists/server/services/lists/list_mappings.json
+++ b/x-pack/plugins/lists/server/services/lists/list_mappings.json
@@ -34,6 +34,12 @@
     },
     "updated_by": {
       "type": "keyword"
+    },
+    "version": {
+      "type": "keyword"
+    },
+    "immutable": {
+      "type": "boolean"
     }
   }
 }
diff --git a/x-pack/plugins/lists/server/services/lists/update_list.mock.ts b/x-pack/plugins/lists/server/services/lists/update_list.mock.ts
index fc3d63277c5b5..dd33c85aca98f 100644
--- a/x-pack/plugins/lists/server/services/lists/update_list.mock.ts
+++ b/x-pack/plugins/lists/server/services/lists/update_list.mock.ts
@@ -13,6 +13,7 @@ import {
   META,
   NAME,
   USER,
+  VERSION,
 } from '../../../common/constants.mock';
 
 export const getUpdateListOptionsMock = (): UpdateListOptions => ({
@@ -25,4 +26,5 @@ export const getUpdateListOptionsMock = (): UpdateListOptions => ({
   meta: META,
   name: NAME,
   user: USER,
+  version: VERSION,
 });
diff --git a/x-pack/plugins/lists/server/services/lists/update_list.ts b/x-pack/plugins/lists/server/services/lists/update_list.ts
index fba57ca744f9d..67d44be2ae1a7 100644
--- a/x-pack/plugins/lists/server/services/lists/update_list.ts
+++ b/x-pack/plugins/lists/server/services/lists/update_list.ts
@@ -16,6 +16,7 @@ import {
   MetaOrUndefined,
   NameOrUndefined,
   UpdateEsListSchema,
+  VersionOrUndefined,
   _VersionOrUndefined,
 } from '../../../common/schemas';
 
@@ -31,6 +32,7 @@ export interface UpdateListOptions {
   description: DescriptionOrUndefined;
   meta: MetaOrUndefined;
   dateNow?: string;
+  version: VersionOrUndefined;
 }
 
 export const updateList = async ({
@@ -43,12 +45,14 @@ export const updateList = async ({
   user,
   meta,
   dateNow,
+  version,
 }: UpdateListOptions): Promise<ListSchema | null> => {
   const updatedAt = dateNow ?? new Date().toISOString();
   const list = await getList({ callCluster, id, listIndex });
   if (list == null) {
     return null;
   } else {
+    const calculatedVersion = version == null ? list.version + 1 : version;
     const doc: UpdateEsListSchema = {
       description,
       meta,
@@ -70,6 +74,7 @@ export const updateList = async ({
       description: description ?? list.description,
       deserializer: list.deserializer,
       id: response._id,
+      immutable: list.immutable,
       meta,
       name: name ?? list.name,
       serializer: list.serializer,
@@ -77,6 +82,7 @@ export const updateList = async ({
       type: list.type,
       updated_at: updatedAt,
       updated_by: user,
+      version: calculatedVersion,
     };
   }
 };
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_version_number.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_version_number.ts
index bbba7c5b8f3bb..a2f5ca3da1b70 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_version_number.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/types/default_version_number.ts
@@ -19,3 +19,5 @@ export const DefaultVersionNumber = new t.Type<Version, Version | undefined, unk
     input == null ? t.success(1) : version.validate(input, context),
   t.identity
 );
+
+export type DefaultVersionNumberDecoded = t.TypeOf<typeof DefaultVersionNumber>;
diff --git a/x-pack/plugins/security_solution/common/shared_exports.ts b/x-pack/plugins/security_solution/common/shared_exports.ts
index 1b5b17ef35cae..bd1086a3f21e9 100644
--- a/x-pack/plugins/security_solution/common/shared_exports.ts
+++ b/x-pack/plugins/security_solution/common/shared_exports.ts
@@ -7,6 +7,10 @@
 export { NonEmptyString } from './detection_engine/schemas/types/non_empty_string';
 export { DefaultUuid } from './detection_engine/schemas/types/default_uuid';
 export { DefaultStringArray } from './detection_engine/schemas/types/default_string_array';
+export {
+  DefaultVersionNumber,
+  DefaultVersionNumberDecoded,
+} from './detection_engine/schemas/types/default_version_number';
 export { exactCheck } from './exact_check';
 export { getPaths, foldLeftRight } from './test_utils';
 export { validate, validateEither } from './validate';
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx
index 1ff5d770521f3..90e195b6e95a0 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.test.tsx
@@ -15,7 +15,7 @@ import { getField } from '../../../../../../../src/plugins/data/common/index_pat
 import { ListSchema } from '../../../lists_plugin_deps';
 import { getFoundListSchemaMock } from '../../../../../lists/common/schemas/response/found_list_schema.mock';
 import { getListResponseMock } from '../../../../../lists/common/schemas/response/list_schema.mock';
-import { DATE_NOW } from '../../../../../lists/common/constants.mock';
+import { DATE_NOW, VERSION, IMMUTABLE } from '../../../../../lists/common/constants.mock';
 
 import { AutocompleteFieldListsComponent } from './field_value_lists';
 
@@ -221,6 +221,8 @@ describe('AutocompleteFieldListsComponent', () => {
       type: 'ip',
       updated_at: DATE_NOW,
       updated_by: 'some user',
+      version: VERSION,
+      immutable: IMMUTABLE,
     });
   });
 });

From 073bd66a8612f3f453aedbe0b8e0f29afb9766bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patryk=20Kopyci=C5=84ski?= <patryk.kopycinski@elastic.co>
Date: Wed, 22 Jul 2020 02:18:28 +0200
Subject: [PATCH 16/34] [Detections] Add validation for Threshold value field
 (#72611)

---
 .../rules/step_define_rule/schema.tsx         | 14 ++++++++
 .../bulk_create_threshold_signals.test.ts     | 35 +++++++++++++++++++
 .../signals/bulk_create_threshold_signals.ts  |  2 +-
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
index 67d795ccf90f0..333b28bf27bbf 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/schema.tsx
@@ -202,6 +202,20 @@ export const schema: FormSchema = {
           defaultMessage: 'Threshold',
         }
       ),
+      validations: [
+        {
+          validator: fieldValidators.numberGreaterThanField({
+            than: 1,
+            message: i18n.translate(
+              'xpack.securitySolution.detectionEngine.validations.thresholdValueFieldData.numberGreaterThanOrEqualOneErrorMessage',
+              {
+                defaultMessage: 'Value must be greater than or equal one.',
+              }
+            ),
+            allowEquality: true,
+          }),
+        },
+      ],
     },
   },
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts
index 744e2b0c06efe..d97dc4ba2cbd2 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.test.ts
@@ -193,4 +193,39 @@ describe('getThresholdSignalQueryFields', () => {
       'event.dataset': 'traefik.access',
     });
   });
+
+  it('should return proper object for exists filters', () => {
+    const filters = {
+      bool: {
+        should: [
+          {
+            bool: {
+              should: [
+                {
+                  exists: {
+                    field: 'process.name',
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            },
+          },
+          {
+            bool: {
+              should: [
+                {
+                  exists: {
+                    field: 'event.type',
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            },
+          },
+        ],
+        minimum_should_match: 1,
+      },
+    };
+    expect(getThresholdSignalQueryFields(filters)).toEqual({});
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts
index ef9fbe485b92f..e2f3d16bd6d03 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/bulk_create_threshold_signals.ts
@@ -83,7 +83,7 @@ export const getThresholdSignalQueryFields = (filter: unknown) => {
         return { ...acc, ...item.match_phrase };
       }
 
-      if (item.bool.should && (item.bool.should[0].match || item.bool.should[0].match_phrase)) {
+      if (item.bool?.should && (item.bool.should[0].match || item.bool.should[0].match_phrase)) {
         return { ...acc, ...(item.bool.should[0].match || item.bool.should[0].match_phrase) };
       }
 

From 9c7d65cfc2ad88282a52654265c7d64e0442929f Mon Sep 17 00:00:00 2001
From: Yara Tercero <yctercero@users.noreply.github.com>
Date: Tue, 21 Jul 2020 21:00:46 -0400
Subject: [PATCH 17/34] [Security Solution][Exceptions] - Require non empty
 entries and non empty string values in exception list items (#72748)

## Summary

This PR updates the exception list entries schemas.

- **Prior:** `entries` could be `undefined` or empty array on `ExceptionListItemSchema`
  - **Now:** `entries` is a required field that cannot be empty - there's really no use for an item without `entries`

- **Prior:** `field` and `value` could be empty string in `EntryMatch`
  - **Now:** `field` and `value` can no longer be empty strings

- **Prior:** `field` could be empty string and `value` could be empty array in `EntryMatchAny`
  - **Now:** `field` and `value` can no longer be empty string and array respectively

- **Prior:** `field` and `list.id` could be empty string in `EntryList`
  - **Now:** `field` and `list.id` can no longer be empty strings

- **Prior:** `field` could be empty string in `EntryExists`
  - **Now:** `field` can no longer be empty string

- **Prior:** `field` could be empty string in `EntryNested`
  - **Now:** `field` can no longer be empty string

- **Prior:** `entries` could be empty array in `EntryNested`
  - **Now:** `entries` can no longer be empty array
---
 .../create_endpoint_list_item_schema.test.ts  |   8 +-
 .../create_endpoint_list_item_schema.ts       |   4 +-
 .../create_exception_list_item_schema.test.ts |   8 +-
 .../create_exception_list_item_schema.ts      |   4 +-
 .../update_endpoint_list_item_schema.test.ts  |   8 +-
 .../update_endpoint_list_item_schema.ts       |   4 +-
 .../update_exception_list_item_schema.test.ts |   8 +-
 .../update_exception_list_item_schema.ts      |   4 +-
 .../types/default_entries_array.test.ts       |  99 ------
 .../schemas/types/default_entries_array.ts    |  22 --
 .../common/schemas/types/entries.mock.ts      |  70 +---
 .../common/schemas/types/entries.test.ts      | 334 ++++--------------
 .../lists/common/schemas/types/entries.ts     |  57 +--
 .../common/schemas/types/entry_exists.mock.ts |  15 +
 .../common/schemas/types/entry_exists.test.ts |  79 +++++
 .../common/schemas/types/entry_exists.ts      |  21 ++
 .../common/schemas/types/entry_list.mock.ts   |  16 +
 .../common/schemas/types/entry_list.test.ts   |  95 +++++
 .../lists/common/schemas/types/entry_list.ts  |  22 ++
 .../common/schemas/types/entry_match.mock.ts  |  16 +
 .../common/schemas/types/entry_match.test.ts  | 107 ++++++
 .../lists/common/schemas/types/entry_match.ts |  22 ++
 .../schemas/types/entry_match_any.mock.ts     |  16 +
 .../schemas/types/entry_match_any.test.ts     | 105 ++++++
 .../common/schemas/types/entry_match_any.ts   |  24 ++
 .../common/schemas/types/entry_nested.mock.ts |  17 +
 .../common/schemas/types/entry_nested.test.ts | 124 +++++++
 .../common/schemas/types/entry_nested.ts      |  22 ++
 .../lists/common/schemas/types/index.ts       |   9 +-
 .../types/non_empty_entries_array.test.ts     | 123 +++++++
 .../schemas/types/non_empty_entries_array.ts  |  31 ++
 .../non_empty_nested_entries_array.test.ts    | 131 +++++++
 .../types/non_empty_nested_entries_array.ts   |  40 +++
 ...non_empty_or_nullable_string_array.test.ts |  69 ++++
 .../non_empty_or_nullable_string_array.ts     |  34 ++
 .../new/exception_list_item.json              |   2 +-
 .../exception_list_client_types.ts            |   5 +-
 .../update_exception_list_item.ts             |   4 +-
 .../build_exceptions_query.test.ts            |  95 ++++-
 .../build_exceptions_query.ts                 |   2 +-
 .../common/components/autocomplete/field.tsx  |   7 +-
 .../autocomplete/field_value_lists.tsx        |   5 +
 .../autocomplete/field_value_match.tsx        |   8 +-
 .../autocomplete/field_value_match_any.tsx    |   8 +-
 .../components/autocomplete/helpers.test.ts   |   8 +-
 .../common/components/autocomplete/helpers.ts |   2 +-
 .../builder/builder_exception_item.test.tsx   |   6 +-
 .../exceptions/builder/entry_item.tsx         |   4 +
 .../components/exceptions/helpers.test.tsx    | 107 +++++-
 .../common/components/exceptions/helpers.tsx  |  16 +-
 .../endpoint/lib/artifacts/lists.test.ts      |   2 +-
 .../server/endpoint/lib/artifacts/lists.ts    |   2 +-
 52 files changed, 1481 insertions(+), 570 deletions(-)
 delete mode 100644 x-pack/plugins/lists/common/schemas/types/default_entries_array.test.ts
 delete mode 100644 x-pack/plugins/lists/common/schemas/types/default_entries_array.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_exists.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_exists.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_list.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_list.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_list.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match_any.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_match_any.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_nested.mock.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/entry_nested.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts
 create mode 100644 x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.ts

diff --git a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts
index 916e8db483454..5de9fbb0d5b50 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.test.ts
@@ -142,7 +142,7 @@ describe('create_endpoint_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should validate an undefined for "entries" but return an array', () => {
+  test('it should NOT validate an undefined for "entries"', () => {
     const inputPayload = getCreateEndpointListItemSchemaMock();
     const outputPayload = getCreateEndpointListItemSchemaMock();
     delete inputPayload.entries;
@@ -151,8 +151,10 @@ describe('create_endpoint_list_item_schema', () => {
     const checked = exactCheck(inputPayload, decoded);
     const message = pipe(checked, foldLeftRight);
     delete (message.schema as CreateEndpointListItemSchema).item_id;
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(outputPayload);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "entries"',
+    ]);
+    expect(message.schema).toEqual({});
   });
 
   test('it should validate an undefined for "tags" but return an array and generate a correct body not counting the auto generated uuid', () => {
diff --git a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts
index 3f0e1a12894d4..ab30e8e35548d 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_endpoint_list_item_schema.ts
@@ -20,7 +20,7 @@ import {
   tags,
 } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
-import { CreateCommentsArray, DefaultCreateCommentsArray, DefaultEntryArray } from '../types';
+import { CreateCommentsArray, DefaultCreateCommentsArray, nonEmptyEntriesArray } from '../types';
 import { EntriesArray } from '../types/entries';
 import { DefaultUuid } from '../../siem_common_deps';
 
@@ -28,6 +28,7 @@ export const createEndpointListItemSchema = t.intersection([
   t.exact(
     t.type({
       description,
+      entries: nonEmptyEntriesArray,
       name,
       type: exceptionListItemType,
     })
@@ -36,7 +37,6 @@ export const createEndpointListItemSchema = t.intersection([
     t.partial({
       _tags, // defaults to empty array if not set during decode
       comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode
-      entries: DefaultEntryArray, // defaults to empty array if not set during decode
       item_id: DefaultUuid, // defaults to GUID (uuid v4) if not set during decode
       meta, // defaults to undefined if not set during decode
       tags, // defaults to empty array if not set during decode
diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
index 34551b74d8c9f..08f3966af08d9 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.test.ts
@@ -130,7 +130,7 @@ describe('create_exception_list_item_schema', () => {
     expect(message.schema).toEqual({});
   });
 
-  test('it should validate an undefined for "entries" but return an array', () => {
+  test('it should NOT validate an undefined for "entries"', () => {
     const inputPayload = getCreateExceptionListItemSchemaMock();
     const outputPayload = getCreateExceptionListItemSchemaMock();
     delete inputPayload.entries;
@@ -139,8 +139,10 @@ describe('create_exception_list_item_schema', () => {
     const checked = exactCheck(inputPayload, decoded);
     const message = pipe(checked, foldLeftRight);
     delete (message.schema as CreateExceptionListItemSchema).item_id;
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(outputPayload);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "entries"',
+    ]);
+    expect(message.schema).toEqual({});
   });
 
   test('it should validate an undefined for "namespace_type" but return enum "single" and generate a correct body not counting the auto generated uuid', () => {
diff --git a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
index c2ccf18ed8720..c3f41cac90c64 100644
--- a/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/create_exception_list_item_schema.ts
@@ -25,8 +25,8 @@ import { RequiredKeepUndefined } from '../../types';
 import {
   CreateCommentsArray,
   DefaultCreateCommentsArray,
-  DefaultEntryArray,
   NamespaceType,
+  nonEmptyEntriesArray,
 } from '../types';
 import { EntriesArray } from '../types/entries';
 import { DefaultUuid } from '../../siem_common_deps';
@@ -35,6 +35,7 @@ export const createExceptionListItemSchema = t.intersection([
   t.exact(
     t.type({
       description,
+      entries: nonEmptyEntriesArray,
       list_id,
       name,
       type: exceptionListItemType,
@@ -44,7 +45,6 @@ export const createExceptionListItemSchema = t.intersection([
     t.partial({
       _tags, // defaults to empty array if not set during decode
       comments: DefaultCreateCommentsArray, // defaults to empty array if not set during decode
-      entries: DefaultEntryArray, // defaults to empty array if not set during decode
       item_id: DefaultUuid, // defaults to GUID (uuid v4) if not set during decode
       meta, // defaults to undefined if not set during decode
       namespace_type, // defaults to 'single' if not set during decode
diff --git a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts
index 838cb81d84c1d..db5bc45ad028b 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.test.ts
@@ -97,7 +97,7 @@ describe('update_endpoint_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "entries" but return an array', () => {
+  test('it should NOT accept an undefined for "entries"', () => {
     const inputPayload = getUpdateEndpointListItemSchemaMock();
     const outputPayload = getUpdateEndpointListItemSchemaMock();
     delete inputPayload.entries;
@@ -105,8 +105,10 @@ describe('update_endpoint_list_item_schema', () => {
     const decoded = updateEndpointListItemSchema.decode(inputPayload);
     const checked = exactCheck(inputPayload, decoded);
     const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(outputPayload);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "entries"',
+    ]);
+    expect(message.schema).toEqual({});
   });
 
   test('it should accept an undefined for "tags" but return an array', () => {
diff --git a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts
index 4430aa98b8e3d..5bf0cb3b7984e 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts
@@ -22,16 +22,17 @@ import {
 } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
 import {
-  DefaultEntryArray,
   DefaultUpdateCommentsArray,
   EntriesArray,
   UpdateCommentsArray,
+  nonEmptyEntriesArray,
 } from '../types';
 
 export const updateEndpointListItemSchema = t.intersection([
   t.exact(
     t.type({
       description,
+      entries: nonEmptyEntriesArray,
       name,
       type: exceptionListItemType,
     })
@@ -41,7 +42,6 @@ export const updateEndpointListItemSchema = t.intersection([
       _tags, // defaults to empty array if not set during decode
       _version, // defaults to undefined if not set during decode
       comments: DefaultUpdateCommentsArray, // defaults to empty array if not set during decode
-      entries: DefaultEntryArray, // defaults to empty array if not set during decode
       id, // defaults to undefined if not set during decode
       item_id: t.union([t.string, t.undefined]),
       meta, // defaults to undefined if not set during decode
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
index 2592e44888ff6..ce589fb097a60 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.test.ts
@@ -97,7 +97,7 @@ describe('update_exception_list_item_schema', () => {
     expect(message.schema).toEqual(outputPayload);
   });
 
-  test('it should accept an undefined for "entries" but return an array', () => {
+  test('it should NOT accept an undefined for "entries"', () => {
     const inputPayload = getUpdateExceptionListItemSchemaMock();
     const outputPayload = getUpdateExceptionListItemSchemaMock();
     delete inputPayload.entries;
@@ -105,8 +105,10 @@ describe('update_exception_list_item_schema', () => {
     const decoded = updateExceptionListItemSchema.decode(inputPayload);
     const checked = exactCheck(inputPayload, decoded);
     const message = pipe(checked, foldLeftRight);
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(outputPayload);
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "entries"',
+    ]);
+    expect(message.schema).toEqual({});
   });
 
   test('it should accept an undefined for "namespace_type" but return enum "single"', () => {
diff --git a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
index 9e0a1759fc9f4..7fbd5cd65f04d 100644
--- a/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
+++ b/x-pack/plugins/lists/common/schemas/request/update_exception_list_item_schema.ts
@@ -23,17 +23,18 @@ import {
 } from '../common/schemas';
 import { RequiredKeepUndefined } from '../../types';
 import {
-  DefaultEntryArray,
   DefaultUpdateCommentsArray,
   EntriesArray,
   NamespaceType,
   UpdateCommentsArray,
+  nonEmptyEntriesArray,
 } from '../types';
 
 export const updateExceptionListItemSchema = t.intersection([
   t.exact(
     t.type({
       description,
+      entries: nonEmptyEntriesArray,
       name,
       type: exceptionListItemType,
     })
@@ -43,7 +44,6 @@ export const updateExceptionListItemSchema = t.intersection([
       _tags, // defaults to empty array if not set during decode
       _version, // defaults to undefined if not set during decode
       comments: DefaultUpdateCommentsArray, // defaults to empty array if not set during decode
-      entries: DefaultEntryArray, // defaults to empty array if not set during decode
       id, // defaults to undefined if not set during decode
       item_id: t.union([t.string, t.undefined]),
       meta, // defaults to undefined if not set during decode
diff --git a/x-pack/plugins/lists/common/schemas/types/default_entries_array.test.ts b/x-pack/plugins/lists/common/schemas/types/default_entries_array.test.ts
deleted file mode 100644
index 21115690c0a5f..0000000000000
--- a/x-pack/plugins/lists/common/schemas/types/default_entries_array.test.ts
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { pipe } from 'fp-ts/lib/pipeable';
-import { left } from 'fp-ts/lib/Either';
-
-import { foldLeftRight, getPaths } from '../../siem_common_deps';
-
-import { DefaultEntryArray } from './default_entries_array';
-import { EntriesArray } from './entries';
-import { getEntriesArrayMock, getEntryMatchMock, getEntryNestedMock } from './entries.mock';
-
-// NOTE: This may seem weird, but when validating schemas that use a union
-// it checks against every item in that union. Since entries consist of 5
-// different entry types, it returns 5 of these. To make more readable,
-// extracted here.
-const returnedSchemaError =
-  '"Array<({| field: string, operator: "excluded" | "included", type: "match", value: string |} | {| field: string, operator: "excluded" | "included", type: "match_any", value: DefaultStringArray |} | {| field: string, list: {| id: string, type: "binary" | "boolean" | "byte" | "date" | "date_nanos" | "date_range" | "double" | "double_range" | "float" | "float_range" | "geo_point" | "geo_shape" | "half_float" | "integer" | "integer_range" | "ip" | "ip_range" | "keyword" | "long" | "long_range" | "shape" | "short" | "text" |}, operator: "excluded" | "included", type: "list" |} | {| field: string, operator: "excluded" | "included", type: "exists" |} | {| entries: Array<{| field: string, operator: "excluded" | "included", type: "match", value: string |}>, field: string, type: "nested" |})>"';
-
-describe('default_entries_array', () => {
-  test('it should validate an empty array', () => {
-    const payload: EntriesArray = [];
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(payload);
-  });
-
-  test('it should validate an array of regular and nested entries', () => {
-    const payload: EntriesArray = getEntriesArrayMock();
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(payload);
-  });
-
-  test('it should validate an array of nested entries', () => {
-    const payload: EntriesArray = [{ ...getEntryNestedMock() }];
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(payload);
-  });
-
-  test('it should validate an array of non nested entries', () => {
-    const payload: EntriesArray = [{ ...getEntryMatchMock() }];
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual(payload);
-  });
-
-  test('it should NOT validate an array of numbers', () => {
-    const payload = [1];
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    // TODO: Known weird error formatting that is on our list to address
-    expect(getPaths(left(message.errors))).toEqual([
-      `Invalid value "1" supplied to ${returnedSchemaError}`,
-      `Invalid value "1" supplied to ${returnedSchemaError}`,
-      `Invalid value "1" supplied to ${returnedSchemaError}`,
-      `Invalid value "1" supplied to ${returnedSchemaError}`,
-      `Invalid value "1" supplied to ${returnedSchemaError}`,
-    ]);
-    expect(message.schema).toEqual({});
-  });
-
-  test('it should NOT validate an array of strings', () => {
-    const payload = ['some string'];
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([
-      `Invalid value "some string" supplied to ${returnedSchemaError}`,
-      `Invalid value "some string" supplied to ${returnedSchemaError}`,
-      `Invalid value "some string" supplied to ${returnedSchemaError}`,
-      `Invalid value "some string" supplied to ${returnedSchemaError}`,
-      `Invalid value "some string" supplied to ${returnedSchemaError}`,
-    ]);
-    expect(message.schema).toEqual({});
-  });
-
-  test('it should return a default array entry', () => {
-    const payload = null;
-    const decoded = DefaultEntryArray.decode(payload);
-    const message = pipe(decoded, foldLeftRight);
-
-    expect(getPaths(left(message.errors))).toEqual([]);
-    expect(message.schema).toEqual([]);
-  });
-});
diff --git a/x-pack/plugins/lists/common/schemas/types/default_entries_array.ts b/x-pack/plugins/lists/common/schemas/types/default_entries_array.ts
deleted file mode 100644
index a85fdf8537f39..0000000000000
--- a/x-pack/plugins/lists/common/schemas/types/default_entries_array.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import * as t from 'io-ts';
-import { Either } from 'fp-ts/lib/Either';
-
-import { EntriesArray, entriesArray } from './entries';
-
-/**
- * Types the DefaultEntriesArray as:
- *   - If null or undefined, then a default array of type entry will be set
- */
-export const DefaultEntryArray = new t.Type<EntriesArray, EntriesArray, unknown>(
-  'DefaultEntryArray',
-  entriesArray.is,
-  (input): Either<t.Errors, EntriesArray> =>
-    input == null ? t.success([]) : entriesArray.decode(input),
-  t.identity
-);
diff --git a/x-pack/plugins/lists/common/schemas/types/entries.mock.ts b/x-pack/plugins/lists/common/schemas/types/entries.mock.ts
index 8af18c970c6ae..3ed3f4e7ff88f 100644
--- a/x-pack/plugins/lists/common/schemas/types/entries.mock.ts
+++ b/x-pack/plugins/lists/common/schemas/types/entries.mock.ts
@@ -4,65 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  ENTRY_VALUE,
-  EXISTS,
-  FIELD,
-  LIST,
-  LIST_ID,
-  MATCH,
-  MATCH_ANY,
-  NESTED,
-  OPERATOR,
-  TYPE,
-} from '../../constants.mock';
-
-import {
-  EntriesArray,
-  EntryExists,
-  EntryList,
-  EntryMatch,
-  EntryMatchAny,
-  EntryNested,
-} from './entries';
-
-export const getEntryMatchMock = (): EntryMatch => ({
-  field: FIELD,
-  operator: OPERATOR,
-  type: MATCH,
-  value: ENTRY_VALUE,
-});
-
-export const getEntryMatchAnyMock = (): EntryMatchAny => ({
-  field: FIELD,
-  operator: OPERATOR,
-  type: MATCH_ANY,
-  value: [ENTRY_VALUE],
-});
-
-export const getEntryListMock = (): EntryList => ({
-  field: FIELD,
-  list: { id: LIST_ID, type: TYPE },
-  operator: OPERATOR,
-  type: LIST,
-});
-
-export const getEntryExistsMock = (): EntryExists => ({
-  field: FIELD,
-  operator: OPERATOR,
-  type: EXISTS,
-});
-
-export const getEntryNestedMock = (): EntryNested => ({
-  entries: [getEntryMatchMock(), getEntryMatchMock()],
-  field: FIELD,
-  type: NESTED,
-});
+import { EntriesArray } from './entries';
+import { getEntryMatchMock } from './entry_match.mock';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { getEntryListMock } from './entry_list.mock';
+import { getEntryExistsMock } from './entry_exists.mock';
+import { getEntryNestedMock } from './entry_nested.mock';
 
 export const getEntriesArrayMock = (): EntriesArray => [
-  getEntryMatchMock(),
-  getEntryMatchAnyMock(),
-  getEntryListMock(),
-  getEntryExistsMock(),
-  getEntryNestedMock(),
+  { ...getEntryMatchMock() },
+  { ...getEntryMatchAnyMock() },
+  { ...getEntryListMock() },
+  { ...getEntryExistsMock() },
+  { ...getEntryNestedMock() },
 ];
diff --git a/x-pack/plugins/lists/common/schemas/types/entries.test.ts b/x-pack/plugins/lists/common/schemas/types/entries.test.ts
index 01f82f12f2b2c..cad94220a232c 100644
--- a/x-pack/plugins/lists/common/schemas/types/entries.test.ts
+++ b/x-pack/plugins/lists/common/schemas/types/entries.test.ts
@@ -9,359 +9,147 @@ import { left } from 'fp-ts/lib/Either';
 
 import { foldLeftRight, getPaths } from '../../siem_common_deps';
 
-import {
-  getEntryExistsMock,
-  getEntryListMock,
-  getEntryMatchAnyMock,
-  getEntryMatchMock,
-  getEntryNestedMock,
-} from './entries.mock';
-import {
-  EntryExists,
-  EntryList,
-  EntryMatch,
-  EntryMatchAny,
-  EntryNested,
-  entriesExists,
-  entriesList,
-  entriesMatch,
-  entriesMatchAny,
-  entriesNested,
-} from './entries';
+import { getEntryMatchMock } from './entry_match.mock';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { getEntryListMock } from './entry_list.mock';
+import { getEntryExistsMock } from './entry_exists.mock';
+import { getEntryNestedMock } from './entry_nested.mock';
+import { getEntriesArrayMock } from './entries.mock';
+import { entriesArray, entriesArrayOrUndefined, entry } from './entries';
 
 describe('Entries', () => {
-  describe('entriesMatch', () => {
-    test('it should validate an entry', () => {
-      const payload = getEntryMatchMock();
-      const decoded = entriesMatch.decode(payload);
+  describe('entry', () => {
+    test('it should validate a match entry', () => {
+      const payload = { ...getEntryMatchMock() };
+      const decoded = entry.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when operator is "included"', () => {
-      const payload = getEntryMatchMock();
-      const decoded = entriesMatch.decode(payload);
+    test('it should validate a match_any entry', () => {
+      const payload = { ...getEntryMatchAnyMock() };
+      const decoded = entry.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when "operator" is "excluded"', () => {
-      const payload = getEntryMatchMock();
-      payload.operator = 'excluded';
-      const decoded = entriesMatch.decode(payload);
+    test('it should validate a exists entry', () => {
+      const payload = { ...getEntryExistsMock() };
+      const decoded = entry.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should not validate when "value" is not string', () => {
-      const payload: Omit<EntryMatch, 'value'> & { value: string[] } = {
-        ...getEntryMatchMock(),
-        value: ['some value'],
-      };
-      const decoded = entriesMatch.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "["some value"]" supplied to "value"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should not validate when "type" is not "match"', () => {
-      const payload: Omit<EntryMatch, 'type'> & { type: string } = {
-        ...getEntryMatchMock(),
-        type: 'match_any',
-      };
-      const decoded = entriesMatch.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "match_any" supplied to "type"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should strip out extra keys', () => {
-      const payload: EntryMatch & {
-        extraKey?: string;
-      } = getEntryMatchMock();
-      payload.extraKey = 'some value';
-      const decoded = entriesMatch.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(getEntryMatchMock());
-    });
-  });
-
-  describe('entriesMatchAny', () => {
-    test('it should validate an entry', () => {
-      const payload = getEntryMatchAnyMock();
-      const decoded = entriesMatchAny.decode(payload);
+    test('it should validate a list entry', () => {
+      const payload = { ...getEntryListMock() };
+      const decoded = entry.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when operator is "included"', () => {
-      const payload = getEntryMatchAnyMock();
-      const decoded = entriesMatchAny.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should validate when operator is "excluded"', () => {
-      const payload = getEntryMatchAnyMock();
-      payload.operator = 'excluded';
-      const decoded = entriesMatchAny.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(payload);
-    });
-
-    test('it should not validate when value is not string array', () => {
-      const payload: Omit<EntryMatchAny, 'value'> & { value: string } = {
-        ...getEntryMatchAnyMock(),
-        value: 'some string',
-      };
-      const decoded = entriesMatchAny.decode(payload);
+    test('it should NOT validate a nested entry', () => {
+      const payload = { ...getEntryNestedMock() };
+      const decoded = entry.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "some string" supplied to "value"',
+        'Invalid value "undefined" supplied to "operator"',
+        'Invalid value "nested" supplied to "type"',
+        'Invalid value "undefined" supplied to "value"',
+        'Invalid value "undefined" supplied to "operator"',
+        'Invalid value "nested" supplied to "type"',
+        'Invalid value "undefined" supplied to "value"',
+        'Invalid value "undefined" supplied to "list"',
+        'Invalid value "undefined" supplied to "operator"',
+        'Invalid value "nested" supplied to "type"',
+        'Invalid value "undefined" supplied to "operator"',
+        'Invalid value "nested" supplied to "type"',
       ]);
       expect(message.schema).toEqual({});
     });
-
-    test('it should not validate when "type" is not "match_any"', () => {
-      const payload: Omit<EntryMatchAny, 'type'> & { type: string } = {
-        ...getEntryMatchAnyMock(),
-        type: 'match',
-      };
-      const decoded = entriesMatchAny.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should strip out extra keys', () => {
-      const payload: EntryMatchAny & {
-        extraKey?: string;
-      } = getEntryMatchAnyMock();
-      payload.extraKey = 'some extra key';
-      const decoded = entriesMatchAny.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(getEntryMatchAnyMock());
-    });
   });
 
-  describe('entriesExists', () => {
-    test('it should validate an entry', () => {
-      const payload = getEntryExistsMock();
-      const decoded = entriesExists.decode(payload);
+  describe('entriesArray', () => {
+    test('it should validate an array with match entry', () => {
+      const payload = [{ ...getEntryMatchMock() }];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when "operator" is "included"', () => {
-      const payload = getEntryExistsMock();
-      const decoded = entriesExists.decode(payload);
+    test('it should validate an array with match_any entry', () => {
+      const payload = [{ ...getEntryMatchAnyMock() }];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when "operator" is "excluded"', () => {
-      const payload = getEntryExistsMock();
-      payload.operator = 'excluded';
-      const decoded = entriesExists.decode(payload);
+    test('it should validate an array with exists entry', () => {
+      const payload = [{ ...getEntryExistsMock() }];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should strip out extra keys', () => {
-      const payload: EntryExists & {
-        extraKey?: string;
-      } = getEntryExistsMock();
-      payload.extraKey = 'some extra key';
-      const decoded = entriesExists.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(getEntryExistsMock());
-    });
-
-    test('it should not validate when "type" is not "exists"', () => {
-      const payload: Omit<EntryExists, 'type'> & { type: string } = {
-        ...getEntryExistsMock(),
-        type: 'match',
-      };
-      const decoded = entriesExists.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
-      expect(message.schema).toEqual({});
-    });
-  });
-
-  describe('entriesList', () => {
-    test('it should validate an entry', () => {
-      const payload = getEntryListMock();
-      const decoded = entriesList.decode(payload);
+    test('it should validate an array with list entry', () => {
+      const payload = [{ ...getEntryListMock() }];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when operator is "included"', () => {
-      const payload = getEntryListMock();
-      const decoded = entriesList.decode(payload);
+    test('it should validate an array with nested entry', () => {
+      const payload = [{ ...getEntryNestedMock() }];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should validate when "operator" is "excluded"', () => {
-      const payload = getEntryListMock();
-      payload.operator = 'excluded';
-      const decoded = entriesList.decode(payload);
+    test('it should validate an array with all types of entries', () => {
+      const payload = [...getEntriesArrayMock()];
+      const decoded = entriesArray.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
-
-    test('it should not validate when "list" is not expected value', () => {
-      const payload: Omit<EntryList, 'list'> & { list: string } = {
-        ...getEntryListMock(),
-        list: 'someListId',
-      };
-      const decoded = entriesList.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "someListId" supplied to "list"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should not validate when "type" is not "lists"', () => {
-      const payload: Omit<EntryList, 'type'> & { type: 'match_any' } = {
-        ...getEntryListMock(),
-        type: 'match_any',
-      };
-      const decoded = entriesList.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "match_any" supplied to "type"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should strip out extra keys', () => {
-      const payload: EntryList & {
-        extraKey?: string;
-      } = getEntryListMock();
-      payload.extraKey = 'some extra key';
-      const decoded = entriesList.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(getEntryListMock());
-    });
   });
 
-  describe('entriesNested', () => {
-    test('it should validate a nested entry', () => {
-      const payload = getEntryNestedMock();
-      const decoded = entriesNested.decode(payload);
+  describe('entriesArrayOrUndefined', () => {
+    test('it should validate undefined', () => {
+      const payload = undefined;
+      const decoded = entriesArrayOrUndefined.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
       expect(message.schema).toEqual(payload);
     });
 
-    test('it should NOT validate when "type" is not "nested"', () => {
-      const payload: Omit<EntryNested, 'type'> & { type: 'match' } = {
-        ...getEntryNestedMock(),
-        type: 'match',
-      };
-      const decoded = entriesNested.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should NOT validate when "field" is not a string', () => {
-      const payload: Omit<EntryNested, 'field'> & {
-        field: number;
-      } = { ...getEntryNestedMock(), field: 1 };
-      const decoded = entriesNested.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual(['Invalid value "1" supplied to "field"']);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should NOT validate when "entries" is not a an array', () => {
-      const payload: Omit<EntryNested, 'entries'> & {
-        entries: string;
-      } = { ...getEntryNestedMock(), entries: 'im a string' };
-      const decoded = entriesNested.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "im a string" supplied to "entries"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should NOT validate when "entries" contains an entry item that is not type "match"', () => {
-      const payload: Omit<EntryNested, 'entries'> & {
-        entries: EntryMatchAny[];
-      } = { ...getEntryNestedMock(), entries: [getEntryMatchAnyMock()] };
-      const decoded = entriesNested.decode(payload);
-      const message = pipe(decoded, foldLeftRight);
-
-      expect(getPaths(left(message.errors))).toEqual([
-        'Invalid value "match_any" supplied to "entries,type"',
-        'Invalid value "["some host name"]" supplied to "entries,value"',
-      ]);
-      expect(message.schema).toEqual({});
-    });
-
-    test('it should strip out extra keys', () => {
-      const payload: EntryNested & {
-        extraKey?: string;
-      } = getEntryNestedMock();
-      payload.extraKey = 'some extra key';
-      const decoded = entriesNested.decode(payload);
+    test('it should validate an array with nested entry', () => {
+      const payload = [{ ...getEntryNestedMock() }];
+      const decoded = entriesArrayOrUndefined.decode(payload);
       const message = pipe(decoded, foldLeftRight);
 
       expect(getPaths(left(message.errors))).toEqual([]);
-      expect(message.schema).toEqual(getEntryNestedMock());
+      expect(message.schema).toEqual(payload);
     });
   });
 });
diff --git a/x-pack/plugins/lists/common/schemas/types/entries.ts b/x-pack/plugins/lists/common/schemas/types/entries.ts
index c379f77b862c8..4f20b9278d3ff 100644
--- a/x-pack/plugins/lists/common/schemas/types/entries.ts
+++ b/x-pack/plugins/lists/common/schemas/types/entries.ts
@@ -8,62 +8,19 @@
 
 import * as t from 'io-ts';
 
-import { operator, type } from '../common/schemas';
-import { DefaultStringArray } from '../../siem_common_deps';
-
-export const entriesMatch = t.exact(
-  t.type({
-    field: t.string,
-    operator,
-    type: t.keyof({ match: null }),
-    value: t.string,
-  })
-);
-export type EntryMatch = t.TypeOf<typeof entriesMatch>;
-
-export const entriesMatchAny = t.exact(
-  t.type({
-    field: t.string,
-    operator,
-    type: t.keyof({ match_any: null }),
-    value: DefaultStringArray,
-  })
-);
-export type EntryMatchAny = t.TypeOf<typeof entriesMatchAny>;
-
-export const entriesList = t.exact(
-  t.type({
-    field: t.string,
-    list: t.exact(t.type({ id: t.string, type })),
-    operator,
-    type: t.keyof({ list: null }),
-  })
-);
-export type EntryList = t.TypeOf<typeof entriesList>;
-
-export const entriesExists = t.exact(
-  t.type({
-    field: t.string,
-    operator,
-    type: t.keyof({ exists: null }),
-  })
-);
-export type EntryExists = t.TypeOf<typeof entriesExists>;
-
-export const entriesNested = t.exact(
-  t.type({
-    entries: t.array(entriesMatch),
-    field: t.string,
-    type: t.keyof({ nested: null }),
-  })
-);
-export type EntryNested = t.TypeOf<typeof entriesNested>;
+import { entriesMatchAny } from './entry_match_any';
+import { entriesMatch } from './entry_match';
+import { entriesExists } from './entry_exists';
+import { entriesList } from './entry_list';
+import { entriesNested } from './entry_nested';
 
 export const entry = t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists]);
 export type Entry = t.TypeOf<typeof entry>;
+
 export const entriesArray = t.array(
   t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists, entriesNested])
 );
 export type EntriesArray = t.TypeOf<typeof entriesArray>;
+
 export const entriesArrayOrUndefined = t.union([entriesArray, t.undefined]);
 export type EntriesArrayOrUndefined = t.TypeOf<typeof entriesArrayOrUndefined>;
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_exists.mock.ts b/x-pack/plugins/lists/common/schemas/types/entry_exists.mock.ts
new file mode 100644
index 0000000000000..aa93eee6374a4
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_exists.mock.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EXISTS, FIELD, OPERATOR } from '../../constants.mock';
+
+import { EntryExists } from './entry_exists';
+
+export const getEntryExistsMock = (): EntryExists => ({
+  field: FIELD,
+  operator: OPERATOR,
+  type: EXISTS,
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts b/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts
new file mode 100644
index 0000000000000..9d5b669333db8
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_exists.test.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryExistsMock } from './entry_exists.mock';
+import { EntryExists, entriesExists } from './entry_exists';
+
+describe('entriesExists', () => {
+  test('it should validate an entry', () => {
+    const payload = { ...getEntryExistsMock() };
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "included"', () => {
+    const payload = { ...getEntryExistsMock() };
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "excluded"', () => {
+    const payload = { ...getEntryExistsMock() };
+    payload.operator = 'excluded';
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate when "field" is empty string', () => {
+    const payload: Omit<EntryExists, 'field'> & { field: string } = {
+      ...getEntryExistsMock(),
+      field: '',
+    };
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryExists & {
+      extraKey?: string;
+    } = { ...getEntryExistsMock() };
+    payload.extraKey = 'some extra key';
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({ ...getEntryExistsMock() });
+  });
+
+  test('it should not validate when "type" is not "exists"', () => {
+    const payload: Omit<EntryExists, 'type'> & { type: string } = {
+      ...getEntryExistsMock(),
+      type: 'match',
+    };
+    const decoded = entriesExists.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_exists.ts b/x-pack/plugins/lists/common/schemas/types/entry_exists.ts
new file mode 100644
index 0000000000000..05c82d2532218
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_exists.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../siem_common_deps';
+import { operator } from '../common/schemas';
+
+export const entriesExists = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ exists: null }),
+  })
+);
+export type EntryExists = t.TypeOf<typeof entriesExists>;
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_list.mock.ts b/x-pack/plugins/lists/common/schemas/types/entry_list.mock.ts
new file mode 100644
index 0000000000000..d5166b7984c93
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_list.mock.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FIELD, LIST, LIST_ID, OPERATOR, TYPE } from '../../constants.mock';
+
+import { EntryList } from './entry_list';
+
+export const getEntryListMock = (): EntryList => ({
+  field: FIELD,
+  list: { id: LIST_ID, type: TYPE },
+  operator: OPERATOR,
+  type: LIST,
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts b/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts
new file mode 100644
index 0000000000000..14857edad5e3b
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_list.test.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryListMock } from './entry_list.mock';
+import { EntryList, entriesList } from './entry_list';
+
+describe('entriesList', () => {
+  test('it should validate an entry', () => {
+    const payload = { ...getEntryListMock() };
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "included"', () => {
+    const payload = { ...getEntryListMock() };
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "excluded"', () => {
+    const payload = { ...getEntryListMock() };
+    payload.operator = 'excluded';
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate when "list" is not expected value', () => {
+    const payload: Omit<EntryList, 'list'> & { list: string } = {
+      ...getEntryListMock(),
+      list: 'someListId',
+    };
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "someListId" supplied to "list"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "list.id" is empty string', () => {
+    const payload: Omit<EntryList, 'list'> & { list: { id: string; type: 'ip' } } = {
+      ...getEntryListMock(),
+      list: { id: '', type: 'ip' },
+    };
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "list,id"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "type" is not "lists"', () => {
+    const payload: Omit<EntryList, 'type'> & { type: 'match_any' } = {
+      ...getEntryListMock(),
+      type: 'match_any',
+    };
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "match_any" supplied to "type"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryList & {
+      extraKey?: string;
+    } = { ...getEntryListMock() };
+    payload.extraKey = 'some extra key';
+    const decoded = entriesList.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({ ...getEntryListMock() });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_list.ts b/x-pack/plugins/lists/common/schemas/types/entry_list.ts
new file mode 100644
index 0000000000000..ae9de967db027
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_list.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../siem_common_deps';
+import { operator, type } from '../common/schemas';
+
+export const entriesList = t.exact(
+  t.type({
+    field: NonEmptyString,
+    list: t.exact(t.type({ id: NonEmptyString, type })),
+    operator,
+    type: t.keyof({ list: null }),
+  })
+);
+export type EntryList = t.TypeOf<typeof entriesList>;
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match.mock.ts b/x-pack/plugins/lists/common/schemas/types/entry_match.mock.ts
new file mode 100644
index 0000000000000..5f3a09f17eb3b
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match.mock.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ENTRY_VALUE, FIELD, MATCH, OPERATOR } from '../../constants.mock';
+
+import { EntryMatch } from './entry_match';
+
+export const getEntryMatchMock = (): EntryMatch => ({
+  field: FIELD,
+  operator: OPERATOR,
+  type: MATCH,
+  value: ENTRY_VALUE,
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts b/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts
new file mode 100644
index 0000000000000..2c64592518eb7
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match.test.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryMatchMock } from './entry_match.mock';
+import { EntryMatch, entriesMatch } from './entry_match';
+
+describe('entriesMatch', () => {
+  test('it should validate an entry', () => {
+    const payload = { ...getEntryMatchMock() };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "included"', () => {
+    const payload = { ...getEntryMatchMock() };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "excluded"', () => {
+    const payload = { ...getEntryMatchMock() };
+    payload.operator = 'excluded';
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate when "field" is empty string', () => {
+    const payload: Omit<EntryMatch, 'field'> & { field: string } = {
+      ...getEntryMatchMock(),
+      field: '',
+    };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "value" is not string', () => {
+    const payload: Omit<EntryMatch, 'value'> & { value: string[] } = {
+      ...getEntryMatchMock(),
+      value: ['some value'],
+    };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "["some value"]" supplied to "value"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "value" is empty string', () => {
+    const payload: Omit<EntryMatch, 'value'> & { value: string } = {
+      ...getEntryMatchMock(),
+      value: '',
+    };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "value"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "type" is not "match"', () => {
+    const payload: Omit<EntryMatch, 'type'> & { type: string } = {
+      ...getEntryMatchMock(),
+      type: 'match_any',
+    };
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "match_any" supplied to "type"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryMatch & {
+      extraKey?: string;
+    } = { ...getEntryMatchMock() };
+    payload.extraKey = 'some value';
+    const decoded = entriesMatch.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({ ...getEntryMatchMock() });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match.ts b/x-pack/plugins/lists/common/schemas/types/entry_match.ts
new file mode 100644
index 0000000000000..a21f83f317e35
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../siem_common_deps';
+import { operator } from '../common/schemas';
+
+export const entriesMatch = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ match: null }),
+    value: NonEmptyString,
+  })
+);
+export type EntryMatch = t.TypeOf<typeof entriesMatch>;
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match_any.mock.ts b/x-pack/plugins/lists/common/schemas/types/entry_match_any.mock.ts
new file mode 100644
index 0000000000000..ac4ef69207c8c
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match_any.mock.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ENTRY_VALUE, FIELD, MATCH_ANY, OPERATOR } from '../../constants.mock';
+
+import { EntryMatchAny } from './entry_match_any';
+
+export const getEntryMatchAnyMock = (): EntryMatchAny => ({
+  field: FIELD,
+  operator: OPERATOR,
+  type: MATCH_ANY,
+  value: [ENTRY_VALUE],
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts b/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts
new file mode 100644
index 0000000000000..4dab2f45711f0
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match_any.test.ts
@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { EntryMatchAny, entriesMatchAny } from './entry_match_any';
+
+describe('entriesMatchAny', () => {
+  test('it should validate an entry', () => {
+    const payload = { ...getEntryMatchAnyMock() };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "included"', () => {
+    const payload = { ...getEntryMatchAnyMock() };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "excluded"', () => {
+    const payload = { ...getEntryMatchAnyMock() };
+    payload.operator = 'excluded';
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should not validate when field is empty string', () => {
+    const payload: Omit<EntryMatchAny, 'field'> & { field: string } = {
+      ...getEntryMatchAnyMock(),
+      field: '',
+    };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when value is empty array', () => {
+    const payload: Omit<EntryMatchAny, 'value'> & { value: string[] } = {
+      ...getEntryMatchAnyMock(),
+      value: [],
+    };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "[]" supplied to "value"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when value is not string array', () => {
+    const payload: Omit<EntryMatchAny, 'value'> & { value: string } = {
+      ...getEntryMatchAnyMock(),
+      value: 'some string',
+    };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "some string" supplied to "value"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should not validate when "type" is not "match_any"', () => {
+    const payload: Omit<EntryMatchAny, 'type'> & { type: string } = {
+      ...getEntryMatchAnyMock(),
+      type: 'match',
+    };
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryMatchAny & {
+      extraKey?: string;
+    } = { ...getEntryMatchAnyMock() };
+    payload.extraKey = 'some extra key';
+    const decoded = entriesMatchAny.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({ ...getEntryMatchAnyMock() });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_match_any.ts b/x-pack/plugins/lists/common/schemas/types/entry_match_any.ts
new file mode 100644
index 0000000000000..e93ad4aa131d1
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_match_any.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../siem_common_deps';
+import { operator } from '../common/schemas';
+
+import { nonEmptyOrNullableStringArray } from './non_empty_or_nullable_string_array';
+
+export const entriesMatchAny = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ match_any: null }),
+    value: nonEmptyOrNullableStringArray,
+  })
+);
+export type EntryMatchAny = t.TypeOf<typeof entriesMatchAny>;
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_nested.mock.ts b/x-pack/plugins/lists/common/schemas/types/entry_nested.mock.ts
new file mode 100644
index 0000000000000..f645bc9e40d78
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_nested.mock.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FIELD, NESTED } from '../../constants.mock';
+
+import { EntryNested } from './entry_nested';
+import { getEntryMatchMock } from './entry_match.mock';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+
+export const getEntryNestedMock = (): EntryNested => ({
+  entries: [{ ...getEntryMatchMock() }, { ...getEntryMatchAnyMock() }],
+  field: FIELD,
+  type: NESTED,
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts b/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts
new file mode 100644
index 0000000000000..d9b58855413b1
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_nested.test.ts
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryNestedMock } from './entry_nested.mock';
+import { EntryNested, entriesNested } from './entry_nested';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { getEntryExistsMock } from './entry_exists.mock';
+
+describe('entriesNested', () => {
+  test('it should validate a nested entry', () => {
+    const payload = { ...getEntryNestedMock() };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate when "type" is not "nested"', () => {
+    const payload: Omit<EntryNested, 'type'> & { type: 'match' } = {
+      ...getEntryNestedMock(),
+      type: 'match',
+    };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate when "field" is empty string', () => {
+    const payload: Omit<EntryNested, 'field'> & {
+      field: string;
+    } = { ...getEntryNestedMock(), field: '' };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate when "field" is not a string', () => {
+    const payload: Omit<EntryNested, 'field'> & {
+      field: number;
+    } = { ...getEntryNestedMock(), field: 1 };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "1" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate when "entries" is not a an array', () => {
+    const payload: Omit<EntryNested, 'entries'> & {
+      entries: string;
+    } = { ...getEntryNestedMock(), entries: 'im a string' };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "im a string" supplied to "entries"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate when "entries" contains an entry item that is type "match"', () => {
+    const payload = { ...getEntryNestedMock(), entries: [{ ...getEntryMatchAnyMock() }] };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({
+      entries: [
+        {
+          field: 'host.name',
+          operator: 'included',
+          type: 'match_any',
+          value: ['some host name'],
+        },
+      ],
+      field: 'host.name',
+      type: 'nested',
+    });
+  });
+
+  test('it should validate when "entries" contains an entry item that is type "exists"', () => {
+    const payload = { ...getEntryNestedMock(), entries: [{ ...getEntryExistsMock() }] };
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({
+      entries: [
+        {
+          field: 'host.name',
+          operator: 'included',
+          type: 'exists',
+        },
+      ],
+      field: 'host.name',
+      type: 'nested',
+    });
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryNested & {
+      extraKey?: string;
+    } = { ...getEntryNestedMock() };
+    payload.extraKey = 'some extra key';
+    const decoded = entriesNested.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual({ ...getEntryNestedMock() });
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/entry_nested.ts b/x-pack/plugins/lists/common/schemas/types/entry_nested.ts
new file mode 100644
index 0000000000000..9989f501d4338
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/entry_nested.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/* eslint-disable @typescript-eslint/camelcase */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../siem_common_deps';
+
+import { nonEmptyNestedEntriesArray } from './non_empty_nested_entries_array';
+
+export const entriesNested = t.exact(
+  t.type({
+    entries: nonEmptyNestedEntriesArray,
+    field: NonEmptyString,
+    type: t.keyof({ nested: null }),
+  })
+);
+export type EntryNested = t.TypeOf<typeof entriesNested>;
diff --git a/x-pack/plugins/lists/common/schemas/types/index.ts b/x-pack/plugins/lists/common/schemas/types/index.ts
index 16433e00f2b16..463f7cfe51ce3 100644
--- a/x-pack/plugins/lists/common/schemas/types/index.ts
+++ b/x-pack/plugins/lists/common/schemas/types/index.ts
@@ -10,5 +10,12 @@ export * from './default_comments_array';
 export * from './default_create_comments_array';
 export * from './default_update_comments_array';
 export * from './default_namespace';
-export * from './default_entries_array';
 export * from './entries';
+export * from './entry_match';
+export * from './entry_match_any';
+export * from './entry_list';
+export * from './entry_exists';
+export * from './entry_nested';
+export * from './non_empty_entries_array';
+export * from './non_empty_or_nullable_string_array';
+export * from './non_empty_nested_entries_array';
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts
new file mode 100644
index 0000000000000..ab7002982cf28
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.test.ts
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryMatchMock } from './entry_match.mock';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { getEntryListMock } from './entry_list.mock';
+import { getEntryExistsMock } from './entry_exists.mock';
+import { getEntryNestedMock } from './entry_nested.mock';
+import { getEntriesArrayMock } from './entries.mock';
+import { nonEmptyEntriesArray } from './non_empty_entries_array';
+import { EntriesArray } from './entries';
+
+describe('non_empty_entries_array', () => {
+  test('it should NOT validate an empty array', () => {
+    const payload: EntriesArray = [];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "[]" supplied to "NonEmptyEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "undefined"', () => {
+    const payload = undefined;
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "NonEmptyEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "null"', () => {
+    const payload = null;
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "null" supplied to "NonEmptyEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an array of "match" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryMatchMock() }, { ...getEntryMatchMock() }];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "match_any" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryMatchAnyMock() }, { ...getEntryMatchAnyMock() }];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "exists" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryExistsMock() }, { ...getEntryExistsMock() }];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "list" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryListMock() }, { ...getEntryListMock() }];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "nested" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryNestedMock() }, { ...getEntryNestedMock() }];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of entries', () => {
+    const payload: EntriesArray = [...getEntriesArrayMock()];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of non entries', () => {
+    const payload = [1];
+    const decoded = nonEmptyEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "NonEmptyEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.ts
new file mode 100644
index 0000000000000..1370fe022c258
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_entries_array.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+import { EntriesArray, entriesArray } from './entries';
+
+/**
+ * Types the nonEmptyEntriesArray as:
+ *   - An array of entries of length 1 or greater
+ *
+ */
+export const nonEmptyEntriesArray = new t.Type<EntriesArray, EntriesArray, unknown>(
+  'NonEmptyEntriesArray',
+  entriesArray.is,
+  (input, context): Either<t.Errors, EntriesArray> => {
+    if (Array.isArray(input) && input.length === 0) {
+      return t.failure(input, context);
+    } else {
+      return entriesArray.validate(input, context);
+    }
+  },
+  t.identity
+);
+
+export type NonEmptyEntriesArray = t.OutputOf<typeof nonEmptyEntriesArray>;
+export type NonEmptyEntriesArrayDecoded = t.TypeOf<typeof nonEmptyEntriesArray>;
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts
new file mode 100644
index 0000000000000..1154f2b6098da
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.test.ts
@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { getEntryMatchMock } from './entry_match.mock';
+import { getEntryMatchAnyMock } from './entry_match_any.mock';
+import { getEntryExistsMock } from './entry_exists.mock';
+import { getEntryNestedMock } from './entry_nested.mock';
+import { nonEmptyNestedEntriesArray } from './non_empty_nested_entries_array';
+import { EntriesArray } from './entries';
+
+describe('non_empty_nested_entries_array', () => {
+  test('it should NOT validate an empty array', () => {
+    const payload: EntriesArray = [];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "[]" supplied to "NonEmptyNestedEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "undefined"', () => {
+    const payload = undefined;
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "NonEmptyNestedEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "null"', () => {
+    const payload = null;
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "null" supplied to "NonEmptyNestedEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an array of "match" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryMatchMock() }, { ...getEntryMatchMock() }];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "match_any" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryMatchAnyMock() }, { ...getEntryMatchAnyMock() }];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate an array of "exists" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryExistsMock() }, { ...getEntryExistsMock() }];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of "nested" entries', () => {
+    const payload: EntriesArray = [{ ...getEntryNestedMock() }, { ...getEntryNestedMock() }];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+      'Invalid value "undefined" supplied to "value"',
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+      'Invalid value "undefined" supplied to "value"',
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+      'Invalid value "undefined" supplied to "value"',
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+      'Invalid value "undefined" supplied to "value"',
+      'Invalid value "undefined" supplied to "operator"',
+      'Invalid value "nested" supplied to "type"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should validate an array of entries', () => {
+    const payload: EntriesArray = [
+      { ...getEntryExistsMock() },
+      { ...getEntryMatchAnyMock() },
+      { ...getEntryMatchMock() },
+    ];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should NOT validate an array of non entries', () => {
+    const payload = [1];
+    const decoded = nonEmptyNestedEntriesArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "1" supplied to "NonEmptyNestedEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyNestedEntriesArray"',
+      'Invalid value "1" supplied to "NonEmptyNestedEntriesArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts
new file mode 100644
index 0000000000000..88a0f09b3cef0
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_nested_entries_array.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+import { entriesMatchAny } from './entry_match_any';
+import { entriesMatch } from './entry_match';
+import { entriesExists } from './entry_exists';
+
+export const nestedEntriesArray = t.array(t.union([entriesMatch, entriesMatchAny, entriesExists]));
+export type NestedEntriesArray = t.TypeOf<typeof nestedEntriesArray>;
+
+/**
+ * Types the nonEmptyNestedEntriesArray as:
+ *   - An array of entries of length 1 or greater
+ *
+ */
+export const nonEmptyNestedEntriesArray = new t.Type<
+  NestedEntriesArray,
+  NestedEntriesArray,
+  unknown
+>(
+  'NonEmptyNestedEntriesArray',
+  nestedEntriesArray.is,
+  (input, context): Either<t.Errors, NestedEntriesArray> => {
+    if (Array.isArray(input) && input.length === 0) {
+      return t.failure(input, context);
+    } else {
+      return nestedEntriesArray.validate(input, context);
+    }
+  },
+  t.identity
+);
+
+export type NonEmptyNestedEntriesArray = t.OutputOf<typeof nonEmptyNestedEntriesArray>;
+export type NonEmptyNestedEntriesArrayDecoded = t.TypeOf<typeof nonEmptyNestedEntriesArray>;
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts
new file mode 100644
index 0000000000000..e3cc9104853e5
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.test.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../siem_common_deps';
+
+import { nonEmptyOrNullableStringArray } from './non_empty_or_nullable_string_array';
+
+describe('nonEmptyOrNullableStringArray', () => {
+  test('it should NOT validate an empty array', () => {
+    const payload: string[] = [];
+    const decoded = nonEmptyOrNullableStringArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "[]" supplied to "NonEmptyOrNullableStringArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "undefined"', () => {
+    const payload = undefined;
+    const decoded = nonEmptyOrNullableStringArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "undefined" supplied to "NonEmptyOrNullableStringArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate "null"', () => {
+    const payload = null;
+    const decoded = nonEmptyOrNullableStringArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "null" supplied to "NonEmptyOrNullableStringArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an array of with an empty string', () => {
+    const payload: string[] = ['im good', ''];
+    const decoded = nonEmptyOrNullableStringArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "["im good",""]" supplied to "NonEmptyOrNullableStringArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should NOT validate an array of non strings', () => {
+    const payload = [1];
+    const decoded = nonEmptyOrNullableStringArray.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "[1]" supplied to "NonEmptyOrNullableStringArray"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+});
diff --git a/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.ts b/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.ts
new file mode 100644
index 0000000000000..f8ae1701e1322
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/types/non_empty_or_nullable_string_array.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { Either } from 'fp-ts/lib/Either';
+
+/**
+ * Types the nonEmptyOrNullableStringArray as:
+ *   - An array of non empty strings of length 1 or greater
+ *   - This differs from NonEmptyStringArray in that both input and output are type array
+ *
+ */
+export const nonEmptyOrNullableStringArray = new t.Type<string[], string[], unknown>(
+  'NonEmptyOrNullableStringArray',
+  t.array(t.string).is,
+  (input, context): Either<t.Errors, string[]> => {
+    const emptyValueFound = Array.isArray(input) && input.some((value) => value === '');
+    const nonStringValueFound =
+      Array.isArray(input) && input.some((value) => typeof value !== 'string');
+
+    if (Array.isArray(input) && (emptyValueFound || nonStringValueFound || input.length === 0)) {
+      return t.failure(input, context);
+    } else {
+      return t.array(t.string).validate(input, context);
+    }
+  },
+  t.identity
+);
+
+export type NonEmptyOrNullableStringArray = t.OutputOf<typeof nonEmptyOrNullableStringArray>;
+export type NonEmptyOrNullableStringArrayDecoded = t.TypeOf<typeof nonEmptyOrNullableStringArray>;
diff --git a/x-pack/plugins/lists/server/scripts/exception_lists/new/exception_list_item.json b/x-pack/plugins/lists/server/scripts/exception_lists/new/exception_list_item.json
index eede855aab199..5fbfcc10bcc3c 100644
--- a/x-pack/plugins/lists/server/scripts/exception_lists/new/exception_list_item.json
+++ b/x-pack/plugins/lists/server/scripts/exception_lists/new/exception_list_item.json
@@ -8,7 +8,7 @@
   "name": "Sample Endpoint Exception List",
   "entries": [
     {
-      "field": "actingProcess.file.signer",
+      "field": "host.ip",
       "operator": "excluded",
       "type": "exists"
     },
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
index 51e3a7ee8046f..555b9c5e95a77 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
@@ -14,7 +14,6 @@ import {
   Description,
   DescriptionOrUndefined,
   EntriesArray,
-  EntriesArrayOrUndefined,
   ExceptionListItemType,
   ExceptionListItemTypeOrUndefined,
   ExceptionListType,
@@ -140,7 +139,7 @@ export interface UpdateExceptionListItemOptions {
   _tags: _TagsOrUndefined;
   _version: _VersionOrUndefined;
   comments: UpdateCommentsArray;
-  entries: EntriesArrayOrUndefined;
+  entries: EntriesArray;
   id: IdOrUndefined;
   itemId: ItemIdOrUndefined;
   namespaceType: NamespaceType;
@@ -155,7 +154,7 @@ export interface UpdateEndpointListItemOptions {
   _tags: _TagsOrUndefined;
   _version: _VersionOrUndefined;
   comments: UpdateCommentsArray;
-  entries: EntriesArrayOrUndefined;
+  entries: EntriesArray;
   id: IdOrUndefined;
   itemId: ItemIdOrUndefined;
   name: NameOrUndefined;
diff --git a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
index f26dd7e18dd5c..ccb74e8796705 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/update_exception_list_item.ts
@@ -8,7 +8,7 @@ import { SavedObjectsClientContract } from 'kibana/server';
 
 import {
   DescriptionOrUndefined,
-  EntriesArrayOrUndefined,
+  EntriesArray,
   ExceptionListItemSchema,
   ExceptionListItemTypeOrUndefined,
   ExceptionListSoSchema,
@@ -37,7 +37,7 @@ interface UpdateExceptionListItemOptions {
   _version: _VersionOrUndefined;
   name: NameOrUndefined;
   description: DescriptionOrUndefined;
-  entries: EntriesArrayOrUndefined;
+  entries: EntriesArray;
   savedObjectsClient: SavedObjectsClientContract;
   namespaceType: NamespaceType;
   itemId: ItemIdOrUndefined;
diff --git a/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.test.ts b/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.test.ts
index caf2dfb761ed0..1c7a2a5de6594 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.test.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.test.ts
@@ -25,6 +25,9 @@ import {
   Operator,
 } from '../../../lists/common/schemas';
 import { getExceptionListItemSchemaMock } from '../../../lists/common/schemas/response/exception_list_item_schema.mock';
+import { getEntryMatchMock } from '../../../lists/common/schemas/types/entry_match.mock';
+import { getEntryMatchAnyMock } from '../../../lists/common/schemas/types/entry_match_any.mock';
+import { getEntryExistsMock } from '../../../lists/common/schemas/types/entry_exists.mock';
 
 describe('build_exceptions_query', () => {
   let exclude: boolean;
@@ -295,20 +298,95 @@ describe('build_exceptions_query', () => {
         const item: EntryNested = {
           field: 'parent',
           type: 'nested',
-          entries: [makeMatchEntry({ field: 'nestedField', operator: 'included' })],
+          entries: [
+            {
+              ...getEntryMatchMock(),
+              field: 'nestedField',
+              operator: 'included',
+              value: 'value-1',
+            },
+          ],
         };
         const result = buildNested({ item, language: 'kuery' });
 
         expect(result).toEqual('parent:{ nestedField:"value-1" }');
       });
 
+      test('it returns formatted query when entry item is "exists"', () => {
+        const item: EntryNested = {
+          field: 'parent',
+          type: 'nested',
+          entries: [{ ...getEntryExistsMock(), field: 'nestedField', operator: 'included' }],
+        };
+        const result = buildNested({ item, language: 'kuery' });
+
+        expect(result).toEqual('parent:{ nestedField:* }');
+      });
+
+      test('it returns formatted query when entry item is "exists" and operator is "excluded"', () => {
+        const item: EntryNested = {
+          field: 'parent',
+          type: 'nested',
+          entries: [{ ...getEntryExistsMock(), field: 'nestedField', operator: 'excluded' }],
+        };
+        const result = buildNested({ item, language: 'kuery' });
+
+        expect(result).toEqual('parent:{ not nestedField:* }');
+      });
+
+      test('it returns formatted query when entry item is "match_any"', () => {
+        const item: EntryNested = {
+          field: 'parent',
+          type: 'nested',
+          entries: [
+            {
+              ...getEntryMatchAnyMock(),
+              field: 'nestedField',
+              operator: 'included',
+              value: ['value1', 'value2'],
+            },
+          ],
+        };
+        const result = buildNested({ item, language: 'kuery' });
+
+        expect(result).toEqual('parent:{ nestedField:("value1" or "value2") }');
+      });
+
+      test('it returns formatted query when entry item is "match_any" and operator is "excluded"', () => {
+        const item: EntryNested = {
+          field: 'parent',
+          type: 'nested',
+          entries: [
+            {
+              ...getEntryMatchAnyMock(),
+              field: 'nestedField',
+              operator: 'excluded',
+              value: ['value1', 'value2'],
+            },
+          ],
+        };
+        const result = buildNested({ item, language: 'kuery' });
+
+        expect(result).toEqual('parent:{ not nestedField:("value1" or "value2") }');
+      });
+
       test('it returns formatted query when multiple items in nested entry', () => {
         const item: EntryNested = {
           field: 'parent',
           type: 'nested',
           entries: [
-            makeMatchEntry({ field: 'nestedField', operator: 'included' }),
-            makeMatchEntry({ field: 'nestedFieldB', operator: 'included', value: 'value-2' }),
+            {
+              ...getEntryMatchMock(),
+              field: 'nestedField',
+              operator: 'included',
+              value: 'value-1',
+            },
+            {
+              ...getEntryMatchMock(),
+              field: 'nestedFieldB',
+              operator: 'included',
+              value: 'value-2',
+            },
           ],
         };
         const result = buildNested({ item, language: 'kuery' });
@@ -514,7 +592,7 @@ describe('build_exceptions_query', () => {
         entries,
       });
       const expectedQuery =
-        'b:("value-1" OR "value-2") AND parent:{ nestedField:"value-3" } AND NOT _exists_e';
+        'b:("value-1" OR "value-2") AND parent:{ NOT nestedField:"value-3" } AND NOT _exists_e';
       expect(query).toEqual(expectedQuery);
     });
 
@@ -576,7 +654,7 @@ describe('build_exceptions_query', () => {
           language: 'kuery',
           entries,
         });
-        const expectedQuery = 'b:* and parent:{ c:"value-1" and d:"value-2" } and e:*';
+        const expectedQuery = 'b:* and parent:{ not c:"value-1" and d:"value-2" } and e:*';
 
         expect(query).toEqual(expectedQuery);
       });
@@ -642,7 +720,8 @@ describe('build_exceptions_query', () => {
           language: 'kuery',
           entries,
         });
-        const expectedQuery = 'b:"value" and parent:{ c:"valueC" and d:"valueD" } and e:"valueE"';
+        const expectedQuery =
+          'b:"value" and parent:{ not c:"valueC" and not d:"valueD" } and e:"valueE"';
 
         expect(query).toEqual(expectedQuery);
       });
@@ -684,7 +763,7 @@ describe('build_exceptions_query', () => {
           language: 'kuery',
           entries,
         });
-        const expectedQuery = 'not b:("value-1" or "value-2") and parent:{ c:"valueC" }';
+        const expectedQuery = 'not b:("value-1" or "value-2") and parent:{ not c:"valueC" }';
 
         expect(query).toEqual(expectedQuery);
       });
@@ -800,7 +879,7 @@ describe('build_exceptions_query', () => {
           exclude,
         });
         const expectedQuery =
-          '(some.parentField:{ nested.field:"some value" } and some.not.nested.field:"some value") or (b:("value-1" or "value-2") and parent:{ c:"valueC" and d:"valueD" } and e:("value-1" or "value-2"))';
+          '(some.parentField:{ nested.field:"some value" } and some.not.nested.field:"some value") or (b:("value-1" or "value-2") and parent:{ not c:"valueC" and not d:"valueD" } and e:("value-1" or "value-2"))';
 
         expect(query).toEqual([{ query: expectedQuery, language: 'kuery' }]);
       });
diff --git a/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts b/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts
index fc4fbae02b8fb..ff492dcda3b66 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/build_exceptions_query.ts
@@ -126,7 +126,7 @@ export const buildNested = ({
 }): string => {
   const { field, entries } = item;
   const and = getLanguageBooleanOperator({ language, value: 'and' });
-  const values = entries.map((entry) => `${entry.field}:"${entry.value}"`);
+  const values = entries.map((entry) => evaluateValues({ item: entry, language }));
 
   return `${field}:{ ${values.join(` ${and} `)} }`;
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
index ed844b5130c77..fab2b1e4a7463 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useMemo, useCallback } from 'react';
+import React, { useState, useMemo, useCallback } from 'react';
 import { EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
 
 import { IFieldType, IIndexPattern } from '../../../../../../../src/plugins/data/common';
@@ -19,6 +19,7 @@ interface OperatorProps {
   isClearable: boolean;
   fieldTypeFilter?: string[];
   fieldInputWidth?: number;
+  isRequired?: boolean;
   onChange: (a: IFieldType[]) => void;
 }
 
@@ -29,10 +30,12 @@ export const FieldComponent: React.FC<OperatorProps> = ({
   isLoading = false,
   isDisabled = false,
   isClearable = false,
+  isRequired = false,
   fieldTypeFilter = [],
   fieldInputWidth = 190,
   onChange,
 }): JSX.Element => {
+  const [touched, setIsTouched] = useState(false);
   const getLabel = useCallback((field): string => field.name, []);
   const optionsMemo = useMemo((): IFieldType[] => {
     if (indexPattern != null) {
@@ -74,6 +77,8 @@ export const FieldComponent: React.FC<OperatorProps> = ({
       isLoading={isLoading}
       isDisabled={isDisabled}
       isClearable={isClearable}
+      isInvalid={isRequired ? touched && selectedField == null : false}
+      onFocus={() => setIsTouched(true)}
       singleSelection={{ asPlainText: true }}
       data-test-subj="fieldAutocompleteComboBox"
       style={{ width: `${fieldInputWidth}px` }}
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx
index a9d85452651b5..cd90d6eb85623 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_lists.tsx
@@ -18,6 +18,7 @@ interface AutocompleteFieldListsProps {
   isLoading: boolean;
   isDisabled: boolean;
   isClearable: boolean;
+  isRequired?: boolean;
   onChange: (arg: ListSchema) => void;
 }
 
@@ -28,8 +29,10 @@ export const AutocompleteFieldListsComponent: React.FC<AutocompleteFieldListsPro
   isLoading = false,
   isDisabled = false,
   isClearable = false,
+  isRequired = false,
   onChange,
 }): JSX.Element => {
+  const [touched, setIsTouched] = useState(false);
   const { http } = useKibana().services;
   const [lists, setLists] = useState<ListSchema[]>([]);
   const { loading, result, start } = useFindLists();
@@ -97,6 +100,8 @@ export const AutocompleteFieldListsComponent: React.FC<AutocompleteFieldListsPro
       options={comboOptions}
       selectedOptions={selectedComboOptions}
       onChange={handleValuesChange}
+      isInvalid={isRequired ? touched && (selectedValue == null || selectedValue === '') : false}
+      onFocus={() => setIsTouched(true)}
       singleSelection={{ asPlainText: true }}
       sortMatchesBy="startsWith"
       data-test-subj="valuesAutocompleteComboBox listsComboxBox"
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
index a082811920f88..992005b3be8bc 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 import { EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
 import { uniq } from 'lodash';
 
@@ -22,6 +22,7 @@ interface AutocompleteFieldMatchProps {
   isLoading: boolean;
   isDisabled: boolean;
   isClearable: boolean;
+  isRequired?: boolean;
   fieldInputWidth?: number;
   onChange: (arg: string) => void;
 }
@@ -34,9 +35,11 @@ export const AutocompleteFieldMatchComponent: React.FC<AutocompleteFieldMatchPro
   isLoading,
   isDisabled = false,
   isClearable = false,
+  isRequired = false,
   fieldInputWidth,
   onChange,
 }): JSX.Element => {
+  const [touched, setIsTouched] = useState(false);
   const [isLoadingSuggestions, suggestions, updateSuggestions] = useFieldValueAutocomplete({
     selectedField,
     operatorType: OperatorTypeEnum.MATCH,
@@ -96,7 +99,8 @@ export const AutocompleteFieldMatchComponent: React.FC<AutocompleteFieldMatchPro
       singleSelection={{ asPlainText: true }}
       onSearchChange={onSearchChange}
       onCreateOption={onChange}
-      isInvalid={!isValid}
+      isInvalid={isRequired ? touched && !isValid : false}
+      onFocus={() => setIsTouched(true)}
       sortMatchesBy="startsWith"
       data-test-subj="valuesAutocompleteComboBox matchComboxBox"
       style={fieldInputWidth ? { width: `${fieldInputWidth}px` } : {}}
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx
index 461d49dddfdef..27807a752c141 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/field_value_match_any.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useCallback, useMemo } from 'react';
+import React, { useState, useCallback, useMemo } from 'react';
 import { EuiComboBoxOptionOption, EuiComboBox } from '@elastic/eui';
 import { uniq } from 'lodash';
 
@@ -22,6 +22,7 @@ interface AutocompleteFieldMatchAnyProps {
   isLoading: boolean;
   isDisabled: boolean;
   isClearable: boolean;
+  isRequired?: boolean;
   onChange: (arg: string[]) => void;
 }
 
@@ -33,8 +34,10 @@ export const AutocompleteFieldMatchAnyComponent: React.FC<AutocompleteFieldMatch
   isLoading,
   isDisabled = false,
   isClearable = false,
+  isRequired = false,
   onChange,
 }): JSX.Element => {
+  const [touched, setIsTouched] = useState(false);
   const [isLoadingSuggestions, suggestions, updateSuggestions] = useFieldValueAutocomplete({
     selectedField,
     operatorType: OperatorTypeEnum.MATCH_ANY,
@@ -92,7 +95,8 @@ export const AutocompleteFieldMatchAnyComponent: React.FC<AutocompleteFieldMatch
       onChange={handleValuesChange}
       onSearchChange={onSearchChange}
       onCreateOption={onCreateOption}
-      isInvalid={!isValid}
+      isInvalid={isRequired ? touched && (selectedValue.length === 0 || !isValid) : !isValid}
+      onFocus={() => setIsTouched(true)}
       delimiter=", "
       data-test-subj="valuesAutocompleteComboBox matchAnyComboxBox"
       fullWidth
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
index cb07d99913107..b25bb245c6792 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.test.ts
@@ -54,16 +54,16 @@ describe('helpers', () => {
   });
 
   describe('#validateParams', () => {
-    test('returns true if value is undefined', () => {
+    test('returns false if value is undefined', () => {
       const isValid = validateParams(undefined, getField('@timestamp'));
 
-      expect(isValid).toBeTruthy();
+      expect(isValid).toBeFalsy();
     });
 
-    test('returns true if value is empty string', () => {
+    test('returns false if value is empty string', () => {
       const isValid = validateParams('', getField('@timestamp'));
 
-      expect(isValid).toBeTruthy();
+      expect(isValid).toBeFalsy();
     });
 
     test('returns true if type is "date" and value is valid', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
index 16659593784db..a65f1fa35d3c2 100644
--- a/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/autocomplete/helpers.ts
@@ -36,7 +36,7 @@ export const validateParams = (
 ): boolean => {
   // Box would show error state if empty otherwise
   if (params == null || params === '') {
-    return true;
+    return false;
   }
 
   const types = field != null && field.esTypes != null ? field.esTypes : [];
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx
index 9ca7a371ce81b..0f3b6ec2e94e4 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/builder_exception_item.test.tsx
@@ -12,10 +12,8 @@ import euiLightVars from '@elastic/eui/dist/eui_theme_light.json';
 import { ExceptionListItemComponent } from './builder_exception_item';
 import { fields } from '../../../../../../../../src/plugins/data/common/index_patterns/fields/fields.mocks.ts';
 import { getExceptionListItemSchemaMock } from '../../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import {
-  getEntryMatchMock,
-  getEntryMatchAnyMock,
-} from '../../../../../../lists/common/schemas/types/entries.mock';
+import { getEntryMatchMock } from '../../../../../../lists/common/schemas/types/entry_match.mock';
+import { getEntryMatchAnyMock } from '../../../../../../lists/common/schemas/types/entry_match_any.mock';
 
 describe('ExceptionListItemComponent', () => {
   describe('and badge logic', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
index 0f5000c8c0abe..7bf279168a9a0 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/builder/entry_item.tsx
@@ -117,6 +117,7 @@ export const EntryItemComponent: React.FC<EntryItemProps> = ({
         isDisabled={isLoading}
         onChange={handleFieldChange}
         data-test-subj="exceptionBuilderEntryField"
+        isRequired
       />
     );
 
@@ -170,6 +171,7 @@ export const EntryItemComponent: React.FC<EntryItemProps> = ({
             isClearable={false}
             indexPattern={indexPattern}
             onChange={handleFieldMatchValueChange}
+            isRequired
             data-test-subj="exceptionBuilderEntryFieldMatch"
           />
         );
@@ -185,6 +187,7 @@ export const EntryItemComponent: React.FC<EntryItemProps> = ({
             isClearable={false}
             indexPattern={indexPattern}
             onChange={handleFieldMatchAnyValueChange}
+            isRequired
             data-test-subj="exceptionBuilderEntryFieldMatchAny"
           />
         );
@@ -199,6 +202,7 @@ export const EntryItemComponent: React.FC<EntryItemProps> = ({
             isDisabled={isLoading}
             isClearable={false}
             onChange={handleFieldListValueChange}
+            isRequired
             data-test-subj="exceptionBuilderEntryFieldList"
           />
         );
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
index 7171d3c6b815e..dace2eb5f0672 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
@@ -38,18 +38,20 @@ import {
   existsOperator,
   doesNotExistOperator,
 } from '../autocomplete/operators';
-import { OperatorTypeEnum, OperatorEnum } from '../../../lists_plugin_deps';
+import { OperatorTypeEnum, OperatorEnum, EntryNested } from '../../../lists_plugin_deps';
 import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import {
-  getEntryExistsMock,
-  getEntryListMock,
-  getEntryMatchMock,
-  getEntryMatchAnyMock,
-  getEntriesArrayMock,
-} from '../../../../../lists/common/schemas/types/entries.mock';
+import { getEntryMatchMock } from '../../../../../lists/common/schemas/types/entry_match.mock';
+import { getEntryMatchAnyMock } from '../../../../../lists/common/schemas/types/entry_match_any.mock';
+import { getEntryExistsMock } from '../../../../../lists/common/schemas/types/entry_exists.mock';
+import { getEntryListMock } from '../../../../../lists/common/schemas/types/entry_list.mock';
 import { getCommentsArrayMock } from '../../../../../lists/common/schemas/types/comments.mock';
+import { getEntriesArrayMock } from '../../../../../lists/common/schemas/types/entries.mock';
 import { ENTRIES } from '../../../../../lists/common/constants.mock';
-import { ExceptionListItemSchema, EntriesArray } from '../../../../../lists/common/schemas';
+import {
+  CreateExceptionListItemSchema,
+  ExceptionListItemSchema,
+  EntriesArray,
+} from '../../../../../lists/common/schemas';
 import { IIndexPattern } from 'src/plugins/data/common';
 
 describe('Exception helpers', () => {
@@ -251,8 +253,8 @@ describe('Exception helpers', () => {
         {
           fieldName: 'host.name.host.name',
           isNested: true,
-          operator: 'is',
-          value: 'some host name',
+          operator: 'is one of',
+          value: ['some host name'],
         },
       ];
       expect(result).toEqual(expected);
@@ -482,7 +484,7 @@ describe('Exception helpers', () => {
   });
 
   describe('#filterExceptionItems', () => {
-    test('it removes empty entry items', () => {
+    test('it removes entry items with "value" of "undefined"', () => {
       const { entries, ...rest } = getExceptionListItemSchemaMock();
       const mockEmptyException: EmptyEntry = {
         field: 'host.name',
@@ -500,6 +502,85 @@ describe('Exception helpers', () => {
       expect(exceptions).toEqual([getExceptionListItemSchemaMock()]);
     });
 
+    test('it removes "match" entry items with "value" of empty string', () => {
+      const { entries, ...rest } = { ...getExceptionListItemSchemaMock() };
+      const mockEmptyException: EmptyEntry = {
+        field: 'host.name',
+        type: OperatorTypeEnum.MATCH,
+        operator: OperatorEnum.INCLUDED,
+        value: '',
+      };
+      const output: Array<
+        ExceptionListItemSchema | CreateExceptionListItemSchema
+      > = filterExceptionItems([
+        {
+          ...rest,
+          entries: [...entries, mockEmptyException],
+        },
+      ]);
+
+      expect(output).toEqual([{ ...getExceptionListItemSchemaMock() }]);
+    });
+
+    test('it removes "match" entry items with "field" of empty string', () => {
+      const { entries, ...rest } = { ...getExceptionListItemSchemaMock() };
+      const mockEmptyException: EmptyEntry = {
+        field: '',
+        type: OperatorTypeEnum.MATCH,
+        operator: OperatorEnum.INCLUDED,
+        value: 'some value',
+      };
+      const output: Array<
+        ExceptionListItemSchema | CreateExceptionListItemSchema
+      > = filterExceptionItems([
+        {
+          ...rest,
+          entries: [...entries, mockEmptyException],
+        },
+      ]);
+
+      expect(output).toEqual([{ ...getExceptionListItemSchemaMock() }]);
+    });
+
+    test('it removes "match_any" entry items with "field" of empty string', () => {
+      const { entries, ...rest } = { ...getExceptionListItemSchemaMock() };
+      const mockEmptyException: EmptyEntry = {
+        field: '',
+        type: OperatorTypeEnum.MATCH_ANY,
+        operator: OperatorEnum.INCLUDED,
+        value: ['some value'],
+      };
+      const output: Array<
+        ExceptionListItemSchema | CreateExceptionListItemSchema
+      > = filterExceptionItems([
+        {
+          ...rest,
+          entries: [...entries, mockEmptyException],
+        },
+      ]);
+
+      expect(output).toEqual([{ ...getExceptionListItemSchemaMock() }]);
+    });
+
+    test('it removes "nested" entry items with "field" of empty string', () => {
+      const { entries, ...rest } = { ...getExceptionListItemSchemaMock() };
+      const mockEmptyException: EntryNested = {
+        field: '',
+        type: OperatorTypeEnum.NESTED,
+        entries: [{ ...getEntryMatchMock() }],
+      };
+      const output: Array<
+        ExceptionListItemSchema | CreateExceptionListItemSchema
+      > = filterExceptionItems([
+        {
+          ...rest,
+          entries: [...entries, mockEmptyException],
+        },
+      ]);
+
+      expect(output).toEqual([{ ...getExceptionListItemSchemaMock() }]);
+    });
+
     test('it removes `temporaryId` from items', () => {
       const { meta, ...rest } = getNewExceptionItem({
         listType: 'detection',
@@ -509,7 +590,7 @@ describe('Exception helpers', () => {
       });
       const exceptions = filterExceptionItems([{ ...rest, meta }]);
 
-      expect(exceptions).toEqual([{ ...rest, meta: undefined }]);
+      expect(exceptions).toEqual([{ ...rest, entries: [], meta: undefined }]);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
index 3d028431de8ff..4d8fc5f68870b 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
@@ -39,6 +39,7 @@ import {
   EntryNested,
 } from '../../../lists_plugin_deps';
 import { IFieldType, IIndexPattern } from '../../../../../../../src/plugins/data/common';
+import { validate } from '../../../../common/validate';
 import { TimelineNonEcsData } from '../../../graphql/types';
 import { WithCopyToClipboard } from '../../lib/clipboard/with_copy_to_clipboard';
 
@@ -348,11 +349,22 @@ export const filterExceptionItems = (
 ): Array<ExceptionListItemSchema | CreateExceptionListItemSchema> => {
   return exceptions.reduce<Array<ExceptionListItemSchema | CreateExceptionListItemSchema>>(
     (acc, exception) => {
-      const entries = exception.entries.filter((t) => entry.is(t) || entriesNested.is(t));
+      const entries = exception.entries.filter((t) => {
+        const [validatedEntry] = validate(t, entry);
+        const [validatedNestedEntry] = validate(t, entriesNested);
+
+        if (validatedEntry != null || validatedNestedEntry != null) {
+          return true;
+        }
+
+        return false;
+      });
+
       const item = { ...exception, entries };
+
       if (exceptionListItemSchema.is(item)) {
         return [...acc, item];
-      } else if (createExceptionListItemSchema.is(item) && item.meta != null) {
+      } else if (createExceptionListItemSchema.is(item)) {
         const { meta, ...rest } = item;
         const itemSansMetaId: CreateExceptionListItemSchema = { ...rest, meta: undefined };
         return [...acc, itemSansMetaId];
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
index d3d073efa73c1..bb8b4fb3d5ce7 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.test.ts
@@ -8,7 +8,7 @@ import { ExceptionListClient } from '../../../../../lists/server';
 import { listMock } from '../../../../../lists/server/mocks';
 import { getFoundExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/found_exception_list_item_schema.mock';
 import { getExceptionListItemSchemaMock } from '../../../../../lists/common/schemas/response/exception_list_item_schema.mock';
-import { EntriesArray, EntryList } from '../../../../../lists/common/schemas/types/entries';
+import { EntriesArray, EntryList } from '../../../../../lists/common/schemas/types';
 import { buildArtifact, getFullEndpointExceptionList } from './lists';
 import { TranslatedEntry, TranslatedExceptionListItem } from '../../schemas/artifacts';
 
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
index 68fa2a0511a48..5998a88527f2f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts
@@ -9,7 +9,7 @@ import { deflate } from 'zlib';
 import { ExceptionListItemSchema } from '../../../../../lists/common/schemas';
 import { validate } from '../../../../common/validate';
 
-import { Entry, EntryNested } from '../../../../../lists/common/schemas/types/entries';
+import { Entry, EntryNested } from '../../../../../lists/common/schemas/types';
 import { FoundExceptionListItemSchema } from '../../../../../lists/common/schemas/response/found_exception_list_item_schema';
 import { ExceptionListClient } from '../../../../../lists/server';
 import { ENDPOINT_LIST_ID } from '../../../../common/shared_imports';

From 1a1d7049e8ea14b60eb30cc85b7f19cc98a7777b Mon Sep 17 00:00:00 2001
From: Garrett Spong <spong@users.noreply.github.com>
Date: Tue, 21 Jul 2020 19:21:40 -0600
Subject: [PATCH 18/34] [Security Solution] Fixes exception modal not loading
 content (#72770)

## Summary

When using the `useFetchIndexPatterns` hook multiple times within a component (e.g. add_exception_modal & edit_exception_modal), the `apolloClient` will perform `queryDeduplication` and prevent the first query from executing. A deep compare is not performed on `indices`, so another field must be passed to circumvent this.


For all the lovely details, see https://github.com/apollographql/react-apollo/issues/2202

Note: As of yesterday, [support has been added](https://github.com/apollographql/apollo-client/pull/6526) for configuring `queryDeduplicating` via `context`. This is available in `apollo-client` `2.6`, so when upgrading (currently on `2.3.8`) we can swap out this workaround to leverage this functionality.

Note II: This [link](https://www.apollographql.com/docs/link/links/dedup/#context) may also be an option after upgrading to a supported version.
---
 .../exceptions/add_exception_modal/index.tsx           |  7 +++++--
 .../exceptions/edit_exception_modal/index.tsx          |  7 +++++--
 .../detection_engine/rules/fetch_index_patterns.tsx    | 10 +++++++++-
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
index e630645ef8c4e..6e77cd7082d56 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/add_exception_modal/index.tsx
@@ -114,9 +114,12 @@ export const AddExceptionModal = memo(function AddExceptionModal({
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
   const [
     { isLoading: isSignalIndexPatternLoading, indexPatterns: signalIndexPatterns },
-  ] = useFetchIndexPatterns(signalIndexName !== null ? [signalIndexName] : []);
+  ] = useFetchIndexPatterns(signalIndexName !== null ? [signalIndexName] : [], 'signals');
 
-  const [{ isLoading: isIndexPatternLoading, indexPatterns }] = useFetchIndexPatterns(ruleIndices);
+  const [{ isLoading: isIndexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
+    ruleIndices,
+    'rules'
+  );
 
   const onError = useCallback(
     (error: Error) => {
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
index d07a8b5f0d2f6..2d12cfbec160a 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/edit_exception_modal/index.tsx
@@ -97,9 +97,12 @@ export const EditExceptionModal = memo(function EditExceptionModal({
   const { loading: isSignalIndexLoading, signalIndexName } = useSignalIndex();
   const [
     { isLoading: isSignalIndexPatternLoading, indexPatterns: signalIndexPatterns },
-  ] = useFetchIndexPatterns(signalIndexName !== null ? [signalIndexName] : []);
+  ] = useFetchIndexPatterns(signalIndexName !== null ? [signalIndexName] : [], 'signals');
 
-  const [{ isLoading: isIndexPatternLoading, indexPatterns }] = useFetchIndexPatterns(ruleIndices);
+  const [{ isLoading: isIndexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
+    ruleIndices,
+    'rules'
+  );
 
   const onError = useCallback(
     (error) => {
diff --git a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
index 6257a9980e00c..c0997a5e62908 100644
--- a/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
+++ b/x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/fetch_index_patterns.tsx
@@ -38,7 +38,14 @@ const DEFAULT_BROWSER_FIELDS = {};
 const DEFAULT_INDEX_PATTERNS = { fields: [], title: '' };
 const DEFAULT_DOC_VALUE_FIELDS: DocValueFields[] = [];
 
-export const useFetchIndexPatterns = (defaultIndices: string[] = []): Return => {
+// Fun fact: When using this hook multiple times within a component (e.g. add_exception_modal & edit_exception_modal),
+// the apolloClient will perform queryDeduplication and prevent the first query from executing. A deep compare is not
+// performed on `indices`, so another field must be passed to circumvent this.
+// For details, see https://github.com/apollographql/react-apollo/issues/2202
+export const useFetchIndexPatterns = (
+  defaultIndices: string[] = [],
+  queryDeduplication?: string
+): Return => {
   const apolloClient = useApolloClient();
   const [indices, setIndices] = useState<string[]>(defaultIndices);
 
@@ -74,6 +81,7 @@ export const useFetchIndexPatterns = (defaultIndices: string[] = []): Return =>
             variables: {
               sourceId: 'default',
               defaultIndex: indices,
+              ...(queryDeduplication != null ? { queryDeduplication } : {}),
             },
             context: {
               fetchOptions: {

From 6f405289ecd7fea77d08633ccfe85ddfffe96621 Mon Sep 17 00:00:00 2001
From: Andrew Cholakian <andrew@andrewvc.com>
Date: Tue, 21 Jul 2020 20:36:43 -0500
Subject: [PATCH 19/34] [Uptime] Rename Whitelist to Allowlist in
 parse_filter_map (#71584)

Fixes https://github.com/elastic/kibana/issues/71583

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../components/overview/filter_group/parse_filter_map.ts      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/plugins/uptime/public/components/overview/filter_group/parse_filter_map.ts b/x-pack/plugins/uptime/public/components/overview/filter_group/parse_filter_map.ts
index 08766521799ea..47c86543c1287 100644
--- a/x-pack/plugins/uptime/public/components/overview/filter_group/parse_filter_map.ts
+++ b/x-pack/plugins/uptime/public/components/overview/filter_group/parse_filter_map.ts
@@ -14,7 +14,7 @@ interface FilterField {
  * If your code needs to support custom fields, introduce a second parameter to
  * `parseFiltersMap` to take a list of FilterField objects.
  */
-const filterWhitelist: FilterField[] = [
+const filterAllowList: FilterField[] = [
   { name: 'ports', fieldName: 'url.port' },
   { name: 'locations', fieldName: 'observer.geo.name' },
   { name: 'tags', fieldName: 'tags' },
@@ -28,7 +28,7 @@ export const parseFiltersMap = (filterMapString: string) => {
   const filterSlices: { [key: string]: any } = {};
   try {
     const map = new Map<string, string[]>(JSON.parse(filterMapString));
-    filterWhitelist.forEach(({ name, fieldName }) => {
+    filterAllowList.forEach(({ name, fieldName }) => {
       filterSlices[name] = map.get(fieldName) ?? [];
     });
     return filterSlices;

From ad65b2ce34354b59f38b44da1c7d0dd01e0aedc9 Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Wed, 22 Jul 2020 00:12:13 -0600
Subject: [PATCH 20/34] [Security Solution] Hide KQL bar (all pages) and alerts
 filters (Detections) when Resolver is full screen (#72788)

## Summary

Fixes an issue where the KQL bar (on all pages) and alerts filters (on the `Detections` page) should be hidden when Resolver is in full screen mode.

**To reproduce:**

1) Navigate to the `Detections` page
2) Enter `agent.type : endpoint` in the KQL bar to only show endpoint alerts
3) Click the `Full screen` button in the detections table

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), and `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are visible in full screen mode

4) Click the `Analyze event` button to show Resolver

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are  **NOT** visible in full screen mode **when Resolver is open**

**Actual result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (incorrectly) visible in full screen mode, per the screenshot below:

![filters-in-full-screen-mode](https://user-images.githubusercontent.com/4459398/88079205-9f565b80-cb3a-11ea-996a-fb71bf43c473.png)

5) Click the `< Back to events` button

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions become visible again

6) Press the `Esc` (Escape) key to exit Full screen mode

**Expected result**
* The KQL bar, inspect button, alerts filters (`Open | In progress | Closed`), `Showing n alerts`,  `Select all n alerts`, and `Additional filters` actions are (still) visible

## Screenshot (fixed)

The following screenshot of the fix was taken from the `Detections` page after following the reproduction steps above:

![filters-in-full-screen-mode-fixed](https://user-images.githubusercontent.com/4459398/88125154-e882cb80-cb8b-11ea-9b45-718fd9ef0844.png)
---
 .../cypress/integration/events_viewer.spec.ts |   2 +-
 .../events_viewer/events_viewer.test.tsx      | 247 ++++++++++++++++++
 .../events_viewer/events_viewer.tsx           |  26 +-
 .../filters_global/filters_global.tsx         |  19 +-
 .../components/header_section/index.test.tsx  |  24 ++
 .../alerts_filter_group/index.tsx             |   2 +-
 .../detection_engine.test.tsx                 |   1 +
 .../detection_engine/detection_engine.tsx     |  13 +-
 .../rules/details/index.test.tsx              |   1 +
 .../detection_engine/rules/details/index.tsx  |  13 +-
 .../public/hosts/pages/details/index.tsx      | 193 ++++++++------
 .../public/hosts/pages/hosts.tsx              |  29 +-
 .../public/network/pages/network.tsx          |  24 +-
 .../components/timeline/helpers.test.tsx      |  42 ++-
 .../timelines/components/timeline/helpers.tsx |  11 +
 15 files changed, 537 insertions(+), 110 deletions(-)

diff --git a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
index 84ca1e20e9576..cd4573817cc27 100644
--- a/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/events_viewer.spec.ts
@@ -153,7 +153,7 @@ describe('Events Viewer', () => {
     });
   });
 
-  context('Events columns', () => {
+  context.skip('Events columns', () => {
     before(() => {
       loginAndWaitForPage(HOSTS_URL);
       openEvents();
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 049953e21febd..833688ae57993 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -15,11 +15,17 @@ import { wait as waitFor } from '@testing-library/react';
 
 import { mockEventViewerResponse } from './mock';
 import { StatefulEventsViewer } from '.';
+import { EventsViewer } from './events_viewer';
 import { defaultHeaders } from './default_headers';
 import { useFetchIndexPatterns } from '../../../detections/containers/detection_engine/rules/fetch_index_patterns';
 import { mockBrowserFields, mockDocValueFields } from '../../containers/source/mock';
 import { eventsDefaultModel } from './default_model';
 import { useMountAppended } from '../../utils/use_mount_appended';
+import { inputsModel } from '../../store/inputs';
+import { TimelineId } from '../../../../common/types/timeline';
+import { KqlMode } from '../../../timelines/store/timeline/model';
+import { SortDirection } from '../../../timelines/components/timeline/body/sort';
+import { AlertsTableFilterGroup } from '../../../detections/components/alerts_table/alerts_filter_group';
 
 jest.mock('../../components/url_state/normalize_time_range.ts');
 
@@ -40,6 +46,39 @@ const defaultMocks = {
   isLoading: false,
 };
 
+const utilityBar = (refetch: inputsModel.Refetch, totalCount: number) => (
+  <div data-test-subj="mock-utility-bar" />
+);
+
+const eventsViewerDefaultProps = {
+  browserFields: {},
+  columns: [],
+  dataProviders: [],
+  deletedEventIds: [],
+  docValueFields: [],
+  end: to,
+  filters: [],
+  id: TimelineId.detectionsPage,
+  indexPattern: mockIndexPattern,
+  isLive: false,
+  isLoadingIndexPattern: false,
+  itemsPerPage: 10,
+  itemsPerPageOptions: [],
+  kqlMode: 'filter' as KqlMode,
+  onChangeItemsPerPage: jest.fn(),
+  query: {
+    query: '',
+    language: 'kql',
+  },
+  start: from,
+  sort: {
+    columnId: 'foo',
+    sortDirection: 'none' as SortDirection,
+  },
+  toggleColumn: jest.fn(),
+  utilityBar,
+};
+
 describe('EventsViewer', () => {
   const mount = useMountAppended();
 
@@ -213,4 +252,212 @@ describe('EventsViewer', () => {
       });
     });
   });
+
+  describe('headerFilterGroup', () => {
+    test('it renders the provided headerFilterGroup', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer
+              {...eventsViewerDefaultProps}
+              graphEventId={undefined}
+              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="alerts-table-filter-group"]`).exists()).toBe(true);
+      });
+    });
+
+    test('it has a visible HeaderFilterGroupWrapper when Resolver is NOT showing, because graphEventId is undefined', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer
+              {...eventsViewerDefaultProps}
+              graphEventId={undefined}
+              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(
+          wrapper.find(`[data-test-subj="header-filter-group-wrapper"]`).first()
+        ).not.toHaveStyleRule('visibility', 'hidden');
+      });
+    });
+
+    test('it has a visible HeaderFilterGroupWrapper when Resolver is NOT showing, because graphEventId is an empty string', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer
+              {...eventsViewerDefaultProps}
+              graphEventId=""
+              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(
+          wrapper.find(`[data-test-subj="header-filter-group-wrapper"]`).first()
+        ).not.toHaveStyleRule('visibility', 'hidden');
+      });
+    });
+
+    test('it does NOT have a visible HeaderFilterGroupWrapper when Resolver is showing, because graphEventId is a valid id', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer
+              {...eventsViewerDefaultProps}
+              graphEventId="a valid id"
+              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(
+          wrapper.find(`[data-test-subj="header-filter-group-wrapper"]`).first()
+        ).toHaveStyleRule('visibility', 'hidden');
+      });
+    });
+
+    test('it (still) renders an invisible headerFilterGroup (to maintain state while hidden) when Resolver is showing, because graphEventId is a valid id', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer
+              {...eventsViewerDefaultProps}
+              graphEventId="a valid id"
+              headerFilterGroup={<AlertsTableFilterGroup onFilterGroupChanged={jest.fn()} />}
+            />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="alerts-table-filter-group"]`).exists()).toBe(true);
+      });
+    });
+  });
+
+  describe('utilityBar', () => {
+    test('it renders the provided utilityBar when Resolver is NOT showing, because graphEventId is undefined', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="mock-utility-bar"]`).exists()).toBe(true);
+      });
+    });
+
+    test('it renders the provided utilityBar when Resolver is NOT showing, because graphEventId is an empty string', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="mock-utility-bar"]`).exists()).toBe(true);
+      });
+    });
+
+    test('it does NOT render the provided utilityBar when Resolver is showing, because graphEventId is a valid id', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="mock-utility-bar"]`).exists()).toBe(false);
+      });
+    });
+  });
+
+  describe('header inspect button', () => {
+    test('it renders the inspect button when Resolver is NOT showing, because graphEventId is undefined', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId={undefined} />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="inspect-icon-button"]`).exists()).toBe(true);
+      });
+    });
+
+    test('it renders the inspect button when Resolver is NOT showing, because graphEventId is an empty string', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId="" />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="inspect-icon-button"]`).exists()).toBe(true);
+      });
+    });
+
+    test('it does NOT render the inspect button when Resolver is showing, because graphEventId is a valid id', async () => {
+      const wrapper = mount(
+        <TestProviders>
+          <MockedProvider mocks={mockEventViewerResponse} addTypename={false}>
+            <EventsViewer {...eventsViewerDefaultProps} graphEventId="a valid id" />
+          </MockedProvider>
+        </TestProviders>
+      );
+
+      await waitFor(() => {
+        wrapper.update();
+
+        expect(wrapper.find(`[data-test-subj="inspect-icon-button"]`).exists()).toBe(false);
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index 3f474da102ca4..bc036b38524ba 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -22,7 +22,7 @@ import { StatefulBody } from '../../../timelines/components/timeline/body/statef
 import { DataProvider } from '../../../timelines/components/timeline/data_providers/data_provider';
 import { OnChangeItemsPerPage } from '../../../timelines/components/timeline/events';
 import { Footer, footerHeight } from '../../../timelines/components/timeline/footer';
-import { combineQueries } from '../../../timelines/components/timeline/helpers';
+import { combineQueries, resolverIsShowing } from '../../../timelines/components/timeline/helpers';
 import { TimelineRefetch } from '../../../timelines/components/timeline/refetch_timeline';
 import { EventDetailsWidthProvider } from './event_details_width_context';
 import * as i18n from './translations';
@@ -73,6 +73,16 @@ const EventsContainerLoading = styled.div`
   overflow: auto;
 `;
 
+/**
+ * Hides stateful headerFilterGroup implementations, but prevents the component
+ * from being unmounted, to preserve the state of the component
+ */
+const HeaderFilterGroupWrapper = styled.header<{ show: boolean }>`
+  ${({ show }) => css`
+    ${show ? '' : 'visibility: hidden;'};
+  `}
+`;
+
 interface Props {
   browserFields: BrowserFields;
   columns: ColumnHeaderOptions[];
@@ -234,14 +244,21 @@ const EventsViewerComponent: React.FC<Props> = ({
               return (
                 <>
                   <HeaderSection
-                    id={id}
+                    id={!resolverIsShowing(graphEventId) ? id : undefined}
                     height={headerFilterGroup ? COMPACT_HEADER_HEIGHT : EVENTS_VIEWER_HEADER_HEIGHT}
                     subtitle={utilityBar ? undefined : subtitle}
                     title={inspect ? justTitle : titleWithExitFullScreen}
                   >
-                    {headerFilterGroup}
+                    {headerFilterGroup && (
+                      <HeaderFilterGroupWrapper
+                        data-test-subj="header-filter-group-wrapper"
+                        show={!resolverIsShowing(graphEventId)}
+                      >
+                        {headerFilterGroup}
+                      </HeaderFilterGroupWrapper>
+                    )}
                   </HeaderSection>
-                  {utilityBar && (
+                  {utilityBar && !resolverIsShowing(graphEventId) && (
                     <UtilityBar>{utilityBar?.(refetch, totalCountMinusDeleted)}</UtilityBar>
                   )}
                   <EventsContainerLoading data-test-subj={`events-container-loading-${loading}`}>
@@ -307,6 +324,7 @@ export const EventsViewer = React.memo(
     prevProps.deletedEventIds === nextProps.deletedEventIds &&
     prevProps.end === nextProps.end &&
     deepEqual(prevProps.filters, nextProps.filters) &&
+    prevProps.headerFilterGroup === nextProps.headerFilterGroup &&
     prevProps.height === nextProps.height &&
     prevProps.id === nextProps.id &&
     deepEqual(prevProps.indexPattern, nextProps.indexPattern) &&
diff --git a/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx b/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
index 65901ec589daf..b52438486406e 100644
--- a/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
@@ -39,16 +39,27 @@ const Wrapper = styled.aside<{ isSticky?: boolean }>`
 `;
 Wrapper.displayName = 'Wrapper';
 
+const FiltersGlobalContainer = styled.header<{ show: boolean }>`
+  ${({ show }) => css`
+    ${show ? '' : 'display: none;'};
+  `}
+`;
+
+FiltersGlobalContainer.displayName = 'FiltersGlobalContainer';
+
 export interface FiltersGlobalProps {
   children: React.ReactNode;
+  show?: boolean;
 }
 
-export const FiltersGlobal = React.memo<FiltersGlobalProps>(({ children }) => (
+export const FiltersGlobal = React.memo<FiltersGlobalProps>(({ children, show = true }) => (
   <Sticky disableCompensation={disableStickyMq.matches} topOffset={-offsetChrome}>
     {({ style, isSticky }) => (
-      <Wrapper className="siemFiltersGlobal" isSticky={isSticky} style={style}>
-        {children}
-      </Wrapper>
+      <FiltersGlobalContainer show={show}>
+        <Wrapper className="siemFiltersGlobal" isSticky={isSticky} style={style}>
+          {children}
+        </Wrapper>
+      </FiltersGlobalContainer>
     )}
   </Sticky>
 ));
diff --git a/x-pack/plugins/security_solution/public/common/components/header_section/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/header_section/index.test.tsx
index b33ce22651d65..32f6216be63f2 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_section/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/header_section/index.test.tsx
@@ -131,4 +131,28 @@ describe('HeaderSection', () => {
         .exists()
     ).toBe(true);
   });
+
+  test('it renders an inspect button when an `id` is provided', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <HeaderSection id="an id" title="Test title">
+          <p>{'Test children'}</p>
+        </HeaderSection>
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="inspect-icon-button"]').first().exists()).toBe(true);
+  });
+
+  test('it does NOT an inspect button when an `id` is NOT provided', () => {
+    const wrapper = mount(
+      <TestProviders>
+        <HeaderSection title="Test title">
+          <p>{'Test children'}</p>
+        </HeaderSection>
+      </TestProviders>
+    );
+
+    expect(wrapper.find('[data-test-subj="inspect-icon-button"]').first().exists()).toBe(false);
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx
index ba64868b70817..a227d2d3c3a8e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/alerts_filter_group/index.tsx
@@ -36,7 +36,7 @@ const AlertsTableFilterGroupComponent: React.FC<Props> = ({ onFilterGroupChanged
   }, [setFilterGroup, onFilterGroupChanged]);
 
   return (
-    <EuiFilterGroup>
+    <EuiFilterGroup data-test-subj="alerts-table-filter-group">
       <EuiFilterButton
         data-test-subj="openAlerts"
         hasActiveFilters={filterGroup === FILTER_OPEN}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
index e7a8c4854fa9e..110620fad7eba 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
@@ -82,6 +82,7 @@ describe('DetectionEnginePageComponent', () => {
       <TestProviders store={store}>
         <Router history={mockHistory}>
           <DetectionEnginePageComponent
+            graphEventId={undefined}
             query={{ query: 'query', language: 'language' }}
             filters={[]}
             setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index acafb15db3448..090fdc4980933 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -51,10 +51,15 @@ import {
   MIN_EVENTS_VIEWER_BODY_HEIGHT,
 } from '../../../timelines/components/timeline/body/helpers';
 import { footerHeight } from '../../../timelines/components/timeline/footer';
+import { showGlobalFilters } from '../../../timelines/components/timeline/helpers';
+import { timelineSelectors } from '../../../timelines/store/timeline';
+import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
+import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { buildShowBuildingBlockFilter } from '../../components/alerts_table/default_config';
 
 export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
   filters,
+  graphEventId,
   query,
   setAbsoluteRangeDatePicker,
 }) => {
@@ -151,7 +156,7 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
       {indicesExist ? (
         <StickyContainer>
           <EuiWindowEvent event="resize" handler={noop} />
-          <FiltersGlobal>
+          <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
             <SiemSearchBar id="global" indexPattern={indexPattern} />
           </FiltersGlobal>
 
@@ -232,13 +237,19 @@ export const DetectionEnginePageComponent: React.FC<PropsFromRedux> = ({
 
 const makeMapStateToProps = () => {
   const getGlobalInputs = inputsSelectors.globalSelector();
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
   return (state: State) => {
     const globalInputs: InputsRange = getGlobalInputs(state);
     const { query, filters } = globalInputs;
 
+    const timeline: TimelineModel =
+      getTimeline(state, TimelineId.detectionsPage) ?? timelineDefaults;
+    const { graphEventId } = timeline;
+
     return {
       query,
       filters,
+      graphEventId,
     };
   };
 };
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
index a251c617e542a..5e6587dab1736 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
@@ -82,6 +82,7 @@ describe('RuleDetailsPageComponent', () => {
       <TestProviders store={store}>
         <Router history={mockHistory}>
           <RuleDetailsPageComponent
+            graphEventId={undefined}
             query={{ query: '', language: 'language' }}
             filters={[]}
             setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index f913cafec9a96..5832f07134936 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -92,6 +92,10 @@ import {
 import { footerHeight } from '../../../../../timelines/components/timeline/footer';
 import { isMlRule } from '../../../../../../common/machine_learning/helpers';
 import { isThresholdRule } from '../../../../../../common/detection_engine/utils';
+import { showGlobalFilters } from '../../../../../timelines/components/timeline/helpers';
+import { timelineSelectors } from '../../../../../timelines/store/timeline';
+import { timelineDefaults } from '../../../../../timelines/store/timeline/defaults';
+import { TimelineModel } from '../../../../../timelines/store/timeline/model';
 
 enum RuleDetailTabs {
   alerts = 'alerts',
@@ -122,6 +126,7 @@ const getRuleDetailsTabs = (rule: Rule | null) => {
 
 export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
   filters,
+  graphEventId,
   query,
   setAbsoluteRangeDatePicker,
 }) => {
@@ -351,7 +356,7 @@ export const RuleDetailsPageComponent: FC<PropsFromRedux> = ({
       {indicesExist ? (
         <StickyContainer>
           <EuiWindowEvent event="resize" handler={noop} />
-          <FiltersGlobal>
+          <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
             <SiemSearchBar id="global" indexPattern={indexPattern} />
           </FiltersGlobal>
 
@@ -541,13 +546,19 @@ RuleDetailsPageComponent.displayName = 'RuleDetailsPageComponent';
 
 const makeMapStateToProps = () => {
   const getGlobalInputs = inputsSelectors.globalSelector();
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
   return (state: State) => {
     const globalInputs: InputsRange = getGlobalInputs(state);
     const { query, filters } = globalInputs;
 
+    const timeline: TimelineModel =
+      getTimeline(state, TimelineId.detectionsRulesDetailsPage) ?? timelineDefaults;
+    const { graphEventId } = timeline;
+
     return {
       query,
       filters,
+      graphEventId,
     };
   };
 };
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
index 447d003625c8f..781aa711ff0d9 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiHorizontalRule, EuiSpacer } from '@elastic/eui';
+import { EuiHorizontalRule, EuiSpacer, EuiWindowEvent } from '@elastic/eui';
+import { noop } from 'lodash/fp';
 import React, { useEffect, useCallback, useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 import { StickyContainer } from 'react-sticky';
@@ -44,6 +45,13 @@ import { navTabsHostDetails } from './nav_tabs';
 import { HostDetailsProps } from './types';
 import { type } from './utils';
 import { getHostDetailsPageFilters } from './helpers';
+import { showGlobalFilters } from '../../../timelines/components/timeline/helpers';
+import { useFullScreen } from '../../../common/containers/use_full_screen';
+import { Display } from '../display';
+import { timelineSelectors } from '../../../timelines/store/timeline';
+import { TimelineModel } from '../../../timelines/store/timeline/model';
+import { TimelineId } from '../../../../common/types/timeline';
+import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 
 const HostOverviewManage = manageQuery(HostOverview);
 const KpiHostDetailsManage = manageQuery(KpiHostsComponent);
@@ -51,6 +59,7 @@ const KpiHostDetailsManage = manageQuery(KpiHostsComponent);
 const HostDetailsComponent = React.memo<HostDetailsProps & PropsFromRedux>(
   ({
     filters,
+    graphEventId,
     query,
     setAbsoluteRangeDatePicker,
     setHostDetailsTablesActivePageToZero,
@@ -58,6 +67,7 @@ const HostDetailsComponent = React.memo<HostDetailsProps & PropsFromRedux>(
     hostDetailsPagePath,
   }) => {
     const { to, from, deleteQuery, setQuery, isInitializing } = useGlobalTime();
+    const { globalFullScreen } = useFullScreen();
     useEffect(() => {
       setHostDetailsTablesActivePageToZero();
     }, [setHostDetailsTablesActivePageToZero, detailName]);
@@ -93,90 +103,93 @@ const HostDetailsComponent = React.memo<HostDetailsProps & PropsFromRedux>(
       <>
         {indicesExist ? (
           <StickyContainer>
-            <FiltersGlobal>
+            <EuiWindowEvent event="resize" handler={noop} />
+            <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
               <SiemSearchBar indexPattern={indexPattern} id="global" />
             </FiltersGlobal>
 
-            <WrapperPage>
-              <HeaderPage
-                border
-                subtitle={
-                  <LastEventTime indexKey={LastEventIndexKey.hostDetails} hostName={detailName} />
-                }
-                title={detailName}
-              />
-
-              <HostOverviewByNameQuery
-                sourceId="default"
-                hostName={detailName}
-                skip={isInitializing}
-                startDate={from}
-                endDate={to}
-              >
-                {({ hostOverview, loading, id, inspect, refetch }) => (
-                  <AnomalyTableProvider
-                    criteriaFields={hostToCriteria(hostOverview)}
-                    startDate={from}
-                    endDate={to}
-                    skip={isInitializing}
-                  >
-                    {({ isLoadingAnomaliesData, anomaliesData }) => (
-                      <HostOverviewManage
-                        id={id}
-                        inspect={inspect}
-                        refetch={refetch}
-                        setQuery={setQuery}
-                        data={hostOverview}
-                        anomaliesData={anomaliesData}
-                        isLoadingAnomaliesData={isLoadingAnomaliesData}
-                        loading={loading}
-                        startDate={from}
-                        endDate={to}
-                        narrowDateRange={(score, interval) => {
-                          const fromTo = scoreIntervalToDateTime(score, interval);
-                          setAbsoluteRangeDatePicker({
-                            id: 'global',
-                            from: fromTo.from,
-                            to: fromTo.to,
-                          });
-                        }}
-                      />
-                    )}
-                  </AnomalyTableProvider>
-                )}
-              </HostOverviewByNameQuery>
-
-              <EuiHorizontalRule />
-
-              <KpiHostDetailsQuery
-                sourceId="default"
-                filterQuery={filterQuery}
-                skip={isInitializing}
-                startDate={from}
-                endDate={to}
-              >
-                {({ kpiHostDetails, id, inspect, loading, refetch }) => (
-                  <KpiHostDetailsManage
-                    data={kpiHostDetails}
-                    from={from}
-                    id={id}
-                    inspect={inspect}
-                    loading={loading}
-                    refetch={refetch}
-                    setQuery={setQuery}
-                    to={to}
-                    narrowDateRange={narrowDateRange}
-                  />
-                )}
-              </KpiHostDetailsQuery>
-
-              <EuiSpacer />
-
-              <SiemNavigation
-                navTabs={navTabsHostDetails(detailName, hasMlUserPermissions(capabilities))}
-              />
-
-              <EuiSpacer />
+            <WrapperPage noPadding={globalFullScreen}>
+              <Display show={!globalFullScreen}>
+                <HeaderPage
+                  border
+                  subtitle={
+                    <LastEventTime indexKey={LastEventIndexKey.hostDetails} hostName={detailName} />
+                  }
+                  title={detailName}
+                />
+
+                <HostOverviewByNameQuery
+                  sourceId="default"
+                  hostName={detailName}
+                  skip={isInitializing}
+                  startDate={from}
+                  endDate={to}
+                >
+                  {({ hostOverview, loading, id, inspect, refetch }) => (
+                    <AnomalyTableProvider
+                      criteriaFields={hostToCriteria(hostOverview)}
+                      startDate={from}
+                      endDate={to}
+                      skip={isInitializing}
+                    >
+                      {({ isLoadingAnomaliesData, anomaliesData }) => (
+                        <HostOverviewManage
+                          id={id}
+                          inspect={inspect}
+                          refetch={refetch}
+                          setQuery={setQuery}
+                          data={hostOverview}
+                          anomaliesData={anomaliesData}
+                          isLoadingAnomaliesData={isLoadingAnomaliesData}
+                          loading={loading}
+                          startDate={from}
+                          endDate={to}
+                          narrowDateRange={(score, interval) => {
+                            const fromTo = scoreIntervalToDateTime(score, interval);
+                            setAbsoluteRangeDatePicker({
+                              id: 'global',
+                              from: fromTo.from,
+                              to: fromTo.to,
+                            });
+                          }}
+                        />
+                      )}
+                    </AnomalyTableProvider>
+                  )}
+                </HostOverviewByNameQuery>
+
+                <EuiHorizontalRule />
+
+                <KpiHostDetailsQuery
+                  sourceId="default"
+                  filterQuery={filterQuery}
+                  skip={isInitializing}
+                  startDate={from}
+                  endDate={to}
+                >
+                  {({ kpiHostDetails, id, inspect, loading, refetch }) => (
+                    <KpiHostDetailsManage
+                      data={kpiHostDetails}
+                      from={from}
+                      id={id}
+                      inspect={inspect}
+                      loading={loading}
+                      refetch={refetch}
+                      setQuery={setQuery}
+                      to={to}
+                      narrowDateRange={narrowDateRange}
+                    />
+                  )}
+                </KpiHostDetailsQuery>
+
+                <EuiSpacer />
+
+                <SiemNavigation
+                  navTabs={navTabsHostDetails(detailName, hasMlUserPermissions(capabilities))}
+                />
+
+                <EuiSpacer />
+              </Display>
 
               <HostDetailsTabs
                 docValueFields={docValueFields}
@@ -213,10 +226,18 @@ HostDetailsComponent.displayName = 'HostDetailsComponent';
 export const makeMapStateToProps = () => {
   const getGlobalQuerySelector = inputsSelectors.globalQuerySelector();
   const getGlobalFiltersQuerySelector = inputsSelectors.globalFiltersQuerySelector();
-  return (state: State) => ({
-    query: getGlobalQuerySelector(state),
-    filters: getGlobalFiltersQuerySelector(state),
-  });
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
+  return (state: State) => {
+    const timeline: TimelineModel =
+      getTimeline(state, TimelineId.hostsPageEvents) ?? timelineDefaults;
+    const { graphEventId } = timeline;
+
+    return {
+      query: getGlobalQuerySelector(state),
+      filters: getGlobalFiltersQuerySelector(state),
+      graphEventId,
+    };
+  };
 };
 
 const mapDispatchToProps = {
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
index a3885eac5377c..1219effa5ff6d 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
@@ -26,6 +26,7 @@ import { KpiHostsQuery } from '../containers/kpi_hosts';
 import { useFullScreen } from '../../common/containers/use_full_screen';
 import { useGlobalTime } from '../../common/containers/use_global_time';
 import { useWithSource } from '../../common/containers/source';
+import { TimelineId } from '../../../common/types/timeline';
 import { LastEventIndexKey } from '../../graphql/types';
 import { useKibana } from '../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../common/lib/keury';
@@ -44,11 +45,15 @@ import { HostsComponentProps } from './types';
 import { filterHostData } from './navigation';
 import { hostsModel } from '../store';
 import { HostsTableType } from '../store/model';
+import { showGlobalFilters } from '../../timelines/components/timeline/helpers';
+import { timelineSelectors } from '../../timelines/store/timeline';
+import { timelineDefaults } from '../../timelines/store/timeline/defaults';
+import { TimelineModel } from '../../timelines/store/timeline/model';
 
 const KpiHostsComponentManage = manageQuery(KpiHostsComponent);
 
 export const HostsComponent = React.memo<HostsComponentProps & PropsFromRedux>(
-  ({ filters, query, setAbsoluteRangeDatePicker, hostsPagePath }) => {
+  ({ filters, graphEventId, query, setAbsoluteRangeDatePicker, hostsPagePath }) => {
     const { to, from, deleteQuery, setQuery, isInitializing } = useGlobalTime();
     const { globalFullScreen } = useFullScreen();
     const capabilities = useMlCapabilities();
@@ -93,7 +98,7 @@ export const HostsComponent = React.memo<HostsComponentProps & PropsFromRedux>(
         {indicesExist ? (
           <StickyContainer>
             <EuiWindowEvent event="resize" handler={noop} />
-            <FiltersGlobal>
+            <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
               <SiemSearchBar indexPattern={indexPattern} id="global" />
             </FiltersGlobal>
 
@@ -167,10 +172,22 @@ HostsComponent.displayName = 'HostsComponent';
 const makeMapStateToProps = () => {
   const getGlobalQuerySelector = inputsSelectors.globalQuerySelector();
   const getGlobalFiltersQuerySelector = inputsSelectors.globalFiltersQuerySelector();
-  const mapStateToProps = (state: State) => ({
-    query: getGlobalQuerySelector(state),
-    filters: getGlobalFiltersQuerySelector(state),
-  });
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
+  const mapStateToProps = (state: State) => {
+    const hostsPageEventsTimeline: TimelineModel =
+      getTimeline(state, TimelineId.hostsPageEvents) ?? timelineDefaults;
+    const { graphEventId: hostsPageEventsGraphEventId } = hostsPageEventsTimeline;
+
+    const hostsPageExternalAlertsTimeline: TimelineModel =
+      getTimeline(state, TimelineId.hostsPageExternalAlerts) ?? timelineDefaults;
+    const { graphEventId: hostsPageExternalAlertsGraphEventId } = hostsPageExternalAlertsTimeline;
+
+    return {
+      query: getGlobalQuerySelector(state),
+      filters: getGlobalFiltersQuerySelector(state),
+      graphEventId: hostsPageEventsGraphEventId ?? hostsPageExternalAlertsGraphEventId,
+    };
+  };
 
   return mapStateToProps;
 };
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.tsx b/x-pack/plugins/security_solution/public/network/pages/network.tsx
index 0def110c45a14..ca8da4eb711e5 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.tsx
@@ -41,6 +41,11 @@ import { OverviewEmpty } from '../../overview/components/overview_empty';
 import * as i18n from './translations';
 import { NetworkComponentProps } from './types';
 import { NetworkRouteType } from './navigation/types';
+import { showGlobalFilters } from '../../timelines/components/timeline/helpers';
+import { timelineSelectors } from '../../timelines/store/timeline';
+import { TimelineId } from '../../../common/types/timeline';
+import { timelineDefaults } from '../../timelines/store/timeline/defaults';
+import { TimelineModel } from '../../timelines/store/timeline/model';
 
 const KpiNetworkComponentManage = manageQuery(KpiNetworkComponent);
 const sourceId = 'default';
@@ -48,6 +53,7 @@ const sourceId = 'default';
 const NetworkComponent = React.memo<NetworkComponentProps & PropsFromRedux>(
   ({
     filters,
+    graphEventId,
     query,
     setAbsoluteRangeDatePicker,
     networkPagePath,
@@ -100,7 +106,7 @@ const NetworkComponent = React.memo<NetworkComponentProps & PropsFromRedux>(
         {indicesExist ? (
           <StickyContainer>
             <EuiWindowEvent event="resize" handler={noop} />
-            <FiltersGlobal>
+            <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
               <SiemSearchBar indexPattern={indexPattern} id="global" />
             </FiltersGlobal>
 
@@ -189,10 +195,18 @@ NetworkComponent.displayName = 'NetworkComponent';
 const makeMapStateToProps = () => {
   const getGlobalQuerySelector = inputsSelectors.globalQuerySelector();
   const getGlobalFiltersQuerySelector = inputsSelectors.globalFiltersQuerySelector();
-  const mapStateToProps = (state: State) => ({
-    query: getGlobalQuerySelector(state),
-    filters: getGlobalFiltersQuerySelector(state),
-  });
+  const getTimeline = timelineSelectors.getTimelineByIdSelector();
+  const mapStateToProps = (state: State) => {
+    const timeline: TimelineModel =
+      getTimeline(state, TimelineId.networkPageExternalAlerts) ?? timelineDefaults;
+    const { graphEventId } = timeline;
+
+    return {
+      query: getGlobalQuerySelector(state),
+      filters: getGlobalFiltersQuerySelector(state),
+      graphEventId,
+    };
+  };
   return mapStateToProps;
 };
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
index c371d1862be72..21b96dfe4118d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.test.tsx
@@ -9,7 +9,7 @@ import { mockIndexPattern } from '../../../common/mock';
 
 import { DataProviderType } from './data_providers/data_provider';
 import { mockDataProviders } from './data_providers/mock/mock_data_providers';
-import { buildGlobalQuery, combineQueries } from './helpers';
+import { buildGlobalQuery, combineQueries, resolverIsShowing, showGlobalFilters } from './helpers';
 import { mockBrowserFields } from '../../../common/containers/source/mock';
 import { EsQueryConfig, Filter, esFilters } from '../../../../../../../src/plugins/data/public';
 
@@ -500,4 +500,44 @@ describe('Combined Queries', () => {
       '{"bool":{"must":[],"filter":[{"bool":{"filter":[{"bool":{"should":[{"bool":{"filter":[{"bool":{"should":[{"match_phrase":{"name":"Provider 1"}}],"minimum_should_match":1}},{"bool":{"filter":[{"bool":{"should":[{"match_phrase":{"name":"Provider 3"}}],"minimum_should_match":1}},{"bool":{"should":[{"match_phrase":{"name":"Provider 4"}}],"minimum_should_match":1}}]}}]}},{"bool":{"filter":[{"bool":{"should":[{"match_phrase":{"name":"Provider 2"}}],"minimum_should_match":1}},{"bool":{"should":[{"match_phrase":{"name":"Provider 5"}}],"minimum_should_match":1}}]}}],"minimum_should_match":1}},{"bool":{"should":[{"match_phrase":{"host.name":"host-1"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}'
     );
   });
+
+  describe('resolverIsShowing', () => {
+    test('it returns true when graphEventId is NOT an empty string', () => {
+      expect(resolverIsShowing('a valid id')).toBe(true);
+    });
+
+    test('it returns false when graphEventId is undefined', () => {
+      expect(resolverIsShowing(undefined)).toBe(false);
+    });
+
+    test('it returns false when graphEventId is an empty string', () => {
+      expect(resolverIsShowing('')).toBe(false);
+    });
+  });
+
+  describe('showGlobalFilters', () => {
+    test('it returns false when `globalFullScreen` is true and `graphEventId` is NOT an empty string, because Resolver IS showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: true, graphEventId: 'a valid id' })).toBe(false);
+    });
+
+    test('it returns true when `globalFullScreen` is true and `graphEventId` is undefined, because Resolver is NOT showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: true, graphEventId: undefined })).toBe(true);
+    });
+
+    test('it returns true when `globalFullScreen` is true and `graphEventId` is an empty string, because Resolver is NOT showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: true, graphEventId: '' })).toBe(true);
+    });
+
+    test('it returns true when `globalFullScreen` is false and `graphEventId` is NOT an empty string, because Resolver IS showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: false, graphEventId: 'a valid id' })).toBe(true);
+    });
+
+    test('it returns true when `globalFullScreen` is false and `graphEventId` is undefined, because Resolver is NOT showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: false, graphEventId: undefined })).toBe(true);
+    });
+
+    test('it returns true when `globalFullScreen` is false and `graphEventId` is an empty string, because Resolver is NOT showing', () => {
+      expect(showGlobalFilters({ globalFullScreen: false, graphEventId: '' })).toBe(true);
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
index b21ea3e4f86e9..84387720b5b11 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
@@ -158,3 +158,14 @@ export const combineQueries = ({
 export const STATEFUL_EVENT_CSS_CLASS_NAME = 'event-column-view';
 
 export const DEFAULT_ICON_BUTTON_WIDTH = 24;
+
+export const resolverIsShowing = (graphEventId: string | undefined): boolean =>
+  graphEventId != null && graphEventId !== '';
+
+export const showGlobalFilters = ({
+  globalFullScreen,
+  graphEventId,
+}: {
+  globalFullScreen: boolean;
+  graphEventId: string | undefined;
+}): boolean => (globalFullScreen && resolverIsShowing(graphEventId) ? false : true);

From 47eaf604bba91de195dbae06f79da1c7bb5ae105 Mon Sep 17 00:00:00 2001
From: Pierre Gayvallet <pierre.gayvallet@elastic.co>
Date: Wed, 22 Jul 2020 09:25:53 +0200
Subject: [PATCH 21/34] fix preAuth/preRouting mocks (#72663)

---
 src/core/server/http/http_server.mocks.ts |  7 ++++++-
 src/core/server/http/http_service.mock.ts | 10 ++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/core/server/http/http_server.mocks.ts b/src/core/server/http/http_server.mocks.ts
index 7d37af833d4c1..ba6662db3655e 100644
--- a/src/core/server/http/http_server.mocks.ts
+++ b/src/core/server/http/http_server.mocks.ts
@@ -89,7 +89,12 @@ function createKibanaRequestMock<P = any, Q = any, B = any>({
         settings: { tags: routeTags, auth: routeAuthRequired, app: kibanaRouteState },
       },
       raw: {
-        req: { socket },
+        req: {
+          socket,
+          // these are needed to avoid an error when consuming KibanaRequest.events
+          on: jest.fn(),
+          off: jest.fn(),
+        },
       },
     }),
     {
diff --git a/src/core/server/http/http_service.mock.ts b/src/core/server/http/http_service.mock.ts
index 51f11b15f2e09..676cee1954c59 100644
--- a/src/core/server/http/http_service.mock.ts
+++ b/src/core/server/http/http_service.mock.ts
@@ -33,6 +33,7 @@ import { OnPreRoutingToolkit } from './lifecycle/on_pre_routing';
 import { AuthToolkit } from './lifecycle/auth';
 import { sessionStorageMock } from './cookie_session_storage.mocks';
 import { OnPostAuthToolkit } from './lifecycle/on_post_auth';
+import { OnPreAuthToolkit } from './lifecycle/on_pre_auth';
 import { OnPreResponseToolkit } from './lifecycle/on_pre_response';
 
 type BasePathMocked = jest.Mocked<InternalHttpServiceSetup['basePath']>;
@@ -175,15 +176,19 @@ const createHttpServiceMock = () => {
   return mocked;
 };
 
-const createOnPreAuthToolkitMock = (): jest.Mocked<OnPreRoutingToolkit> => ({
+const createOnPreAuthToolkitMock = (): jest.Mocked<OnPreAuthToolkit> => ({
   next: jest.fn(),
-  rewriteUrl: jest.fn(),
 });
 
 const createOnPostAuthToolkitMock = (): jest.Mocked<OnPostAuthToolkit> => ({
   next: jest.fn(),
 });
 
+const createOnPreRoutingToolkitMock = (): jest.Mocked<OnPreRoutingToolkit> => ({
+  next: jest.fn(),
+  rewriteUrl: jest.fn(),
+});
+
 const createAuthToolkitMock = (): jest.Mocked<AuthToolkit> => ({
   authenticated: jest.fn(),
   notHandled: jest.fn(),
@@ -205,6 +210,7 @@ export const httpServiceMock = {
   createOnPreAuthToolkit: createOnPreAuthToolkitMock,
   createOnPostAuthToolkit: createOnPostAuthToolkitMock,
   createOnPreResponseToolkit: createOnPreResponseToolkitMock,
+  createOnPreRoutingToolkit: createOnPreRoutingToolkitMock,
   createAuthToolkit: createAuthToolkitMock,
   createRouter: mockRouter.create,
 };

From a93c327e9deb35d13dcb56361d3ad3d2c55c65c3 Mon Sep 17 00:00:00 2001
From: Pete Harverson <peteharverson@users.noreply.github.com>
Date: Wed, 22 Jul 2020 09:30:13 +0100
Subject: [PATCH 22/34] [ML] Fix layout of anomaly chart tooltip for long field
 values (#72689)

---
 .../components/chart_tooltip/_chart_tooltip.scss   |  5 -----
 .../components/chart_tooltip/chart_tooltip.tsx     | 14 ++++++++++++--
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/x-pack/plugins/ml/public/application/components/chart_tooltip/_chart_tooltip.scss b/x-pack/plugins/ml/public/application/components/chart_tooltip/_chart_tooltip.scss
index 25bf3597c3466..46e5d91e1cc83 100644
--- a/x-pack/plugins/ml/public/application/components/chart_tooltip/_chart_tooltip.scss
+++ b/x-pack/plugins/ml/public/application/components/chart_tooltip/_chart_tooltip.scss
@@ -25,15 +25,10 @@
   }
 
   &__label {
-    overflow-wrap: break-word;
-    word-wrap: break-word;
     min-width: 1px;
-    flex: 1 1 auto;
   }
 
   &__value {
-    overflow-wrap: break-word;
-    word-wrap: break-word;
     font-weight: $euiFontWeightBold;
     text-align: right;
     font-feature-settings: 'tnum';
diff --git a/x-pack/plugins/ml/public/application/components/chart_tooltip/chart_tooltip.tsx b/x-pack/plugins/ml/public/application/components/chart_tooltip/chart_tooltip.tsx
index 7897ef5cad0df..3bd4ae1748311 100644
--- a/x-pack/plugins/ml/public/application/components/chart_tooltip/chart_tooltip.tsx
+++ b/x-pack/plugins/ml/public/application/components/chart_tooltip/chart_tooltip.tsx
@@ -7,6 +7,7 @@
 import React, { FC, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import classNames from 'classnames';
 import TooltipTrigger from 'react-popper-tooltip';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { TooltipValueFormatter } from '@elastic/charts';
 
 import './_index.scss';
@@ -79,8 +80,17 @@ const Tooltip: FC<{ service: ChartTooltipService }> = React.memo(({ service }) =
                         borderLeftColor: color,
                       }}
                     >
-                      <span className="mlChartTooltip__label">{label}</span>
-                      <span className="mlChartTooltip__value">{value}</span>
+                      <EuiFlexGroup>
+                        <EuiFlexItem
+                          className="eui-textBreakWord mlChartTooltip__label"
+                          grow={false}
+                        >
+                          {label}
+                        </EuiFlexItem>
+                        <EuiFlexItem className="eui-textBreakAll mlChartTooltip__value">
+                          {value}
+                        </EuiFlexItem>
+                      </EuiFlexGroup>
                     </div>
                   );
                 })}

From 1810dd1fe78777652985361814228a27c00d3a5c Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 11:25:41 +0200
Subject: [PATCH 23/34] Unskip vislib tests (#71452)

---
 .../value_axis_options.test.tsx.snap          |   2 +-
 .../metrics_axes/value_axis_options.tsx       |   2 +-
 test/functional/apps/visualize/_area_chart.js |  62 +-
 test/functional/apps/visualize/_line_chart.js |  62 +-
 .../apps/visualize/_vertical_bar_chart.js     | 933 +++++++++---------
 .../_vertical_bar_chart_nontimeindex.js       |  66 +-
 .../page_objects/visualize_chart_page.ts      |   4 +
 7 files changed, 493 insertions(+), 638 deletions(-)

diff --git a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
index b89d193c7c751..36f5480e85406 100644
--- a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
+++ b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/value_axis_options.test.tsx.snap
@@ -102,7 +102,7 @@ exports[`ValueAxisOptions component should init with the default set of props 1`
     value=""
   />
   <LabelOptions
-    axisFilterCheckboxName="yAxisFilterLabelsCheckboxValueAxis-1"
+    axisFilterCheckboxName="yAxisFilterLabelsCheckbox-ValueAxis-1"
     axisLabels={
       Object {
         "color": "black",
diff --git a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/value_axis_options.tsx b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/value_axis_options.tsx
index 52962fe813b44..b42d038267d77 100644
--- a/src/plugins/vis_type_vislib/public/components/options/metrics_axes/value_axis_options.tsx
+++ b/src/plugins/vis_type_vislib/public/components/options/metrics_axes/value_axis_options.tsx
@@ -187,7 +187,7 @@ function ValueAxisOptions({
 
           <LabelOptions
             axisLabels={axis.labels}
-            axisFilterCheckboxName={`yAxisFilterLabelsCheckbox${axis.id}`}
+            axisFilterCheckboxName={`yAxisFilterLabelsCheckbox-${axis.id}`}
             setAxisLabel={setAxisLabel}
           />
         </>
diff --git a/test/functional/apps/visualize/_area_chart.js b/test/functional/apps/visualize/_area_chart.js
index 41e56986f677b..4321f0df89250 100644
--- a/test/functional/apps/visualize/_area_chart.js
+++ b/test/functional/apps/visualize/_area_chart.js
@@ -298,7 +298,7 @@ export default function ({ getService, getPageObjects }) {
       });
     });
 
-    describe.skip('switch between Y axis scale types', () => {
+    describe('switch between Y axis scale types', () => {
       before(initAreaChart);
       const axisId = 'ValueAxis-1';
 
@@ -308,57 +308,25 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.visEditor.selectYAxisScaleType(axisId, 'log');
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show filtered ticks on selecting log scale', async () => {
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show ticks on selecting square root scale', async () => {
diff --git a/test/functional/apps/visualize/_line_chart.js b/test/functional/apps/visualize/_line_chart.js
index a492f3858b524..24e4ef4a7fe25 100644
--- a/test/functional/apps/visualize/_line_chart.js
+++ b/test/functional/apps/visualize/_line_chart.js
@@ -181,7 +181,7 @@ export default function ({ getService, getPageObjects }) {
       await PageObjects.visChart.waitForVisualization();
     });
 
-    describe.skip('switch between Y axis scale types', () => {
+    describe('switch between Y axis scale types', () => {
       before(initLineChart);
       const axisId = 'ValueAxis-1';
 
@@ -191,57 +191,25 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.visEditor.selectYAxisScaleType(axisId, 'log');
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show filtered ticks on selecting log scale', async () => {
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show ticks on selecting square root scale', async () => {
diff --git a/test/functional/apps/visualize/_vertical_bar_chart.js b/test/functional/apps/visualize/_vertical_bar_chart.js
index f1d83908b9b6d..ff0423eb531da 100644
--- a/test/functional/apps/visualize/_vertical_bar_chart.js
+++ b/test/functional/apps/visualize/_vertical_bar_chart.js
@@ -28,19 +28,28 @@ export default function ({ getService, getPageObjects }) {
   const PageObjects = getPageObjects(['visualize', 'visEditor', 'visChart', 'timePicker']);
 
   describe('vertical bar chart', function () {
+    const vizName1 = 'Visualization VerticalBarChart';
+
+    const initBarChart = async () => {
+      log.debug('navigateToApp visualize');
+      await PageObjects.visualize.navigateToNewVisualization();
+      log.debug('clickVerticalBarChart');
+      await PageObjects.visualize.clickVerticalBarChart();
+      await PageObjects.visualize.clickNewSearch();
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
+      log.debug('Bucket = X-Axis');
+      await PageObjects.visEditor.clickBucket('X-axis');
+      log.debug('Aggregation = Date Histogram');
+      await PageObjects.visEditor.selectAggregation('Date Histogram');
+      log.debug('Field = @timestamp');
+      await PageObjects.visEditor.selectField('@timestamp');
+      // leaving Interval set to Auto
+      await PageObjects.visEditor.clickGo();
+    };
+
     describe('bar charts x axis tick labels', () => {
       it('should show tick labels also after rotation of the chart', async function () {
-        await PageObjects.visualize.navigateToNewVisualization();
-        await PageObjects.visualize.clickVerticalBarChart();
-        await PageObjects.visualize.clickNewSearch();
-        await PageObjects.timePicker.setDefaultAbsoluteRange();
-        await PageObjects.visEditor.clickBucket('X-axis');
-        log.debug('Aggregation = Date Histogram');
-        await PageObjects.visEditor.selectAggregation('Date Histogram');
-        log.debug('Field = @timestamp');
-        await PageObjects.visEditor.selectField('@timestamp');
-        // leaving Interval set to Auto
-        await PageObjects.visEditor.clickGo();
+        await initBarChart();
         const bottomLabels = await PageObjects.visChart.getXAxisLabels();
         log.debug(`${bottomLabels.length} tick labels on bottom x axis`);
 
@@ -62,6 +71,7 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.visEditor.clickBucket('X-axis');
         await PageObjects.visEditor.selectAggregation('Date Range');
         await PageObjects.visEditor.selectField('@timestamp');
+
         await PageObjects.visEditor.clickGo();
         const bottomLabels = await PageObjects.visChart.getXAxisLabels();
         expect(bottomLabels.length).to.be(1);
@@ -95,519 +105,456 @@ export default function ({ getService, getPageObjects }) {
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/22322
-    describe.skip('vertical bar chart flaky part', function () {
-      const vizName1 = 'Visualization VerticalBarChart';
+    it('should save and load', async function () {
+      await initBarChart();
+      await PageObjects.visualize.saveVisualizationExpectSuccessAndBreadcrumb(vizName1);
 
-      const initBarChart = async () => {
-        log.debug('navigateToApp visualize');
-        await PageObjects.visualize.navigateToNewVisualization();
-        log.debug('clickVerticalBarChart');
-        await PageObjects.visualize.clickVerticalBarChart();
-        await PageObjects.visualize.clickNewSearch();
-        await PageObjects.timePicker.setDefaultAbsoluteRange();
-        log.debug('Bucket = X-Axis');
-        await PageObjects.visEditor.clickBucket('X-axis');
-        log.debug('Aggregation = Date Histogram');
-        await PageObjects.visEditor.selectAggregation('Date Histogram');
-        log.debug('Field = @timestamp');
-        await PageObjects.visEditor.selectField('@timestamp');
-        // leaving Interval set to Auto
-        await PageObjects.visEditor.clickGo();
-      };
+      await PageObjects.visualize.loadSavedVisualization(vizName1);
+      await PageObjects.visChart.waitForVisualization();
+    });
 
-      before(initBarChart);
+    it('should have inspector enabled', async function () {
+      await inspector.expectIsEnabled();
+    });
 
-      it('should save and load', async function () {
-        await PageObjects.visualize.saveVisualizationExpectSuccessAndBreadcrumb(vizName1);
+    it('should show correct chart', async function () {
+      const expectedChartValues = [
+        37,
+        202,
+        740,
+        1437,
+        1371,
+        751,
+        188,
+        31,
+        42,
+        202,
+        683,
+        1361,
+        1415,
+        707,
+        177,
+        27,
+        32,
+        175,
+        707,
+        1408,
+        1355,
+        726,
+        201,
+        29,
+      ];
+
+      // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
+      // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
+      // try sleeping a bit before getting that data
+      await retry.try(async () => {
+        const data = await PageObjects.visChart.getBarChartData();
+        log.debug('data=' + data);
+        log.debug('data.length=' + data.length);
+        expect(data).to.eql(expectedChartValues);
+      });
+    });
 
-        await PageObjects.visualize.loadSavedVisualization(vizName1);
-        await PageObjects.visChart.waitForVisualization();
+    it('should show correct data', async function () {
+      // this is only the first page of the tabular data.
+      const expectedChartData = [
+        ['2015-09-20 00:00', '37'],
+        ['2015-09-20 03:00', '202'],
+        ['2015-09-20 06:00', '740'],
+        ['2015-09-20 09:00', '1,437'],
+        ['2015-09-20 12:00', '1,371'],
+        ['2015-09-20 15:00', '751'],
+        ['2015-09-20 18:00', '188'],
+        ['2015-09-20 21:00', '31'],
+        ['2015-09-21 00:00', '42'],
+        ['2015-09-21 03:00', '202'],
+        ['2015-09-21 06:00', '683'],
+        ['2015-09-21 09:00', '1,361'],
+        ['2015-09-21 12:00', '1,415'],
+        ['2015-09-21 15:00', '707'],
+        ['2015-09-21 18:00', '177'],
+        ['2015-09-21 21:00', '27'],
+        ['2015-09-22 00:00', '32'],
+        ['2015-09-22 03:00', '175'],
+        ['2015-09-22 06:00', '707'],
+        ['2015-09-22 09:00', '1,408'],
+      ];
+
+      await inspector.open();
+      await inspector.expectTableData(expectedChartData);
+      await inspector.close();
+    });
+
+    it('should have `drop partial buckets` option', async () => {
+      const fromTime = 'Sep 20, 2015 @ 06:31:44.000';
+      const toTime = 'Sep 22, 2015 @ 18:31:44.000';
+
+      await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
+
+      let expectedChartValues = [
+        82,
+        218,
+        341,
+        440,
+        480,
+        517,
+        522,
+        446,
+        403,
+        321,
+        258,
+        172,
+        95,
+        55,
+        38,
+        24,
+        3,
+        4,
+        11,
+        14,
+        17,
+        38,
+        49,
+        115,
+        152,
+        216,
+        315,
+        402,
+        446,
+        513,
+        520,
+        474,
+        421,
+        307,
+        230,
+        170,
+        99,
+        48,
+        30,
+        15,
+        10,
+        2,
+        8,
+        7,
+        17,
+        34,
+        37,
+        104,
+        153,
+        241,
+        313,
+        404,
+        492,
+        512,
+        503,
+        473,
+        379,
+        293,
+        277,
+        156,
+        56,
+      ];
+
+      // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
+      // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
+      // try sleeping a bit before getting that data
+      await retry.try(async () => {
+        const data = await PageObjects.visChart.getBarChartData();
+        log.debug('data=' + data);
+        log.debug('data.length=' + data.length);
+        expect(data).to.eql(expectedChartValues);
       });
 
-      it('should have inspector enabled', async function () {
-        await inspector.expectIsEnabled();
+      await PageObjects.visEditor.toggleOpenEditor(2);
+      await PageObjects.visEditor.clickDropPartialBuckets();
+      await PageObjects.visEditor.clickGo();
+
+      expectedChartValues = [
+        218,
+        341,
+        440,
+        480,
+        517,
+        522,
+        446,
+        403,
+        321,
+        258,
+        172,
+        95,
+        55,
+        38,
+        24,
+        3,
+        4,
+        11,
+        14,
+        17,
+        38,
+        49,
+        115,
+        152,
+        216,
+        315,
+        402,
+        446,
+        513,
+        520,
+        474,
+        421,
+        307,
+        230,
+        170,
+        99,
+        48,
+        30,
+        15,
+        10,
+        2,
+        8,
+        7,
+        17,
+        34,
+        37,
+        104,
+        153,
+        241,
+        313,
+        404,
+        492,
+        512,
+        503,
+        473,
+        379,
+        293,
+        277,
+        156,
+      ];
+
+      // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
+      // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
+      // try sleeping a bit before getting that data
+      await retry.try(async () => {
+        const data = await PageObjects.visChart.getBarChartData();
+        log.debug('data=' + data);
+        log.debug('data.length=' + data.length);
+        expect(data).to.eql(expectedChartValues);
       });
+    });
 
-      it('should show correct chart', async function () {
-        const expectedChartValues = [
-          37,
-          202,
-          740,
-          1437,
-          1371,
-          751,
-          188,
-          31,
-          42,
-          202,
-          683,
-          1361,
-          1415,
-          707,
-          177,
-          27,
-          32,
-          175,
-          707,
-          1408,
-          1355,
-          726,
-          201,
-          29,
-        ];
+    describe('switch between Y axis scale types', () => {
+      before(initBarChart);
+      const axisId = 'ValueAxis-1';
 
-        // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
-        // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
-        // try sleeping a bit before getting that data
-        await retry.try(async () => {
-          const data = await PageObjects.visChart.getBarChartData();
-          log.debug('data=' + data);
-          log.debug('data.length=' + data.length);
-          expect(data).to.eql(expectedChartValues);
-        });
+      it('should show ticks on selecting log scale', async () => {
+        await PageObjects.visEditor.clickMetricsAndAxes();
+        await PageObjects.visEditor.clickYAxisOptions(axisId);
+        await PageObjects.visEditor.selectYAxisScaleType(axisId, 'log');
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
-      it('should show correct data', async function () {
-        // this is only the first page of the tabular data.
-        const expectedChartData = [
-          ['2015-09-20 00:00', '37'],
-          ['2015-09-20 03:00', '202'],
-          ['2015-09-20 06:00', '740'],
-          ['2015-09-20 09:00', '1,437'],
-          ['2015-09-20 12:00', '1,371'],
-          ['2015-09-20 15:00', '751'],
-          ['2015-09-20 18:00', '188'],
-          ['2015-09-20 21:00', '31'],
-          ['2015-09-21 00:00', '42'],
-          ['2015-09-21 03:00', '202'],
-          ['2015-09-21 06:00', '683'],
-          ['2015-09-21 09:00', '1,361'],
-          ['2015-09-21 12:00', '1,415'],
-          ['2015-09-21 15:00', '707'],
-          ['2015-09-21 18:00', '177'],
-          ['2015-09-21 21:00', '27'],
-          ['2015-09-22 00:00', '32'],
-          ['2015-09-22 03:00', '175'],
-          ['2015-09-22 06:00', '707'],
-          ['2015-09-22 09:00', '1,408'],
-        ];
-
-        await inspector.open();
-        await inspector.expectTableData(expectedChartData);
-        await inspector.close();
+      it('should show filtered ticks on selecting log scale', async () => {
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
-      it('should have `drop partial buckets` option', async () => {
-        const fromTime = 'Sep 20, 2015 @ 06:31:44.000';
-        const toTime = 'Sep 22, 2015 @ 18:31:44.000';
-
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
-
-        let expectedChartValues = [
-          82,
-          218,
-          341,
-          440,
-          480,
-          517,
-          522,
-          446,
-          403,
-          321,
-          258,
-          172,
-          95,
-          55,
-          38,
-          24,
-          3,
-          4,
-          11,
-          14,
-          17,
-          38,
-          49,
-          115,
-          152,
-          216,
-          315,
-          402,
-          446,
-          513,
-          520,
-          474,
-          421,
-          307,
-          230,
-          170,
-          99,
-          48,
-          30,
-          15,
-          10,
-          2,
-          8,
-          7,
-          17,
-          34,
-          37,
-          104,
-          153,
-          241,
-          313,
-          404,
-          492,
-          512,
-          503,
-          473,
-          379,
-          293,
-          277,
-          156,
-          56,
+      it('should show ticks on selecting square root scale', async () => {
+        await PageObjects.visEditor.selectYAxisScaleType(axisId, 'square root');
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabels();
+        const expectedLabels = [
+          '0',
+          '200',
+          '400',
+          '600',
+          '800',
+          '1,000',
+          '1,200',
+          '1,400',
+          '1,600',
         ];
+        expect(labels).to.eql(expectedLabels);
+      });
 
-        // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
-        // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
-        // try sleeping a bit before getting that data
-        await retry.try(async () => {
-          const data = await PageObjects.visChart.getBarChartData();
-          log.debug('data=' + data);
-          log.debug('data.length=' + data.length);
-          expect(data).to.eql(expectedChartValues);
-        });
-
-        await PageObjects.visEditor.toggleOpenEditor(2);
-        await PageObjects.visEditor.clickDropPartialBuckets();
+      it('should show filtered ticks on selecting square root scale', async () => {
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
         await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabels();
+        const expectedLabels = ['200', '400', '600', '800', '1,000', '1,200', '1,400'];
+        expect(labels).to.eql(expectedLabels);
+      });
 
-        expectedChartValues = [
-          218,
-          341,
-          440,
-          480,
-          517,
-          522,
-          446,
-          403,
-          321,
-          258,
-          172,
-          95,
-          55,
-          38,
-          24,
-          3,
-          4,
-          11,
-          14,
-          17,
-          38,
-          49,
-          115,
-          152,
-          216,
-          315,
-          402,
-          446,
-          513,
-          520,
-          474,
-          421,
-          307,
-          230,
-          170,
-          99,
-          48,
-          30,
-          15,
-          10,
-          2,
-          8,
-          7,
-          17,
-          34,
-          37,
-          104,
-          153,
-          241,
-          313,
-          404,
-          492,
-          512,
-          503,
-          473,
-          379,
-          293,
-          277,
-          156,
+      it('should show ticks on selecting linear scale', async () => {
+        await PageObjects.visEditor.selectYAxisScaleType(axisId, 'linear');
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabels();
+        log.debug(labels);
+        const expectedLabels = [
+          '0',
+          '200',
+          '400',
+          '600',
+          '800',
+          '1,000',
+          '1,200',
+          '1,400',
+          '1,600',
         ];
+        expect(labels).to.eql(expectedLabels);
+      });
 
-        // Most recent failure on Jenkins usually indicates the bar chart is still being drawn?
-        // return arguments[0].getAttribute(arguments[1]);","args":[{"ELEMENT":"592"},"fill"]}] arguments[0].getAttribute is not a function
-        // try sleeping a bit before getting that data
-        await retry.try(async () => {
-          const data = await PageObjects.visChart.getBarChartData();
-          log.debug('data=' + data);
-          log.debug('data.length=' + data.length);
-          expect(data).to.eql(expectedChartValues);
-        });
+      it('should show filtered ticks on selecting linear scale', async () => {
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabels();
+        const expectedLabels = ['200', '400', '600', '800', '1,000', '1,200', '1,400'];
+        expect(labels).to.eql(expectedLabels);
       });
+    });
 
-      describe('switch between Y axis scale types', () => {
-        before(initBarChart);
+    describe('vertical bar in percent mode', async () => {
+      it('should show ticks with percentage values', async function () {
         const axisId = 'ValueAxis-1';
+        await PageObjects.visEditor.clickMetricsAndAxes();
+        await PageObjects.visEditor.clickYAxisOptions(axisId);
+        await PageObjects.visEditor.selectYAxisMode('percentage');
+        await PageObjects.visEditor.changeYAxisShowCheckbox(axisId, true);
+        await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
+        await PageObjects.visEditor.clickGo();
+        const labels = await PageObjects.visChart.getYAxisLabels();
+        expect(labels[0]).to.eql('0%');
+        expect(labels[labels.length - 1]).to.eql('100%');
+      });
+    });
 
-        it('should show ticks on selecting log scale', async () => {
-          await PageObjects.visEditor.clickMetricsAndAxes();
-          await PageObjects.visEditor.clickYAxisOptions(axisId);
-          await PageObjects.visEditor.selectYAxisScaleType(axisId, 'log');
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          const expectedLabels = [
-            '2',
-            '3',
-            '4',
-            '5',
-            '7',
-            '9',
-            '20',
-            '30',
-            '40',
-            '50',
-            '70',
-            '90',
-            '200',
-            '300',
-            '400',
-            '500',
-            '700',
-            '900',
-            '2,000',
-            '3,000',
-            '4,000',
-            '5,000',
-            '7,000',
-          ];
-          expect(labels).to.eql(expectedLabels);
-        });
-
-        it('should show filtered ticks on selecting log scale', async () => {
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          const expectedLabels = [
-            '2',
-            '3',
-            '4',
-            '5',
-            '7',
-            '9',
-            '20',
-            '30',
-            '40',
-            '50',
-            '70',
-            '90',
-            '200',
-            '300',
-            '400',
-            '500',
-            '700',
-            '900',
-            '2,000',
-            '3,000',
-            '4,000',
-            '5,000',
-            '7,000',
-          ];
-          expect(labels).to.eql(expectedLabels);
-        });
-
-        it('should show ticks on selecting square root scale', async () => {
-          await PageObjects.visEditor.selectYAxisScaleType(axisId, 'square root');
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          const expectedLabels = [
-            '0',
-            '200',
-            '400',
-            '600',
-            '800',
-            '1,000',
-            '1,200',
-            '1,400',
-            '1,600',
-          ];
-          expect(labels).to.eql(expectedLabels);
-        });
-
-        it('should show filtered ticks on selecting square root scale', async () => {
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          const expectedLabels = ['200', '400', '600', '800', '1,000', '1,200', '1,400'];
-          expect(labels).to.eql(expectedLabels);
-        });
-
-        it('should show ticks on selecting linear scale', async () => {
-          await PageObjects.visEditor.selectYAxisScaleType(axisId, 'linear');
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          log.debug(labels);
-          const expectedLabels = [
-            '0',
-            '200',
-            '400',
-            '600',
-            '800',
-            '1,000',
-            '1,200',
-            '1,400',
-            '1,600',
-          ];
-          expect(labels).to.eql(expectedLabels);
-        });
-
-        it('should show filtered ticks on selecting linear scale', async () => {
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          const expectedLabels = ['200', '400', '600', '800', '1,000', '1,200', '1,400'];
-          expect(labels).to.eql(expectedLabels);
-        });
+    describe('vertical bar with Split series', function () {
+      before(initBarChart);
+
+      it('should show correct series', async function () {
+        await PageObjects.visEditor.toggleOpenEditor(2, 'false');
+        await PageObjects.visEditor.clickBucket('Split series');
+        await PageObjects.visEditor.selectAggregation('Terms');
+        await PageObjects.visEditor.selectField('response.raw');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        await PageObjects.visEditor.clickGo();
+
+        const expectedEntries = ['200', '404', '503'];
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        expect(legendEntries).to.eql(expectedEntries);
       });
 
-      describe('vertical bar in percent mode', async () => {
-        it('should show ticks with percentage values', async function () {
-          const axisId = 'ValueAxis-1';
-          await PageObjects.visEditor.clickMetricsAndAxes();
-          await PageObjects.visEditor.clickYAxisOptions(axisId);
-          await PageObjects.visEditor.selectYAxisMode('percentage');
-          await PageObjects.visEditor.changeYAxisShowCheckbox(axisId, true);
-          await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
-          await PageObjects.visEditor.clickGo();
-          const labels = await PageObjects.visChart.getYAxisLabels();
-          expect(labels[0]).to.eql('0%');
-          expect(labels[labels.length - 1]).to.eql('100%');
-        });
+      it('should allow custom sorting of series', async () => {
+        await PageObjects.visEditor.toggleOpenEditor(1, 'false');
+        await PageObjects.visEditor.selectCustomSortMetric(3, 'Min', 'bytes');
+        await PageObjects.visEditor.clickGo();
+
+        const expectedEntries = ['404', '200', '503'];
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        expect(legendEntries).to.eql(expectedEntries);
       });
 
-      describe('vertical bar with Split series', function () {
-        before(initBarChart);
-
-        it('should show correct series', async function () {
-          await PageObjects.visEditor.toggleOpenEditor(2, 'false');
-          await PageObjects.visEditor.clickBucket('Split series');
-          await PageObjects.visEditor.selectAggregation('Terms');
-          await PageObjects.visEditor.selectField('response.raw');
-          await PageObjects.visChart.waitForVisualizationRenderingStabilized();
-          await PageObjects.visEditor.clickGo();
-
-          const expectedEntries = ['200', '404', '503'];
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          expect(legendEntries).to.eql(expectedEntries);
-        });
-
-        it('should allow custom sorting of series', async () => {
-          await PageObjects.visEditor.toggleOpenEditor(1, 'false');
-          await PageObjects.visEditor.selectCustomSortMetric(3, 'Min', 'bytes');
-          await PageObjects.visEditor.clickGo();
-
-          const expectedEntries = ['404', '200', '503'];
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          expect(legendEntries).to.eql(expectedEntries);
-        });
-
-        it('should correctly filter by legend', async () => {
-          await PageObjects.visChart.filterLegend('200');
-          await PageObjects.visChart.waitForVisualization();
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          const expectedEntries = ['200'];
-          expect(legendEntries).to.eql(expectedEntries);
-          await filterBar.removeFilter('response.raw');
-          await PageObjects.visChart.waitForVisualization();
-        });
+      it('should correctly filter by legend', async () => {
+        await PageObjects.visChart.filterLegend('200');
+        await PageObjects.visChart.waitForVisualization();
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        const expectedEntries = ['200'];
+        expect(legendEntries).to.eql(expectedEntries);
+        await filterBar.removeFilter('response.raw');
+        await PageObjects.visChart.waitForVisualization();
       });
+    });
 
-      describe('vertical bar with multiple splits', function () {
-        before(initBarChart);
-
-        it('should show correct series', async function () {
-          await PageObjects.visEditor.toggleOpenEditor(2, 'false');
-          await PageObjects.visEditor.clickBucket('Split series');
-          await PageObjects.visEditor.selectAggregation('Terms');
-          await PageObjects.visEditor.selectField('response.raw');
-          await PageObjects.visChart.waitForVisualizationRenderingStabilized();
-
-          await PageObjects.visEditor.toggleOpenEditor(3, 'false');
-          await PageObjects.visEditor.clickBucket('Split series');
-          await PageObjects.visEditor.selectAggregation('Terms');
-          await PageObjects.visEditor.selectField('machine.os');
-          await PageObjects.visChart.waitForVisualizationRenderingStabilized();
-          await PageObjects.visEditor.clickGo();
-
-          const expectedEntries = [
-            '200 - win 8',
-            '200 - win xp',
-            '200 - ios',
-            '200 - osx',
-            '200 - win 7',
-            '404 - ios',
-            '503 - ios',
-            '503 - osx',
-            '503 - win 7',
-            '503 - win 8',
-            '503 - win xp',
-            '404 - osx',
-            '404 - win 7',
-            '404 - win 8',
-            '404 - win xp',
-          ];
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          expect(legendEntries).to.eql(expectedEntries);
-        });
-
-        it('should show correct series when disabling first agg', async function () {
-          // this will avoid issues with the play tooltip covering the disable agg button
-          await testSubjects.scrollIntoView('metricsAggGroup');
-          await PageObjects.visEditor.toggleDisabledAgg(3);
-          await PageObjects.visEditor.clickGo();
-
-          const expectedEntries = ['win 8', 'win xp', 'ios', 'osx', 'win 7'];
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          expect(legendEntries).to.eql(expectedEntries);
-        });
+    describe('vertical bar with multiple splits', function () {
+      before(initBarChart);
+
+      it('should show correct series', async function () {
+        await PageObjects.visEditor.toggleOpenEditor(2, 'false');
+        await PageObjects.visEditor.clickBucket('Split series');
+        await PageObjects.visEditor.selectAggregation('Terms');
+        await PageObjects.visEditor.selectField('response.raw');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+
+        await PageObjects.visEditor.toggleOpenEditor(3, 'false');
+        await PageObjects.visEditor.clickBucket('Split series');
+        await PageObjects.visEditor.selectAggregation('Terms');
+        await PageObjects.visEditor.selectField('machine.os');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        await PageObjects.visEditor.clickGo();
+
+        const expectedEntries = [
+          '200 - win 8',
+          '200 - win xp',
+          '200 - ios',
+          '200 - osx',
+          '200 - win 7',
+          '404 - ios',
+          '503 - ios',
+          '503 - osx',
+          '503 - win 7',
+          '503 - win 8',
+          '503 - win xp',
+          '404 - osx',
+          '404 - win 7',
+          '404 - win 8',
+          '404 - win xp',
+        ];
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        expect(legendEntries).to.eql(expectedEntries);
+      });
+
+      it('should show correct series when disabling first agg', async function () {
+        // this will avoid issues with the play tooltip covering the disable agg button
+        await testSubjects.scrollIntoView('metricsAggGroup');
+        await PageObjects.visEditor.toggleDisabledAgg(3);
+        await PageObjects.visEditor.clickGo();
+
+        const expectedEntries = ['win 8', 'win xp', 'ios', 'osx', 'win 7'];
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        expect(legendEntries).to.eql(expectedEntries);
       });
+    });
+
+    describe('vertical bar with derivative', function () {
+      before(initBarChart);
+
+      it('should show correct series', async function () {
+        await PageObjects.visEditor.toggleOpenEditor(2, 'false');
+        await PageObjects.visEditor.toggleOpenEditor(1);
+        await PageObjects.visEditor.selectAggregation('Derivative', 'metrics');
+        await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+        await PageObjects.visEditor.clickGo();
+
+        const expectedEntries = ['Derivative of Count'];
+        const legendEntries = await PageObjects.visChart.getLegendEntries();
+        expect(legendEntries).to.eql(expectedEntries);
+      });
+
+      it('should show an error if last bucket aggregation is terms', async () => {
+        await PageObjects.visEditor.toggleOpenEditor(2, 'false');
+        await PageObjects.visEditor.clickBucket('Split series');
+        await PageObjects.visEditor.selectAggregation('Terms');
+        await PageObjects.visEditor.selectField('response.raw');
 
-      describe('vertical bar with derivative', function () {
-        before(initBarChart);
-
-        it('should show correct series', async function () {
-          await PageObjects.visEditor.toggleOpenEditor(2, 'false');
-          await PageObjects.visEditor.toggleOpenEditor(1);
-          await PageObjects.visEditor.selectAggregation('Derivative', 'metrics');
-          await PageObjects.visChart.waitForVisualizationRenderingStabilized();
-          await PageObjects.visEditor.clickGo();
-
-          const expectedEntries = ['Derivative of Count'];
-          const legendEntries = await PageObjects.visChart.getLegendEntries();
-          expect(legendEntries).to.eql(expectedEntries);
-        });
-
-        it('should show an error if last bucket aggregation is terms', async () => {
-          await PageObjects.visEditor.toggleOpenEditor(2, 'false');
-          await PageObjects.visEditor.clickBucket('Split series');
-          await PageObjects.visEditor.selectAggregation('Terms');
-          await PageObjects.visEditor.selectField('response.raw');
-
-          const errorMessage = await PageObjects.visEditor.getBucketErrorMessage();
-          expect(errorMessage).to.contain('Last bucket aggregation must be "Date Histogram"');
-        });
+        const errorMessage = await PageObjects.visEditor.getBucketErrorMessage();
+        expect(errorMessage).to.contain('Last bucket aggregation must be "Date Histogram"');
       });
     });
   });
diff --git a/test/functional/apps/visualize/_vertical_bar_chart_nontimeindex.js b/test/functional/apps/visualize/_vertical_bar_chart_nontimeindex.js
index 42dfd791321a1..f95781c9bbb33 100644
--- a/test/functional/apps/visualize/_vertical_bar_chart_nontimeindex.js
+++ b/test/functional/apps/visualize/_vertical_bar_chart_nontimeindex.js
@@ -25,8 +25,7 @@ export default function ({ getService, getPageObjects }) {
   const inspector = getService('inspector');
   const PageObjects = getPageObjects(['common', 'visualize', 'header', 'visEditor', 'visChart']);
 
-  // FLAKY: https://github.com/elastic/kibana/issues/22322
-  describe.skip('vertical bar chart with index without time filter', function () {
+  describe('vertical bar chart with index without time filter', function () {
     const vizName1 = 'Visualization VerticalBarChart without time filter';
 
     const initBarChart = async () => {
@@ -46,6 +45,7 @@ export default function ({ getService, getPageObjects }) {
       await PageObjects.visEditor.selectField('@timestamp');
       await PageObjects.visEditor.setInterval('3h', { type: 'custom' });
       await PageObjects.visChart.waitForVisualizationRenderingStabilized();
+      await PageObjects.visEditor.clickGo();
     };
 
     before(initBarChart);
@@ -129,7 +129,7 @@ export default function ({ getService, getPageObjects }) {
       await inspector.expectTableData(expectedChartData);
     });
 
-    describe.skip('switch between Y axis scale types', () => {
+    describe('switch between Y axis scale types', () => {
       before(initBarChart);
       const axisId = 'ValueAxis-1';
 
@@ -139,57 +139,25 @@ export default function ({ getService, getPageObjects }) {
         await PageObjects.visEditor.selectYAxisScaleType(axisId, 'log');
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, false);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show filtered ticks on selecting log scale', async () => {
         await PageObjects.visEditor.changeYAxisFilterLabelsCheckbox(axisId, true);
         await PageObjects.visEditor.clickGo();
-        const labels = await PageObjects.visChart.getYAxisLabels();
-        const expectedLabels = [
-          '2',
-          '3',
-          '5',
-          '7',
-          '10',
-          '20',
-          '30',
-          '50',
-          '70',
-          '100',
-          '200',
-          '300',
-          '500',
-          '700',
-          '1,000',
-          '2,000',
-          '3,000',
-          '5,000',
-          '7,000',
-        ];
-        expect(labels).to.eql(expectedLabels);
+        const labels = await PageObjects.visChart.getYAxisLabelsAsNumbers();
+        const minLabel = 2;
+        const maxLabel = 5000;
+        const numberOfLabels = 10;
+        expect(labels.length).to.be.greaterThan(numberOfLabels);
+        expect(labels[0]).to.eql(minLabel);
+        expect(labels[labels.length - 1]).to.be.greaterThan(maxLabel);
       });
 
       it('should show ticks on selecting square root scale', async () => {
diff --git a/test/functional/page_objects/visualize_chart_page.ts b/test/functional/page_objects/visualize_chart_page.ts
index 590631ad48b00..ade78cbb810d5 100644
--- a/test/functional/page_objects/visualize_chart_page.ts
+++ b/test/functional/page_objects/visualize_chart_page.ts
@@ -51,6 +51,10 @@ export function VisualizeChartPageProvider({ getService, getPageObjects }: FtrPr
         .map((tick) => $(tick).text().trim());
     }
 
+    public async getYAxisLabelsAsNumbers() {
+      return (await this.getYAxisLabels()).map((label) => Number(label.replace(',', '')));
+    }
+
     /**
      * Gets the chart data and scales it based on chart height and label.
      * @param dataLabel data-label value

From edaea1e341ea7304ff283fa0f15a473e256745f2 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 11:26:04 +0200
Subject: [PATCH 24/34] Stabilize filter bar test (#72032)

---
 test/functional/apps/dashboard/dashboard_filter_bar.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/functional/apps/dashboard/dashboard_filter_bar.js b/test/functional/apps/dashboard/dashboard_filter_bar.js
index f3241568bbb3e..dd0318ea5c0d7 100644
--- a/test/functional/apps/dashboard/dashboard_filter_bar.js
+++ b/test/functional/apps/dashboard/dashboard_filter_bar.js
@@ -30,8 +30,7 @@ export default function ({ getService, getPageObjects }) {
   const browser = getService('browser');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'visualize', 'timePicker']);
 
-  // FLAKY: https://github.com/elastic/kibana/issues/71987
-  describe.skip('dashboard filter bar', () => {
+  describe('dashboard filter bar', () => {
     before(async () => {
       await esArchiver.load('dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
@@ -69,6 +68,7 @@ export default function ({ getService, getPageObjects }) {
       it('uses default index pattern on an empty dashboard', async () => {
         await testSubjects.click('addFilter');
         await dashboardExpect.fieldSuggestions(['bytes']);
+        await filterBar.ensureFieldEditorModalIsClosed();
       });
 
       it('shows index pattern of vis when one is added', async () => {
@@ -77,6 +77,7 @@ export default function ({ getService, getPageObjects }) {
         await filterBar.ensureFieldEditorModalIsClosed();
         await testSubjects.click('addFilter');
         await dashboardExpect.fieldSuggestions(['animal']);
+        await filterBar.ensureFieldEditorModalIsClosed();
       });
 
       it('works when a vis with no index pattern is added', async () => {

From b9aede40d6a94720a1432612d7866ddb4864e22b Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 11:26:37 +0200
Subject: [PATCH 25/34] stabilize failing test (#72086)

---
 test/functional/page_objects/dashboard_page.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/functional/page_objects/dashboard_page.ts b/test/functional/page_objects/dashboard_page.ts
index 7c325ba6d4aec..b662fd62e4b02 100644
--- a/test/functional/page_objects/dashboard_page.ts
+++ b/test/functional/page_objects/dashboard_page.ts
@@ -294,6 +294,7 @@ export function DashboardPageProvider({ getService, getPageObjects }: FtrProvide
         await this.enterDashboardTitleAndClickSave(dashboardName, saveOptions);
 
         if (saveOptions.needsConfirm) {
+          await this.ensureDuplicateTitleCallout();
           await this.clickSave();
         }
 

From 78ea171a8011cc319563276033beade44a74c30d Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 11:28:23 +0200
Subject: [PATCH 26/34] Stabilize closing toast (#72097)

* stabilize closing toast

* unskip test

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 test/functional/apps/dashboard/dashboard_snapshots.js | 3 +--
 test/functional/page_objects/common_page.ts           | 6 +++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/test/functional/apps/dashboard/dashboard_snapshots.js b/test/functional/apps/dashboard/dashboard_snapshots.js
index 20bc30c889d65..787e839aa08a5 100644
--- a/test/functional/apps/dashboard/dashboard_snapshots.js
+++ b/test/functional/apps/dashboard/dashboard_snapshots.js
@@ -28,8 +28,7 @@ export default function ({ getService, getPageObjects, updateBaselines }) {
   const dashboardPanelActions = getService('dashboardPanelActions');
   const dashboardAddPanel = getService('dashboardAddPanel');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/52854
-  describe.skip('dashboard snapshots', function describeIndexTests() {
+  describe('dashboard snapshots', function describeIndexTests() {
     before(async function () {
       await esArchiver.load('dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 8c5a99204bab6..d6a96eb651d02 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -407,7 +407,11 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
     async closeToastIfExists() {
       const toastShown = await find.existsByCssSelector('.euiToast');
       if (toastShown) {
-        await find.clickByCssSelector('.euiToast__closeButton');
+        try {
+          await find.clickByCssSelector('.euiToast__closeButton');
+        } catch (err) {
+          // ignore errors, toast clear themselves after timeout
+        }
       }
     }
 

From 3709de64d614533571da8e190e751c51f3484073 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 12:14:59 +0200
Subject: [PATCH 27/34] [Lens] Legend config (#70619)

---
 .../workspace_panel_wrapper.tsx               |   2 +-
 .../pie_visualization/pie_visualization.tsx   |   6 +-
 .../pie_visualization/register_expression.tsx |   6 +
 .../render_function.test.tsx                  |   7 +
 .../pie_visualization/render_function.tsx     |   3 +
 .../pie_visualization/settings_widget.scss    |   3 -
 .../pie_visualization/settings_widget.tsx     | 230 --------------
 .../public/pie_visualization/to_expression.ts |   1 +
 .../public/pie_visualization/toolbar.scss     |   3 +
 .../lens/public/pie_visualization/toolbar.tsx | 281 ++++++++++++++++++
 .../lens/public/pie_visualization/types.ts    |   1 +
 .../__snapshots__/to_expression.test.ts.snap  |   1 +
 .../public/xy_visualization/to_expression.ts  |   3 +
 .../lens/public/xy_visualization/types.ts     |  16 +
 .../xy_visualization/xy_config_panel.tsx      |  94 ++++++
 .../xy_visualization/xy_expression.test.tsx   |  67 +++++
 .../public/xy_visualization/xy_expression.tsx |   6 +-
 .../translations/translations/ja-JP.json      |   6 +-
 .../translations/translations/zh-CN.json      |   6 +-
 19 files changed, 498 insertions(+), 244 deletions(-)
 delete mode 100644 x-pack/plugins/lens/public/pie_visualization/settings_widget.scss
 delete mode 100644 x-pack/plugins/lens/public/pie_visualization/settings_widget.tsx
 create mode 100644 x-pack/plugins/lens/public/pie_visualization/toolbar.scss
 create mode 100644 x-pack/plugins/lens/public/pie_visualization/toolbar.tsx

diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
index f6e15002ca66c..411488abce77f 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
@@ -63,7 +63,7 @@ export function WorkspacePanelWrapper({
         clearStagedPreview: false,
       });
     },
-    [dispatch]
+    [dispatch, activeVisualization]
   );
   return (
     <>
diff --git a/x-pack/plugins/lens/public/pie_visualization/pie_visualization.tsx b/x-pack/plugins/lens/public/pie_visualization/pie_visualization.tsx
index 4f0c081d8be00..369ab28293fbc 100644
--- a/x-pack/plugins/lens/public/pie_visualization/pie_visualization.tsx
+++ b/x-pack/plugins/lens/public/pie_visualization/pie_visualization.tsx
@@ -13,7 +13,7 @@ import { toExpression, toPreviewExpression } from './to_expression';
 import { LayerState, PieVisualizationState } from './types';
 import { suggestions } from './suggestions';
 import { CHART_NAMES, MAX_PIE_BUCKETS, MAX_TREEMAP_BUCKETS } from './constants';
-import { SettingsWidget } from './settings_widget';
+import { PieToolbar } from './toolbar';
 
 function newLayerState(layerId: string): LayerState {
   return {
@@ -204,10 +204,10 @@ export const pieVisualization: Visualization<PieVisualizationState, PieVisualiza
   toExpression,
   toPreviewExpression,
 
-  renderLayerContextMenu(domElement, props) {
+  renderToolbar(domElement, props) {
     render(
       <I18nProvider>
-        <SettingsWidget {...props} />
+        <PieToolbar {...props} />
       </I18nProvider>,
       domElement
     );
diff --git a/x-pack/plugins/lens/public/pie_visualization/register_expression.tsx b/x-pack/plugins/lens/public/pie_visualization/register_expression.tsx
index cea84db8b2794..89d93ab79233f 100644
--- a/x-pack/plugins/lens/public/pie_visualization/register_expression.tsx
+++ b/x-pack/plugins/lens/public/pie_visualization/register_expression.tsx
@@ -7,6 +7,7 @@
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { i18n } from '@kbn/i18n';
+import { Position } from '@elastic/charts';
 import { I18nProvider } from '@kbn/i18n/react';
 import {
   IInterpreterRenderHandlers,
@@ -73,6 +74,11 @@ export const pie: ExpressionFunctionDefinition<
       types: ['boolean'],
       help: '',
     },
+    legendPosition: {
+      types: ['string'],
+      options: [Position.Top, Position.Right, Position.Bottom, Position.Left],
+      help: '',
+    },
     percentDecimals: {
       types: ['number'],
       help: '',
diff --git a/x-pack/plugins/lens/public/pie_visualization/render_function.test.tsx b/x-pack/plugins/lens/public/pie_visualization/render_function.test.tsx
index cfbeb27efb3d0..38ef44a2fef18 100644
--- a/x-pack/plugins/lens/public/pie_visualization/render_function.test.tsx
+++ b/x-pack/plugins/lens/public/pie_visualization/render_function.test.tsx
@@ -65,6 +65,13 @@ describe('PieVisualization component', () => {
       };
     }
 
+    test('it shows legend on correct side', () => {
+      const component = shallow(
+        <PieComponent args={{ ...args, legendPosition: 'top' }} {...getDefaultArgs()} />
+      );
+      expect(component.find(Settings).prop('legendPosition')).toEqual('top');
+    });
+
     test('it shows legend for 2 groups using default legendDisplay', () => {
       const component = shallow(<PieComponent args={args} {...getDefaultArgs()} />);
       expect(component.find(Settings).prop('showLegend')).toEqual(true);
diff --git a/x-pack/plugins/lens/public/pie_visualization/render_function.tsx b/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
index f349cc4dfd648..79986986b217d 100644
--- a/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
+++ b/x-pack/plugins/lens/public/pie_visualization/render_function.tsx
@@ -22,6 +22,7 @@ import {
   PartitionFillLabel,
   RecursivePartial,
   LayerValue,
+  Position,
 } from '@elastic/charts';
 import { FormatFactory, LensFilterEvent } from '../types';
 import { VisualizationContainer } from '../visualization_container';
@@ -55,6 +56,7 @@ export function PieComponent(
     numberDisplay,
     categoryDisplay,
     legendDisplay,
+    legendPosition,
     nestedLegend,
     percentDecimals,
     hideLabels,
@@ -237,6 +239,7 @@ export function PieComponent(
             (legendDisplay === 'show' ||
               (legendDisplay === 'default' && columnGroups.length > 1 && shape !== 'treemap'))
           }
+          legendPosition={legendPosition || Position.Right}
           legendMaxDepth={nestedLegend ? undefined : 1 /* Color is based only on first layer */}
           onElementClick={(args) => {
             const context = getFilterContext(
diff --git a/x-pack/plugins/lens/public/pie_visualization/settings_widget.scss b/x-pack/plugins/lens/public/pie_visualization/settings_widget.scss
deleted file mode 100644
index 4fa328d8a904d..0000000000000
--- a/x-pack/plugins/lens/public/pie_visualization/settings_widget.scss
+++ /dev/null
@@ -1,3 +0,0 @@
-.lnsPieSettingsWidget {
-  min-width: $euiSizeXL * 10;
-}
diff --git a/x-pack/plugins/lens/public/pie_visualization/settings_widget.tsx b/x-pack/plugins/lens/public/pie_visualization/settings_widget.tsx
deleted file mode 100644
index e5fde12f74b42..0000000000000
--- a/x-pack/plugins/lens/public/pie_visualization/settings_widget.tsx
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-import {
-  EuiForm,
-  EuiFormRow,
-  EuiSuperSelect,
-  EuiRange,
-  EuiSwitch,
-  EuiHorizontalRule,
-  EuiSpacer,
-  EuiButtonGroup,
-} from '@elastic/eui';
-import { DEFAULT_PERCENT_DECIMALS } from './constants';
-import { PieVisualizationState, SharedLayerState } from './types';
-import { VisualizationLayerWidgetProps } from '../types';
-import './settings_widget.scss';
-
-const numberOptions: Array<{ value: SharedLayerState['numberDisplay']; inputDisplay: string }> = [
-  {
-    value: 'hidden',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.hiddenNumbersLabel', {
-      defaultMessage: 'Hide from chart',
-    }),
-  },
-  {
-    value: 'percent',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.showPercentValuesLabel', {
-      defaultMessage: 'Show percent',
-    }),
-  },
-  {
-    value: 'value',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.showFormatterValuesLabel', {
-      defaultMessage: 'Show value',
-    }),
-  },
-];
-
-const categoryOptions: Array<{
-  value: SharedLayerState['categoryDisplay'];
-  inputDisplay: string;
-}> = [
-  {
-    value: 'default',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.showCategoriesLabel', {
-      defaultMessage: 'Inside or outside',
-    }),
-  },
-  {
-    value: 'inside',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.fitInsideOnlyLabel', {
-      defaultMessage: 'Inside only',
-    }),
-  },
-  {
-    value: 'hide',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.categoriesInLegendLabel', {
-      defaultMessage: 'Hide labels',
-    }),
-  },
-];
-
-const categoryOptionsTreemap: Array<{
-  value: SharedLayerState['categoryDisplay'];
-  inputDisplay: string;
-}> = [
-  {
-    value: 'default',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.showTreemapCategoriesLabel', {
-      defaultMessage: 'Show labels',
-    }),
-  },
-  {
-    value: 'hide',
-    inputDisplay: i18n.translate('xpack.lens.pieChart.categoriesInLegendLabel', {
-      defaultMessage: 'Hide labels',
-    }),
-  },
-];
-
-const legendOptions: Array<{
-  value: SharedLayerState['legendDisplay'];
-  label: string;
-  id: string;
-}> = [
-  {
-    id: 'pieLegendDisplay-default',
-    value: 'default',
-    label: i18n.translate('xpack.lens.pieChart.defaultLegendLabel', {
-      defaultMessage: 'auto',
-    }),
-  },
-  {
-    id: 'pieLegendDisplay-show',
-    value: 'show',
-    label: i18n.translate('xpack.lens.pieChart.alwaysShowLegendLabel', {
-      defaultMessage: 'show',
-    }),
-  },
-  {
-    id: 'pieLegendDisplay-hide',
-    value: 'hide',
-    label: i18n.translate('xpack.lens.pieChart.hideLegendLabel', {
-      defaultMessage: 'hide',
-    }),
-  },
-];
-
-export function SettingsWidget(props: VisualizationLayerWidgetProps<PieVisualizationState>) {
-  const { state, setState } = props;
-  const layer = state.layers[0];
-  if (!layer) {
-    return null;
-  }
-
-  return (
-    <EuiForm className="lnsPieSettingsWidget">
-      <EuiFormRow
-        label={i18n.translate('xpack.lens.pieChart.labelPositionLabel', {
-          defaultMessage: 'Label position',
-        })}
-        fullWidth
-        display="columnCompressed"
-      >
-        <EuiSuperSelect
-          compressed
-          valueOfSelected={layer.categoryDisplay}
-          options={state.shape === 'treemap' ? categoryOptionsTreemap : categoryOptions}
-          onChange={(option) => {
-            setState({
-              ...state,
-              layers: [{ ...layer, categoryDisplay: option }],
-            });
-          }}
-        />
-      </EuiFormRow>
-      <EuiFormRow
-        label={i18n.translate('xpack.lens.pieChart.numberLabels', {
-          defaultMessage: 'Label values',
-        })}
-        fullWidth
-        display="columnCompressed"
-      >
-        <EuiSuperSelect
-          compressed
-          disabled={layer.categoryDisplay === 'hide'}
-          valueOfSelected={layer.categoryDisplay === 'hide' ? 'hidden' : layer.numberDisplay}
-          options={numberOptions}
-          onChange={(option) => {
-            setState({
-              ...state,
-              layers: [{ ...layer, numberDisplay: option }],
-            });
-          }}
-        />
-      </EuiFormRow>
-      <EuiHorizontalRule margin="s" />
-      <EuiFormRow
-        label={i18n.translate('xpack.lens.pieChart.percentDecimalsLabel', {
-          defaultMessage: 'Decimal places for percent',
-        })}
-        fullWidth
-        display="columnCompressed"
-      >
-        <EuiRange
-          data-test-subj="indexPattern-dimension-formatDecimals"
-          value={layer.percentDecimals ?? DEFAULT_PERCENT_DECIMALS}
-          min={0}
-          max={10}
-          showInput
-          compressed
-          onChange={(e) => {
-            setState({
-              ...state,
-              layers: [{ ...layer, percentDecimals: Number(e.currentTarget.value) }],
-            });
-          }}
-        />
-      </EuiFormRow>
-      <EuiHorizontalRule margin="s" />
-      <EuiFormRow
-        label={i18n.translate('xpack.lens.pieChart.legendDisplayLabel', {
-          defaultMessage: 'Legend display',
-        })}
-        display="columnCompressed"
-      >
-        <div>
-          <EuiButtonGroup
-            legend={i18n.translate('xpack.lens.pieChart.legendDisplayLegend', {
-              defaultMessage: 'Legend display',
-            })}
-            options={legendOptions}
-            idSelected={legendOptions.find(({ value }) => value === layer.legendDisplay)!.id}
-            onChange={(optionId) => {
-              setState({
-                ...state,
-                layers: [
-                  {
-                    ...layer,
-                    legendDisplay: legendOptions.find(({ id }) => id === optionId)!.value,
-                  },
-                ],
-              });
-            }}
-            buttonSize="compressed"
-            isFullWidth
-          />
-
-          <EuiSpacer size="m" />
-          <EuiSwitch
-            compressed
-            label={i18n.translate('xpack.lens.pieChart.nestedLegendLabel', {
-              defaultMessage: 'Nested legend',
-            })}
-            checked={!!layer.nestedLegend}
-            onChange={() => {
-              setState({ ...state, layers: [{ ...layer, nestedLegend: !layer.nestedLegend }] });
-            }}
-          />
-        </div>
-      </EuiFormRow>
-    </EuiForm>
-  );
-}
diff --git a/x-pack/plugins/lens/public/pie_visualization/to_expression.ts b/x-pack/plugins/lens/public/pie_visualization/to_expression.ts
index cf9d311dfd504..fbc47e8bfb00f 100644
--- a/x-pack/plugins/lens/public/pie_visualization/to_expression.ts
+++ b/x-pack/plugins/lens/public/pie_visualization/to_expression.ts
@@ -41,6 +41,7 @@ function expressionHelper(
           numberDisplay: [layer.numberDisplay],
           categoryDisplay: [layer.categoryDisplay],
           legendDisplay: [layer.legendDisplay],
+          legendPosition: [layer.legendPosition || 'right'],
           percentDecimals: [layer.percentDecimals ?? DEFAULT_PERCENT_DECIMALS],
           nestedLegend: [!!layer.nestedLegend],
         },
diff --git a/x-pack/plugins/lens/public/pie_visualization/toolbar.scss b/x-pack/plugins/lens/public/pie_visualization/toolbar.scss
new file mode 100644
index 0000000000000..3cfbe6480c61b
--- /dev/null
+++ b/x-pack/plugins/lens/public/pie_visualization/toolbar.scss
@@ -0,0 +1,3 @@
+.lnsPieToolbar__popover {
+  width: $euiFormMaxWidth;
+}
diff --git a/x-pack/plugins/lens/public/pie_visualization/toolbar.tsx b/x-pack/plugins/lens/public/pie_visualization/toolbar.tsx
new file mode 100644
index 0000000000000..9c3d0d0f34814
--- /dev/null
+++ b/x-pack/plugins/lens/public/pie_visualization/toolbar.tsx
@@ -0,0 +1,281 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import './toolbar.scss';
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiPopover,
+  EuiSelect,
+  EuiFormRow,
+  EuiSuperSelect,
+  EuiRange,
+  EuiSwitch,
+  EuiHorizontalRule,
+  EuiSpacer,
+  EuiButtonGroup,
+} from '@elastic/eui';
+import { Position } from '@elastic/charts';
+import { DEFAULT_PERCENT_DECIMALS } from './constants';
+import { PieVisualizationState, SharedLayerState } from './types';
+import { VisualizationToolbarProps } from '../types';
+import { ToolbarButton } from '../toolbar_button';
+
+const numberOptions: Array<{ value: SharedLayerState['numberDisplay']; inputDisplay: string }> = [
+  {
+    value: 'hidden',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.hiddenNumbersLabel', {
+      defaultMessage: 'Hide from chart',
+    }),
+  },
+  {
+    value: 'percent',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.showPercentValuesLabel', {
+      defaultMessage: 'Show percent',
+    }),
+  },
+  {
+    value: 'value',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.showFormatterValuesLabel', {
+      defaultMessage: 'Show value',
+    }),
+  },
+];
+
+const categoryOptions: Array<{
+  value: SharedLayerState['categoryDisplay'];
+  inputDisplay: string;
+}> = [
+  {
+    value: 'default',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.showCategoriesLabel', {
+      defaultMessage: 'Inside or outside',
+    }),
+  },
+  {
+    value: 'inside',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.fitInsideOnlyLabel', {
+      defaultMessage: 'Inside only',
+    }),
+  },
+  {
+    value: 'hide',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.categoriesInLegendLabel', {
+      defaultMessage: 'Hide labels',
+    }),
+  },
+];
+
+const categoryOptionsTreemap: Array<{
+  value: SharedLayerState['categoryDisplay'];
+  inputDisplay: string;
+}> = [
+  {
+    value: 'default',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.showTreemapCategoriesLabel', {
+      defaultMessage: 'Show labels',
+    }),
+  },
+  {
+    value: 'hide',
+    inputDisplay: i18n.translate('xpack.lens.pieChart.categoriesInLegendLabel', {
+      defaultMessage: 'Hide labels',
+    }),
+  },
+];
+
+const legendOptions: Array<{
+  value: SharedLayerState['legendDisplay'];
+  label: string;
+  id: string;
+}> = [
+  {
+    id: 'pieLegendDisplay-default',
+    value: 'default',
+    label: i18n.translate('xpack.lens.pieChart.legendVisibility.auto', {
+      defaultMessage: 'auto',
+    }),
+  },
+  {
+    id: 'pieLegendDisplay-show',
+    value: 'show',
+    label: i18n.translate('xpack.lens.pieChart.legendVisibility.show', {
+      defaultMessage: 'show',
+    }),
+  },
+  {
+    id: 'pieLegendDisplay-hide',
+    value: 'hide',
+    label: i18n.translate('xpack.lens.pieChart.legendVisibility.hide', {
+      defaultMessage: 'hide',
+    }),
+  },
+];
+
+export function PieToolbar(props: VisualizationToolbarProps<PieVisualizationState>) {
+  const [open, setOpen] = useState(false);
+  const { state, setState } = props;
+  const layer = state.layers[0];
+  if (!layer) {
+    return null;
+  }
+  return (
+    <EuiFlexGroup justifyContent="flexEnd">
+      <EuiFlexItem grow={false}>
+        <EuiPopover
+          panelClassName="lnsPieToolbar__popover"
+          button={
+            <ToolbarButton
+              fontWeight="normal"
+              onClick={() => {
+                setOpen(!open);
+              }}
+            >
+              {i18n.translate('xpack.lens.pieChart.settingsLabel', { defaultMessage: 'Settings' })}
+            </ToolbarButton>
+          }
+          isOpen={open}
+          closePopover={() => {
+            setOpen(false);
+          }}
+          anchorPosition="downRight"
+        >
+          <EuiFormRow
+            label={i18n.translate('xpack.lens.pieChart.labelPositionLabel', {
+              defaultMessage: 'Label position',
+            })}
+            fullWidth
+            display="columnCompressed"
+          >
+            <EuiSuperSelect
+              compressed
+              valueOfSelected={layer.categoryDisplay}
+              options={state.shape === 'treemap' ? categoryOptionsTreemap : categoryOptions}
+              onChange={(option) => {
+                setState({
+                  ...state,
+                  layers: [{ ...layer, categoryDisplay: option }],
+                });
+              }}
+            />
+          </EuiFormRow>
+          <EuiFormRow
+            label={i18n.translate('xpack.lens.pieChart.numberLabels', {
+              defaultMessage: 'Label values',
+            })}
+            fullWidth
+            display="columnCompressed"
+          >
+            <EuiSuperSelect
+              compressed
+              disabled={layer.categoryDisplay === 'hide'}
+              valueOfSelected={layer.categoryDisplay === 'hide' ? 'hidden' : layer.numberDisplay}
+              options={numberOptions}
+              onChange={(option) => {
+                setState({
+                  ...state,
+                  layers: [{ ...layer, numberDisplay: option }],
+                });
+              }}
+            />
+          </EuiFormRow>
+          <EuiHorizontalRule margin="s" />
+          <EuiFormRow
+            label={i18n.translate('xpack.lens.pieChart.percentDecimalsLabel', {
+              defaultMessage: 'Decimal places for percent',
+            })}
+            fullWidth
+            display="columnCompressed"
+          >
+            <EuiRange
+              data-test-subj="indexPattern-dimension-formatDecimals"
+              value={layer.percentDecimals ?? DEFAULT_PERCENT_DECIMALS}
+              min={0}
+              max={10}
+              showInput
+              compressed
+              onChange={(e) => {
+                setState({
+                  ...state,
+                  layers: [{ ...layer, percentDecimals: Number(e.currentTarget.value) }],
+                });
+              }}
+            />
+          </EuiFormRow>
+          <EuiHorizontalRule margin="s" />
+          <EuiFormRow
+            label={i18n.translate('xpack.lens.pieChart.legendDisplayLabel', {
+              defaultMessage: 'Legend display',
+            })}
+            display="columnCompressed"
+          >
+            <div>
+              <EuiButtonGroup
+                legend={i18n.translate('xpack.lens.pieChart.legendDisplayLegend', {
+                  defaultMessage: 'Legend display',
+                })}
+                options={legendOptions}
+                idSelected={legendOptions.find(({ value }) => value === layer.legendDisplay)!.id}
+                onChange={(optionId) => {
+                  setState({
+                    ...state,
+                    layers: [
+                      {
+                        ...layer,
+                        legendDisplay: legendOptions.find(({ id }) => id === optionId)!.value,
+                      },
+                    ],
+                  });
+                }}
+                buttonSize="compressed"
+                isFullWidth
+              />
+
+              <EuiSpacer size="s" />
+              <EuiSwitch
+                compressed
+                label={i18n.translate('xpack.lens.pieChart.nestedLegendLabel', {
+                  defaultMessage: 'Nested legend',
+                })}
+                disabled={layer.legendDisplay === 'hide'}
+                checked={!!layer.nestedLegend}
+                onChange={() => {
+                  setState({ ...state, layers: [{ ...layer, nestedLegend: !layer.nestedLegend }] });
+                }}
+              />
+            </div>
+          </EuiFormRow>
+          <EuiFormRow
+            display="columnCompressed"
+            label={i18n.translate('xpack.lens.xyChart.legendPositionLabel', {
+              defaultMessage: 'Legend position',
+            })}
+          >
+            <EuiSelect
+              compressed
+              disabled={layer.legendDisplay === 'hide'}
+              options={[
+                { value: Position.Top, text: 'Top' },
+                { value: Position.Left, text: 'Left' },
+                { value: Position.Right, text: 'Right' },
+                { value: Position.Bottom, text: 'Bottom' },
+              ]}
+              value={layer.legendPosition || Position.Right}
+              onChange={(e) => {
+                setState({
+                  ...state,
+                  layers: [{ ...layer, legendPosition: e.target.value as Position }],
+                });
+              }}
+            />
+          </EuiFormRow>
+        </EuiPopover>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+}
diff --git a/x-pack/plugins/lens/public/pie_visualization/types.ts b/x-pack/plugins/lens/public/pie_visualization/types.ts
index 60b6564248640..74156bce2ea70 100644
--- a/x-pack/plugins/lens/public/pie_visualization/types.ts
+++ b/x-pack/plugins/lens/public/pie_visualization/types.ts
@@ -13,6 +13,7 @@ export interface SharedLayerState {
   numberDisplay: 'hidden' | 'percent' | 'value';
   categoryDisplay: 'default' | 'inside' | 'hide';
   legendDisplay: 'default' | 'show' | 'hide';
+  legendPosition?: 'left' | 'right' | 'top' | 'bottom';
   nestedLegend?: boolean;
   percentDecimals?: number;
 }
diff --git a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/to_expression.test.ts.snap b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/to_expression.test.ts.snap
index d7d76bdd1f44a..b5783803b803c 100644
--- a/x-pack/plugins/lens/public/xy_visualization/__snapshots__/to_expression.test.ts.snap
+++ b/x-pack/plugins/lens/public/xy_visualization/__snapshots__/to_expression.test.ts.snap
@@ -64,6 +64,7 @@ Object {
                   "position": Array [
                     "bottom",
                   ],
+                  "showSingleSeries": Array [],
                 },
                 "function": "lens_xy_legendConfig",
                 "type": "function",
diff --git a/x-pack/plugins/lens/public/xy_visualization/to_expression.ts b/x-pack/plugins/lens/public/xy_visualization/to_expression.ts
index 3b9406cedd499..b17704b38cdec 100644
--- a/x-pack/plugins/lens/public/xy_visualization/to_expression.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/to_expression.ts
@@ -127,6 +127,9 @@ export const buildExpression = (
                   function: 'lens_xy_legendConfig',
                   arguments: {
                     isVisible: [state.legend.isVisible],
+                    showSingleSeries: state.legend.showSingleSeries
+                      ? [state.legend.showSingleSeries]
+                      : [],
                     position: [state.legend.position],
                   },
                 },
diff --git a/x-pack/plugins/lens/public/xy_visualization/types.ts b/x-pack/plugins/lens/public/xy_visualization/types.ts
index 08f29c65b26d0..605119535d1f0 100644
--- a/x-pack/plugins/lens/public/xy_visualization/types.ts
+++ b/x-pack/plugins/lens/public/xy_visualization/types.ts
@@ -19,8 +19,18 @@ import { VisualizationType } from '../index';
 import { FittingFunction } from './fitting_functions';
 
 export interface LegendConfig {
+  /**
+   * Flag whether the legend should be shown. If there is just a single series, it will be hidden
+   */
   isVisible: boolean;
+  /**
+   * Position of the legend relative to the chart
+   */
   position: Position;
+  /**
+   * Flag whether the legend should be shown even with just a single series
+   */
+  showSingleSeries?: boolean;
 }
 
 type LegendConfigResult = LegendConfig & { type: 'lens_xy_legendConfig' };
@@ -50,6 +60,12 @@ export const legendConfig: ExpressionFunctionDefinition<
         defaultMessage: 'Specifies the legend position.',
       }),
     },
+    showSingleSeries: {
+      types: ['boolean'],
+      help: i18n.translate('xpack.lens.xyChart.showSingleSeries.help', {
+        defaultMessage: 'Specifies whether a legend with just a single entry should be shown',
+      }),
+    },
   },
   fn: function fn(input: unknown, args: LegendConfig) {
     return {
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
index d22b3ec0a44a6..59c4b393df467 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_config_panel.tsx
@@ -7,6 +7,7 @@
 import './xy_config_panel.scss';
 import React, { useState } from 'react';
 import { i18n } from '@kbn/i18n';
+import { Position } from '@elastic/charts';
 import { debounce } from 'lodash';
 import {
   EuiButtonGroup,
@@ -16,12 +17,14 @@ import {
   EuiFormRow,
   EuiPopover,
   EuiText,
+  EuiSelect,
   htmlIdGenerator,
   EuiForm,
   EuiColorPicker,
   EuiColorPickerProps,
   EuiToolTip,
   EuiIcon,
+  EuiHorizontalRule,
 } from '@elastic/eui';
 import {
   VisualizationLayerWidgetProps,
@@ -46,6 +49,30 @@ function updateLayer(state: State, layer: UnwrapArray<State['layers']>, index: n
   };
 }
 
+const legendOptions: Array<{ id: string; value: 'auto' | 'show' | 'hide'; label: string }> = [
+  {
+    id: `xy_legend_auto`,
+    value: 'auto',
+    label: i18n.translate('xpack.lens.xyChart.legendVisibility.auto', {
+      defaultMessage: 'auto',
+    }),
+  },
+  {
+    id: `xy_legend_show`,
+    value: 'show',
+    label: i18n.translate('xpack.lens.xyChart.legendVisibility.show', {
+      defaultMessage: 'show',
+    }),
+  },
+  {
+    id: `xy_legend_hide`,
+    value: 'hide',
+    label: i18n.translate('xpack.lens.xyChart.legendVisibility.hide', {
+      defaultMessage: 'hide',
+    }),
+  },
+];
+
 export function LayerContextMenu(props: VisualizationLayerWidgetProps<State>) {
   const { state, layerId } = props;
   const horizontalOnly = isHorizontalChart(state.layers);
@@ -95,6 +122,12 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
   const hasNonBarSeries = props.state?.layers.some(
     (layer) => layer.seriesType === 'line' || layer.seriesType === 'area'
   );
+  const legendMode =
+    props.state?.legend.isVisible && !props.state?.legend.showSingleSeries
+      ? 'auto'
+      : !props.state?.legend.isVisible
+      ? 'hide'
+      : 'show';
   return (
     <EuiFlexGroup justifyContent="flexEnd">
       <EuiFlexItem grow={false}>
@@ -157,6 +190,67 @@ export function XyToolbar(props: VisualizationToolbarProps<State>) {
               />
             </EuiFormRow>
           </EuiToolTip>
+          <EuiHorizontalRule margin="s" />
+          <EuiFormRow
+            display="columnCompressed"
+            label={i18n.translate('xpack.lens.xyChart.legendVisibilityLabel', {
+              defaultMessage: 'Legend display',
+            })}
+          >
+            <EuiButtonGroup
+              isFullWidth
+              legend={i18n.translate('xpack.lens.xyChart.legendVisibilityLabel', {
+                defaultMessage: 'Legend display',
+              })}
+              name="legendDisplay"
+              buttonSize="compressed"
+              options={legendOptions}
+              idSelected={legendOptions.find(({ value }) => value === legendMode)!.id}
+              onChange={(optionId) => {
+                const newMode = legendOptions.find(({ id }) => id === optionId)!.value;
+                if (newMode === 'auto') {
+                  props.setState({
+                    ...props.state,
+                    legend: { ...props.state.legend, isVisible: true, showSingleSeries: false },
+                  });
+                } else if (newMode === 'show') {
+                  props.setState({
+                    ...props.state,
+                    legend: { ...props.state.legend, isVisible: true, showSingleSeries: true },
+                  });
+                } else if (newMode === 'hide') {
+                  props.setState({
+                    ...props.state,
+                    legend: { ...props.state.legend, isVisible: false, showSingleSeries: false },
+                  });
+                }
+              }}
+            />
+          </EuiFormRow>
+          <EuiFormRow
+            display="columnCompressed"
+            label={i18n.translate('xpack.lens.xyChart.legendPositionLabel', {
+              defaultMessage: 'Legend position',
+            })}
+          >
+            <EuiSelect
+              disabled={legendMode === 'hide'}
+              compressed
+              options={[
+                { value: Position.Top, text: 'Top' },
+                { value: Position.Left, text: 'Left' },
+                { value: Position.Right, text: 'Right' },
+                { value: Position.Bottom, text: 'Bottom' },
+              ]}
+              value={props.state?.legend.position}
+              onChange={(e) => {
+                props.setState({
+                  ...props.state,
+                  legend: { ...props.state.legend, position: e.target.value as Position },
+                });
+              }}
+            />
+          </EuiFormRow>
         </EuiPopover>
       </EuiFlexItem>
     </EuiFlexGroup>
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
index b7a50b3af640c..c880cbb641e5d 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_expression.test.tsx
@@ -1556,6 +1556,73 @@ describe('xy_expression', () => {
       expect(component.find(Settings).prop('showLegend')).toEqual(true);
     });
 
+    test('it should always show legend if showSingleSeries is set', () => {
+      const { data, args } = sampleArgs();
+
+      const component = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{
+            ...args,
+            layers: [{ ...args.layers[0], accessors: ['a'], splitAccessor: undefined }],
+            legend: { ...args.legend, isVisible: true, showSingleSeries: true },
+          }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      expect(component.find(Settings).prop('showLegend')).toEqual(true);
+    });
+
+    test('it not show legend if isVisible is set to false', () => {
+      const { data, args } = sampleArgs();
+
+      const component = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{
+            ...args,
+            legend: { ...args.legend, isVisible: false },
+          }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      expect(component.find(Settings).prop('showLegend')).toEqual(false);
+    });
+
+    test('it should show legend on right side', () => {
+      const { data, args } = sampleArgs();
+
+      const component = shallow(
+        <XYChart
+          data={{ ...data }}
+          args={{
+            ...args,
+            legend: { ...args.legend, position: 'top' },
+          }}
+          formatFactory={getFormatSpy}
+          timeZone="UTC"
+          chartsThemeService={chartsThemeService}
+          histogramBarTarget={50}
+          onClickValue={onClickValue}
+          onSelectRange={onSelectRange}
+        />
+      );
+
+      expect(component.find(Settings).prop('legendPosition')).toEqual('top');
+    });
+
     test('it should apply the fitting function to all non-bar series', () => {
       const data: LensMultiTable = {
         type: 'lens_multitable',
diff --git a/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx b/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
index 3ab12aa0879b0..871b626d62560 100644
--- a/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
+++ b/x-pack/plugins/lens/public/xy_visualization/xy_expression.tsx
@@ -282,7 +282,11 @@ export function XYChart({
   return (
     <Chart>
       <Settings
-        showLegend={legend.isVisible ? chartHasMoreThanOneSeries : legend.isVisible}
+        showLegend={
+          legend.isVisible && !legend.showSingleSeries
+            ? chartHasMoreThanOneSeries
+            : legend.isVisible
+        }
         legendPosition={legend.position}
         showLegendExtra={false}
         theme={chartTheme}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 451557ff93092..1d8d93e7c961d 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -8569,15 +8569,15 @@
     "xpack.lens.pie.treemaplabel": "ツリーマップ",
     "xpack.lens.pie.treemapSuggestionLabel": "ツリーマップとして",
     "xpack.lens.pie.visualizationName": "パイ",
-    "xpack.lens.pieChart.alwaysShowLegendLabel": "表示",
     "xpack.lens.pieChart.categoriesInLegendLabel": "ラベルを非表示",
-    "xpack.lens.pieChart.defaultLegendLabel": "自動",
     "xpack.lens.pieChart.fitInsideOnlyLabel": "内部のみ",
     "xpack.lens.pieChart.hiddenNumbersLabel": "グラフから非表示",
-    "xpack.lens.pieChart.hideLegendLabel": "非表示",
     "xpack.lens.pieChart.labelPositionLabel": "ラベル位置",
     "xpack.lens.pieChart.legendDisplayLabel": "凡例表示",
     "xpack.lens.pieChart.legendDisplayLegend": "凡例表示",
+    "xpack.lens.pieChart.legendVisibility.auto": "自動",
+    "xpack.lens.pieChart.legendVisibility.hide": "非表示",
+    "xpack.lens.pieChart.legendVisibility.show": "表示",
     "xpack.lens.pieChart.nestedLegendLabel": "ネストされた凡例",
     "xpack.lens.pieChart.numberLabels": "ラベル値",
     "xpack.lens.pieChart.percentDecimalsLabel": "割合の小数点桁数",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 3a2ef39d49ece..0ea2c9f17e257 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -8574,15 +8574,15 @@
     "xpack.lens.pie.treemaplabel": "树状图",
     "xpack.lens.pie.treemapSuggestionLabel": "为树状图",
     "xpack.lens.pie.visualizationName": "饼图",
-    "xpack.lens.pieChart.alwaysShowLegendLabel": "显示",
     "xpack.lens.pieChart.categoriesInLegendLabel": "隐藏标签",
-    "xpack.lens.pieChart.defaultLegendLabel": "自动",
     "xpack.lens.pieChart.fitInsideOnlyLabel": "仅内部",
     "xpack.lens.pieChart.hiddenNumbersLabel": "在图表中隐藏",
-    "xpack.lens.pieChart.hideLegendLabel": "隐藏",
     "xpack.lens.pieChart.labelPositionLabel": "标签位置",
     "xpack.lens.pieChart.legendDisplayLabel": "图例显示",
     "xpack.lens.pieChart.legendDisplayLegend": "图例显示",
+    "xpack.lens.pieChart.legendVisibility.auto": "自动",
+    "xpack.lens.pieChart.legendVisibility.hide": "隐藏",
+    "xpack.lens.pieChart.legendVisibility.show": "显示",
     "xpack.lens.pieChart.nestedLegendLabel": "嵌套图例",
     "xpack.lens.pieChart.numberLabels": "标签值",
     "xpack.lens.pieChart.percentDecimalsLabel": "百分比的小数位数",

From d9920604311ed03d9bc6d3f68c3fa3f3edaeac12 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 22 Jul 2020 12:15:39 +0200
Subject: [PATCH 28/34] do  not pass title as part of tsvb request (#72619)

---
 src/plugins/visualizations/public/legacy/build_pipeline.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugins/visualizations/public/legacy/build_pipeline.ts b/src/plugins/visualizations/public/legacy/build_pipeline.ts
index e74a83d91fabf..d3fe814f3b010 100644
--- a/src/plugins/visualizations/public/legacy/build_pipeline.ts
+++ b/src/plugins/visualizations/public/legacy/build_pipeline.ts
@@ -255,7 +255,7 @@ export const buildPipelineVisFunction: BuildPipelineVisFunction = {
   input_control_vis: (params) => {
     return `input_control_vis ${prepareJson('visConfig', params)}`;
   },
-  metrics: (params, schemas, uiState = {}) => {
+  metrics: ({ title, ...params }, schemas, uiState = {}) => {
     const paramsJson = prepareJson('params', params);
     const uiStateJson = prepareJson('uiState', uiState);
 

From cb0405eeaecbc85986a52462605b54671bd343ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Wed, 22 Jul 2020 13:30:52 +0100
Subject: [PATCH 29/34] [Observability] filter "hasData" api by processor event
 (#72810)

* filtering hasdata by processor event

* adding api test
---
 .../lib/observability_overview/has_data.ts    |   21 +-
 .../observability_overview/data.json.gz       |  Bin 0 -> 377 bytes
 .../observability_overview/mappings.json      | 4229 +++++++++++++++++
 .../apm_api_integration/basic/tests/index.ts  |    5 +
 .../tests/observability_overview/has_data.ts  |   41 +
 .../observability_overview.ts                 |   47 +
 6 files changed, 4342 insertions(+), 1 deletion(-)
 create mode 100644 x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/data.json.gz
 create mode 100644 x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/mappings.json
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts

diff --git a/x-pack/plugins/apm/server/lib/observability_overview/has_data.ts b/x-pack/plugins/apm/server/lib/observability_overview/has_data.ts
index 73cc2d273ec69..fc7445ab4a225 100644
--- a/x-pack/plugins/apm/server/lib/observability_overview/has_data.ts
+++ b/x-pack/plugins/apm/server/lib/observability_overview/has_data.ts
@@ -3,6 +3,8 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { PROCESSOR_EVENT } from '../../../common/elasticsearch_fieldnames';
+import { ProcessorEvent } from '../../../common/processor_event';
 import { Setup } from '../helpers/setup_request';
 
 export async function hasData({ setup }: { setup: Setup }) {
@@ -15,7 +17,24 @@ export async function hasData({ setup }: { setup: Setup }) {
         indices['apm_oss.metricsIndices'],
       ],
       terminateAfter: 1,
-      size: 0,
+      body: {
+        size: 0,
+        query: {
+          bool: {
+            filter: [
+              {
+                terms: {
+                  [PROCESSOR_EVENT]: [
+                    ProcessorEvent.error,
+                    ProcessorEvent.metric,
+                    ProcessorEvent.transaction,
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
     };
 
     const response = await client.search(params);
diff --git a/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/data.json.gz b/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/data.json.gz
new file mode 100644
index 0000000000000000000000000000000000000000..23602666f3b43ddab67671239a717cd706c6a0f2
GIT binary patch
literal 377
zcmV-<0fzn`iwFoj4j5km17u-zVJ>QOZ*Bl>Qn7BrFcjSR3X~Z~wiBB;Q&p)0U04_@
zstUc>rld;jC=RF<;@@jSQbJ*|<a>Ab{O<WUnNFkbr_oV9jg*zqEC2_n_5nHii@%mC
zRIA0?YGW49RkCEtE%|HlQl9C7VU+$3Bxq`s#W=>un!-Y>O7n>*rXJxj6$9VdeJigW
zJo40)wRRoUO|S_HggK&Og?XN`Jmqmp*t*wyzLstz4{z43E3FA?60;abed%<S9JJ|f
zMgDcZsaB7Bia5iJ5V5}ZvW3&FZ+UB{o1Lz83)SWl*;XWircj_cumq({a8wjrBRZ!7
zdyHg4{f*@HJL@_F^?4ZpxKNxV0I3{vF3v<s$tb~yXf9Do8AZTkhKS;9PJnHJ>anUS
z{g}p&8^rH<{*h-C<1u6S1Yv{yY_o^yp4a=JwyELEhCs5rw3^mR?VSA|SHF<x`d7xj
XLlUFv;5-@5)8zCEyNDos!vX*RO5nOW

literal 0
HcmV?d00001

diff --git a/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/mappings.json b/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/mappings.json
new file mode 100644
index 0000000000000..e6f40fedaab4c
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/fixtures/es_archiver/observability_overview/mappings.json
@@ -0,0 +1,4229 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+    },
+    "index": "apm-8.0.0-onboarding-2020.06.29",
+    "mappings": {
+      "_meta": {
+        "beat": "apm",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "network.inner": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "network.inner.*"
+          }
+        },
+        {
+          "observer.egress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.egress.*"
+          }
+        },
+        {
+          "observer.ingress": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "observer.ingress.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "labels_string": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_boolean": {
+            "mapping": {
+              "type": "boolean"
+            },
+            "match_mapping_type": "boolean",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "labels_*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "transaction.marks": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "transaction.marks.*"
+          }
+        },
+        {
+          "transaction.marks.*.*": {
+            "mapping": {
+              "scaling_factor": 1000000,
+              "type": "scaled_float"
+            },
+            "path_match": "transaction.marks.*.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "dynamic": "false",
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "path": "agent.name",
+              "type": "alias"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "child": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "client": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "dynamic": "false",
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
+        "container": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dll": {
+          "properties": {
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "dynamic": "false",
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "culprit": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exception": {
+              "properties": {
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "handled": {
+                  "type": "boolean"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "module": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "grouping_key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "log": {
+              "properties": {
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "logger_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "param_message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "experimental": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "dynamic": "false",
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "dynamic": "false",
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "finished": {
+                  "type": "boolean"
+                },
+                "headers": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "dynamic": "false",
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "dynamic": "true",
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "inner": {
+              "properties": {
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "observer": {
+          "dynamic": "false",
+          "properties": {
+            "egress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingress": {
+              "properties": {
+                "interface": {
+                  "properties": {
+                    "alias": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "vlan": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "zone": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "listening": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_major": {
+              "type": "byte"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "parent": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "dynamic": "false",
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "code_signature": {
+              "properties": {
+                "exists": {
+                  "type": "boolean"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "trusted": {
+                  "type": "boolean"
+                },
+                "valid": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "code_signature": {
+                  "properties": {
+                    "exists": {
+                      "type": "boolean"
+                    },
+                    "status": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "trusted": {
+                      "type": "boolean"
+                    },
+                    "valid": {
+                      "type": "boolean"
+                    }
+                  }
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entity_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha512": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pe": {
+              "properties": {
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file_version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "processor": {
+          "properties": {
+            "event": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "profile": {
+          "dynamic": "false",
+          "properties": {
+            "alloc_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "alloc_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "cpu": {
+              "properties": {
+                "ns": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "type": "long"
+            },
+            "inuse_objects": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "inuse_space": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                }
+              }
+            },
+            "samples": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "stack": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            },
+            "top": {
+              "dynamic": "false",
+              "properties": {
+                "filename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "line": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "author": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "dynamic": "false",
+          "properties": {
+            "environment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "framework": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "language": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "runtime": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "dynamic": "false",
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "sourcemap": {
+          "dynamic": "false",
+          "properties": {
+            "bundle_filepath": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "span": {
+          "dynamic": "false",
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "db": {
+              "dynamic": "false",
+              "properties": {
+                "link": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rows_affected": {
+                  "type": "long"
+                }
+              }
+            },
+            "destination": {
+              "dynamic": "false",
+              "properties": {
+                "service": {
+                  "dynamic": "false",
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "resource": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "start": {
+              "properties": {
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "subtype": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sync": {
+              "type": "boolean"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "total": {
+                  "properties": {
+                    "norm": {
+                      "properties": {
+                        "pct": {
+                          "scaling_factor": 1000,
+                          "type": "scaled_float"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "memory": {
+              "properties": {
+                "actual": {
+                  "properties": {
+                    "free": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "total": {
+                  "type": "long"
+                }
+              }
+            },
+            "process": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "total": {
+                      "properties": {
+                        "norm": {
+                          "properties": {
+                            "pct": {
+                              "scaling_factor": 1000,
+                              "type": "scaled_float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "size": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timestamp": {
+          "properties": {
+            "us": {
+              "type": "long"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "dynamic": "false",
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "transaction": {
+          "dynamic": "false",
+          "properties": {
+            "breakdown": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                }
+              }
+            },
+            "duration": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "histogram": {
+                  "type": "histogram"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "us": {
+                  "type": "long"
+                }
+              }
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "marks": {
+              "dynamic": "true",
+              "properties": {
+                "*": {
+                  "properties": {
+                    "*": {
+                      "dynamic": "true",
+                      "type": "object"
+                    }
+                  }
+                }
+              }
+            },
+            "message": {
+              "dynamic": "false",
+              "properties": {
+                "age": {
+                  "properties": {
+                    "ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "queue": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "root": {
+              "type": "boolean"
+            },
+            "sampled": {
+              "type": "boolean"
+            },
+            "self_time": {
+              "properties": {
+                "count": {
+                  "type": "long"
+                },
+                "sum": {
+                  "properties": {
+                    "us": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "span_count": {
+              "properties": {
+                "dropped": {
+                  "type": "long"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "dynamic": "false",
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "dynamic": "false",
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "view spans": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "2000"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "message",
+            "tags",
+            "agent.ephemeral_id",
+            "agent.id",
+            "agent.name",
+            "agent.type",
+            "agent.version",
+            "as.organization.name",
+            "client.address",
+            "client.as.organization.name",
+            "client.domain",
+            "client.geo.city_name",
+            "client.geo.continent_name",
+            "client.geo.country_iso_code",
+            "client.geo.country_name",
+            "client.geo.name",
+            "client.geo.region_iso_code",
+            "client.geo.region_name",
+            "client.mac",
+            "client.registered_domain",
+            "client.top_level_domain",
+            "client.user.domain",
+            "client.user.email",
+            "client.user.full_name",
+            "client.user.group.domain",
+            "client.user.group.id",
+            "client.user.group.name",
+            "client.user.hash",
+            "client.user.id",
+            "client.user.name",
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "container.runtime",
+            "destination.address",
+            "destination.as.organization.name",
+            "destination.domain",
+            "destination.geo.city_name",
+            "destination.geo.continent_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.country_name",
+            "destination.geo.name",
+            "destination.geo.region_iso_code",
+            "destination.geo.region_name",
+            "destination.mac",
+            "destination.registered_domain",
+            "destination.top_level_domain",
+            "destination.user.domain",
+            "destination.user.email",
+            "destination.user.full_name",
+            "destination.user.group.domain",
+            "destination.user.group.id",
+            "destination.user.group.name",
+            "destination.user.hash",
+            "destination.user.id",
+            "destination.user.name",
+            "dns.answers.class",
+            "dns.answers.data",
+            "dns.answers.name",
+            "dns.answers.type",
+            "dns.header_flags",
+            "dns.id",
+            "dns.op_code",
+            "dns.question.class",
+            "dns.question.name",
+            "dns.question.registered_domain",
+            "dns.question.subdomain",
+            "dns.question.top_level_domain",
+            "dns.question.type",
+            "dns.response_code",
+            "dns.type",
+            "ecs.version",
+            "error.code",
+            "error.id",
+            "error.message",
+            "error.stack_trace",
+            "error.type",
+            "event.action",
+            "event.category",
+            "event.code",
+            "event.dataset",
+            "event.hash",
+            "event.id",
+            "event.kind",
+            "event.module",
+            "event.original",
+            "event.outcome",
+            "event.provider",
+            "event.timezone",
+            "event.type",
+            "file.device",
+            "file.directory",
+            "file.extension",
+            "file.gid",
+            "file.group",
+            "file.hash.md5",
+            "file.hash.sha1",
+            "file.hash.sha256",
+            "file.hash.sha512",
+            "file.inode",
+            "file.mode",
+            "file.name",
+            "file.owner",
+            "file.path",
+            "file.target_path",
+            "file.type",
+            "file.uid",
+            "geo.city_name",
+            "geo.continent_name",
+            "geo.country_iso_code",
+            "geo.country_name",
+            "geo.name",
+            "geo.region_iso_code",
+            "geo.region_name",
+            "group.domain",
+            "group.id",
+            "group.name",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha256",
+            "hash.sha512",
+            "host.architecture",
+            "host.geo.city_name",
+            "host.geo.continent_name",
+            "host.geo.country_iso_code",
+            "host.geo.country_name",
+            "host.geo.name",
+            "host.geo.region_iso_code",
+            "host.geo.region_name",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.full",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.type",
+            "host.user.domain",
+            "host.user.email",
+            "host.user.full_name",
+            "host.user.group.domain",
+            "host.user.group.id",
+            "host.user.group.name",
+            "host.user.hash",
+            "host.user.id",
+            "host.user.name",
+            "http.request.body.content",
+            "http.request.method",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "log.logger",
+            "log.origin.file.name",
+            "log.origin.function",
+            "log.original",
+            "log.syslog.facility.name",
+            "log.syslog.severity.name",
+            "network.application",
+            "network.community_id",
+            "network.direction",
+            "network.iana_number",
+            "network.name",
+            "network.protocol",
+            "network.transport",
+            "network.type",
+            "observer.geo.city_name",
+            "observer.geo.continent_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.country_name",
+            "observer.geo.name",
+            "observer.geo.region_iso_code",
+            "observer.geo.region_name",
+            "observer.hostname",
+            "observer.mac",
+            "observer.name",
+            "observer.os.family",
+            "observer.os.full",
+            "observer.os.kernel",
+            "observer.os.name",
+            "observer.os.platform",
+            "observer.os.version",
+            "observer.product",
+            "observer.serial_number",
+            "observer.type",
+            "observer.vendor",
+            "observer.version",
+            "organization.id",
+            "organization.name",
+            "os.family",
+            "os.full",
+            "os.kernel",
+            "os.name",
+            "os.platform",
+            "os.version",
+            "package.architecture",
+            "package.checksum",
+            "package.description",
+            "package.install_scope",
+            "package.license",
+            "package.name",
+            "package.path",
+            "package.version",
+            "process.args",
+            "text",
+            "process.executable",
+            "process.hash.md5",
+            "process.hash.sha1",
+            "process.hash.sha256",
+            "process.hash.sha512",
+            "process.name",
+            "text",
+            "text",
+            "text",
+            "text",
+            "text",
+            "process.thread.name",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.as.organization.name",
+            "server.domain",
+            "server.geo.city_name",
+            "server.geo.continent_name",
+            "server.geo.country_iso_code",
+            "server.geo.country_name",
+            "server.geo.name",
+            "server.geo.region_iso_code",
+            "server.geo.region_name",
+            "server.mac",
+            "server.registered_domain",
+            "server.top_level_domain",
+            "server.user.domain",
+            "server.user.email",
+            "server.user.full_name",
+            "server.user.group.domain",
+            "server.user.group.id",
+            "server.user.group.name",
+            "server.user.hash",
+            "server.user.id",
+            "server.user.name",
+            "service.ephemeral_id",
+            "service.id",
+            "service.name",
+            "service.node.name",
+            "service.state",
+            "service.type",
+            "service.version",
+            "source.address",
+            "source.as.organization.name",
+            "source.domain",
+            "source.geo.city_name",
+            "source.geo.continent_name",
+            "source.geo.country_iso_code",
+            "source.geo.country_name",
+            "source.geo.name",
+            "source.geo.region_iso_code",
+            "source.geo.region_name",
+            "source.mac",
+            "source.registered_domain",
+            "source.top_level_domain",
+            "source.user.domain",
+            "source.user.email",
+            "source.user.full_name",
+            "source.user.group.domain",
+            "source.user.group.id",
+            "source.user.group.name",
+            "source.user.hash",
+            "source.user.id",
+            "source.user.name",
+            "threat.framework",
+            "threat.tactic.id",
+            "threat.tactic.name",
+            "threat.tactic.reference",
+            "threat.technique.id",
+            "threat.technique.name",
+            "threat.technique.reference",
+            "tracing.trace.id",
+            "tracing.transaction.id",
+            "url.domain",
+            "url.extension",
+            "url.fragment",
+            "url.full",
+            "url.original",
+            "url.password",
+            "url.path",
+            "url.query",
+            "url.registered_domain",
+            "url.scheme",
+            "url.top_level_domain",
+            "url.username",
+            "user.domain",
+            "user.email",
+            "user.full_name",
+            "user.group.domain",
+            "user.group.id",
+            "user.group.name",
+            "user.hash",
+            "user.id",
+            "user.name",
+            "user_agent.device.name",
+            "user_agent.name",
+            "text",
+            "user_agent.original",
+            "user_agent.os.family",
+            "user_agent.os.full",
+            "user_agent.os.kernel",
+            "user_agent.os.name",
+            "user_agent.os.platform",
+            "user_agent.os.version",
+            "user_agent.version",
+            "text",
+            "timeseries.instance",
+            "cloud.project.id",
+            "cloud.image.id",
+            "host.os.build",
+            "host.os.codename",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.replicaset.name",
+            "kubernetes.deployment.name",
+            "kubernetes.statefulset.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "processor.name",
+            "processor.event",
+            "url.scheme",
+            "url.full",
+            "url.domain",
+            "url.path",
+            "url.query",
+            "url.fragment",
+            "http.version",
+            "http.request.method",
+            "http.request.referrer",
+            "service.name",
+            "service.version",
+            "service.environment",
+            "service.node.name",
+            "service.language.name",
+            "service.language.version",
+            "service.runtime.name",
+            "service.runtime.version",
+            "service.framework.name",
+            "service.framework.version",
+            "transaction.id",
+            "transaction.type",
+            "text",
+            "transaction.name",
+            "span.type",
+            "span.subtype",
+            "trace.id",
+            "parent.id",
+            "agent.name",
+            "agent.version",
+            "agent.ephemeral_id",
+            "container.id",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "host.architecture",
+            "host.hostname",
+            "host.name",
+            "host.os.platform",
+            "process.args",
+            "process.title",
+            "observer.listening",
+            "observer.hostname",
+            "observer.version",
+            "observer.type",
+            "user.name",
+            "user.id",
+            "user.email",
+            "destination.address",
+            "text",
+            "user_agent.original",
+            "user_agent.name",
+            "user_agent.version",
+            "user_agent.device.name",
+            "user_agent.os.platform",
+            "user_agent.os.name",
+            "user_agent.os.full",
+            "user_agent.os.family",
+            "user_agent.os.version",
+            "user_agent.os.kernel",
+            "cloud.account.id",
+            "cloud.account.name",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.project.id",
+            "cloud.project.name",
+            "cloud.provider",
+            "cloud.region",
+            "error.id",
+            "error.culprit",
+            "error.grouping_key",
+            "error.exception.code",
+            "error.exception.message",
+            "error.exception.module",
+            "error.exception.type",
+            "error.log.level",
+            "error.log.logger_name",
+            "error.log.message",
+            "error.log.param_message",
+            "profile.top.id",
+            "profile.top.function",
+            "profile.top.filename",
+            "profile.stack.id",
+            "profile.stack.function",
+            "profile.stack.filename",
+            "sourcemap.service.name",
+            "sourcemap.service.version",
+            "sourcemap.bundle_filepath",
+            "view spans",
+            "child.id",
+            "span.id",
+            "span.name",
+            "span.action",
+            "span.db.link",
+            "span.destination.service.type",
+            "span.destination.service.name",
+            "span.destination.service.resource",
+            "span.message.queue.name",
+            "transaction.result",
+            "transaction.message.queue.name",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "1ms"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/index.ts b/x-pack/test/apm_api_integration/basic/tests/index.ts
index 873aa478ad080..a1950f1c0947f 100644
--- a/x-pack/test/apm_api_integration/basic/tests/index.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/index.ts
@@ -36,5 +36,10 @@ export default function apmApiIntegrationTests({ loadTestFile }: FtrProviderCont
       loadTestFile(require.resolve('./transaction_groups/transaction_charts'));
       loadTestFile(require.resolve('./transaction_groups/error_rate'));
     });
+
+    describe('Observability overview', function () {
+      loadTestFile(require.resolve('./observability_overview/has_data'));
+      loadTestFile(require.resolve('./observability_overview/observability_overview'));
+    });
   });
 }
diff --git a/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts b/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
new file mode 100644
index 0000000000000..127721e8e2112
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/observability_overview/has_data.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  describe('Has data', () => {
+    describe('when data is not loaded', () => {
+      it('returns false when there is no data', async () => {
+        const response = await supertest.get('/api/apm/observability_overview/has_data');
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(false);
+      });
+    });
+    describe('when only onboarding data is loaded', () => {
+      before(() => esArchiver.load('observability_overview'));
+      after(() => esArchiver.unload('observability_overview'));
+      it('returns false when there is only onboarding data', async () => {
+        const response = await supertest.get('/api/apm/observability_overview/has_data');
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(false);
+      });
+    });
+    describe('when data is loaded', () => {
+      before(() => esArchiver.load('8.0.0'));
+      after(() => esArchiver.unload('8.0.0'));
+
+      it('returns true when there is at least one document on transaction, error or metrics indices', async () => {
+        const response = await supertest.get('/api/apm/observability_overview/has_data');
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(true);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts b/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts
new file mode 100644
index 0000000000000..bd8b0c6126faa
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/observability_overview/observability_overview.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  // url parameters
+  const start = encodeURIComponent('2020-06-29T06:00:00.000Z');
+  const end = encodeURIComponent('2020-06-29T10:00:00.000Z');
+  const bucketSize = '60s';
+
+  describe('Observability overview', () => {
+    describe('when data is not loaded', () => {
+      it('handles the empty state', async () => {
+        const response = await supertest.get(
+          `/api/apm/observability_overview?start=${start}&end=${end}&bucketSize=${bucketSize}`
+        );
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql({ serviceCount: 0, transactionCoordinates: [] });
+      });
+    });
+    describe('when data is loaded', () => {
+      before(() => esArchiver.load('8.0.0'));
+      after(() => esArchiver.unload('8.0.0'));
+
+      it('returns the service count and transaction coordinates', async () => {
+        const response = await supertest.get(
+          `/api/apm/observability_overview?start=${start}&end=${end}&bucketSize=${bucketSize}`
+        );
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql({
+          serviceCount: 3,
+          transactionCoordinates: [
+            { x: 1593413220000, y: 0.016666666666666666 },
+            { x: 1593413280000, y: 1.0458333333333334 },
+          ],
+        });
+      });
+    });
+  });
+}

From a41633d8c5a3581df83f2e95dfcf33f76793fab6 Mon Sep 17 00:00:00 2001
From: Gidi Meir Morris <github@gidi.io>
Date: Wed, 22 Jul 2020 13:39:33 +0100
Subject: [PATCH 30/34] [Task Manager] Addresses flaky test introduced by
 buffered store (#72815)

Removed unused functionality which we weren't using anyway and was causing some flaky behaviour.
---
 .../server/lib/bulk_operation_buffer.test.ts  | 44 +------------------
 .../server/lib/bulk_operation_buffer.ts       | 11 +----
 2 files changed, 3 insertions(+), 52 deletions(-)

diff --git a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
index 1994e5f749371..2c6d2b64f5d44 100644
--- a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
+++ b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts
@@ -33,7 +33,7 @@ function errorAttempts(task: TaskInstance): Err<OperationError<TaskInstance, Err
   });
 }
 
-describe.skip('Bulk Operation Buffer', () => {
+describe('Bulk Operation Buffer', () => {
   describe('createBuffer()', () => {
     test('batches up multiple Operation calls', async () => {
       const bulkUpdate: jest.Mocked<BulkOperation<TaskInstance, Error>> = jest.fn(
@@ -54,48 +54,6 @@ describe.skip('Bulk Operation Buffer', () => {
       expect(bulkUpdate).toHaveBeenCalledWith([task1, task2]);
     });
 
-    test('batch updates are executed at most by the next Event Loop tick by default', async () => {
-      const bulkUpdate: jest.Mocked<BulkOperation<TaskInstance, Error>> = jest.fn((tasks) => {
-        return Promise.resolve(tasks.map(incrementAttempts));
-      });
-
-      const bufferedUpdate = createBuffer(bulkUpdate);
-
-      const task1 = createTask();
-      const task2 = createTask();
-      const task3 = createTask();
-      const task4 = createTask();
-      const task5 = createTask();
-      const task6 = createTask();
-
-      return new Promise((resolve) => {
-        Promise.all([bufferedUpdate(task1), bufferedUpdate(task2)]).then((_) => {
-          expect(bulkUpdate).toHaveBeenCalledTimes(1);
-          expect(bulkUpdate).toHaveBeenCalledWith([task1, task2]);
-          expect(bulkUpdate).not.toHaveBeenCalledWith([task3, task4]);
-        });
-
-        setTimeout(() => {
-          // on next tick
-          setTimeout(() => {
-            // on next tick
-            expect(bulkUpdate).toHaveBeenCalledTimes(2);
-            Promise.all([bufferedUpdate(task5), bufferedUpdate(task6)]).then((_) => {
-              expect(bulkUpdate).toHaveBeenCalledTimes(3);
-              expect(bulkUpdate).toHaveBeenCalledWith([task5, task6]);
-              resolve();
-            });
-          }, 0);
-
-          expect(bulkUpdate).toHaveBeenCalledTimes(1);
-          Promise.all([bufferedUpdate(task3), bufferedUpdate(task4)]).then((_) => {
-            expect(bulkUpdate).toHaveBeenCalledTimes(2);
-            expect(bulkUpdate).toHaveBeenCalledWith([task3, task4]);
-          });
-        }, 0);
-      });
-    });
-
     test('batch updates can be customised to execute after a certain period', async () => {
       const bulkUpdate: jest.Mocked<BulkOperation<TaskInstance, Error>> = jest.fn((tasks) => {
         return Promise.resolve(tasks.map(incrementAttempts));
diff --git a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts
index fca7ce02e0cd7..c8e5b837fa36c 100644
--- a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts
+++ b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts
@@ -93,11 +93,8 @@ export function createBuffer<Input extends Entity, ErrorOutput, Output extends E
               // the race is started in response to the first operation into the buffer
               // so we flush once the remaining operations come in (which is `bufferMaxOperations - 1`)
               storeUpdateBuffer.pipe(bufferCount(bufferMaxOperations - 1)),
-              bufferMaxDuration
-                ? // if theres a max duration, flush buffer based on that
-                  from(resolveIn(bufferMaxDuration))
-                : // ensure we flush by the end of the "current" event loop tick
-                  from(resolveImmediate()),
+              // flush buffer once max duration has passed
+              from(resolveIn(bufferMaxDuration)),
             ]).pipe(first(), mapTo(FLUSH))
           : from([DONT_FLUSH]);
       }),
@@ -118,10 +115,6 @@ export function createBuffer<Input extends Entity, ErrorOutput, Output extends E
   };
 }
 
-function resolveImmediate() {
-  return new Promise(setImmediate);
-}
-
 function resolveIn(ms: number) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);

From 4dcf719edbf74b944b12180030d5540de1f74b47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Marcondes?=
 <55978943+cauemarcondes@users.noreply.github.com>
Date: Wed, 22 Jul 2020 14:01:29 +0100
Subject: [PATCH 31/34] Adding api test for transaction_groups /breakdown and
 /avg_duration_by_browser (#72623)

* adding api test for transaction_groups /breakdown and /avg_duration_by_browser

* adding filter by transaction name

* adding filter by transaction name

* addressing pr comments

* fixing TS issue

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../avg_duration_by_browser/fetcher.ts        |   8 +-
 .../avg_duration_by_browser/index.ts          |   1 +
 .../apm/server/routes/transaction_groups.ts   |   3 +-
 .../apm_api_integration/basic/tests/index.ts  |   2 +
 .../avg_duration_by_browser.ts                |  53 ++
 .../tests/transaction_groups/breakdown.ts     |  67 ++
 .../expectation/avg_duration_by_browser.json  | 735 ++++++++++++++++++
 ..._duration_by_browser_transaction_name.json | 731 +++++++++++++++++
 .../expectation/breakdown.json                | 202 +++++
 .../breakdown_transaction_name.json           |  55 ++
 10 files changed, 1855 insertions(+), 2 deletions(-)
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser.json
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser_transaction_name.json
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
 create mode 100644 x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json

diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
index e3d688b694380..b4d98ec41fc2d 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/fetcher.ts
@@ -12,6 +12,7 @@ import {
   TRANSACTION_TYPE,
   USER_AGENT_NAME,
   TRANSACTION_DURATION,
+  TRANSACTION_NAME,
 } from '../../../../common/elasticsearch_fieldnames';
 import { rangeFilter } from '../../../../common/utils/range_filter';
 import { getBucketSize } from '../../helpers/get_bucket_size';
@@ -23,15 +24,20 @@ export type ESResponse = PromiseReturnType<typeof fetcher>;
 
 export function fetcher(options: Options) {
   const { end, client, indices, start, uiFiltersES } = options.setup;
-  const { serviceName } = options;
+  const { serviceName, transactionName } = options;
   const { intervalString } = getBucketSize(start, end, 'auto');
 
+  const transactionNameFilter = transactionName
+    ? [{ term: { [TRANSACTION_NAME]: transactionName } }]
+    : [];
+
   const filter: ESFilter[] = [
     { term: { [PROCESSOR_EVENT]: ProcessorEvent.transaction } },
     { term: { [SERVICE_NAME]: serviceName } },
     { term: { [TRANSACTION_TYPE]: TRANSACTION_PAGE_LOAD } },
     { range: rangeFilter(start, end) },
     ...uiFiltersES,
+    ...transactionNameFilter,
   ];
 
   const params = {
diff --git a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
index 000890f52ebe6..e3a0d9e26142a 100644
--- a/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
+++ b/x-pack/plugins/apm/server/lib/transactions/avg_duration_by_browser/index.ts
@@ -16,6 +16,7 @@ import { transformer } from './transformer';
 export interface Options {
   serviceName: string;
   setup: Setup & SetupTimeRange & SetupUIFilters;
+  transactionName?: string;
 }
 
 export type AvgDurationByBrowserAPIResponse = Array<{
diff --git a/x-pack/plugins/apm/server/routes/transaction_groups.ts b/x-pack/plugins/apm/server/routes/transaction_groups.ts
index 813d757c7c33e..c667ce4f07e93 100644
--- a/x-pack/plugins/apm/server/routes/transaction_groups.ts
+++ b/x-pack/plugins/apm/server/routes/transaction_groups.ts
@@ -164,7 +164,6 @@ export const transactionGroupsAvgDurationByBrowser = createRoute(() => ({
     }),
     query: t.intersection([
       t.partial({
-        transactionType: t.string,
         transactionName: t.string,
       }),
       uiFiltersRt,
@@ -174,10 +173,12 @@ export const transactionGroupsAvgDurationByBrowser = createRoute(() => ({
   handler: async ({ context, request }) => {
     const setup = await setupRequest(context, request);
     const { serviceName } = context.params.path;
+    const { transactionName } = context.params.query;
 
     return getTransactionAvgDurationByBrowser({
       serviceName,
       setup,
+      transactionName,
     });
   },
 }));
diff --git a/x-pack/test/apm_api_integration/basic/tests/index.ts b/x-pack/test/apm_api_integration/basic/tests/index.ts
index a1950f1c0947f..b6a32ace5db56 100644
--- a/x-pack/test/apm_api_integration/basic/tests/index.ts
+++ b/x-pack/test/apm_api_integration/basic/tests/index.ts
@@ -35,6 +35,8 @@ export default function apmApiIntegrationTests({ loadTestFile }: FtrProviderCont
       loadTestFile(require.resolve('./transaction_groups/top_transaction_groups'));
       loadTestFile(require.resolve('./transaction_groups/transaction_charts'));
       loadTestFile(require.resolve('./transaction_groups/error_rate'));
+      loadTestFile(require.resolve('./transaction_groups/breakdown'));
+      loadTestFile(require.resolve('./transaction_groups/avg_duration_by_browser'));
     });
 
     describe('Observability overview', function () {
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
new file mode 100644
index 0000000000000..690935ddc7f6a
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/avg_duration_by_browser.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import expectedAvgDurationByBrowser from './expectation/avg_duration_by_browser.json';
+import expectedAvgDurationByBrowserWithTransactionName from './expectation/avg_duration_by_browser_transaction_name.json';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
+  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const transactionName = '/products';
+  const uiFilters = encodeURIComponent(JSON.stringify({}));
+
+  describe('Average duration by browser', () => {
+    describe('when data is not loaded', () => {
+      it('handles the empty state', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/client/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}`
+        );
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql([]);
+      });
+    });
+
+    describe('when data is loaded', () => {
+      before(() => esArchiver.load('8.0.0'));
+      after(() => esArchiver.unload('8.0.0'));
+
+      it('returns the average duration by browser', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/client/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}`
+        );
+
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(expectedAvgDurationByBrowser);
+      });
+      it('returns the average duration by browser filtering by transaction name', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/client/transaction_groups/avg_duration_by_browser?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionName=${transactionName}`
+        );
+
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(expectedAvgDurationByBrowserWithTransactionName);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
new file mode 100644
index 0000000000000..5b61112a374c1
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/breakdown.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import expectedBreakdown from './expectation/breakdown.json';
+import expectedBreakdownWithTransactionName from './expectation/breakdown_transaction_name.json';
+
+export default function ApiTest({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const esArchiver = getService('esArchiver');
+
+  const start = encodeURIComponent('2020-06-29T06:45:00.000Z');
+  const end = encodeURIComponent('2020-06-29T06:49:00.000Z');
+  const transactionType = 'request';
+  const transactionName = 'GET /api';
+  const uiFilters = encodeURIComponent(JSON.stringify({}));
+
+  describe('Breakdown', () => {
+    describe('when data is not loaded', () => {
+      it('handles the empty state', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
+        );
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql({ kpis: [], timeseries: [] });
+      });
+    });
+
+    describe('when data is loaded', () => {
+      before(() => esArchiver.load('8.0.0'));
+      after(() => esArchiver.unload('8.0.0'));
+
+      it('returns the transaction breakdown for a service', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
+        );
+
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(expectedBreakdown);
+      });
+      it('returns the transaction breakdown for a transaction group', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}&transactionName=${transactionName}`
+        );
+
+        expect(response.status).to.be(200);
+        expect(response.body).to.eql(expectedBreakdownWithTransactionName);
+      });
+      it('returns the top 4 by percentage and sorts them by name', async () => {
+        const response = await supertest.get(
+          `/api/apm/services/opbeans-node/transaction_groups/breakdown?start=${start}&end=${end}&uiFilters=${uiFilters}&transactionType=${transactionType}`
+        );
+
+        expect(response.status).to.be(200);
+        expect(response.body.kpis.map((kpi: { name: string }) => kpi.name)).to.eql([
+          'app',
+          'http',
+          'postgresql',
+          'redis',
+        ]);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser.json
new file mode 100644
index 0000000000000..cd53af3bf7080
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser.json
@@ -0,0 +1,735 @@
+[
+  {
+     "title":"HeadlessChrome",
+     "data":[
+        {
+           "x":1593413100000
+        },
+        {
+           "x":1593413101000
+        },
+        {
+           "x":1593413102000
+        },
+        {
+           "x":1593413103000
+        },
+        {
+           "x":1593413104000
+        },
+        {
+           "x":1593413105000
+        },
+        {
+           "x":1593413106000
+        },
+        {
+           "x":1593413107000
+        },
+        {
+           "x":1593413108000
+        },
+        {
+           "x":1593413109000
+        },
+        {
+           "x":1593413110000
+        },
+        {
+           "x":1593413111000
+        },
+        {
+           "x":1593413112000
+        },
+        {
+           "x":1593413113000
+        },
+        {
+           "x":1593413114000
+        },
+        {
+           "x":1593413115000
+        },
+        {
+           "x":1593413116000
+        },
+        {
+           "x":1593413117000
+        },
+        {
+           "x":1593413118000
+        },
+        {
+           "x":1593413119000
+        },
+        {
+           "x":1593413120000
+        },
+        {
+           "x":1593413121000
+        },
+        {
+           "x":1593413122000
+        },
+        {
+           "x":1593413123000
+        },
+        {
+           "x":1593413124000
+        },
+        {
+           "x":1593413125000
+        },
+        {
+           "x":1593413126000
+        },
+        {
+           "x":1593413127000
+        },
+        {
+           "x":1593413128000
+        },
+        {
+           "x":1593413129000
+        },
+        {
+           "x":1593413130000
+        },
+        {
+           "x":1593413131000
+        },
+        {
+           "x":1593413132000
+        },
+        {
+           "x":1593413133000
+        },
+        {
+           "x":1593413134000
+        },
+        {
+           "x":1593413135000
+        },
+        {
+           "x":1593413136000
+        },
+        {
+           "x":1593413137000
+        },
+        {
+           "x":1593413138000
+        },
+        {
+           "x":1593413139000
+        },
+        {
+           "x":1593413140000
+        },
+        {
+           "x":1593413141000
+        },
+        {
+           "x":1593413142000
+        },
+        {
+           "x":1593413143000
+        },
+        {
+           "x":1593413144000
+        },
+        {
+           "x":1593413145000
+        },
+        {
+           "x":1593413146000
+        },
+        {
+           "x":1593413147000
+        },
+        {
+           "x":1593413148000
+        },
+        {
+           "x":1593413149000
+        },
+        {
+           "x":1593413150000
+        },
+        {
+           "x":1593413151000
+        },
+        {
+           "x":1593413152000
+        },
+        {
+           "x":1593413153000
+        },
+        {
+           "x":1593413154000
+        },
+        {
+           "x":1593413155000
+        },
+        {
+           "x":1593413156000
+        },
+        {
+           "x":1593413157000
+        },
+        {
+           "x":1593413158000
+        },
+        {
+           "x":1593413159000
+        },
+        {
+           "x":1593413160000
+        },
+        {
+           "x":1593413161000
+        },
+        {
+           "x":1593413162000
+        },
+        {
+           "x":1593413163000
+        },
+        {
+           "x":1593413164000
+        },
+        {
+           "x":1593413165000
+        },
+        {
+           "x":1593413166000
+        },
+        {
+           "x":1593413167000
+        },
+        {
+           "x":1593413168000
+        },
+        {
+           "x":1593413169000
+        },
+        {
+           "x":1593413170000
+        },
+        {
+           "x":1593413171000
+        },
+        {
+           "x":1593413172000
+        },
+        {
+           "x":1593413173000
+        },
+        {
+           "x":1593413174000
+        },
+        {
+           "x":1593413175000
+        },
+        {
+           "x":1593413176000
+        },
+        {
+           "x":1593413177000
+        },
+        {
+           "x":1593413178000
+        },
+        {
+           "x":1593413179000
+        },
+        {
+           "x":1593413180000
+        },
+        {
+           "x":1593413181000
+        },
+        {
+           "x":1593413182000
+        },
+        {
+           "x":1593413183000
+        },
+        {
+           "x":1593413184000
+        },
+        {
+           "x":1593413185000
+        },
+        {
+           "x":1593413186000
+        },
+        {
+           "x":1593413187000
+        },
+        {
+           "x":1593413188000
+        },
+        {
+           "x":1593413189000
+        },
+        {
+           "x":1593413190000
+        },
+        {
+           "x":1593413191000
+        },
+        {
+           "x":1593413192000
+        },
+        {
+           "x":1593413193000
+        },
+        {
+           "x":1593413194000
+        },
+        {
+           "x":1593413195000
+        },
+        {
+           "x":1593413196000
+        },
+        {
+           "x":1593413197000
+        },
+        {
+           "x":1593413198000
+        },
+        {
+           "x":1593413199000
+        },
+        {
+           "x":1593413200000
+        },
+        {
+           "x":1593413201000
+        },
+        {
+           "x":1593413202000
+        },
+        {
+           "x":1593413203000
+        },
+        {
+           "x":1593413204000
+        },
+        {
+           "x":1593413205000
+        },
+        {
+           "x":1593413206000
+        },
+        {
+           "x":1593413207000
+        },
+        {
+           "x":1593413208000
+        },
+        {
+           "x":1593413209000
+        },
+        {
+           "x":1593413210000
+        },
+        {
+           "x":1593413211000
+        },
+        {
+           "x":1593413212000
+        },
+        {
+           "x":1593413213000
+        },
+        {
+           "x":1593413214000
+        },
+        {
+           "x":1593413215000
+        },
+        {
+           "x":1593413216000
+        },
+        {
+           "x":1593413217000
+        },
+        {
+           "x":1593413218000
+        },
+        {
+           "x":1593413219000
+        },
+        {
+           "x":1593413220000
+        },
+        {
+           "x":1593413221000
+        },
+        {
+           "x":1593413222000
+        },
+        {
+           "x":1593413223000
+        },
+        {
+           "x":1593413224000
+        },
+        {
+           "x":1593413225000
+        },
+        {
+           "x":1593413226000
+        },
+        {
+           "x":1593413227000
+        },
+        {
+           "x":1593413228000
+        },
+        {
+           "x":1593413229000
+        },
+        {
+           "x":1593413230000
+        },
+        {
+           "x":1593413231000
+        },
+        {
+           "x":1593413232000
+        },
+        {
+           "x":1593413233000
+        },
+        {
+           "x":1593413234000
+        },
+        {
+           "x":1593413235000
+        },
+        {
+           "x":1593413236000
+        },
+        {
+           "x":1593413237000
+        },
+        {
+           "x":1593413238000
+        },
+        {
+           "x":1593413239000
+        },
+        {
+           "x":1593413240000
+        },
+        {
+           "x":1593413241000
+        },
+        {
+           "x":1593413242000
+        },
+        {
+           "x":1593413243000
+        },
+        {
+           "x":1593413244000
+        },
+        {
+           "x":1593413245000
+        },
+        {
+           "x":1593413246000
+        },
+        {
+           "x":1593413247000
+        },
+        {
+           "x":1593413248000
+        },
+        {
+           "x":1593413249000
+        },
+        {
+           "x":1593413250000
+        },
+        {
+           "x":1593413251000
+        },
+        {
+           "x":1593413252000
+        },
+        {
+           "x":1593413253000
+        },
+        {
+           "x":1593413254000
+        },
+        {
+           "x":1593413255000
+        },
+        {
+           "x":1593413256000
+        },
+        {
+           "x":1593413257000
+        },
+        {
+           "x":1593413258000
+        },
+        {
+           "x":1593413259000
+        },
+        {
+           "x":1593413260000
+        },
+        {
+           "x":1593413261000
+        },
+        {
+           "x":1593413262000
+        },
+        {
+           "x":1593413263000
+        },
+        {
+           "x":1593413264000
+        },
+        {
+           "x":1593413265000
+        },
+        {
+           "x":1593413266000
+        },
+        {
+           "x":1593413267000
+        },
+        {
+           "x":1593413268000
+        },
+        {
+           "x":1593413269000
+        },
+        {
+           "x":1593413270000
+        },
+        {
+           "x":1593413271000
+        },
+        {
+           "x":1593413272000
+        },
+        {
+           "x":1593413273000
+        },
+        {
+           "x":1593413274000
+        },
+        {
+           "x":1593413275000
+        },
+        {
+           "x":1593413276000
+        },
+        {
+           "x":1593413277000
+        },
+        {
+           "x":1593413278000
+        },
+        {
+           "x":1593413279000
+        },
+        {
+           "x":1593413280000
+        },
+        {
+           "x":1593413281000
+        },
+        {
+           "x":1593413282000
+        },
+        {
+           "x":1593413283000
+        },
+        {
+           "x":1593413284000
+        },
+        {
+           "x":1593413285000
+        },
+        {
+           "x":1593413286000
+        },
+        {
+           "x":1593413287000,
+           "y":342000
+        },
+        {
+           "x":1593413288000
+        },
+        {
+           "x":1593413289000
+        },
+        {
+           "x":1593413290000
+        },
+        {
+           "x":1593413291000
+        },
+        {
+           "x":1593413292000
+        },
+        {
+           "x":1593413293000
+        },
+        {
+           "x":1593413294000
+        },
+        {
+           "x":1593413295000
+        },
+        {
+           "x":1593413296000
+        },
+        {
+           "x":1593413297000
+        },
+        {
+           "x":1593413298000,
+           "y":173000
+        },
+        {
+           "x":1593413299000
+        },
+        {
+           "x":1593413300000
+        },
+        {
+           "x":1593413301000,
+           "y":109000
+        },
+        {
+           "x":1593413302000
+        },
+        {
+           "x":1593413303000
+        },
+        {
+           "x":1593413304000
+        },
+        {
+           "x":1593413305000
+        },
+        {
+           "x":1593413306000
+        },
+        {
+           "x":1593413307000
+        },
+        {
+           "x":1593413308000
+        },
+        {
+           "x":1593413309000
+        },
+        {
+           "x":1593413310000
+        },
+        {
+           "x":1593413311000
+        },
+        {
+           "x":1593413312000
+        },
+        {
+           "x":1593413313000
+        },
+        {
+           "x":1593413314000
+        },
+        {
+           "x":1593413315000
+        },
+        {
+           "x":1593413316000
+        },
+        {
+           "x":1593413317000
+        },
+        {
+           "x":1593413318000,
+           "y":140000
+        },
+        {
+           "x":1593413319000
+        },
+        {
+           "x":1593413320000
+        },
+        {
+           "x":1593413321000
+        },
+        {
+           "x":1593413322000
+        },
+        {
+           "x":1593413323000
+        },
+        {
+           "x":1593413324000
+        },
+        {
+           "x":1593413325000
+        },
+        {
+           "x":1593413326000
+        },
+        {
+           "x":1593413327000
+        },
+        {
+           "x":1593413328000,
+           "y":77000
+        },
+        {
+           "x":1593413329000
+        },
+        {
+           "x":1593413330000
+        },
+        {
+           "x":1593413331000
+        },
+        {
+           "x":1593413332000
+        },
+        {
+           "x":1593413333000
+        },
+        {
+           "x":1593413334000
+        },
+        {
+           "x":1593413335000
+        },
+        {
+           "x":1593413336000
+        },
+        {
+           "x":1593413337000
+        },
+        {
+           "x":1593413338000
+        },
+        {
+           "x":1593413339000
+        },
+        {
+           "x":1593413340000
+        }
+     ]
+  }
+]
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser_transaction_name.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser_transaction_name.json
new file mode 100644
index 0000000000000..107302831d55f
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/avg_duration_by_browser_transaction_name.json
@@ -0,0 +1,731 @@
+[
+   {
+      "title":"HeadlessChrome",
+      "data":[
+         {
+            "x":1593413100000
+         },
+         {
+            "x":1593413101000
+         },
+         {
+            "x":1593413102000
+         },
+         {
+            "x":1593413103000
+         },
+         {
+            "x":1593413104000
+         },
+         {
+            "x":1593413105000
+         },
+         {
+            "x":1593413106000
+         },
+         {
+            "x":1593413107000
+         },
+         {
+            "x":1593413108000
+         },
+         {
+            "x":1593413109000
+         },
+         {
+            "x":1593413110000
+         },
+         {
+            "x":1593413111000
+         },
+         {
+            "x":1593413112000
+         },
+         {
+            "x":1593413113000
+         },
+         {
+            "x":1593413114000
+         },
+         {
+            "x":1593413115000
+         },
+         {
+            "x":1593413116000
+         },
+         {
+            "x":1593413117000
+         },
+         {
+            "x":1593413118000
+         },
+         {
+            "x":1593413119000
+         },
+         {
+            "x":1593413120000
+         },
+         {
+            "x":1593413121000
+         },
+         {
+            "x":1593413122000
+         },
+         {
+            "x":1593413123000
+         },
+         {
+            "x":1593413124000
+         },
+         {
+            "x":1593413125000
+         },
+         {
+            "x":1593413126000
+         },
+         {
+            "x":1593413127000
+         },
+         {
+            "x":1593413128000
+         },
+         {
+            "x":1593413129000
+         },
+         {
+            "x":1593413130000
+         },
+         {
+            "x":1593413131000
+         },
+         {
+            "x":1593413132000
+         },
+         {
+            "x":1593413133000
+         },
+         {
+            "x":1593413134000
+         },
+         {
+            "x":1593413135000
+         },
+         {
+            "x":1593413136000
+         },
+         {
+            "x":1593413137000
+         },
+         {
+            "x":1593413138000
+         },
+         {
+            "x":1593413139000
+         },
+         {
+            "x":1593413140000
+         },
+         {
+            "x":1593413141000
+         },
+         {
+            "x":1593413142000
+         },
+         {
+            "x":1593413143000
+         },
+         {
+            "x":1593413144000
+         },
+         {
+            "x":1593413145000
+         },
+         {
+            "x":1593413146000
+         },
+         {
+            "x":1593413147000
+         },
+         {
+            "x":1593413148000
+         },
+         {
+            "x":1593413149000
+         },
+         {
+            "x":1593413150000
+         },
+         {
+            "x":1593413151000
+         },
+         {
+            "x":1593413152000
+         },
+         {
+            "x":1593413153000
+         },
+         {
+            "x":1593413154000
+         },
+         {
+            "x":1593413155000
+         },
+         {
+            "x":1593413156000
+         },
+         {
+            "x":1593413157000
+         },
+         {
+            "x":1593413158000
+         },
+         {
+            "x":1593413159000
+         },
+         {
+            "x":1593413160000
+         },
+         {
+            "x":1593413161000
+         },
+         {
+            "x":1593413162000
+         },
+         {
+            "x":1593413163000
+         },
+         {
+            "x":1593413164000
+         },
+         {
+            "x":1593413165000
+         },
+         {
+            "x":1593413166000
+         },
+         {
+            "x":1593413167000
+         },
+         {
+            "x":1593413168000
+         },
+         {
+            "x":1593413169000
+         },
+         {
+            "x":1593413170000
+         },
+         {
+            "x":1593413171000
+         },
+         {
+            "x":1593413172000
+         },
+         {
+            "x":1593413173000
+         },
+         {
+            "x":1593413174000
+         },
+         {
+            "x":1593413175000
+         },
+         {
+            "x":1593413176000
+         },
+         {
+            "x":1593413177000
+         },
+         {
+            "x":1593413178000
+         },
+         {
+            "x":1593413179000
+         },
+         {
+            "x":1593413180000
+         },
+         {
+            "x":1593413181000
+         },
+         {
+            "x":1593413182000
+         },
+         {
+            "x":1593413183000
+         },
+         {
+            "x":1593413184000
+         },
+         {
+            "x":1593413185000
+         },
+         {
+            "x":1593413186000
+         },
+         {
+            "x":1593413187000
+         },
+         {
+            "x":1593413188000
+         },
+         {
+            "x":1593413189000
+         },
+         {
+            "x":1593413190000
+         },
+         {
+            "x":1593413191000
+         },
+         {
+            "x":1593413192000
+         },
+         {
+            "x":1593413193000
+         },
+         {
+            "x":1593413194000
+         },
+         {
+            "x":1593413195000
+         },
+         {
+            "x":1593413196000
+         },
+         {
+            "x":1593413197000
+         },
+         {
+            "x":1593413198000
+         },
+         {
+            "x":1593413199000
+         },
+         {
+            "x":1593413200000
+         },
+         {
+            "x":1593413201000
+         },
+         {
+            "x":1593413202000
+         },
+         {
+            "x":1593413203000
+         },
+         {
+            "x":1593413204000
+         },
+         {
+            "x":1593413205000
+         },
+         {
+            "x":1593413206000
+         },
+         {
+            "x":1593413207000
+         },
+         {
+            "x":1593413208000
+         },
+         {
+            "x":1593413209000
+         },
+         {
+            "x":1593413210000
+         },
+         {
+            "x":1593413211000
+         },
+         {
+            "x":1593413212000
+         },
+         {
+            "x":1593413213000
+         },
+         {
+            "x":1593413214000
+         },
+         {
+            "x":1593413215000
+         },
+         {
+            "x":1593413216000
+         },
+         {
+            "x":1593413217000
+         },
+         {
+            "x":1593413218000
+         },
+         {
+            "x":1593413219000
+         },
+         {
+            "x":1593413220000
+         },
+         {
+            "x":1593413221000
+         },
+         {
+            "x":1593413222000
+         },
+         {
+            "x":1593413223000
+         },
+         {
+            "x":1593413224000
+         },
+         {
+            "x":1593413225000
+         },
+         {
+            "x":1593413226000
+         },
+         {
+            "x":1593413227000
+         },
+         {
+            "x":1593413228000
+         },
+         {
+            "x":1593413229000
+         },
+         {
+            "x":1593413230000
+         },
+         {
+            "x":1593413231000
+         },
+         {
+            "x":1593413232000
+         },
+         {
+            "x":1593413233000
+         },
+         {
+            "x":1593413234000
+         },
+         {
+            "x":1593413235000
+         },
+         {
+            "x":1593413236000
+         },
+         {
+            "x":1593413237000
+         },
+         {
+            "x":1593413238000
+         },
+         {
+            "x":1593413239000
+         },
+         {
+            "x":1593413240000
+         },
+         {
+            "x":1593413241000
+         },
+         {
+            "x":1593413242000
+         },
+         {
+            "x":1593413243000
+         },
+         {
+            "x":1593413244000
+         },
+         {
+            "x":1593413245000
+         },
+         {
+            "x":1593413246000
+         },
+         {
+            "x":1593413247000
+         },
+         {
+            "x":1593413248000
+         },
+         {
+            "x":1593413249000
+         },
+         {
+            "x":1593413250000
+         },
+         {
+            "x":1593413251000
+         },
+         {
+            "x":1593413252000
+         },
+         {
+            "x":1593413253000
+         },
+         {
+            "x":1593413254000
+         },
+         {
+            "x":1593413255000
+         },
+         {
+            "x":1593413256000
+         },
+         {
+            "x":1593413257000
+         },
+         {
+            "x":1593413258000
+         },
+         {
+            "x":1593413259000
+         },
+         {
+            "x":1593413260000
+         },
+         {
+            "x":1593413261000
+         },
+         {
+            "x":1593413262000
+         },
+         {
+            "x":1593413263000
+         },
+         {
+            "x":1593413264000
+         },
+         {
+            "x":1593413265000
+         },
+         {
+            "x":1593413266000
+         },
+         {
+            "x":1593413267000
+         },
+         {
+            "x":1593413268000
+         },
+         {
+            "x":1593413269000
+         },
+         {
+            "x":1593413270000
+         },
+         {
+            "x":1593413271000
+         },
+         {
+            "x":1593413272000
+         },
+         {
+            "x":1593413273000
+         },
+         {
+            "x":1593413274000
+         },
+         {
+            "x":1593413275000
+         },
+         {
+            "x":1593413276000
+         },
+         {
+            "x":1593413277000
+         },
+         {
+            "x":1593413278000
+         },
+         {
+            "x":1593413279000
+         },
+         {
+            "x":1593413280000
+         },
+         {
+            "x":1593413281000
+         },
+         {
+            "x":1593413282000
+         },
+         {
+            "x":1593413283000
+         },
+         {
+            "x":1593413284000
+         },
+         {
+            "x":1593413285000
+         },
+         {
+            "x":1593413286000
+         },
+         {
+            "x":1593413287000
+         },
+         {
+            "x":1593413288000
+         },
+         {
+            "x":1593413289000
+         },
+         {
+            "x":1593413290000
+         },
+         {
+            "x":1593413291000
+         },
+         {
+            "x":1593413292000
+         },
+         {
+            "x":1593413293000
+         },
+         {
+            "x":1593413294000
+         },
+         {
+            "x":1593413295000
+         },
+         {
+            "x":1593413296000
+         },
+         {
+            "x":1593413297000
+         },
+         {
+            "x":1593413298000
+         },
+         {
+            "x":1593413299000
+         },
+         {
+            "x":1593413300000
+         },
+         {
+            "x":1593413301000
+         },
+         {
+            "x":1593413302000
+         },
+         {
+            "x":1593413303000
+         },
+         {
+            "x":1593413304000
+         },
+         {
+            "x":1593413305000
+         },
+         {
+            "x":1593413306000
+         },
+         {
+            "x":1593413307000
+         },
+         {
+            "x":1593413308000
+         },
+         {
+            "x":1593413309000
+         },
+         {
+            "x":1593413310000
+         },
+         {
+            "x":1593413311000
+         },
+         {
+            "x":1593413312000
+         },
+         {
+            "x":1593413313000
+         },
+         {
+            "x":1593413314000
+         },
+         {
+            "x":1593413315000
+         },
+         {
+            "x":1593413316000
+         },
+         {
+            "x":1593413317000
+         },
+         {
+            "x":1593413318000
+         },
+         {
+            "x":1593413319000
+         },
+         {
+            "x":1593413320000
+         },
+         {
+            "x":1593413321000
+         },
+         {
+            "x":1593413322000
+         },
+         {
+            "x":1593413323000
+         },
+         {
+            "x":1593413324000
+         },
+         {
+            "x":1593413325000
+         },
+         {
+            "x":1593413326000
+         },
+         {
+            "x":1593413327000
+         },
+         {
+            "x":1593413328000,
+            "y":77000
+         },
+         {
+            "x":1593413329000
+         },
+         {
+            "x":1593413330000
+         },
+         {
+            "x":1593413331000
+         },
+         {
+            "x":1593413332000
+         },
+         {
+            "x":1593413333000
+         },
+         {
+            "x":1593413334000
+         },
+         {
+            "x":1593413335000
+         },
+         {
+            "x":1593413336000
+         },
+         {
+            "x":1593413337000
+         },
+         {
+            "x":1593413338000
+         },
+         {
+            "x":1593413339000
+         },
+         {
+            "x":1593413340000
+         }
+      ]
+   }
+]
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
new file mode 100644
index 0000000000000..3b884a9eb7907
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown.json
@@ -0,0 +1,202 @@
+{
+  "kpis":[
+     {
+        "name":"app",
+        "percentage":0.16700861715223636,
+        "color":"#54b399"
+     },
+     {
+        "name":"http",
+        "percentage":0.7702092736971686,
+        "color":"#6092c0"
+     },
+     {
+        "name":"postgresql",
+        "percentage":0.0508822322527698,
+        "color":"#d36086"
+     },
+     {
+        "name":"redis",
+        "percentage":0.011899876897825195,
+        "color":"#9170b8"
+     }
+  ],
+  "timeseries":[
+     {
+        "title":"app",
+        "color":"#54b399",
+        "type":"areaStacked",
+        "data":[
+           {
+              "x":1593413100000,
+              "y":null
+           },
+           {
+              "x":1593413130000,
+              "y":null
+           },
+           {
+              "x":1593413160000,
+              "y":null
+           },
+           {
+              "x":1593413190000,
+              "y":null
+           },
+           {
+              "x":1593413220000,
+              "y":null
+           },
+           {
+              "x":1593413250000,
+              "y":null
+           },
+           {
+              "x":1593413280000,
+              "y":null
+           },
+           {
+              "x":1593413310000,
+              "y":0.16700861715223636
+           },
+           {
+              "x":1593413340000,
+              "y":null
+           }
+        ],
+        "hideLegend":true
+     },
+     {
+        "title":"http",
+        "color":"#6092c0",
+        "type":"areaStacked",
+        "data":[
+           {
+              "x":1593413100000,
+              "y":null
+           },
+           {
+              "x":1593413130000,
+              "y":null
+           },
+           {
+              "x":1593413160000,
+              "y":null
+           },
+           {
+              "x":1593413190000,
+              "y":null
+           },
+           {
+              "x":1593413220000,
+              "y":null
+           },
+           {
+              "x":1593413250000,
+              "y":null
+           },
+           {
+              "x":1593413280000,
+              "y":null
+           },
+           {
+              "x":1593413310000,
+              "y":0.7702092736971686
+           },
+           {
+              "x":1593413340000,
+              "y":null
+           }
+        ],
+        "hideLegend":true
+     },
+     {
+        "title":"postgresql",
+        "color":"#d36086",
+        "type":"areaStacked",
+        "data":[
+           {
+              "x":1593413100000,
+              "y":null
+           },
+           {
+              "x":1593413130000,
+              "y":null
+           },
+           {
+              "x":1593413160000,
+              "y":null
+           },
+           {
+              "x":1593413190000,
+              "y":null
+           },
+           {
+              "x":1593413220000,
+              "y":null
+           },
+           {
+              "x":1593413250000,
+              "y":null
+           },
+           {
+              "x":1593413280000,
+              "y":null
+           },
+           {
+              "x":1593413310000,
+              "y":0.0508822322527698
+           },
+           {
+              "x":1593413340000,
+              "y":null
+           }
+        ],
+        "hideLegend":true
+     },
+     {
+        "title":"redis",
+        "color":"#9170b8",
+        "type":"areaStacked",
+        "data":[
+           {
+              "x":1593413100000,
+              "y":null
+           },
+           {
+              "x":1593413130000,
+              "y":null
+           },
+           {
+              "x":1593413160000,
+              "y":null
+           },
+           {
+              "x":1593413190000,
+              "y":null
+           },
+           {
+              "x":1593413220000,
+              "y":null
+           },
+           {
+              "x":1593413250000,
+              "y":null
+           },
+           {
+              "x":1593413280000,
+              "y":null
+           },
+           {
+              "x":1593413310000,
+              "y":0.011899876897825195
+           },
+           {
+              "x":1593413340000,
+              "y":null
+           }
+        ],
+        "hideLegend":true
+     }
+  ]
+}
\ No newline at end of file
diff --git a/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json
new file mode 100644
index 0000000000000..b4f8e376d3609
--- /dev/null
+++ b/x-pack/test/apm_api_integration/basic/tests/transaction_groups/expectation/breakdown_transaction_name.json
@@ -0,0 +1,55 @@
+{
+  "kpis":[
+     {
+        "name":"app",
+        "percentage":1,
+        "color":"#54b399"
+     }
+  ],
+  "timeseries":[
+     {
+        "title":"app",
+        "color":"#54b399",
+        "type":"areaStacked",
+        "data":[
+           {
+              "x":1593413100000,
+              "y":null
+           },
+           {
+              "x":1593413130000,
+              "y":null
+           },
+           {
+              "x":1593413160000,
+              "y":null
+           },
+           {
+              "x":1593413190000,
+              "y":null
+           },
+           {
+              "x":1593413220000,
+              "y":null
+           },
+           {
+              "x":1593413250000,
+              "y":null
+           },
+           {
+              "x":1593413280000,
+              "y":null
+           },
+           {
+              "x":1593413310000,
+              "y":1
+           },
+           {
+              "x":1593413340000,
+              "y":null
+           }
+        ],
+        "hideLegend":true
+     }
+  ]
+}
\ No newline at end of file

From 82dd173b2a0cd0f69d793001afe0ee045724f3d1 Mon Sep 17 00:00:00 2001
From: Poff Poffenberger <poffdeluxe@gmail.com>
Date: Wed, 22 Jul 2020 08:05:53 -0500
Subject: [PATCH 32/34] Use server basepath  when creating reporting jobs
 (#72722)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../reporting/server/export_types/png/create_job/index.ts      | 3 +--
 .../server/export_types/printable_pdf/create_job/index.ts      | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts b/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
index b63f2a09041b3..9227354520b6e 100644
--- a/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/png/create_job/index.ts
@@ -13,7 +13,6 @@ export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ESQueueCreateJobFn<
   JobParamsPNG
 >> = function createJobFactoryFn(reporting) {
   const config = reporting.getConfig();
-  const setupDeps = reporting.getPluginSetupDeps();
   const crypto = cryptoFactory(config.get('encryptionKey'));
 
   return async function scheduleTask(
@@ -32,7 +31,7 @@ export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ESQueueCreateJobFn<
       headers: serializedEncryptedHeaders,
       browserTimezone,
       layout,
-      basePath: setupDeps.basePath(req),
+      basePath: config.kbnConfig.get('server', 'basePath'),
       forceNow: new Date().toISOString(),
     };
   };
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
index aa88ef863d32b..4540983129ebc 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/create_job/index.ts
@@ -13,7 +13,6 @@ export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ESQueueCreateJobFn<
   JobParamsPDF
 >> = function createJobFactoryFn(reporting) {
   const config = reporting.getConfig();
-  const setupDeps = reporting.getPluginSetupDeps();
   const crypto = cryptoFactory(config.get('encryptionKey'));
 
   return async function scheduleTaskFn(
@@ -26,7 +25,7 @@ export const scheduleTaskFnFactory: ScheduleTaskFnFactory<ESQueueCreateJobFn<
     validateUrls(relativeUrls);
 
     return {
-      basePath: setupDeps.basePath(req),
+      basePath: config.kbnConfig.get('server', 'basePath'),
       browserTimezone,
       forceNow: new Date().toISOString(),
       headers: serializedEncryptedHeaders,

From 670520a25344b50703a90765938064311334d331 Mon Sep 17 00:00:00 2001
From: Chris Roberson <chrisronline@gmail.com>
Date: Wed, 22 Jul 2020 09:24:14 -0400
Subject: [PATCH 33/34] [Monitoring] Revert direct shipping code (#72505)

* Backout these changes

* Fix test
---
 .../plugins/monitoring/server/config.test.ts  | 35 --------
 x-pack/plugins/monitoring/server/config.ts    |  2 -
 .../__tests__/bulk_uploader.js                | 89 -------------------
 .../server/kibana_monitoring/bulk_uploader.js | 25 +-----
 .../lib/send_bulk_payload.js                  | 56 +-----------
 5 files changed, 5 insertions(+), 202 deletions(-)

diff --git a/x-pack/plugins/monitoring/server/config.test.ts b/x-pack/plugins/monitoring/server/config.test.ts
index 16d52f684109e..32b8691bd6049 100644
--- a/x-pack/plugins/monitoring/server/config.test.ts
+++ b/x-pack/plugins/monitoring/server/config.test.ts
@@ -27,33 +27,6 @@ describe('config schema', () => {
           },
           "enabled": true,
         },
-        "elasticsearch": Object {
-          "apiVersion": "master",
-          "customHeaders": Object {},
-          "healthCheck": Object {
-            "delay": "PT2.5S",
-          },
-          "ignoreVersionMismatch": false,
-          "logFetchCount": 10,
-          "logQueries": false,
-          "pingTimeout": "PT30S",
-          "preserveHost": true,
-          "requestHeadersWhitelist": Array [
-            "authorization",
-          ],
-          "requestTimeout": "PT30S",
-          "shardTimeout": "PT30S",
-          "sniffInterval": false,
-          "sniffOnConnectionFault": false,
-          "sniffOnStart": false,
-          "ssl": Object {
-            "alwaysPresentCertificate": false,
-            "keystore": Object {},
-            "truststore": Object {},
-            "verificationMode": "full",
-          },
-          "startupTimeout": "PT5S",
-        },
         "enabled": true,
         "kibana": Object {
           "collection": Object {
@@ -125,9 +98,6 @@ describe('createConfig()', () => {
   it('should wrap in Elasticsearch config', async () => {
     const config = createConfig(
       configSchema.validate({
-        elasticsearch: {
-          hosts: 'http://localhost:9200',
-        },
         ui: {
           elasticsearch: {
             hosts: 'http://localhost:9200',
@@ -135,7 +105,6 @@ describe('createConfig()', () => {
         },
       })
     );
-    expect(config.elasticsearch.hosts).toEqual(['http://localhost:9200']);
     expect(config.ui.elasticsearch.hosts).toEqual(['http://localhost:9200']);
   });
 
@@ -147,9 +116,6 @@ describe('createConfig()', () => {
     };
     const config = createConfig(
       configSchema.validate({
-        elasticsearch: {
-          ssl,
-        },
         ui: {
           elasticsearch: {
             ssl,
@@ -162,7 +128,6 @@ describe('createConfig()', () => {
       key: 'contents-of-packages/kbn-dev-utils/certs/elasticsearch.key',
       certificateAuthorities: ['contents-of-packages/kbn-dev-utils/certs/ca.crt'],
     });
-    expect(config.elasticsearch.ssl).toEqual(expected);
     expect(config.ui.elasticsearch.ssl).toEqual(expected);
   });
 });
diff --git a/x-pack/plugins/monitoring/server/config.ts b/x-pack/plugins/monitoring/server/config.ts
index a430be8da6a5f..789211c43db31 100644
--- a/x-pack/plugins/monitoring/server/config.ts
+++ b/x-pack/plugins/monitoring/server/config.ts
@@ -21,7 +21,6 @@ export const monitoringElasticsearchConfigSchema = elasticsearchConfigSchema.ext
 
 export const configSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
-  elasticsearch: monitoringElasticsearchConfigSchema,
   ui: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
     ccs: schema.object({
@@ -86,7 +85,6 @@ export type MonitoringConfig = ReturnType<typeof createConfig>;
 export function createConfig(config: TypeOf<typeof configSchema>) {
   return {
     ...config,
-    elasticsearch: new ElasticsearchConfig(config.elasticsearch as ElasticsearchConfigType),
     ui: {
       ...config.ui,
       elasticsearch: new MonitoringElasticsearchConfig(config.ui.elasticsearch),
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/__tests__/bulk_uploader.js b/x-pack/plugins/monitoring/server/kibana_monitoring/__tests__/bulk_uploader.js
index 3421f5d3830d6..da12bde966091 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/__tests__/bulk_uploader.js
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/__tests__/bulk_uploader.js
@@ -6,10 +6,8 @@
 
 import { noop } from 'lodash';
 import sinon from 'sinon';
-import moment from 'moment';
 import expect from '@kbn/expect';
 import { BulkUploader } from '../bulk_uploader';
-import { MONITORING_SYSTEM_API_VERSION } from '../../../common/constants';
 
 const FETCH_INTERVAL = 300;
 const CHECK_DELAY = 500;
@@ -314,92 +312,5 @@ describe('BulkUploader', () => {
         done();
       }, CHECK_DELAY);
     });
-
-    it('uses a direct connection to the monitoring cluster, when configured', (done) => {
-      const dateInIndex = '2020.02.10';
-      const oldNow = moment.now;
-      moment.now = () => 1581310800000;
-      const prodClusterUuid = '1sdfd5';
-      const prodCluster = {
-        callWithInternalUser: sinon
-          .stub()
-          .withArgs('monitoring.bulk')
-          .callsFake((arg) => {
-            let resolution = null;
-            if (arg === 'info') {
-              resolution = { cluster_uuid: prodClusterUuid };
-            }
-            return new Promise((resolve) => resolve(resolution));
-          }),
-      };
-      const monitoringCluster = {
-        callWithInternalUser: sinon
-          .stub()
-          .withArgs('bulk')
-          .callsFake(() => {
-            return new Promise((resolve) => setTimeout(resolve, CHECK_DELAY + 1));
-          }),
-      };
-
-      const collectorFetch = sinon.stub().returns({
-        type: 'kibana_stats',
-        result: { type: 'kibana_stats', payload: { testData: 12345 } },
-      });
-
-      const collectors = new MockCollectorSet(server, [
-        {
-          fetch: collectorFetch,
-          isReady: () => true,
-          formatForBulkUpload: (result) => result,
-          isUsageCollector: false,
-        },
-      ]);
-      const customServer = {
-        ...server,
-        elasticsearchPlugin: {
-          createCluster: () => monitoringCluster,
-          getCluster: (name) => {
-            if (name === 'admin' || name === 'data') {
-              return prodCluster;
-            }
-            return monitoringCluster;
-          },
-        },
-        config: {
-          get: (key) => {
-            if (key === 'monitoring.elasticsearch') {
-              return {
-                hosts: ['http://localhost:9200'],
-                username: 'tester',
-                password: 'testing',
-                ssl: {},
-              };
-            }
-            return null;
-          },
-        },
-      };
-      const kbnServerStatus = { toJSON: () => ({ overall: { state: 'green' } }) };
-      const kbnServerVersion = 'master';
-      const uploader = new BulkUploader({
-        ...customServer,
-        interval: FETCH_INTERVAL,
-        kbnServerStatus,
-        kbnServerVersion,
-      });
-      uploader.start(collectors);
-      setTimeout(() => {
-        uploader.stop();
-        const firstCallArgs = monitoringCluster.callWithInternalUser.firstCall.args;
-        expect(firstCallArgs[0]).to.be('bulk');
-        expect(firstCallArgs[1].body[0].index._index).to.be(
-          `.monitoring-kibana-${MONITORING_SYSTEM_API_VERSION}-${dateInIndex}`
-        );
-        expect(firstCallArgs[1].body[1].type).to.be('kibana_stats');
-        expect(firstCallArgs[1].body[1].cluster_uuid).to.be(prodClusterUuid);
-        moment.now = oldNow;
-        done();
-      }, CHECK_DELAY);
-    });
   });
 });
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/bulk_uploader.js b/x-pack/plugins/monitoring/server/kibana_monitoring/bulk_uploader.js
index 6035837bac85d..b23b4fc888120 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/bulk_uploader.js
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/bulk_uploader.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { defaultsDeep, uniq, compact, get } from 'lodash';
+import { defaultsDeep, uniq, compact } from 'lodash';
 
 import {
   TELEMETRY_COLLECTION_INTERVAL,
@@ -12,7 +12,6 @@ import {
 } from '../../common/constants';
 
 import { sendBulkPayload, monitoringBulk } from './lib';
-import { hasMonitoringCluster } from '../es_client/instantiate_client';
 
 /*
  * Handles internal Kibana stats collection and uploading data to Monitoring
@@ -31,13 +30,11 @@ import { hasMonitoringCluster } from '../es_client/instantiate_client';
  * @param {Object} xpackInfo server.plugins.xpack_main.info object
  */
 export class BulkUploader {
-  constructor({ config, log, interval, elasticsearch, kibanaStats }) {
+  constructor({ log, interval, elasticsearch, kibanaStats }) {
     if (typeof interval !== 'number') {
       throw new Error('interval number of milliseconds is required');
     }
 
-    this._hasDirectConnectionToMonitoringCluster = false;
-    this._productionClusterUuid = null;
     this._timer = null;
     // Hold sending and fetching usage until monitoring.bulk is successful. This means that we
     // send usage data on the second tick. But would save a lot of bandwidth fetching usage on
@@ -54,15 +51,6 @@ export class BulkUploader {
       plugins: [monitoringBulk],
     });
 
-    if (hasMonitoringCluster(config.elasticsearch)) {
-      this._log.info(`Detected direct connection to monitoring cluster`);
-      this._hasDirectConnectionToMonitoringCluster = true;
-      this._cluster = elasticsearch.legacy.createClient('monitoring-direct', config.elasticsearch);
-      elasticsearch.legacy.client.callAsInternalUser('info').then((data) => {
-        this._productionClusterUuid = get(data, 'cluster_uuid');
-      });
-    }
-
     this.kibanaStats = kibanaStats;
     this.kibanaStatusGetter = null;
   }
@@ -181,14 +169,7 @@ export class BulkUploader {
   }
 
   async _onPayload(payload) {
-    return await sendBulkPayload(
-      this._cluster,
-      this._interval,
-      payload,
-      this._log,
-      this._hasDirectConnectionToMonitoringCluster,
-      this._productionClusterUuid
-    );
+    return await sendBulkPayload(this._cluster, this._interval, payload, this._log);
   }
 
   getKibanaStats(type) {
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/lib/send_bulk_payload.js b/x-pack/plugins/monitoring/server/kibana_monitoring/lib/send_bulk_payload.js
index 9607b45d7e408..66799e4aa651a 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/lib/send_bulk_payload.js
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/lib/send_bulk_payload.js
@@ -3,64 +3,12 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import moment from 'moment';
-import { chunk, get } from 'lodash';
-import {
-  MONITORING_SYSTEM_API_VERSION,
-  KIBANA_SYSTEM_ID,
-  KIBANA_STATS_TYPE_MONITORING,
-  KIBANA_SETTINGS_TYPE,
-} from '../../../common/constants';
-
-const SUPPORTED_TYPES = [KIBANA_STATS_TYPE_MONITORING, KIBANA_SETTINGS_TYPE];
-export function formatForNormalBulkEndpoint(payload, productionClusterUuid) {
-  const dateSuffix = moment.utc().format('YYYY.MM.DD');
-  return chunk(payload, 2).reduce((accum, chunk) => {
-    const type = get(chunk[0], 'index._type');
-    if (!type || !SUPPORTED_TYPES.includes(type)) {
-      return accum;
-    }
-
-    const { timestamp } = chunk[1];
-
-    accum.push({
-      index: {
-        _index: `.monitoring-kibana-${MONITORING_SYSTEM_API_VERSION}-${dateSuffix}`,
-      },
-    });
-    accum.push({
-      [type]: chunk[1],
-      type,
-      timestamp,
-      cluster_uuid: productionClusterUuid,
-    });
-    return accum;
-  }, []);
-}
+import { MONITORING_SYSTEM_API_VERSION, KIBANA_SYSTEM_ID } from '../../../common/constants';
 
 /*
  * Send the Kibana usage data to the ES Monitoring Bulk endpoint
  */
-export async function sendBulkPayload(
-  cluster,
-  interval,
-  payload,
-  log,
-  hasDirectConnectionToMonitoringCluster = false,
-  productionClusterUuid = null
-) {
-  if (hasDirectConnectionToMonitoringCluster) {
-    if (productionClusterUuid === null) {
-      log.warn(
-        `Unable to determine production cluster uuid to use for shipping monitoring data. Kibana monitoring data will appear in a standalone cluster in the Stack Monitoring UI.`
-      );
-    }
-    const formattedPayload = formatForNormalBulkEndpoint(payload, productionClusterUuid);
-    return await cluster.callAsInternalUser('bulk', {
-      body: formattedPayload,
-    });
-  }
-
+export async function sendBulkPayload(cluster, interval, payload) {
   return cluster.callAsInternalUser('monitoring.bulk', {
     system_id: KIBANA_SYSTEM_ID,
     system_api_version: MONITORING_SYSTEM_API_VERSION,

From 4abe864f106b4f5fe623e546a4ffdf1277239f58 Mon Sep 17 00:00:00 2001
From: Gidi Meir Morris <github@gidi.io>
Date: Wed, 22 Jul 2020 14:45:57 +0100
Subject: [PATCH 34/34] Adds Role Based Access-Control to the Alerting & Action
 plugins based on Kibana Feature Controls (#67157)

This PR adds _Role Based Access-Control_ to the Alerting framework & Actions feature using  Kibana Feature Controls, addressing most of the Meta issue: https://github.com/elastic/kibana/issues/43994

This also closes https://github.com/elastic/kibana/issues/62438

This PR includes the following:

1. Adds `alerting` specific Security Actions (not to be confused with Alerting Actions) to the `security` plugin which allows us to assign alerting specific privileges to users of other plugins using the `features` plugin.
2. Removes the security wrapper from the savedObjectsClient in AlertsClient and instead plugs in the new AlertsAuthorization which performs the privilege checks on each api call made to the AlertsClient.
3. Adds privileges in each plugin that is already using the Alerting Framework which mirror (as closely as possible) the existing api-level tag-based privileges and plugs them into the AlertsClient.
4. Adds feature granted privileges arounds Actions (by relying on Saved Object privileges under the hood) and plugs them into the ActionsClient
5. Removes the legacy api-level tag-based privilege system from both the Alerts and Action HTTP APIs
---
 examples/alerting_example/kibana.json         |    2 +-
 examples/alerting_example/server/plugin.ts    |   38 +-
 x-pack/plugins/actions/kibana.json            |    4 +-
 .../actions/server/actions_client.mock.ts     |    1 +
 .../actions/server/actions_client.test.ts     |  541 ++++++-
 .../plugins/actions/server/actions_client.ts  |   53 +-
 .../actions_authorization.mock.ts             |   22 +
 .../actions_authorization.test.ts             |  191 +++
 .../authorization/actions_authorization.ts    |   59 +
 .../server/authorization/audit_logger.mock.ts |   22 +
 .../server/authorization/audit_logger.test.ts |   75 +
 .../server/authorization/audit_logger.ts      |   66 +
 .../actions/server/create_execute_function.ts |   14 +-
 x-pack/plugins/actions/server/feature.ts      |   41 +
 x-pack/plugins/actions/server/index.ts        |    2 +
 .../server/lib/action_executor.test.ts        |   64 +-
 .../actions/server/lib/action_executor.ts     |   17 +-
 .../server/lib/task_runner_factory.test.ts    |    3 +-
 .../actions/server/lib/task_runner_factory.ts |    7 +-
 x-pack/plugins/actions/server/mocks.ts        |    5 +
 x-pack/plugins/actions/server/plugin.test.ts  |    3 +
 x-pack/plugins/actions/server/plugin.ts       |   97 +-
 .../actions/server/routes/create.test.ts      |    7 -
 .../plugins/actions/server/routes/create.ts   |    3 -
 .../actions/server/routes/delete.test.ts      |    7 -
 .../plugins/actions/server/routes/delete.ts   |    3 -
 .../actions/server/routes/execute.test.ts     |    7 -
 .../plugins/actions/server/routes/execute.ts  |    3 -
 .../plugins/actions/server/routes/get.test.ts |    7 -
 x-pack/plugins/actions/server/routes/get.ts   |    3 -
 .../actions/server/routes/get_all.test.ts     |   21 -
 .../plugins/actions/server/routes/get_all.ts  |    3 -
 .../server/routes/list_action_types.test.ts   |   38 +-
 .../server/routes/list_action_types.ts        |    6 +-
 .../actions/server/routes/update.test.ts      |    7 -
 .../plugins/actions/server/routes/update.ts   |    3 -
 .../actions/server/saved_objects/index.ts     |   11 +-
 .../plugins/alerting_builtins/common/index.ts |    7 +
 x-pack/plugins/alerting_builtins/kibana.json  |    2 +-
 .../alert_types/index_threshold/alert_type.ts |    6 +-
 .../alerting_builtins/server/feature.ts       |   49 +
 .../plugins/alerting_builtins/server/index.ts |    1 +
 .../alerting_builtins/server/plugin.test.ts   |   12 +-
 .../alerting_builtins/server/plugin.ts        |    8 +-
 .../plugins/alerting_builtins/server/types.ts |    2 +
 x-pack/plugins/alerts/README.md               |  109 +-
 x-pack/plugins/alerts/common/index.ts         |    1 +
 x-pack/plugins/alerts/kibana.json             |    2 +-
 .../plugins/alerts/public/alert_api.test.ts   |    8 +-
 .../alert_navigation_registry.test.ts         |    2 +-
 .../alerts/server/alert_type_registry.test.ts |   80 +-
 .../alerts/server/alert_type_registry.ts      |   57 +-
 .../alerts/server/alerts_client.mock.ts       |    1 +
 .../alerts/server/alerts_client.test.ts       | 1414 ++++++++++++++---
 x-pack/plugins/alerts/server/alerts_client.ts |  291 +++-
 .../server/alerts_client_factory.test.ts      |  119 +-
 .../alerts/server/alerts_client_factory.ts    |   38 +-
 .../alerts_authorization.mock.ts              |   25 +
 .../alerts_authorization.test.ts              | 1256 +++++++++++++++
 .../authorization/alerts_authorization.ts     |  457 ++++++
 .../server/authorization/audit_logger.mock.ts |   24 +
 .../server/authorization/audit_logger.test.ts |  311 ++++
 .../server/authorization/audit_logger.ts      |  117 ++
 x-pack/plugins/alerts/server/index.ts         |    2 +-
 .../lib/validate_alert_type_params.test.ts    |    6 +-
 x-pack/plugins/alerts/server/plugin.test.ts   |   34 +
 x-pack/plugins/alerts/server/plugin.ts        |   36 +-
 .../alerts/server/routes/create.test.ts       |    7 -
 x-pack/plugins/alerts/server/routes/create.ts |    3 -
 .../alerts/server/routes/delete.test.ts       |    7 -
 x-pack/plugins/alerts/server/routes/delete.ts |    3 -
 .../alerts/server/routes/disable.test.ts      |    7 -
 .../plugins/alerts/server/routes/disable.ts   |    3 -
 .../alerts/server/routes/enable.test.ts       |    7 -
 x-pack/plugins/alerts/server/routes/enable.ts |    3 -
 .../plugins/alerts/server/routes/find.test.ts |    7 -
 x-pack/plugins/alerts/server/routes/find.ts   |    5 +-
 .../plugins/alerts/server/routes/get.test.ts  |    7 -
 x-pack/plugins/alerts/server/routes/get.ts    |    3 -
 .../server/routes/get_alert_state.test.ts     |   21 -
 .../alerts/server/routes/get_alert_state.ts   |    3 -
 .../server/routes/list_alert_types.test.ts    |   66 +-
 .../alerts/server/routes/list_alert_types.ts  |    5 +-
 .../alerts/server/routes/mute_all.test.ts     |    7 -
 .../plugins/alerts/server/routes/mute_all.ts  |    3 -
 .../server/routes/mute_instance.test.ts       |    7 -
 .../alerts/server/routes/mute_instance.ts     |    3 -
 .../alerts/server/routes/unmute_all.test.ts   |    7 -
 .../alerts/server/routes/unmute_all.ts        |    3 -
 .../server/routes/unmute_instance.test.ts     |    7 -
 .../alerts/server/routes/unmute_instance.ts   |    3 -
 .../alerts/server/routes/update.test.ts       |    7 -
 x-pack/plugins/alerts/server/routes/update.ts |    3 -
 .../server/routes/update_api_key.test.ts      |    7 -
 .../alerts/server/routes/update_api_key.ts    |    3 -
 .../server/saved_objects/migrations.test.ts   |   34 +
 .../alerts/server/saved_objects/migrations.ts |   26 +-
 .../create_execution_handler.test.ts          |    2 +-
 .../server/task_runner/task_runner.test.ts    |  114 +-
 .../alerts/server/task_runner/task_runner.ts  |   85 +-
 .../task_runner/task_runner_factory.test.ts   |    6 +-
 .../server/task_runner/task_runner_factory.ts |    4 +-
 x-pack/plugins/apm/server/feature.ts          |   50 +-
 x-pack/plugins/features/common/feature.ts     |   11 +
 .../common/feature_kibana_privileges.ts       |   28 +
 .../__snapshots__/oss_features.test.ts.snap   |   12 +
 .../features/server/feature_registry.test.ts  |  162 ++
 .../plugins/features/server/feature_schema.ts |   43 +-
 .../inventory/components/alert_flyout.tsx     |    2 +-
 .../components/alert_flyout.tsx               |    2 +-
 x-pack/plugins/infra/server/features.ts       |   47 +-
 ...r_inventory_metric_threshold_alert_type.ts |    2 +-
 .../register_metric_threshold_alert_type.ts   |    2 +-
 x-pack/plugins/monitoring/server/plugin.ts    |    5 +
 .../__snapshots__/alerting.test.ts.snap       |   37 +
 .../authorization/actions/actions.mock.ts     |   35 +
 .../server/authorization/actions/actions.ts   |    3 +
 .../authorization/actions/alerting.test.ts    |   45 +
 .../server/authorization/actions/alerting.ts  |   31 +
 .../disable_ui_capabilities.test.ts           |    3 +
 .../server/authorization/index.mock.ts        |    5 +-
 .../alerting.test.ts                          |  178 +++
 .../feature_privilege_builder/alerting.ts     |   42 +
 .../feature_privilege_builder/index.ts        |    2 +
 .../feature_privilege_iterator.test.ts        |  143 ++
 .../feature_privilege_iterator.ts             |    8 +
 .../authorization/privileges/privileges.ts    |    1 -
 x-pack/plugins/security/server/mocks.ts       |    1 +
 x-pack/plugins/security/server/plugin.test.ts |    4 +
 x-pack/plugins/security/server/plugin.ts      |    6 +-
 .../notifications/create_notifications.ts     |    4 +-
 .../detection_engine/rules/create_rules.ts    |    4 +-
 .../security_solution/server/plugin.ts        |   59 +-
 .../email/email_connector.test.tsx            |    1 +
 .../email/email_connector.tsx                 |    8 +-
 .../es_index/es_index_connector.test.tsx      |    1 +
 .../es_index/es_index_connector.tsx           |    5 +-
 .../pagerduty/pagerduty_connectors.test.tsx   |    1 +
 .../pagerduty/pagerduty_connectors.tsx        |    4 +-
 .../servicenow/servicenow_connectors.test.tsx |    2 +
 .../servicenow/servicenow_connectors.tsx      |    5 +-
 .../slack/slack_connectors.test.tsx           |    1 +
 .../slack/slack_connectors.tsx                |    3 +-
 .../webhook/webhook_connectors.test.tsx       |    1 +
 .../webhook/webhook_connectors.tsx            |    9 +-
 .../application/lib/action_variables.test.ts  |    4 +-
 .../public/application/lib/alert_api.test.ts  |    4 +-
 .../public/application/lib/capabilities.ts    |   24 +-
 .../action_connector_form.test.tsx            |    7 +
 .../action_connector_form.tsx                 |    9 +-
 .../action_connector_form/action_form.tsx     |   93 +-
 .../connector_add_flyout.tsx                  |    1 +
 .../connector_add_modal.test.tsx              |    8 +-
 .../connector_add_modal.tsx                   |    1 +
 .../connector_edit_flyout.tsx                 |    1 +
 .../actions_connectors_list.test.tsx          |   42 +-
 .../components/actions_connectors_list.tsx    |   54 +-
 .../components/alert_details.test.tsx         |  187 ++-
 .../components/alert_details.tsx              |   27 +-
 .../components/alert_instances.test.tsx       |    7 +-
 .../components/alert_instances.tsx            |    8 +-
 .../components/alert_instances_route.test.tsx |    6 +-
 .../components/alert_instances_route.tsx      |    9 +-
 .../sections/alert_form/alert_add.test.tsx    |   40 +-
 .../sections/alert_form/alert_add.tsx         |    3 +
 .../sections/alert_form/alert_edit.tsx        |    3 +
 .../sections/alert_form/alert_form.test.tsx   |   61 +-
 .../sections/alert_form/alert_form.tsx        |   86 +-
 .../components/alerts_list.test.tsx           |   27 +-
 .../alerts_list/components/alerts_list.tsx    |   96 +-
 .../components/collapsed_item_actions.tsx     |   15 +-
 .../triggers_actions_ui/public/types.ts       |    5 +-
 x-pack/plugins/uptime/server/kibana.index.ts  |   44 +-
 .../actions_simulators/server/plugin.ts       |   14 +-
 .../fixtures/plugins/alerts/kibana.json       |    2 +-
 .../plugins/alerts/server/alert_types.ts      |   18 +-
 .../fixtures/plugins/alerts/server/plugin.ts  |   44 +-
 .../plugins/alerts_restricted/kibana.json     |   10 +
 .../plugins/alerts_restricted/package.json    |   20 +
 .../alerts_restricted/server/alert_types.ts   |   33 +
 .../plugins/alerts_restricted/server/index.ts |    9 +
 .../alerts_restricted/server/plugin.ts        |   62 +
 .../common/lib/alert_utils.ts                 |   20 +-
 .../common/lib/get_test_alert_data.ts         |    2 +-
 .../common/lib/index.ts                       |    6 +-
 .../security_and_spaces/scenarios.ts          |   96 +-
 .../tests/actions/create.ts                   |   49 +-
 .../tests/actions/delete.ts                   |   41 +-
 .../tests/actions/execute.ts                  |   70 +-
 .../security_and_spaces/tests/actions/get.ts  |   31 +-
 .../tests/actions/get_all.ts                  |   30 +-
 .../tests/actions/list_action_types.ts        |   10 +-
 .../tests/actions/update.ts                   |   69 +-
 .../tests/alerting/alerts.ts                  |  225 ++-
 .../tests/alerting/create.ts                  |  266 +++-
 .../tests/alerting/delete.ts                  |  221 ++-
 .../tests/alerting/disable.ts                 |  227 ++-
 .../tests/alerting/enable.ts                  |  239 ++-
 .../tests/alerting/find.ts                    |  215 ++-
 .../security_and_spaces/tests/alerting/get.ts |  188 ++-
 .../tests/alerting/get_alert_state.ts         |   90 +-
 .../tests/alerting/index.ts                   |    2 +-
 .../tests/alerting/list_alert_types.ts        |  124 +-
 .../tests/alerting/mute_all.ts                |  237 ++-
 .../tests/alerting/mute_instance.ts           |  251 ++-
 .../tests/alerting/unmute_all.ts              |  252 ++-
 .../tests/alerting/unmute_instance.ts         |  258 ++-
 .../tests/alerting/update.ts                  |  399 ++++-
 .../tests/alerting/update_api_key.ts          |  251 ++-
 .../index_threshold/alert.ts                  |    2 +-
 .../spaces_only/tests/alerting/create.ts      |   28 +-
 .../spaces_only/tests/alerting/find.ts        |    2 +-
 .../spaces_only/tests/alerting/get.ts         |    2 +-
 .../tests/alerting/get_alert_state.ts         |    2 +-
 .../tests/alerting/list_alert_types.ts        |    7 +-
 .../spaces_only/tests/alerting/migrations.ts  |    9 +
 .../spaces_only/tests/alerting/update.ts      |    2 +-
 .../apis/features/features/features.ts        |    2 +
 .../apis/security/privileges.ts               |    2 +
 .../apis/security/privileges_basic.ts         |    2 +
 .../functional/es_archives/alerts/data.json   |   42 +
 .../apps/triggers_actions_ui/alerts.ts        |    4 +-
 .../fixtures/plugins/alerts/kibana.json       |    2 +-
 .../fixtures/plugins/alerts/public/plugin.ts  |    6 +-
 .../fixtures/plugins/alerts/server/plugin.ts  |   36 +-
 .../services/alerting/alerts.ts               |    6 +-
 226 files changed, 10844 insertions(+), 1704 deletions(-)
 create mode 100644 x-pack/plugins/actions/server/authorization/actions_authorization.mock.ts
 create mode 100644 x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
 create mode 100644 x-pack/plugins/actions/server/authorization/actions_authorization.ts
 create mode 100644 x-pack/plugins/actions/server/authorization/audit_logger.mock.ts
 create mode 100644 x-pack/plugins/actions/server/authorization/audit_logger.test.ts
 create mode 100644 x-pack/plugins/actions/server/authorization/audit_logger.ts
 create mode 100644 x-pack/plugins/actions/server/feature.ts
 create mode 100644 x-pack/plugins/alerting_builtins/common/index.ts
 create mode 100644 x-pack/plugins/alerting_builtins/server/feature.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/alerts_authorization.mock.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/alerts_authorization.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/audit_logger.mock.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/audit_logger.test.ts
 create mode 100644 x-pack/plugins/alerts/server/authorization/audit_logger.ts
 create mode 100644 x-pack/plugins/security/server/authorization/actions/__snapshots__/alerting.test.ts.snap
 create mode 100644 x-pack/plugins/security/server/authorization/actions/actions.mock.ts
 create mode 100644 x-pack/plugins/security/server/authorization/actions/alerting.test.ts
 create mode 100644 x-pack/plugins/security/server/authorization/actions/alerting.ts
 create mode 100644 x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.test.ts
 create mode 100644 x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.ts
 create mode 100644 x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/kibana.json
 create mode 100644 x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/package.json
 create mode 100644 x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/alert_types.ts
 create mode 100644 x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/index.ts
 create mode 100644 x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/plugin.ts

diff --git a/examples/alerting_example/kibana.json b/examples/alerting_example/kibana.json
index 6c04218ca45e2..a2691c5fdcab7 100644
--- a/examples/alerting_example/kibana.json
+++ b/examples/alerting_example/kibana.json
@@ -4,6 +4,6 @@
   "kibanaVersion": "kibana",
   "server": true,
   "ui": true,
-  "requiredPlugins": ["triggers_actions_ui", "charts", "data", "alerts", "actions", "developerExamples"],
+  "requiredPlugins": ["triggers_actions_ui", "charts", "data", "alerts", "actions", "features", "developerExamples"],
   "optionalPlugins": []
 }
diff --git a/examples/alerting_example/server/plugin.ts b/examples/alerting_example/server/plugin.ts
index cdb005feca35c..49352cc285693 100644
--- a/examples/alerting_example/server/plugin.ts
+++ b/examples/alerting_example/server/plugin.ts
@@ -18,20 +18,56 @@
  */
 
 import { Plugin, CoreSetup } from 'kibana/server';
+import { i18n } from '@kbn/i18n';
 import { PluginSetupContract as AlertingSetup } from '../../../x-pack/plugins/alerts/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../../x-pack/plugins/features/server';
 
 import { alertType as alwaysFiringAlert } from './alert_types/always_firing';
 import { alertType as peopleInSpaceAlert } from './alert_types/astros';
+import { INDEX_THRESHOLD_ID } from '../../../x-pack/plugins/alerting_builtins/server';
+import { ALERTING_EXAMPLE_APP_ID } from '../common/constants';
 
 // this plugin's dependendencies
 export interface AlertingExampleDeps {
   alerts: AlertingSetup;
+  features: FeaturesPluginSetup;
 }
 
 export class AlertingExamplePlugin implements Plugin<void, void, AlertingExampleDeps> {
-  public setup(core: CoreSetup, { alerts }: AlertingExampleDeps) {
+  public setup(core: CoreSetup, { alerts, features }: AlertingExampleDeps) {
     alerts.registerType(alwaysFiringAlert);
     alerts.registerType(peopleInSpaceAlert);
+
+    features.registerFeature({
+      id: ALERTING_EXAMPLE_APP_ID,
+      name: i18n.translate('alertsExample.featureRegistry.alertsExampleFeatureName', {
+        defaultMessage: 'Alerts Example',
+      }),
+      app: [],
+      alerting: [alwaysFiringAlert.id, peopleInSpaceAlert.id, INDEX_THRESHOLD_ID],
+      privileges: {
+        all: {
+          alerting: {
+            all: [alwaysFiringAlert.id, peopleInSpaceAlert.id, INDEX_THRESHOLD_ID],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: ['alerting:show'],
+        },
+        read: {
+          alerting: {
+            read: [alwaysFiringAlert.id, peopleInSpaceAlert.id, INDEX_THRESHOLD_ID],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: ['alerting:show'],
+        },
+      },
+    });
   }
 
   public start() {}
diff --git a/x-pack/plugins/actions/kibana.json b/x-pack/plugins/actions/kibana.json
index 14ddb8257ff37..ef604a9cf6417 100644
--- a/x-pack/plugins/actions/kibana.json
+++ b/x-pack/plugins/actions/kibana.json
@@ -4,7 +4,7 @@
   "version": "8.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "actions"],
-  "requiredPlugins": ["licensing", "taskManager", "encryptedSavedObjects", "eventLog"],
-  "optionalPlugins": ["usageCollection", "spaces"],
+  "requiredPlugins": ["licensing", "taskManager", "encryptedSavedObjects", "eventLog", "features"],
+  "optionalPlugins": ["usageCollection", "spaces", "security"],
   "ui": false
 }
diff --git a/x-pack/plugins/actions/server/actions_client.mock.ts b/x-pack/plugins/actions/server/actions_client.mock.ts
index efd044c7e2493..48122a5ce4e0f 100644
--- a/x-pack/plugins/actions/server/actions_client.mock.ts
+++ b/x-pack/plugins/actions/server/actions_client.mock.ts
@@ -19,6 +19,7 @@ const createActionsClientMock = () => {
     getBulk: jest.fn(),
     execute: jest.fn(),
     enqueueExecution: jest.fn(),
+    listTypes: jest.fn(),
   };
   return mocked;
 };
diff --git a/x-pack/plugins/actions/server/actions_client.test.ts b/x-pack/plugins/actions/server/actions_client.test.ts
index 807d75cd0d701..90b989ac3b52e 100644
--- a/x-pack/plugins/actions/server/actions_client.test.ts
+++ b/x-pack/plugins/actions/server/actions_client.test.ts
@@ -22,11 +22,14 @@ import {
 import { actionExecutorMock } from './lib/action_executor.mock';
 import uuid from 'uuid';
 import { KibanaRequest } from 'kibana/server';
+import { ActionsAuthorization } from './authorization/actions_authorization';
+import { actionsAuthorizationMock } from './authorization/actions_authorization.mock';
 
 const defaultKibanaIndex = '.kibana';
-const savedObjectsClient = savedObjectsClientMock.create();
+const unsecuredSavedObjectsClient = savedObjectsClientMock.create();
 const scopedClusterClient = elasticsearchServiceMock.createLegacyScopedClusterClient();
 const actionExecutor = actionExecutorMock.create();
+const authorization = actionsAuthorizationMock.create();
 const executionEnqueuer = jest.fn();
 const request = {} as KibanaRequest;
 
@@ -55,17 +58,88 @@ beforeEach(() => {
   actionTypeRegistry = new ActionTypeRegistry(actionTypeRegistryParams);
   actionsClient = new ActionsClient({
     actionTypeRegistry,
-    savedObjectsClient,
+    unsecuredSavedObjectsClient,
     scopedClusterClient,
     defaultKibanaIndex,
     preconfiguredActions: [],
     actionExecutor,
     executionEnqueuer,
     request,
+    authorization: (authorization as unknown) as ActionsAuthorization,
   });
 });
 
 describe('create()', () => {
+  describe('authorization', () => {
+    test('ensures user is authorised to create this type of action', async () => {
+      const savedObjectCreateResult = {
+        id: '1',
+        type: 'action',
+        attributes: {
+          name: 'my name',
+          actionTypeId: 'my-action-type',
+          config: {},
+        },
+        references: [],
+      };
+      actionTypeRegistry.register({
+        id: 'my-action-type',
+        name: 'My action type',
+        minimumLicenseRequired: 'basic',
+        executor,
+      });
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
+
+      await actionsClient.create({
+        action: {
+          name: 'my name',
+          actionTypeId: 'my-action-type',
+          config: {},
+          secrets: {},
+        },
+      });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('create', 'my-action-type');
+    });
+
+    test('throws when user is not authorised to create this type of action', async () => {
+      const savedObjectCreateResult = {
+        id: '1',
+        type: 'action',
+        attributes: {
+          name: 'my name',
+          actionTypeId: 'my-action-type',
+          config: {},
+        },
+        references: [],
+      };
+      actionTypeRegistry.register({
+        id: 'my-action-type',
+        name: 'My action type',
+        minimumLicenseRequired: 'basic',
+        executor,
+      });
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
+
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to create a "my-action-type" action`)
+      );
+
+      await expect(
+        actionsClient.create({
+          action: {
+            name: 'my name',
+            actionTypeId: 'my-action-type',
+            config: {},
+            secrets: {},
+          },
+        })
+      ).rejects.toMatchInlineSnapshot(`[Error: Unauthorized to create a "my-action-type" action]`);
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('create', 'my-action-type');
+    });
+  });
+
   test('creates an action with all given properties', async () => {
     const savedObjectCreateResult = {
       id: '1',
@@ -83,7 +157,7 @@ describe('create()', () => {
       minimumLicenseRequired: 'basic',
       executor,
     });
-    savedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
     const result = await actionsClient.create({
       action: {
         name: 'my name',
@@ -99,8 +173,8 @@ describe('create()', () => {
       actionTypeId: 'my-action-type',
       config: {},
     });
-    expect(savedObjectsClient.create).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         Object {
@@ -161,7 +235,7 @@ describe('create()', () => {
       minimumLicenseRequired: 'basic',
       executor,
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'type',
       attributes: {
@@ -199,8 +273,8 @@ describe('create()', () => {
         c: true,
       },
     });
-    expect(savedObjectsClient.create).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         Object {
@@ -237,13 +311,14 @@ describe('create()', () => {
     actionTypeRegistry = new ActionTypeRegistry(localActionTypeRegistryParams);
     actionsClient = new ActionsClient({
       actionTypeRegistry,
-      savedObjectsClient,
+      unsecuredSavedObjectsClient,
       scopedClusterClient,
       defaultKibanaIndex,
       preconfiguredActions: [],
       actionExecutor,
       executionEnqueuer,
       request,
+      authorization: (authorization as unknown) as ActionsAuthorization,
     });
 
     const savedObjectCreateResult = {
@@ -262,7 +337,7 @@ describe('create()', () => {
       minimumLicenseRequired: 'basic',
       executor,
     });
-    savedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
 
     await expect(
       actionsClient.create({
@@ -298,7 +373,7 @@ describe('create()', () => {
     mockedLicenseState.ensureLicenseForActionType.mockImplementation(() => {
       throw new Error('Fail');
     });
-    savedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce(savedObjectCreateResult);
     await expect(
       actionsClient.create({
         action: {
@@ -313,8 +388,118 @@ describe('create()', () => {
 });
 
 describe('get()', () => {
-  test('calls savedObjectsClient with id', async () => {
-    savedObjectsClient.get.mockResolvedValueOnce({
+  describe('authorization', () => {
+    test('ensures user is authorised to get the type of action', async () => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'type',
+        attributes: {
+          name: 'my name',
+          actionTypeId: 'my-action-type',
+          config: {},
+        },
+        references: [],
+      });
+
+      await actionsClient.get({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('ensures user is authorised to get preconfigured type of action', async () => {
+      actionsClient = new ActionsClient({
+        actionTypeRegistry,
+        unsecuredSavedObjectsClient,
+        scopedClusterClient,
+        defaultKibanaIndex,
+        actionExecutor,
+        executionEnqueuer,
+        request,
+        authorization: (authorization as unknown) as ActionsAuthorization,
+        preconfiguredActions: [
+          {
+            id: 'testPreconfigured',
+            actionTypeId: 'my-action-type',
+            secrets: {
+              test: 'test1',
+            },
+            isPreconfigured: true,
+            name: 'test',
+            config: {
+              foo: 'bar',
+            },
+          },
+        ],
+      });
+
+      await actionsClient.get({ id: 'testPreconfigured' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'type',
+        attributes: {
+          name: 'my name',
+          actionTypeId: 'my-action-type',
+          config: {},
+        },
+        references: [],
+      });
+
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to get a "my-action-type" action`)
+      );
+
+      await expect(actionsClient.get({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to get a "my-action-type" action]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to create preconfigured of action', async () => {
+      actionsClient = new ActionsClient({
+        actionTypeRegistry,
+        unsecuredSavedObjectsClient,
+        scopedClusterClient,
+        defaultKibanaIndex,
+        actionExecutor,
+        executionEnqueuer,
+        request,
+        authorization: (authorization as unknown) as ActionsAuthorization,
+        preconfiguredActions: [
+          {
+            id: 'testPreconfigured',
+            actionTypeId: 'my-action-type',
+            secrets: {
+              test: 'test1',
+            },
+            isPreconfigured: true,
+            name: 'test',
+            config: {
+              foo: 'bar',
+            },
+          },
+        ],
+      });
+
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to get a "my-action-type" action`)
+      );
+
+      await expect(actionsClient.get({ id: 'testPreconfigured' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to get a "my-action-type" action]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+  });
+
+  test('calls unsecuredSavedObjectsClient with id', async () => {
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'type',
       attributes: {},
@@ -325,8 +510,8 @@ describe('get()', () => {
       id: '1',
       isPreconfigured: false,
     });
-    expect(savedObjectsClient.get).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         "1",
@@ -337,12 +522,13 @@ describe('get()', () => {
   test('return predefined action with id', async () => {
     actionsClient = new ActionsClient({
       actionTypeRegistry,
-      savedObjectsClient,
+      unsecuredSavedObjectsClient,
       scopedClusterClient,
       defaultKibanaIndex,
       actionExecutor,
       executionEnqueuer,
       request,
+      authorization: (authorization as unknown) as ActionsAuthorization,
       preconfiguredActions: [
         {
           id: 'testPreconfigured',
@@ -366,12 +552,84 @@ describe('get()', () => {
       isPreconfigured: true,
       name: 'test',
     });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
   });
 });
 
 describe('getAll()', () => {
-  test('calls savedObjectsClient with parameters', async () => {
+  describe('authorization', () => {
+    function getAllOperation(): ReturnType<ActionsClient['getAll']> {
+      const expectedResult = {
+        total: 1,
+        per_page: 10,
+        page: 1,
+        saved_objects: [
+          {
+            id: '1',
+            type: 'type',
+            attributes: {
+              name: 'test',
+              config: {
+                foo: 'bar',
+              },
+            },
+            score: 1,
+            references: [],
+          },
+        ],
+      };
+      unsecuredSavedObjectsClient.find.mockResolvedValueOnce(expectedResult);
+      scopedClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        aggregations: {
+          '1': { doc_count: 6 },
+          testPreconfigured: { doc_count: 2 },
+        },
+      });
+
+      actionsClient = new ActionsClient({
+        actionTypeRegistry,
+        unsecuredSavedObjectsClient,
+        scopedClusterClient,
+        defaultKibanaIndex,
+        actionExecutor,
+        executionEnqueuer,
+        request,
+        authorization: (authorization as unknown) as ActionsAuthorization,
+        preconfiguredActions: [
+          {
+            id: 'testPreconfigured',
+            actionTypeId: '.slack',
+            secrets: {},
+            isPreconfigured: true,
+            name: 'test',
+            config: {
+              foo: 'bar',
+            },
+          },
+        ],
+      });
+      return actionsClient.getAll();
+    }
+
+    test('ensures user is authorised to get the type of action', async () => {
+      await getAllOperation();
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to get all actions`)
+      );
+
+      await expect(getAllOperation()).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to get all actions]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+  });
+
+  test('calls unsecuredSavedObjectsClient with parameters', async () => {
     const expectedResult = {
       total: 1,
       per_page: 10,
@@ -391,7 +649,7 @@ describe('getAll()', () => {
         },
       ],
     };
-    savedObjectsClient.find.mockResolvedValueOnce(expectedResult);
+    unsecuredSavedObjectsClient.find.mockResolvedValueOnce(expectedResult);
     scopedClusterClient.callAsInternalUser.mockResolvedValueOnce({
       aggregations: {
         '1': { doc_count: 6 },
@@ -401,12 +659,13 @@ describe('getAll()', () => {
 
     actionsClient = new ActionsClient({
       actionTypeRegistry,
-      savedObjectsClient,
+      unsecuredSavedObjectsClient,
       scopedClusterClient,
       defaultKibanaIndex,
       actionExecutor,
       executionEnqueuer,
       request,
+      authorization: (authorization as unknown) as ActionsAuthorization,
       preconfiguredActions: [
         {
           id: 'testPreconfigured',
@@ -443,8 +702,76 @@ describe('getAll()', () => {
 });
 
 describe('getBulk()', () => {
-  test('calls getBulk savedObjectsClient with parameters', async () => {
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+  describe('authorization', () => {
+    function getBulkOperation(): ReturnType<ActionsClient['getBulk']> {
+      unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
+        saved_objects: [
+          {
+            id: '1',
+            type: 'action',
+            attributes: {
+              actionTypeId: 'test',
+              name: 'test',
+              config: {
+                foo: 'bar',
+              },
+            },
+            references: [],
+          },
+        ],
+      });
+      scopedClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        aggregations: {
+          '1': { doc_count: 6 },
+          testPreconfigured: { doc_count: 2 },
+        },
+      });
+
+      actionsClient = new ActionsClient({
+        actionTypeRegistry,
+        unsecuredSavedObjectsClient,
+        scopedClusterClient,
+        defaultKibanaIndex,
+        actionExecutor,
+        executionEnqueuer,
+        request,
+        authorization: (authorization as unknown) as ActionsAuthorization,
+        preconfiguredActions: [
+          {
+            id: 'testPreconfigured',
+            actionTypeId: '.slack',
+            secrets: {},
+            isPreconfigured: true,
+            name: 'test',
+            config: {
+              foo: 'bar',
+            },
+          },
+        ],
+      });
+      return actionsClient.getBulk(['1', 'testPreconfigured']);
+    }
+
+    test('ensures user is authorised to get the type of action', async () => {
+      await getBulkOperation();
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to get all actions`)
+      );
+
+      await expect(getBulkOperation()).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to get all actions]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+  });
+
+  test('calls getBulk unsecuredSavedObjectsClient with parameters', async () => {
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
@@ -469,12 +796,13 @@ describe('getBulk()', () => {
 
     actionsClient = new ActionsClient({
       actionTypeRegistry,
-      savedObjectsClient,
+      unsecuredSavedObjectsClient,
       scopedClusterClient,
       defaultKibanaIndex,
       actionExecutor,
       executionEnqueuer,
       request,
+      authorization: (authorization as unknown) as ActionsAuthorization,
       preconfiguredActions: [
         {
           id: 'testPreconfigured',
@@ -514,13 +842,32 @@ describe('getBulk()', () => {
 });
 
 describe('delete()', () => {
-  test('calls savedObjectsClient with id', async () => {
+  describe('authorization', () => {
+    test('ensures user is authorised to delete actions', async () => {
+      await actionsClient.delete({ id: '1' });
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('delete');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to delete all actions`)
+      );
+
+      await expect(actionsClient.delete({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to delete all actions]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('delete');
+    });
+  });
+
+  test('calls unsecuredSavedObjectsClient with id', async () => {
     const expectedResult = Symbol();
-    savedObjectsClient.delete.mockResolvedValueOnce(expectedResult);
+    unsecuredSavedObjectsClient.delete.mockResolvedValueOnce(expectedResult);
     const result = await actionsClient.delete({ id: '1' });
     expect(result).toEqual(expectedResult);
-    expect(savedObjectsClient.delete).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.delete.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.delete).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.delete.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         "1",
@@ -530,6 +877,60 @@ describe('delete()', () => {
 });
 
 describe('update()', () => {
+  describe('authorization', () => {
+    function updateOperation(): ReturnType<ActionsClient['update']> {
+      actionTypeRegistry.register({
+        id: 'my-action-type',
+        name: 'My action type',
+        minimumLicenseRequired: 'basic',
+        executor,
+      });
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'action',
+        attributes: {
+          actionTypeId: 'my-action-type',
+        },
+        references: [],
+      });
+      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+        id: 'my-action',
+        type: 'action',
+        attributes: {
+          actionTypeId: 'my-action-type',
+          name: 'my name',
+          config: {},
+          secrets: {},
+        },
+        references: [],
+      });
+      return actionsClient.update({
+        id: 'my-action',
+        action: {
+          name: 'my name',
+          config: {},
+          secrets: {},
+        },
+      });
+    }
+    test('ensures user is authorised to update actions', async () => {
+      await updateOperation();
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('update');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to update all actions`)
+      );
+
+      await expect(updateOperation()).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to update all actions]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('update');
+    });
+  });
+
   test('updates an action with all given properties', async () => {
     actionTypeRegistry.register({
       id: 'my-action-type',
@@ -537,7 +938,7 @@ describe('update()', () => {
       minimumLicenseRequired: 'basic',
       executor,
     });
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'action',
       attributes: {
@@ -545,7 +946,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -571,8 +972,8 @@ describe('update()', () => {
       name: 'my name',
       config: {},
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         "my-action",
@@ -584,8 +985,8 @@ describe('update()', () => {
         },
       ]
     `);
-    expect(savedObjectsClient.get).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         "my-action",
@@ -605,7 +1006,7 @@ describe('update()', () => {
       },
       executor,
     });
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -634,7 +1035,7 @@ describe('update()', () => {
       minimumLicenseRequired: 'basic',
       executor,
     });
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -642,7 +1043,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -680,8 +1081,8 @@ describe('update()', () => {
         c: true,
       },
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toMatchInlineSnapshot(`
       Array [
         "action",
         "my-action",
@@ -709,7 +1110,7 @@ describe('update()', () => {
     mockedLicenseState.ensureLicenseForActionType.mockImplementation(() => {
       throw new Error('Fail');
     });
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'action',
       attributes: {
@@ -717,7 +1118,7 @@ describe('update()', () => {
       },
       references: [],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: 'my-action',
       type: 'action',
       attributes: {
@@ -742,6 +1143,35 @@ describe('update()', () => {
 });
 
 describe('execute()', () => {
+  describe('authorization', () => {
+    test('ensures user is authorised to excecute actions', async () => {
+      await actionsClient.execute({
+        actionId: 'action-id',
+        params: {
+          name: 'my name',
+        },
+      });
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to execute all actions`)
+      );
+
+      await expect(
+        actionsClient.execute({
+          actionId: 'action-id',
+          params: {
+            name: 'my name',
+          },
+        })
+      ).rejects.toMatchInlineSnapshot(`[Error: Unauthorized to execute all actions]`);
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+  });
+
   test('calls the actionExecutor with the appropriate parameters', async () => {
     const actionId = uuid.v4();
     actionExecutor.execute.mockResolvedValue({ status: 'ok', actionId });
@@ -765,6 +1195,35 @@ describe('execute()', () => {
 });
 
 describe('enqueueExecution()', () => {
+  describe('authorization', () => {
+    test('ensures user is authorised to excecute actions', async () => {
+      await actionsClient.enqueueExecution({
+        id: uuid.v4(),
+        params: {},
+        spaceId: 'default',
+        apiKey: null,
+      });
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to execute all actions`)
+      );
+
+      await expect(
+        actionsClient.enqueueExecution({
+          id: uuid.v4(),
+          params: {},
+          spaceId: 'default',
+          apiKey: null,
+        })
+      ).rejects.toMatchInlineSnapshot(`[Error: Unauthorized to execute all actions]`);
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+  });
+
   test('calls the executionEnqueuer with the appropriate parameters', async () => {
     const opts = {
       id: uuid.v4(),
@@ -774,6 +1233,6 @@ describe('enqueueExecution()', () => {
     };
     await expect(actionsClient.enqueueExecution(opts)).resolves.toMatchInlineSnapshot(`undefined`);
 
-    expect(executionEnqueuer).toHaveBeenCalledWith(savedObjectsClient, opts);
+    expect(executionEnqueuer).toHaveBeenCalledWith(unsecuredSavedObjectsClient, opts);
   });
 });
diff --git a/x-pack/plugins/actions/server/actions_client.ts b/x-pack/plugins/actions/server/actions_client.ts
index 44f9cfd5c9e61..6744a8d111623 100644
--- a/x-pack/plugins/actions/server/actions_client.ts
+++ b/x-pack/plugins/actions/server/actions_client.ts
@@ -28,6 +28,8 @@ import {
   ExecutionEnqueuer,
   ExecuteOptions as EnqueueExecutionOptions,
 } from './create_execute_function';
+import { ActionsAuthorization } from './authorization/actions_authorization';
+import { ActionType } from '../common';
 
 // We are assuming there won't be many actions. This is why we will load
 // all the actions in advance and assume the total count to not go over 10000.
@@ -52,11 +54,12 @@ interface ConstructorOptions {
   defaultKibanaIndex: string;
   scopedClusterClient: ILegacyScopedClusterClient;
   actionTypeRegistry: ActionTypeRegistry;
-  savedObjectsClient: SavedObjectsClientContract;
+  unsecuredSavedObjectsClient: SavedObjectsClientContract;
   preconfiguredActions: PreConfiguredAction[];
   actionExecutor: ActionExecutorContract;
   executionEnqueuer: ExecutionEnqueuer;
   request: KibanaRequest;
+  authorization: ActionsAuthorization;
 }
 
 interface UpdateOptions {
@@ -67,45 +70,51 @@ interface UpdateOptions {
 export class ActionsClient {
   private readonly defaultKibanaIndex: string;
   private readonly scopedClusterClient: ILegacyScopedClusterClient;
-  private readonly savedObjectsClient: SavedObjectsClientContract;
+  private readonly unsecuredSavedObjectsClient: SavedObjectsClientContract;
   private readonly actionTypeRegistry: ActionTypeRegistry;
   private readonly preconfiguredActions: PreConfiguredAction[];
   private readonly actionExecutor: ActionExecutorContract;
   private readonly request: KibanaRequest;
+  private readonly authorization: ActionsAuthorization;
   private readonly executionEnqueuer: ExecutionEnqueuer;
 
   constructor({
     actionTypeRegistry,
     defaultKibanaIndex,
     scopedClusterClient,
-    savedObjectsClient,
+    unsecuredSavedObjectsClient,
     preconfiguredActions,
     actionExecutor,
     executionEnqueuer,
     request,
+    authorization,
   }: ConstructorOptions) {
     this.actionTypeRegistry = actionTypeRegistry;
-    this.savedObjectsClient = savedObjectsClient;
+    this.unsecuredSavedObjectsClient = unsecuredSavedObjectsClient;
     this.scopedClusterClient = scopedClusterClient;
     this.defaultKibanaIndex = defaultKibanaIndex;
     this.preconfiguredActions = preconfiguredActions;
     this.actionExecutor = actionExecutor;
     this.executionEnqueuer = executionEnqueuer;
     this.request = request;
+    this.authorization = authorization;
   }
 
   /**
    * Create an action
    */
-  public async create({ action }: CreateOptions): Promise<ActionResult> {
-    const { actionTypeId, name, config, secrets } = action;
+  public async create({
+    action: { actionTypeId, name, config, secrets },
+  }: CreateOptions): Promise<ActionResult> {
+    await this.authorization.ensureAuthorized('create', actionTypeId);
+
     const actionType = this.actionTypeRegistry.get(actionTypeId);
     const validatedActionTypeConfig = validateConfig(actionType, config);
     const validatedActionTypeSecrets = validateSecrets(actionType, secrets);
 
     this.actionTypeRegistry.ensureActionTypeEnabled(actionTypeId);
 
-    const result = await this.savedObjectsClient.create('action', {
+    const result = await this.unsecuredSavedObjectsClient.create('action', {
       actionTypeId,
       name,
       config: validatedActionTypeConfig as SavedObjectAttributes,
@@ -125,6 +134,8 @@ export class ActionsClient {
    * Update action
    */
   public async update({ id, action }: UpdateOptions): Promise<ActionResult> {
+    await this.authorization.ensureAuthorized('update');
+
     if (
       this.preconfiguredActions.find((preconfiguredAction) => preconfiguredAction.id === id) !==
       undefined
@@ -139,7 +150,7 @@ export class ActionsClient {
         'update'
       );
     }
-    const existingObject = await this.savedObjectsClient.get<RawAction>('action', id);
+    const existingObject = await this.unsecuredSavedObjectsClient.get<RawAction>('action', id);
     const { actionTypeId } = existingObject.attributes;
     const { name, config, secrets } = action;
     const actionType = this.actionTypeRegistry.get(actionTypeId);
@@ -148,7 +159,7 @@ export class ActionsClient {
 
     this.actionTypeRegistry.ensureActionTypeEnabled(actionTypeId);
 
-    const result = await this.savedObjectsClient.update<RawAction>('action', id, {
+    const result = await this.unsecuredSavedObjectsClient.update<RawAction>('action', id, {
       actionTypeId,
       name,
       config: validatedActionTypeConfig as SavedObjectAttributes,
@@ -168,6 +179,8 @@ export class ActionsClient {
    * Get an action
    */
   public async get({ id }: { id: string }): Promise<ActionResult> {
+    await this.authorization.ensureAuthorized('get');
+
     const preconfiguredActionsList = this.preconfiguredActions.find(
       (preconfiguredAction) => preconfiguredAction.id === id
     );
@@ -179,7 +192,7 @@ export class ActionsClient {
         isPreconfigured: true,
       };
     }
-    const result = await this.savedObjectsClient.get<RawAction>('action', id);
+    const result = await this.unsecuredSavedObjectsClient.get<RawAction>('action', id);
 
     return {
       id,
@@ -194,8 +207,10 @@ export class ActionsClient {
    * Get all actions with preconfigured list
    */
   public async getAll(): Promise<FindActionResult[]> {
+    await this.authorization.ensureAuthorized('get');
+
     const savedObjectsActions = (
-      await this.savedObjectsClient.find<RawAction>({
+      await this.unsecuredSavedObjectsClient.find<RawAction>({
         perPage: MAX_ACTIONS_RETURNED,
         type: 'action',
       })
@@ -221,6 +236,8 @@ export class ActionsClient {
    * Get bulk actions with preconfigured list
    */
   public async getBulk(ids: string[]): Promise<ActionResult[]> {
+    await this.authorization.ensureAuthorized('get');
+
     const actionResults = new Array<ActionResult>();
     for (const actionId of ids) {
       const action = this.preconfiguredActions.find(
@@ -242,7 +259,7 @@ export class ActionsClient {
     ];
 
     const bulkGetOpts = actionSavedObjectsIds.map((id) => ({ id, type: 'action' }));
-    const bulkGetResult = await this.savedObjectsClient.bulkGet<RawAction>(bulkGetOpts);
+    const bulkGetResult = await this.unsecuredSavedObjectsClient.bulkGet<RawAction>(bulkGetOpts);
 
     for (const action of bulkGetResult.saved_objects) {
       if (action.error) {
@@ -259,6 +276,8 @@ export class ActionsClient {
    * Delete action
    */
   public async delete({ id }: { id: string }) {
+    await this.authorization.ensureAuthorized('delete');
+
     if (
       this.preconfiguredActions.find((preconfiguredAction) => preconfiguredAction.id === id) !==
       undefined
@@ -273,18 +292,24 @@ export class ActionsClient {
         'delete'
       );
     }
-    return await this.savedObjectsClient.delete('action', id);
+    return await this.unsecuredSavedObjectsClient.delete('action', id);
   }
 
   public async execute({
     actionId,
     params,
   }: Omit<ExecuteOptions, 'request'>): Promise<ActionTypeExecutorResult> {
+    await this.authorization.ensureAuthorized('execute');
     return this.actionExecutor.execute({ actionId, params, request: this.request });
   }
 
   public async enqueueExecution(options: EnqueueExecutionOptions): Promise<void> {
-    return this.executionEnqueuer(this.savedObjectsClient, options);
+    await this.authorization.ensureAuthorized('execute');
+    return this.executionEnqueuer(this.unsecuredSavedObjectsClient, options);
+  }
+
+  public async listTypes(): Promise<ActionType[]> {
+    return this.actionTypeRegistry.list();
   }
 }
 
diff --git a/x-pack/plugins/actions/server/authorization/actions_authorization.mock.ts b/x-pack/plugins/actions/server/authorization/actions_authorization.mock.ts
new file mode 100644
index 0000000000000..6b55c18241c55
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/actions_authorization.mock.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ActionsAuthorization } from './actions_authorization';
+
+export type ActionsAuthorizationMock = jest.Mocked<PublicMethodsOf<ActionsAuthorization>>;
+
+const createActionsAuthorizationMock = () => {
+  const mocked: ActionsAuthorizationMock = {
+    ensureAuthorized: jest.fn(),
+  };
+  return mocked;
+};
+
+export const actionsAuthorizationMock: {
+  create: () => ActionsAuthorizationMock;
+} = {
+  create: createActionsAuthorizationMock,
+};
diff --git a/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts b/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
new file mode 100644
index 0000000000000..a48124cdbcb6a
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/actions_authorization.test.ts
@@ -0,0 +1,191 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { KibanaRequest } from 'kibana/server';
+import { securityMock } from '../../../../plugins/security/server/mocks';
+import { ActionsAuthorization } from './actions_authorization';
+import { actionsAuthorizationAuditLoggerMock } from './audit_logger.mock';
+import { ActionsAuthorizationAuditLogger, AuthorizationResult } from './audit_logger';
+import { ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from '../saved_objects';
+
+const request = {} as KibanaRequest;
+
+const auditLogger = actionsAuthorizationAuditLoggerMock.create();
+const realAuditLogger = new ActionsAuthorizationAuditLogger();
+
+const mockAuthorizationAction = (type: string, operation: string) => `${type}/${operation}`;
+function mockSecurity() {
+  const security = securityMock.createSetup();
+  const authorization = security.authz;
+  // typescript is having trouble inferring jest's automocking
+  (authorization.actions.savedObject.get as jest.MockedFunction<
+    typeof authorization.actions.savedObject.get
+  >).mockImplementation(mockAuthorizationAction);
+  authorization.mode.useRbacForRequest.mockReturnValue(true);
+  return { authorization };
+}
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  auditLogger.actionsAuthorizationFailure.mockImplementation((username, ...args) =>
+    realAuditLogger.getAuthorizationMessage(AuthorizationResult.Unauthorized, ...args)
+  );
+  auditLogger.actionsAuthorizationSuccess.mockImplementation((username, ...args) =>
+    realAuditLogger.getAuthorizationMessage(AuthorizationResult.Authorized, ...args)
+  );
+});
+
+describe('ensureAuthorized', () => {
+  test('is a no-op when there is no authorization api', async () => {
+    const actionsAuthorization = new ActionsAuthorization({
+      request,
+      auditLogger,
+    });
+
+    await actionsAuthorization.ensureAuthorized('create', 'myType');
+  });
+
+  test('is a no-op when the security license is disabled', async () => {
+    const { authorization } = mockSecurity();
+    authorization.mode.useRbacForRequest.mockReturnValue(false);
+    const actionsAuthorization = new ActionsAuthorization({
+      request,
+      authorization,
+      auditLogger,
+    });
+
+    await actionsAuthorization.ensureAuthorized('create', 'myType');
+  });
+
+  test('ensures the user has privileges to use the operation on the Actions Saved Object type', async () => {
+    const { authorization } = mockSecurity();
+    const checkPrivileges: jest.MockedFunction<ReturnType<
+      typeof authorization.checkPrivilegesDynamicallyWithRequest
+    >> = jest.fn();
+    authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+    const actionsAuthorization = new ActionsAuthorization({
+      request,
+      authorization,
+      auditLogger,
+    });
+
+    checkPrivileges.mockResolvedValueOnce({
+      username: 'some-user',
+      hasAllRequested: true,
+      privileges: [
+        {
+          privilege: mockAuthorizationAction('myType', 'create'),
+          authorized: true,
+        },
+      ],
+    });
+
+    await actionsAuthorization.ensureAuthorized('create', 'myType');
+
+    expect(authorization.actions.savedObject.get).toHaveBeenCalledWith('action', 'create');
+    expect(checkPrivileges).toHaveBeenCalledWith(mockAuthorizationAction('action', 'create'));
+
+    expect(auditLogger.actionsAuthorizationSuccess).toHaveBeenCalledTimes(1);
+    expect(auditLogger.actionsAuthorizationFailure).not.toHaveBeenCalled();
+    expect(auditLogger.actionsAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "some-user",
+        "create",
+        "myType",
+      ]
+    `);
+  });
+
+  test('ensures the user has privileges to execute an Actions Saved Object type', async () => {
+    const { authorization } = mockSecurity();
+    const checkPrivileges: jest.MockedFunction<ReturnType<
+      typeof authorization.checkPrivilegesDynamicallyWithRequest
+    >> = jest.fn();
+    authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+    const actionsAuthorization = new ActionsAuthorization({
+      request,
+      authorization,
+      auditLogger,
+    });
+
+    checkPrivileges.mockResolvedValueOnce({
+      username: 'some-user',
+      hasAllRequested: true,
+      privileges: [
+        {
+          privilege: mockAuthorizationAction('myType', 'execute'),
+          authorized: true,
+        },
+      ],
+    });
+
+    await actionsAuthorization.ensureAuthorized('execute', 'myType');
+
+    expect(authorization.actions.savedObject.get).toHaveBeenCalledWith(
+      ACTION_SAVED_OBJECT_TYPE,
+      'get'
+    );
+    expect(authorization.actions.savedObject.get).toHaveBeenCalledWith(
+      ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
+      'create'
+    );
+    expect(checkPrivileges).toHaveBeenCalledWith([
+      mockAuthorizationAction(ACTION_SAVED_OBJECT_TYPE, 'get'),
+      mockAuthorizationAction(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, 'create'),
+    ]);
+
+    expect(auditLogger.actionsAuthorizationSuccess).toHaveBeenCalledTimes(1);
+    expect(auditLogger.actionsAuthorizationFailure).not.toHaveBeenCalled();
+    expect(auditLogger.actionsAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "some-user",
+        "execute",
+        "myType",
+      ]
+    `);
+  });
+
+  test('throws if user lacks the required privieleges', async () => {
+    const { authorization } = mockSecurity();
+    const checkPrivileges: jest.MockedFunction<ReturnType<
+      typeof authorization.checkPrivilegesDynamicallyWithRequest
+    >> = jest.fn();
+    authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+    const actionsAuthorization = new ActionsAuthorization({
+      request,
+      authorization,
+      auditLogger,
+    });
+
+    checkPrivileges.mockResolvedValueOnce({
+      username: 'some-user',
+      hasAllRequested: false,
+      privileges: [
+        {
+          privilege: mockAuthorizationAction('myType', 'create'),
+          authorized: false,
+        },
+        {
+          privilege: mockAuthorizationAction('myOtherType', 'create'),
+          authorized: true,
+        },
+      ],
+    });
+
+    await expect(
+      actionsAuthorization.ensureAuthorized('create', 'myType')
+    ).rejects.toThrowErrorMatchingInlineSnapshot(`"Unauthorized to create a \\"myType\\" action"`);
+
+    expect(auditLogger.actionsAuthorizationSuccess).not.toHaveBeenCalled();
+    expect(auditLogger.actionsAuthorizationFailure).toHaveBeenCalledTimes(1);
+    expect(auditLogger.actionsAuthorizationFailure.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "some-user",
+        "create",
+        "myType",
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/actions/server/authorization/actions_authorization.ts b/x-pack/plugins/actions/server/authorization/actions_authorization.ts
new file mode 100644
index 0000000000000..da5a5a1cdc3eb
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/actions_authorization.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { KibanaRequest } from 'src/core/server';
+import { SecurityPluginSetup } from '../../../security/server';
+import { ActionsAuthorizationAuditLogger } from './audit_logger';
+import { ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from '../saved_objects';
+
+export interface ConstructorOptions {
+  request: KibanaRequest;
+  auditLogger: ActionsAuthorizationAuditLogger;
+  authorization?: SecurityPluginSetup['authz'];
+}
+
+const operationAlias: Record<
+  string,
+  (authorization: SecurityPluginSetup['authz']) => string | string[]
+> = {
+  execute: (authorization) => [
+    authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'get'),
+    authorization.actions.savedObject.get(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, 'create'),
+  ],
+  list: (authorization) => authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'find'),
+};
+
+export class ActionsAuthorization {
+  private readonly request: KibanaRequest;
+  private readonly authorization?: SecurityPluginSetup['authz'];
+  private readonly auditLogger: ActionsAuthorizationAuditLogger;
+
+  constructor({ request, authorization, auditLogger }: ConstructorOptions) {
+    this.request = request;
+    this.authorization = authorization;
+    this.auditLogger = auditLogger;
+  }
+
+  public async ensureAuthorized(operation: string, actionTypeId?: string) {
+    const { authorization } = this;
+    if (authorization?.mode?.useRbacForRequest(this.request)) {
+      const checkPrivileges = authorization.checkPrivilegesDynamicallyWithRequest(this.request);
+      const { hasAllRequested, username } = await checkPrivileges(
+        operationAlias[operation]
+          ? operationAlias[operation](authorization)
+          : authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, operation)
+      );
+      if (hasAllRequested) {
+        this.auditLogger.actionsAuthorizationSuccess(username, operation, actionTypeId);
+      } else {
+        throw Boom.forbidden(
+          this.auditLogger.actionsAuthorizationFailure(username, operation, actionTypeId)
+        );
+      }
+    }
+  }
+}
diff --git a/x-pack/plugins/actions/server/authorization/audit_logger.mock.ts b/x-pack/plugins/actions/server/authorization/audit_logger.mock.ts
new file mode 100644
index 0000000000000..95d4f4ebcd3aa
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/audit_logger.mock.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ActionsAuthorizationAuditLogger } from './audit_logger';
+
+const createActionsAuthorizationAuditLoggerMock = () => {
+  const mocked = ({
+    getAuthorizationMessage: jest.fn(),
+    actionsAuthorizationFailure: jest.fn(),
+    actionsAuthorizationSuccess: jest.fn(),
+  } as unknown) as jest.Mocked<ActionsAuthorizationAuditLogger>;
+  return mocked;
+};
+
+export const actionsAuthorizationAuditLoggerMock: {
+  create: () => jest.Mocked<ActionsAuthorizationAuditLogger>;
+} = {
+  create: createActionsAuthorizationAuditLoggerMock,
+};
diff --git a/x-pack/plugins/actions/server/authorization/audit_logger.test.ts b/x-pack/plugins/actions/server/authorization/audit_logger.test.ts
new file mode 100644
index 0000000000000..d700abdaa70ff
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/audit_logger.test.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { ActionsAuthorizationAuditLogger } from './audit_logger';
+
+const createMockAuditLogger = () => {
+  return {
+    log: jest.fn(),
+  };
+};
+
+describe(`#constructor`, () => {
+  test('initializes a noop auditLogger if security logger is unavailable', () => {
+    const actionsAuditLogger = new ActionsAuthorizationAuditLogger(undefined);
+
+    const username = 'foo-user';
+    const actionTypeId = 'action-type-id';
+    const operation = 'create';
+    expect(() => {
+      actionsAuditLogger.actionsAuthorizationFailure(username, operation, actionTypeId);
+      actionsAuditLogger.actionsAuthorizationSuccess(username, operation, actionTypeId);
+    }).not.toThrow();
+  });
+});
+
+describe(`#actionsAuthorizationFailure`, () => {
+  test('logs auth failure', () => {
+    const auditLogger = createMockAuditLogger();
+    const actionsAuditLogger = new ActionsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const actionTypeId = 'action-type-id';
+    const operation = 'create';
+
+    actionsAuditLogger.actionsAuthorizationFailure(username, operation, actionTypeId);
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "actions_authorization_failure",
+        "foo-user Unauthorized to create a \\"action-type-id\\" action",
+        Object {
+          "actionTypeId": "action-type-id",
+          "operation": "create",
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
+
+describe(`#savedObjectsAuthorizationSuccess`, () => {
+  test('logs auth success', () => {
+    const auditLogger = createMockAuditLogger();
+    const actionsAuditLogger = new ActionsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const actionTypeId = 'action-type-id';
+
+    const operation = 'create';
+
+    actionsAuditLogger.actionsAuthorizationSuccess(username, operation, actionTypeId);
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "actions_authorization_success",
+        "foo-user Authorized to create a \\"action-type-id\\" action",
+        Object {
+          "actionTypeId": "action-type-id",
+          "operation": "create",
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/actions/server/authorization/audit_logger.ts b/x-pack/plugins/actions/server/authorization/audit_logger.ts
new file mode 100644
index 0000000000000..7e0adc9206656
--- /dev/null
+++ b/x-pack/plugins/actions/server/authorization/audit_logger.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AuditLogger } from '../../../security/server';
+
+export enum AuthorizationResult {
+  Unauthorized = 'Unauthorized',
+  Authorized = 'Authorized',
+}
+
+export class ActionsAuthorizationAuditLogger {
+  private readonly auditLogger: AuditLogger;
+
+  constructor(auditLogger: AuditLogger = { log() {} }) {
+    this.auditLogger = auditLogger;
+  }
+
+  public getAuthorizationMessage(
+    authorizationResult: AuthorizationResult,
+    operation: string,
+    actionTypeId?: string
+  ): string {
+    return `${authorizationResult} to ${operation} ${
+      actionTypeId ? `a "${actionTypeId}" action` : `actions`
+    }`;
+  }
+
+  public actionsAuthorizationFailure(
+    username: string,
+    operation: string,
+    actionTypeId?: string
+  ): string {
+    const message = this.getAuthorizationMessage(
+      AuthorizationResult.Unauthorized,
+      operation,
+      actionTypeId
+    );
+    this.auditLogger.log('actions_authorization_failure', `${username} ${message}`, {
+      username,
+      actionTypeId,
+      operation,
+    });
+    return message;
+  }
+
+  public actionsAuthorizationSuccess(
+    username: string,
+    operation: string,
+    actionTypeId?: string
+  ): string {
+    const message = this.getAuthorizationMessage(
+      AuthorizationResult.Authorized,
+      operation,
+      actionTypeId
+    );
+    this.auditLogger.log('actions_authorization_success', `${username} ${message}`, {
+      username,
+      actionTypeId,
+      operation,
+    });
+    return message;
+  }
+}
diff --git a/x-pack/plugins/actions/server/create_execute_function.ts b/x-pack/plugins/actions/server/create_execute_function.ts
index 2bad33d56f228..85052eef93e05 100644
--- a/x-pack/plugins/actions/server/create_execute_function.ts
+++ b/x-pack/plugins/actions/server/create_execute_function.ts
@@ -7,6 +7,7 @@
 import { SavedObjectsClientContract } from '../../../../src/core/server';
 import { TaskManagerStartContract } from '../../task_manager/server';
 import { RawAction, ActionTypeRegistryContract, PreConfiguredAction } from './types';
+import { ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from './saved_objects';
 
 interface CreateExecuteFunctionOptions {
   taskManager: TaskManagerStartContract;
@@ -49,11 +50,14 @@ export function createExecutionEnqueuerFunction({
       actionTypeRegistry.ensureActionTypeEnabled(actionTypeId);
     }
 
-    const actionTaskParamsRecord = await savedObjectsClient.create('action_task_params', {
-      actionId: id,
-      params,
-      apiKey,
-    });
+    const actionTaskParamsRecord = await savedObjectsClient.create(
+      ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
+      {
+        actionId: id,
+        params,
+        apiKey,
+      }
+    );
 
     await taskManager.schedule({
       taskType: `actions:${actionTypeId}`,
diff --git a/x-pack/plugins/actions/server/feature.ts b/x-pack/plugins/actions/server/feature.ts
new file mode 100644
index 0000000000000..c06acb6761454
--- /dev/null
+++ b/x-pack/plugins/actions/server/feature.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from './saved_objects';
+
+export const ACTIONS_FEATURE = {
+  id: 'actions',
+  name: i18n.translate('xpack.actions.featureRegistry.actionsFeatureName', {
+    defaultMessage: 'Actions',
+  }),
+  icon: 'bell',
+  navLinkId: 'actions',
+  app: [],
+  privileges: {
+    all: {
+      app: [],
+      api: [],
+      catalogue: [],
+      savedObject: {
+        all: [ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE],
+        read: [],
+      },
+      ui: ['show', 'execute', 'save', 'delete'],
+    },
+    read: {
+      app: [],
+      api: [],
+      catalogue: [],
+      savedObject: {
+        // action execution requires 'read' over `actions`, but 'all' over `action_task_params`
+        all: [ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE],
+        read: [ACTION_SAVED_OBJECT_TYPE],
+      },
+      ui: ['show', 'execute'],
+    },
+  },
+};
diff --git a/x-pack/plugins/actions/server/index.ts b/x-pack/plugins/actions/server/index.ts
index 88553c314112f..fef70c3a48455 100644
--- a/x-pack/plugins/actions/server/index.ts
+++ b/x-pack/plugins/actions/server/index.ts
@@ -8,8 +8,10 @@ import { PluginInitializerContext } from '../../../../src/core/server';
 import { ActionsPlugin } from './plugin';
 import { configSchema } from './config';
 import { ActionsClient as ActionsClientClass } from './actions_client';
+import { ActionsAuthorization as ActionsAuthorizationClass } from './authorization/actions_authorization';
 
 export type ActionsClient = PublicMethodsOf<ActionsClientClass>;
+export type ActionsAuthorization = PublicMethodsOf<ActionsAuthorizationClass>;
 
 export {
   ActionsPlugin,
diff --git a/x-pack/plugins/actions/server/lib/action_executor.test.ts b/x-pack/plugins/actions/server/lib/action_executor.test.ts
index c8e6669275e11..65fd0646c639e 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.test.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.test.ts
@@ -9,15 +9,17 @@ import { schema } from '@kbn/config-schema';
 import { ActionExecutor } from './action_executor';
 import { actionTypeRegistryMock } from '../action_type_registry.mock';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/mocks';
-import { loggingSystemMock, savedObjectsClientMock } from '../../../../../src/core/server/mocks';
+import { loggingSystemMock } from '../../../../../src/core/server/mocks';
 import { eventLoggerMock } from '../../../event_log/server/mocks';
 import { spacesServiceMock } from '../../../spaces/server/spaces_service/spaces_service.mock';
 import { ActionType } from '../types';
-import { actionsMock } from '../mocks';
+import { actionsMock, actionsClientMock } from '../mocks';
+import { pick } from 'lodash';
 
 const actionExecutor = new ActionExecutor({ isESOUsingEphemeralEncryptionKey: false });
 const services = actionsMock.createServices();
-const savedObjectsClientWithHidden = savedObjectsClientMock.create();
+
+const actionsClient = actionsClientMock.create();
 const encryptedSavedObjectsClient = encryptedSavedObjectsMock.createClient();
 const actionTypeRegistry = actionTypeRegistryMock.create();
 
@@ -30,11 +32,12 @@ const executeParams = {
 };
 
 const spacesMock = spacesServiceMock.createSetupContract();
+const getActionsClientWithRequest = jest.fn();
 actionExecutor.initialize({
   logger: loggingSystemMock.create().get(),
   spaces: spacesMock,
   getServices: () => services,
-  getScopedSavedObjectsClient: () => savedObjectsClientWithHidden,
+  getActionsClientWithRequest,
   actionTypeRegistry,
   encryptedSavedObjectsClient,
   eventLogger: eventLoggerMock.create(),
@@ -44,6 +47,7 @@ actionExecutor.initialize({
 beforeEach(() => {
   jest.resetAllMocks();
   spacesMock.getSpaceId.mockReturnValue('some-namespace');
+  getActionsClientWithRequest.mockResolvedValue(actionsClient);
 });
 
 test('successfully executes', async () => {
@@ -67,7 +71,13 @@ test('successfully executes', async () => {
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    ...pick(actionSavedObject.attributes, 'actionTypeId', 'config'),
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
   await actionExecutor.execute(executeParams);
@@ -108,7 +118,13 @@ test('provides empty config when config and / or secrets is empty', async () =>
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    actionTypeId: actionSavedObject.attributes.actionTypeId,
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
   await actionExecutor.execute(executeParams);
@@ -138,7 +154,13 @@ test('throws an error when config is invalid', async () => {
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    actionTypeId: actionSavedObject.attributes.actionTypeId,
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
 
@@ -171,7 +193,13 @@ test('throws an error when params is invalid', async () => {
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    actionTypeId: actionSavedObject.attributes.actionTypeId,
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
 
@@ -185,7 +213,7 @@ test('throws an error when params is invalid', async () => {
 });
 
 test('throws an error when failing to load action through savedObjectsClient', async () => {
-  savedObjectsClientWithHidden.get.mockRejectedValueOnce(new Error('No access'));
+  actionsClient.get.mockRejectedValueOnce(new Error('No access'));
   await expect(actionExecutor.execute(executeParams)).rejects.toThrowErrorMatchingInlineSnapshot(
     `"No access"`
   );
@@ -206,7 +234,13 @@ test('throws an error if actionType is not enabled', async () => {
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    actionTypeId: actionSavedObject.attributes.actionTypeId,
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
   actionTypeRegistry.ensureActionTypeEnabled.mockImplementationOnce(() => {
@@ -240,7 +274,13 @@ test('should not throws an error if actionType is preconfigured', async () => {
     },
     references: [],
   };
-  savedObjectsClientWithHidden.get.mockResolvedValueOnce(actionSavedObject);
+  const actionResult = {
+    id: actionSavedObject.id,
+    name: actionSavedObject.id,
+    ...pick(actionSavedObject.attributes, 'actionTypeId', 'config', 'secrets'),
+    isPreconfigured: false,
+  };
+  actionsClient.get.mockResolvedValueOnce(actionResult);
   encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce(actionSavedObject);
   actionTypeRegistry.get.mockReturnValueOnce(actionType);
   actionTypeRegistry.ensureActionTypeEnabled.mockImplementationOnce(() => {
@@ -268,7 +308,7 @@ test('throws an error when passing isESOUsingEphemeralEncryptionKey with value o
   customActionExecutor.initialize({
     logger: loggingSystemMock.create().get(),
     spaces: spacesMock,
-    getScopedSavedObjectsClient: () => savedObjectsClientWithHidden,
+    getActionsClientWithRequest,
     getServices: () => services,
     actionTypeRegistry,
     encryptedSavedObjectsClient,
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index 250bfc2752f1b..0e63cc8f5956e 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Logger, KibanaRequest, SavedObjectsClientContract } from '../../../../../src/core/server';
+import { Logger, KibanaRequest } from '../../../../../src/core/server';
 import { validateParams, validateConfig, validateSecrets } from './validate_with_schema';
 import {
   ActionTypeExecutorResult,
@@ -15,14 +15,15 @@ import {
 } from '../types';
 import { EncryptedSavedObjectsClient } from '../../../encrypted_saved_objects/server';
 import { SpacesServiceSetup } from '../../../spaces/server';
-import { EVENT_LOG_ACTIONS } from '../plugin';
+import { EVENT_LOG_ACTIONS, PluginStartContract } from '../plugin';
 import { IEvent, IEventLogger, SAVED_OBJECT_REL_PRIMARY } from '../../../event_log/server';
+import { ActionsClient } from '../actions_client';
 
 export interface ActionExecutorContext {
   logger: Logger;
   spaces?: SpacesServiceSetup;
   getServices: GetServicesFunction;
-  getScopedSavedObjectsClient: (req: KibanaRequest) => SavedObjectsClientContract;
+  getActionsClientWithRequest: PluginStartContract['getActionsClientWithRequest'];
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
   actionTypeRegistry: ActionTypeRegistryContract;
   eventLogger: IEventLogger;
@@ -76,7 +77,7 @@ export class ActionExecutor {
       actionTypeRegistry,
       eventLogger,
       preconfiguredActions,
-      getScopedSavedObjectsClient,
+      getActionsClientWithRequest,
     } = this.actionExecutorContext!;
 
     const services = getServices(request);
@@ -84,7 +85,7 @@ export class ActionExecutor {
     const namespace = spaceId && spaceId !== 'default' ? { namespace: spaceId } : {};
 
     const { actionTypeId, name, config, secrets } = await getActionInfo(
-      getScopedSavedObjectsClient(request),
+      await getActionsClientWithRequest(request),
       encryptedSavedObjectsClient,
       preconfiguredActions,
       actionId,
@@ -196,7 +197,7 @@ interface ActionInfo {
 }
 
 async function getActionInfo(
-  savedObjectsClient: SavedObjectsClientContract,
+  actionsClient: PublicMethodsOf<ActionsClient>,
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient,
   preconfiguredActions: PreConfiguredAction[],
   actionId: string,
@@ -217,9 +218,7 @@ async function getActionInfo(
 
   // if not pre-configured action, should be a saved object
   // ensure user can read the action before processing
-  const {
-    attributes: { actionTypeId, config, name },
-  } = await savedObjectsClient.get<RawAction>('action', actionId);
+  const { actionTypeId, config, name } = await actionsClient.get({ id: actionId });
 
   const {
     attributes: { secrets },
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
index 06cb84ad79a89..78522682054e1 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
@@ -15,6 +15,7 @@ import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/serv
 import { savedObjectsClientMock, loggingSystemMock } from 'src/core/server/mocks';
 import { eventLoggerMock } from '../../../event_log/server/mocks';
 import { ActionTypeDisabledError } from './errors';
+import { actionsClientMock } from '../mocks';
 
 const spaceIdToNamespace = jest.fn();
 const actionTypeRegistry = actionTypeRegistryMock.create();
@@ -59,7 +60,7 @@ const actionExecutorInitializerParams = {
   logger: loggingSystemMock.create().get(),
   getServices: jest.fn().mockReturnValue(services),
   actionTypeRegistry,
-  getScopedSavedObjectsClient: () => savedObjectsClientMock.create(),
+  getActionsClientWithRequest: jest.fn(async () => actionsClientMock.create()),
   encryptedSavedObjectsClient: mockedEncryptedSavedObjectsClient,
   eventLogger: eventLoggerMock.create(),
   preconfiguredActions: [],
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
index a962497f906a9..9204c41b9288c 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
@@ -17,6 +17,7 @@ import {
   SpaceIdToNamespaceFunction,
   ActionTypeExecutorResult,
 } from '../types';
+import { ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from '../saved_objects';
 
 export interface TaskRunnerContext {
   logger: Logger;
@@ -66,7 +67,7 @@ export class TaskRunnerFactory {
         const {
           attributes: { actionId, params, apiKey },
         } = await encryptedSavedObjectsClient.getDecryptedAsInternalUser<ActionTaskParams>(
-          'action_task_params',
+          ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
           actionTaskParamsId,
           { namespace }
         );
@@ -121,11 +122,11 @@ export class TaskRunnerFactory {
         // Cleanup action_task_params object now that we're done with it
         try {
           const savedObjectsClient = getScopedSavedObjectsClient(fakeRequest);
-          await savedObjectsClient.delete('action_task_params', actionTaskParamsId);
+          await savedObjectsClient.delete(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, actionTaskParamsId);
         } catch (e) {
           // Log error only, we shouldn't fail the task because of an error here (if ever there's retry logic)
           logger.error(
-            `Failed to cleanup action_task_params object [id="${actionTaskParamsId}"]: ${e.message}`
+            `Failed to cleanup ${ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE} object [id="${actionTaskParamsId}"]: ${e.message}`
           );
         }
       },
diff --git a/x-pack/plugins/actions/server/mocks.ts b/x-pack/plugins/actions/server/mocks.ts
index b1e40dce811a0..e2f11abeefff2 100644
--- a/x-pack/plugins/actions/server/mocks.ts
+++ b/x-pack/plugins/actions/server/mocks.ts
@@ -11,7 +11,9 @@ import {
   elasticsearchServiceMock,
   savedObjectsClientMock,
 } from '../../../../src/core/server/mocks';
+import { actionsAuthorizationMock } from './authorization/actions_authorization.mock';
 
+export { actionsAuthorizationMock };
 export { actionsClientMock };
 
 const createSetupMock = () => {
@@ -26,6 +28,9 @@ const createStartMock = () => {
     isActionTypeEnabled: jest.fn(),
     isActionExecutable: jest.fn(),
     getActionsClientWithRequest: jest.fn().mockResolvedValue(actionsClientMock.create()),
+    getActionsAuthorizationWithRequest: jest
+      .fn()
+      .mockReturnValue(actionsAuthorizationMock.create()),
     preconfiguredActions: [],
   };
   return mock;
diff --git a/x-pack/plugins/actions/server/plugin.test.ts b/x-pack/plugins/actions/server/plugin.test.ts
index 1602b26559bed..ac4b332e7fd7a 100644
--- a/x-pack/plugins/actions/server/plugin.test.ts
+++ b/x-pack/plugins/actions/server/plugin.test.ts
@@ -8,6 +8,7 @@ import { PluginInitializerContext, RequestHandlerContext } from '../../../../src
 import { coreMock, httpServerMock } from '../../../../src/core/server/mocks';
 import { usageCollectionPluginMock } from '../../../../src/plugins/usage_collection/server/mocks';
 import { licensingMock } from '../../licensing/server/mocks';
+import { featuresPluginMock } from '../../features/server/mocks';
 import { encryptedSavedObjectsMock } from '../../encrypted_saved_objects/server/mocks';
 import { taskManagerMock } from '../../task_manager/server/mocks';
 import { eventLogMock } from '../../event_log/server/mocks';
@@ -43,6 +44,7 @@ describe('Actions Plugin', () => {
         licensing: licensingMock.createSetup(),
         eventLog: eventLogMock.createSetup(),
         usageCollection: usageCollectionPluginMock.createSetupContract(),
+        features: featuresPluginMock.createSetup(),
       };
     });
 
@@ -200,6 +202,7 @@ describe('Actions Plugin', () => {
         licensing: licensingMock.createSetup(),
         eventLog: eventLogMock.createSetup(),
         usageCollection: usageCollectionPluginMock.createSetupContract(),
+        features: featuresPluginMock.createSetup(),
       };
       pluginsStart = {
         taskManager: taskManagerMock.createStart(),
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
index 114c85ae9f9da..5b8b25d02658b 100644
--- a/x-pack/plugins/actions/server/plugin.ts
+++ b/x-pack/plugins/actions/server/plugin.ts
@@ -29,6 +29,8 @@ import { TaskManagerSetupContract, TaskManagerStartContract } from '../../task_m
 import { LicensingPluginSetup } from '../../licensing/server';
 import { LICENSE_TYPE } from '../../licensing/common/types';
 import { SpacesPluginSetup, SpacesServiceSetup } from '../../spaces/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
+import { SecurityPluginSetup } from '../../security/server';
 
 import { ActionsConfig } from './config';
 import { Services, ActionType, PreConfiguredAction } from './types';
@@ -52,7 +54,14 @@ import {
 } from './routes';
 import { IEventLogger, IEventLogService } from '../../event_log/server';
 import { initializeActionsTelemetry, scheduleActionsTelemetry } from './usage/task';
-import { setupSavedObjects } from './saved_objects';
+import {
+  setupSavedObjects,
+  ACTION_SAVED_OBJECT_TYPE,
+  ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
+} from './saved_objects';
+import { ACTIONS_FEATURE } from './feature';
+import { ActionsAuthorization } from './authorization/actions_authorization';
+import { ActionsAuthorizationAuditLogger } from './authorization/audit_logger';
 
 const EVENT_LOG_PROVIDER = 'actions';
 export const EVENT_LOG_ACTIONS = {
@@ -68,6 +77,7 @@ export interface PluginStartContract {
   isActionTypeEnabled(id: string): boolean;
   isActionExecutable(actionId: string, actionTypeId: string): boolean;
   getActionsClientWithRequest(request: KibanaRequest): Promise<PublicMethodsOf<ActionsClient>>;
+  getActionsAuthorizationWithRequest(request: KibanaRequest): PublicMethodsOf<ActionsAuthorization>;
   preconfiguredActions: PreConfiguredAction[];
 }
 
@@ -78,13 +88,15 @@ export interface ActionsPluginsSetup {
   spaces?: SpacesPluginSetup;
   eventLog: IEventLogService;
   usageCollection?: UsageCollectionSetup;
+  security?: SecurityPluginSetup;
+  features: FeaturesPluginSetup;
 }
 export interface ActionsPluginsStart {
   encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
   taskManager: TaskManagerStartContract;
 }
 
-const includedHiddenTypes = ['action', 'action_task_params'];
+const includedHiddenTypes = [ACTION_SAVED_OBJECT_TYPE, ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE];
 
 export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, PluginStartContract> {
   private readonly kibanaIndex: Promise<string>;
@@ -97,6 +109,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
   private actionExecutor?: ActionExecutor;
   private licenseState: ILicenseState | null = null;
   private spaces?: SpacesServiceSetup;
+  private security?: SecurityPluginSetup;
   private eventLogger?: IEventLogger;
   private isESOUsingEphemeralEncryptionKey?: boolean;
   private readonly telemetryLogger: Logger;
@@ -131,6 +144,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       );
     }
 
+    plugins.features.registerFeature(ACTIONS_FEATURE);
     setupSavedObjects(core.savedObjects, plugins.encryptedSavedObjects);
 
     plugins.eventLog.registerProviderActions(EVENT_LOG_PROVIDER, Object.values(EVENT_LOG_ACTIONS));
@@ -167,6 +181,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
     this.serverBasePath = core.http.basePath.serverBasePath;
     this.actionExecutor = actionExecutor;
     this.spaces = plugins.spaces?.spacesService;
+    this.security = plugins.security;
 
     registerBuiltInActionTypes({
       logger: this.logger,
@@ -227,16 +242,39 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       kibanaIndex,
       isESOUsingEphemeralEncryptionKey,
       preconfiguredActions,
+      instantiateAuthorization,
     } = this;
 
     const encryptedSavedObjectsClient = plugins.encryptedSavedObjects.getClient({
       includedHiddenTypes,
     });
 
-    const getScopedSavedObjectsClient = (request: KibanaRequest) =>
-      core.savedObjects.getScopedClient(request, {
-        includedHiddenTypes,
+    const getActionsClientWithRequest = async (request: KibanaRequest) => {
+      if (isESOUsingEphemeralEncryptionKey === true) {
+        throw new Error(
+          `Unable to create actions client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml`
+        );
+      }
+      return new ActionsClient({
+        unsecuredSavedObjectsClient: core.savedObjects.getScopedClient(request, {
+          excludedWrappers: ['security'],
+          includedHiddenTypes,
+        }),
+        actionTypeRegistry: actionTypeRegistry!,
+        defaultKibanaIndex: await kibanaIndex,
+        scopedClusterClient: core.elasticsearch.legacy.client.asScoped(request),
+        preconfiguredActions,
+        request,
+        authorization: instantiateAuthorization(request),
+        actionExecutor: actionExecutor!,
+        executionEnqueuer: createExecutionEnqueuerFunction({
+          taskManager: plugins.taskManager,
+          actionTypeRegistry: actionTypeRegistry!,
+          isESOUsingEphemeralEncryptionKey: isESOUsingEphemeralEncryptionKey!,
+          preconfiguredActions,
+        }),
       });
+    };
 
     const getScopedSavedObjectsClientWithoutAccessToActions = (request: KibanaRequest) =>
       core.savedObjects.getScopedClient(request);
@@ -245,7 +283,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       logger,
       eventLogger: this.eventLogger!,
       spaces: this.spaces,
-      getScopedSavedObjectsClient,
+      getActionsClientWithRequest,
       getServices: this.getServicesFactory(
         getScopedSavedObjectsClientWithoutAccessToActions,
         core.elasticsearch
@@ -261,7 +299,10 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       encryptedSavedObjectsClient,
       getBasePath: this.getBasePath,
       spaceIdToNamespace: this.spaceIdToNamespace,
-      getScopedSavedObjectsClient,
+      getScopedSavedObjectsClient: (request: KibanaRequest) =>
+        core.savedObjects.getScopedClient(request, {
+          includedHiddenTypes,
+        }),
     });
 
     scheduleActionsTelemetry(this.telemetryLogger, plugins.taskManager);
@@ -273,33 +314,24 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       isActionExecutable: (actionId: string, actionTypeId: string) => {
         return this.actionTypeRegistry!.isActionExecutable(actionId, actionTypeId);
       },
-      // Ability to get an actions client from legacy code
-      async getActionsClientWithRequest(request: KibanaRequest) {
-        if (isESOUsingEphemeralEncryptionKey === true) {
-          throw new Error(
-            `Unable to create actions client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml`
-          );
-        }
-        return new ActionsClient({
-          savedObjectsClient: getScopedSavedObjectsClient(request),
-          actionTypeRegistry: actionTypeRegistry!,
-          defaultKibanaIndex: await kibanaIndex,
-          scopedClusterClient: core.elasticsearch.legacy.client.asScoped(request),
-          preconfiguredActions,
-          request,
-          actionExecutor: actionExecutor!,
-          executionEnqueuer: createExecutionEnqueuerFunction({
-            taskManager: plugins.taskManager,
-            actionTypeRegistry: actionTypeRegistry!,
-            isESOUsingEphemeralEncryptionKey: isESOUsingEphemeralEncryptionKey!,
-            preconfiguredActions,
-          }),
-        });
+      getActionsAuthorizationWithRequest(request: KibanaRequest) {
+        return instantiateAuthorization(request);
       },
+      getActionsClientWithRequest,
       preconfiguredActions,
     };
   }
 
+  private instantiateAuthorization = (request: KibanaRequest) => {
+    return new ActionsAuthorization({
+      request,
+      authorization: this.security?.authz,
+      auditLogger: new ActionsAuthorizationAuditLogger(
+        this.security?.audit.getLogger(ACTIONS_FEATURE.id)
+      ),
+    });
+  };
+
   private getServicesFactory(
     getScopedClient: (request: KibanaRequest) => SavedObjectsClientContract,
     elasticsearch: ElasticsearchServiceStart
@@ -322,6 +354,7 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
       isESOUsingEphemeralEncryptionKey,
       preconfiguredActions,
       actionExecutor,
+      instantiateAuthorization,
     } = this;
 
     return async function actionsRouteHandlerContext(context, request) {
@@ -334,12 +367,16 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
             );
           }
           return new ActionsClient({
-            savedObjectsClient: savedObjects.getScopedClient(request, { includedHiddenTypes }),
+            unsecuredSavedObjectsClient: savedObjects.getScopedClient(request, {
+              excludedWrappers: ['security'],
+              includedHiddenTypes,
+            }),
             actionTypeRegistry: actionTypeRegistry!,
             defaultKibanaIndex,
             scopedClusterClient: context.core.elasticsearch.legacy.client,
             preconfiguredActions,
             request,
+            authorization: instantiateAuthorization(request),
             actionExecutor: actionExecutor!,
             executionEnqueuer: createExecutionEnqueuerFunction({
               taskManager,
diff --git a/x-pack/plugins/actions/server/routes/create.test.ts b/x-pack/plugins/actions/server/routes/create.test.ts
index 940b8ecc61f4e..76f2a79c9f3ee 100644
--- a/x-pack/plugins/actions/server/routes/create.test.ts
+++ b/x-pack/plugins/actions/server/routes/create.test.ts
@@ -28,13 +28,6 @@ describe('createActionRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/action"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-all",
-        ],
-      }
-    `);
 
     const createResult = {
       id: '1',
diff --git a/x-pack/plugins/actions/server/routes/create.ts b/x-pack/plugins/actions/server/routes/create.ts
index 8135567157583..462d3f42b506c 100644
--- a/x-pack/plugins/actions/server/routes/create.ts
+++ b/x-pack/plugins/actions/server/routes/create.ts
@@ -30,9 +30,6 @@ export const createActionRoute = (router: IRouter, licenseState: ILicenseState)
       validate: {
         body: bodySchema,
       },
-      options: {
-        tags: ['access:actions-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/routes/delete.test.ts b/x-pack/plugins/actions/server/routes/delete.test.ts
index 8d759f1a7565e..3bd2d93f255df 100644
--- a/x-pack/plugins/actions/server/routes/delete.test.ts
+++ b/x-pack/plugins/actions/server/routes/delete.test.ts
@@ -28,13 +28,6 @@ describe('deleteActionRoute', () => {
     const [config, handler] = router.delete.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/action/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-all",
-        ],
-      }
-    `);
 
     const actionsClient = actionsClientMock.create();
     actionsClient.delete.mockResolvedValueOnce({});
diff --git a/x-pack/plugins/actions/server/routes/delete.ts b/x-pack/plugins/actions/server/routes/delete.ts
index 9d4fa4019744c..a7303247e95b0 100644
--- a/x-pack/plugins/actions/server/routes/delete.ts
+++ b/x-pack/plugins/actions/server/routes/delete.ts
@@ -31,9 +31,6 @@ export const deleteActionRoute = (router: IRouter, licenseState: ILicenseState)
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:actions-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/routes/execute.test.ts b/x-pack/plugins/actions/server/routes/execute.test.ts
index 6e8ebbf6f91cd..38fca656bef5a 100644
--- a/x-pack/plugins/actions/server/routes/execute.test.ts
+++ b/x-pack/plugins/actions/server/routes/execute.test.ts
@@ -53,13 +53,6 @@ describe('executeActionRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/action/{id}/_execute"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     expect(await handler(context, req, res)).toEqual({ body: executeResult });
 
diff --git a/x-pack/plugins/actions/server/routes/execute.ts b/x-pack/plugins/actions/server/routes/execute.ts
index 28e6a54f5e92d..0d49d9a3a256e 100644
--- a/x-pack/plugins/actions/server/routes/execute.ts
+++ b/x-pack/plugins/actions/server/routes/execute.ts
@@ -32,9 +32,6 @@ export const executeActionRoute = (router: IRouter, licenseState: ILicenseState)
         body: bodySchema,
         params: paramSchema,
       },
-      options: {
-        tags: ['access:actions-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/routes/get.test.ts b/x-pack/plugins/actions/server/routes/get.test.ts
index ee2586851366c..434bd6a9bc224 100644
--- a/x-pack/plugins/actions/server/routes/get.test.ts
+++ b/x-pack/plugins/actions/server/routes/get.test.ts
@@ -29,13 +29,6 @@ describe('getActionRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/action/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const getResult = {
       id: '1',
diff --git a/x-pack/plugins/actions/server/routes/get.ts b/x-pack/plugins/actions/server/routes/get.ts
index 224de241c7374..33577fad87c04 100644
--- a/x-pack/plugins/actions/server/routes/get.ts
+++ b/x-pack/plugins/actions/server/routes/get.ts
@@ -26,9 +26,6 @@ export const getActionRoute = (router: IRouter, licenseState: ILicenseState) =>
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:actions-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/routes/get_all.test.ts b/x-pack/plugins/actions/server/routes/get_all.test.ts
index 6550921278aa5..35db22d2da486 100644
--- a/x-pack/plugins/actions/server/routes/get_all.test.ts
+++ b/x-pack/plugins/actions/server/routes/get_all.test.ts
@@ -29,13 +29,6 @@ describe('getAllActionRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const actionsClient = actionsClientMock.create();
     actionsClient.getAll.mockResolvedValueOnce([]);
@@ -64,13 +57,6 @@ describe('getAllActionRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const actionsClient = actionsClientMock.create();
     actionsClient.getAll.mockResolvedValueOnce([]);
@@ -95,13 +81,6 @@ describe('getAllActionRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const actionsClient = actionsClientMock.create();
     actionsClient.getAll.mockResolvedValueOnce([]);
diff --git a/x-pack/plugins/actions/server/routes/get_all.ts b/x-pack/plugins/actions/server/routes/get_all.ts
index 03a4a97855b6b..1b57f31d14a0d 100644
--- a/x-pack/plugins/actions/server/routes/get_all.ts
+++ b/x-pack/plugins/actions/server/routes/get_all.ts
@@ -19,9 +19,6 @@ export const getAllActionRoute = (router: IRouter, licenseState: ILicenseState)
     {
       path: `${BASE_ACTION_API_PATH}`,
       validate: {},
-      options: {
-        tags: ['access:actions-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/routes/list_action_types.test.ts b/x-pack/plugins/actions/server/routes/list_action_types.test.ts
index f231efe1a07f3..982b64c339a5f 100644
--- a/x-pack/plugins/actions/server/routes/list_action_types.test.ts
+++ b/x-pack/plugins/actions/server/routes/list_action_types.test.ts
@@ -10,6 +10,7 @@ import { licenseStateMock } from '../lib/license_state.mock';
 import { verifyApiAccess } from '../lib';
 import { mockHandlerArguments } from './_mock_handler_arguments';
 import { LicenseType } from '../../../../plugins/licensing/server';
+import { actionsClientMock } from '../mocks';
 
 jest.mock('../lib/verify_api_access.ts', () => ({
   verifyApiAccess: jest.fn(),
@@ -29,13 +30,6 @@ describe('listActionTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/list_action_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
@@ -48,7 +42,9 @@ describe('listActionTypesRoute', () => {
       },
     ];
 
-    const [context, req, res] = mockHandlerArguments({ listTypes }, {}, ['ok']);
+    const actionsClient = actionsClientMock.create();
+    actionsClient.listTypes.mockResolvedValueOnce(listTypes);
+    const [context, req, res] = mockHandlerArguments({ actionsClient }, {}, ['ok']);
 
     expect(await handler(context, req, res)).toMatchInlineSnapshot(`
       Object {
@@ -65,8 +61,6 @@ describe('listActionTypesRoute', () => {
       }
     `);
 
-    expect(context.actions!.listTypes).toHaveBeenCalledTimes(1);
-
     expect(res.ok).toHaveBeenCalledWith({
       body: listTypes,
     });
@@ -81,13 +75,6 @@ describe('listActionTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/list_action_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
@@ -100,8 +87,11 @@ describe('listActionTypesRoute', () => {
       },
     ];
 
+    const actionsClient = actionsClientMock.create();
+    actionsClient.listTypes.mockResolvedValueOnce(listTypes);
+
     const [context, req, res] = mockHandlerArguments(
-      { listTypes },
+      { actionsClient },
       {
         params: { id: '1' },
       },
@@ -126,13 +116,6 @@ describe('listActionTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/list_action_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
@@ -145,8 +128,11 @@ describe('listActionTypesRoute', () => {
       },
     ];
 
+    const actionsClient = actionsClientMock.create();
+    actionsClient.listTypes.mockResolvedValueOnce(listTypes);
+
     const [context, req, res] = mockHandlerArguments(
-      { listTypes },
+      { actionsClient },
       {
         params: { id: '1' },
       },
diff --git a/x-pack/plugins/actions/server/routes/list_action_types.ts b/x-pack/plugins/actions/server/routes/list_action_types.ts
index bfb5fabe127f3..c960a6bac6de0 100644
--- a/x-pack/plugins/actions/server/routes/list_action_types.ts
+++ b/x-pack/plugins/actions/server/routes/list_action_types.ts
@@ -19,9 +19,6 @@ export const listActionTypesRoute = (router: IRouter, licenseState: ILicenseStat
     {
       path: `${BASE_ACTION_API_PATH}/list_action_types`,
       validate: {},
-      options: {
-        tags: ['access:actions-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
@@ -32,8 +29,9 @@ export const listActionTypesRoute = (router: IRouter, licenseState: ILicenseStat
       if (!context.actions) {
         return res.badRequest({ body: 'RouteHandlerContext is not registered for actions' });
       }
+      const actionsClient = context.actions.getActionsClient();
       return res.ok({
-        body: context.actions.listTypes(),
+        body: await actionsClient.listTypes(),
       });
     })
   );
diff --git a/x-pack/plugins/actions/server/routes/update.test.ts b/x-pack/plugins/actions/server/routes/update.test.ts
index 323a52f2fc6e2..6d5b78650ba2a 100644
--- a/x-pack/plugins/actions/server/routes/update.test.ts
+++ b/x-pack/plugins/actions/server/routes/update.test.ts
@@ -28,13 +28,6 @@ describe('updateActionRoute', () => {
     const [config, handler] = router.put.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/actions/action/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:actions-all",
-        ],
-      }
-    `);
 
     const updateResult = {
       id: '1',
diff --git a/x-pack/plugins/actions/server/routes/update.ts b/x-pack/plugins/actions/server/routes/update.ts
index 1e107a4d6edb4..328ce74ef0b08 100644
--- a/x-pack/plugins/actions/server/routes/update.ts
+++ b/x-pack/plugins/actions/server/routes/update.ts
@@ -33,9 +33,6 @@ export const updateActionRoute = (router: IRouter, licenseState: ILicenseState)
         body: bodySchema,
         params: paramSchema,
       },
-      options: {
-        tags: ['access:actions-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/actions/server/saved_objects/index.ts b/x-pack/plugins/actions/server/saved_objects/index.ts
index d68c96a5e9270..54f186acc1ba5 100644
--- a/x-pack/plugins/actions/server/saved_objects/index.ts
+++ b/x-pack/plugins/actions/server/saved_objects/index.ts
@@ -8,12 +8,15 @@ import { SavedObjectsServiceSetup } from 'kibana/server';
 import mappings from './mappings.json';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
 
+export const ACTION_SAVED_OBJECT_TYPE = 'action';
+export const ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE = 'action_task_params';
+
 export function setupSavedObjects(
   savedObjects: SavedObjectsServiceSetup,
   encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
 ) {
   savedObjects.registerType({
-    name: 'action',
+    name: ACTION_SAVED_OBJECT_TYPE,
     hidden: true,
     namespaceType: 'single',
     mappings: mappings.action,
@@ -24,19 +27,19 @@ export function setupSavedObjects(
   // - `config` will be included in AAD
   // - everything else excluded from AAD
   encryptedSavedObjects.registerType({
-    type: 'action',
+    type: ACTION_SAVED_OBJECT_TYPE,
     attributesToEncrypt: new Set(['secrets']),
     attributesToExcludeFromAAD: new Set(['name']),
   });
 
   savedObjects.registerType({
-    name: 'action_task_params',
+    name: ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
     hidden: true,
     namespaceType: 'single',
     mappings: mappings.action_task_params,
   });
   encryptedSavedObjects.registerType({
-    type: 'action_task_params',
+    type: ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
     attributesToEncrypt: new Set(['apiKey']),
   });
 }
diff --git a/x-pack/plugins/alerting_builtins/common/index.ts b/x-pack/plugins/alerting_builtins/common/index.ts
new file mode 100644
index 0000000000000..4f2c166669355
--- /dev/null
+++ b/x-pack/plugins/alerting_builtins/common/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const BUILT_IN_ALERTS_FEATURE_ID = 'builtInAlerts';
diff --git a/x-pack/plugins/alerting_builtins/kibana.json b/x-pack/plugins/alerting_builtins/kibana.json
index cc613d5247ef4..dd70e53604f16 100644
--- a/x-pack/plugins/alerting_builtins/kibana.json
+++ b/x-pack/plugins/alerting_builtins/kibana.json
@@ -3,7 +3,7 @@
   "server": true,
   "version": "8.0.0",
   "kibanaVersion": "kibana",
-  "requiredPlugins": ["alerts"],
+  "requiredPlugins": ["alerts", "features"],
   "configPath": ["xpack", "alerting_builtins"],
   "ui": false
 }
diff --git a/x-pack/plugins/alerting_builtins/server/alert_types/index_threshold/alert_type.ts b/x-pack/plugins/alerting_builtins/server/alert_types/index_threshold/alert_type.ts
index 1a5da8a422b9e..153334cb64047 100644
--- a/x-pack/plugins/alerting_builtins/server/alert_types/index_threshold/alert_type.ts
+++ b/x-pack/plugins/alerting_builtins/server/alert_types/index_threshold/alert_type.ts
@@ -9,11 +9,11 @@ import { AlertType, AlertExecutorOptions } from '../../types';
 import { Params, ParamsSchema } from './alert_type_params';
 import { BaseActionContext, addMessages } from './action_context';
 import { TimeSeriesQuery } from './lib/time_series_query';
+import { Service } from '../../types';
+import { BUILT_IN_ALERTS_FEATURE_ID } from '../../../common';
 
 export const ID = '.index-threshold';
 
-import { Service } from '../../types';
-
 const ActionGroupId = 'threshold met';
 const ComparatorFns = getComparatorFns();
 export const ComparatorFnNames = new Set(ComparatorFns.keys());
@@ -85,7 +85,7 @@ export function getAlertType(service: Service): AlertType {
       ],
     },
     executor,
-    producer: 'alerting',
+    producer: BUILT_IN_ALERTS_FEATURE_ID,
   };
 
   async function executor(options: AlertExecutorOptions) {
diff --git a/x-pack/plugins/alerting_builtins/server/feature.ts b/x-pack/plugins/alerting_builtins/server/feature.ts
new file mode 100644
index 0000000000000..669d2ba627059
--- /dev/null
+++ b/x-pack/plugins/alerting_builtins/server/feature.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { ID as IndexThreshold } from './alert_types/index_threshold/alert_type';
+import { BUILT_IN_ALERTS_FEATURE_ID } from '../common';
+
+export const BUILT_IN_ALERTS_FEATURE = {
+  id: BUILT_IN_ALERTS_FEATURE_ID,
+  name: i18n.translate('xpack.alertingBuiltins.featureRegistry.actionsFeatureName', {
+    defaultMessage: 'Built-In Alerts',
+  }),
+  icon: 'bell',
+  app: [],
+  alerting: [IndexThreshold],
+  privileges: {
+    all: {
+      app: [],
+      catalogue: [],
+      alerting: {
+        all: [IndexThreshold],
+        read: [],
+      },
+      savedObject: {
+        all: [],
+        read: [],
+      },
+      api: [],
+      ui: ['alerting:show'],
+    },
+    read: {
+      app: [],
+      catalogue: [],
+      alerting: {
+        all: [],
+        read: [IndexThreshold],
+      },
+      savedObject: {
+        all: [],
+        read: [],
+      },
+      api: [],
+      ui: ['alerting:show'],
+    },
+  },
+};
diff --git a/x-pack/plugins/alerting_builtins/server/index.ts b/x-pack/plugins/alerting_builtins/server/index.ts
index 00613213d5aed..108393c0d1469 100644
--- a/x-pack/plugins/alerting_builtins/server/index.ts
+++ b/x-pack/plugins/alerting_builtins/server/index.ts
@@ -7,6 +7,7 @@
 import { PluginInitializerContext } from 'src/core/server';
 import { AlertingBuiltinsPlugin } from './plugin';
 import { configSchema } from './config';
+export { ID as INDEX_THRESHOLD_ID } from './alert_types/index_threshold/alert_type';
 
 export const plugin = (ctx: PluginInitializerContext) => new AlertingBuiltinsPlugin(ctx);
 
diff --git a/x-pack/plugins/alerting_builtins/server/plugin.test.ts b/x-pack/plugins/alerting_builtins/server/plugin.test.ts
index 71a904dcbab3d..15ad066523502 100644
--- a/x-pack/plugins/alerting_builtins/server/plugin.test.ts
+++ b/x-pack/plugins/alerting_builtins/server/plugin.test.ts
@@ -7,6 +7,8 @@
 import { AlertingBuiltinsPlugin } from './plugin';
 import { coreMock } from '../../../../src/core/server/mocks';
 import { alertsMock } from '../../alerts/server/mocks';
+import { featuresPluginMock } from '../../features/server/mocks';
+import { BUILT_IN_ALERTS_FEATURE } from './feature';
 
 describe('AlertingBuiltins Plugin', () => {
   describe('setup()', () => {
@@ -22,7 +24,8 @@ describe('AlertingBuiltins Plugin', () => {
 
     it('should register built-in alert types', async () => {
       const alertingSetup = alertsMock.createSetup();
-      await plugin.setup(coreSetup, { alerts: alertingSetup });
+      const featuresSetup = featuresPluginMock.createSetup();
+      await plugin.setup(coreSetup, { alerts: alertingSetup, features: featuresSetup });
 
       expect(alertingSetup.registerType).toHaveBeenCalledTimes(1);
 
@@ -40,11 +43,16 @@ describe('AlertingBuiltins Plugin', () => {
           "name": "Index threshold",
         }
       `);
+      expect(featuresSetup.registerFeature).toHaveBeenCalledWith(BUILT_IN_ALERTS_FEATURE);
     });
 
     it('should return a service in the expected shape', async () => {
       const alertingSetup = alertsMock.createSetup();
-      const service = await plugin.setup(coreSetup, { alerts: alertingSetup });
+      const featuresSetup = featuresPluginMock.createSetup();
+      const service = await plugin.setup(coreSetup, {
+        alerts: alertingSetup,
+        features: featuresSetup,
+      });
 
       expect(typeof service.indexThreshold.timeSeriesQuery).toBe('function');
     });
diff --git a/x-pack/plugins/alerting_builtins/server/plugin.ts b/x-pack/plugins/alerting_builtins/server/plugin.ts
index 12d1b080c7c63..41871c01bfb50 100644
--- a/x-pack/plugins/alerting_builtins/server/plugin.ts
+++ b/x-pack/plugins/alerting_builtins/server/plugin.ts
@@ -9,6 +9,7 @@ import { Plugin, Logger, CoreSetup, CoreStart, PluginInitializerContext } from '
 import { Service, IService, AlertingBuiltinsDeps } from './types';
 import { getService as getServiceIndexThreshold } from './alert_types/index_threshold';
 import { registerBuiltInAlertTypes } from './alert_types';
+import { BUILT_IN_ALERTS_FEATURE } from './feature';
 
 export class AlertingBuiltinsPlugin implements Plugin<IService, IService> {
   private readonly logger: Logger;
@@ -22,7 +23,12 @@ export class AlertingBuiltinsPlugin implements Plugin<IService, IService> {
     };
   }
 
-  public async setup(core: CoreSetup, { alerts }: AlertingBuiltinsDeps): Promise<IService> {
+  public async setup(
+    core: CoreSetup,
+    { alerts, features }: AlertingBuiltinsDeps
+  ): Promise<IService> {
+    features.registerFeature(BUILT_IN_ALERTS_FEATURE);
+
     registerBuiltInAlertTypes({
       service: this.service,
       router: core.http.createRouter(),
diff --git a/x-pack/plugins/alerting_builtins/server/types.ts b/x-pack/plugins/alerting_builtins/server/types.ts
index 1fb5314ca4fd9..f3abc26be8dab 100644
--- a/x-pack/plugins/alerting_builtins/server/types.ts
+++ b/x-pack/plugins/alerting_builtins/server/types.ts
@@ -15,10 +15,12 @@ export {
   AlertType,
   AlertExecutorOptions,
 } from '../../alerts/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
 
 // this plugin's dependendencies
 export interface AlertingBuiltinsDeps {
   alerts: AlertingSetup;
+  features: FeaturesPluginSetup;
 }
 
 // external service exposed through plugin setup/start
diff --git a/x-pack/plugins/alerts/README.md b/x-pack/plugins/alerts/README.md
index 0464ec78a4e9d..10568abbe3c72 100644
--- a/x-pack/plugins/alerts/README.md
+++ b/x-pack/plugins/alerts/README.md
@@ -18,6 +18,7 @@ Table of Contents
 		- [Methods](#methods)
 		- [Executor](#executor)
 		- [Example](#example)
+	- [Role Based Access-Control](#role-based-access-control)
 	- [Alert Navigation](#alert-navigation)
 	- [RESTful API](#restful-api)
 		- [`POST /api/alerts/alert`: Create alert](#post-apialert-create-alert)
@@ -58,7 +59,8 @@ A Kibana alert detects a condition and executes one or more actions when that co
 ## Usage
 
 1. Develop and register an alert type (see alert types -> example).
-2. Create an alert using the RESTful API (see alerts -> create).
+2. Configure feature level privileges using RBAC 
+3. Create an alert using the RESTful API (see alerts -> create).
 
 ## Limitations
 
@@ -293,6 +295,111 @@ server.newPlatform.setup.plugins.alerts.registerType({
 });
 ```
 
+## Role Based Access-Control
+Once you have registered your AlertType, you need to grant your users privileges to use it.
+When registering a feature in Kibana you can specify multiple types of privileges which are granted to users when they're assigned certain roles.
+
+Assuming your feature introduces its own AlertTypes, you'll want to control which roles have all/read privileges for these AlertTypes when they're inside the feature.
+In addition, when users are inside your feature you might want to grant them access to AlertTypes from other features, such as built-in AlertTypes or AlertTypes provided by other features.
+
+You can control all of these abilities by assigning privileges to the Alerting Framework from within your own feature, for example:
+
+```typescript
+features.registerFeature({
+	id: 'my-application-id',
+	name: 'My Application',
+	app: [],
+	privileges: {
+		all: {
+			alerting: {
+				all: [
+					// grant `all` over our own types
+					'my-application-id.my-alert-type',
+					'my-application-id.my-restricted-alert-type',
+					// grant `all` over the built-in IndexThreshold
+					'.index-threshold',
+					// grant `all` over Uptime's TLS AlertType
+					'xpack.uptime.alerts.actionGroups.tls'
+				],
+			},
+		},
+		read: {
+			alerting: {
+				read: [
+					// grant `read` over our own type
+					'my-application-id.my-alert-type',
+					// grant `read` over the built-in IndexThreshold
+					'.index-threshold', 
+					// grant `read` over Uptime's TLS AlertType
+					'xpack.uptime.alerts.actionGroups.tls'
+				],
+			},
+		},
+	},
+});
+```
+
+In this example we can see the following:
+- Our feature grants any user who's assigned the `all` role in our feature the `all` role in the Alerting framework over every alert of the `my-application-id.my-alert-type` type which is created _inside_ the feature. What that means is that this privilege will allow the user to execute any of the `all` operations (listed below) on these alerts as long as their `consumer` is `my-application-id`. Below that you'll notice we've done the same with the `read` role, which is grants the Alerting Framework's `read` role privileges over these very same alerts.
+- In addition, our feature grants the same privileges over any alert of type `my-application-id.my-restricted-alert-type`, which is another hypothetical alertType registered by this feature. It's worth noting though that this type has been omitted from the `read` role. What this means is that only users with the `all` role will be able to interact with alerts of this type.
+- Next, lets look at the `.index-threshold` and `xpack.uptime.alerts.actionGroups.tls` types. These have been specified in both `read` and `all`, which means that all the users in the feature will gain privileges over alerts of these types (as long as their `consumer` is `my-application-id`). The difference between these two and the previous two is that they are _produced_ by other features! `.index-threshold` is a built-in type, provided by the _Built-In Alerts_ feature, and `xpack.uptime.alerts.actionGroups.tls` is an AlertType provided by the _Uptime_ feature. Specifying these type here tells the Alerting Framework that as far as the `my-application-id` feature is concerned, the user is privileged to use them (with `all` and `read` applied), but that isn't enough. Using another feature's AlertType is only possible if both the producer of the AlertType, and the consumer of the AlertType, explicitly grant privileges to do so. In this case, the _Built-In Alerts_ & _Uptime_ features would have to explicitly add these privileges to a role and this role would have to be granted to this user.
+
+It's important to note that any role can be granted a mix of `all` and `read` privileges accross multiple type, for example:
+
+```typescript
+features.registerFeature({
+	id: 'my-application-id',
+	name: 'My Application',
+	app: [],
+	privileges: {
+		all: {
+			alerting: {
+				all: [
+					'my-application-id.my-alert-type',
+					'my-application-id.my-restricted-alert-type'
+				],
+			},
+		},
+		read: {
+			alerting: {
+				all: [
+					'my-application-id.my-alert-type'
+				]
+				read: [
+					'my-application-id.my-restricted-alert-type'
+				],
+			},
+		},
+	},
+});
+```
+
+In the above example, you note that instead of denying users with the `read` role any access to the `my-application-id.my-restricted-alert-type` type, we've decided that these users _should_ be granted `read` privileges over the _resitricted_ AlertType.
+As part of that same change, we also decided that not only should they be allowed to `read` the _restricted_ AlertType, but actually, despite having `read` privileges to the feature as a whole, we do actually want to allow them to create our basic 'my-application-id.my-alert-type' AlertType, as we consider it an extension of _reading_ data in our feature, rather than _writing_ it.
+
+### `read` privileges vs. `all` privileges
+When a user is granted the `read` role in the Alerting Framework, they will be able to execute the following api calls:
+- `get`
+- `getAlertState`
+- `find`
+
+When a user is granted the `all` role in the Alerting Framework, they will be able to execute all of the `read` privileged api calls, but in addition they'll be granted the following calls:
+- `create`
+- `delete`
+- `update`
+- `enable`
+- `disable`
+- `updateApiKey`
+- `muteAll`
+- `unmuteAll`
+- `muteInstance`
+- `unmuteInstance`
+
+Finally, all users, whether they're granted any role or not, are privileged to call the following:
+- `listAlertTypes`, but the output is limited to displaying the AlertTypes the user is perivileged to `get`
+
+Attempting to execute any operation the user isn't privileged to execute will result in an Authorization error thrown by the AlertsClient.
+
 ## Alert Navigation
 When registering an Alert Type, you'll likely want to provide a way of viewing alerts of that type within your own plugin, or perhaps you want to provide a view for all alerts created from within your solution within your own UI.
 
diff --git a/x-pack/plugins/alerts/common/index.ts b/x-pack/plugins/alerts/common/index.ts
index 88a8da5a3e575..b839c07a9db89 100644
--- a/x-pack/plugins/alerts/common/index.ts
+++ b/x-pack/plugins/alerts/common/index.ts
@@ -21,3 +21,4 @@ export interface AlertingFrameworkHealth {
 }
 
 export const BASE_ALERT_API_PATH = '/api/alerts';
+export const ALERTS_FEATURE_ID = 'alerts';
diff --git a/x-pack/plugins/alerts/kibana.json b/x-pack/plugins/alerts/kibana.json
index eef61ff4b3d53..c0ab242831428 100644
--- a/x-pack/plugins/alerts/kibana.json
+++ b/x-pack/plugins/alerts/kibana.json
@@ -5,7 +5,7 @@
   "version": "8.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "alerts"],
-  "requiredPlugins": ["licensing", "taskManager", "encryptedSavedObjects", "actions", "eventLog"],
+  "requiredPlugins": ["licensing", "taskManager", "encryptedSavedObjects", "actions", "eventLog", "features"],
   "optionalPlugins": ["usageCollection", "spaces", "security"],
   "extraPublicDirs": ["common", "common/parse_duration"]
 }
diff --git a/x-pack/plugins/alerts/public/alert_api.test.ts b/x-pack/plugins/alerts/public/alert_api.test.ts
index 45b9f5ba8fe2e..3ee67b79b7bda 100644
--- a/x-pack/plugins/alerts/public/alert_api.test.ts
+++ b/x-pack/plugins/alerts/public/alert_api.test.ts
@@ -22,7 +22,7 @@ describe('loadAlertTypes', () => {
         actionVariables: ['var1'],
         actionGroups: [{ id: 'default', name: 'Default' }],
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: 'alerts',
       },
     ];
     http.get.mockResolvedValueOnce(resolvedValue);
@@ -45,7 +45,7 @@ describe('loadAlertType', () => {
       actionVariables: ['var1'],
       actionGroups: [{ id: 'default', name: 'Default' }],
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: 'alerts',
     };
     http.get.mockResolvedValueOnce([alertType]);
 
@@ -65,7 +65,7 @@ describe('loadAlertType', () => {
       actionVariables: [],
       actionGroups: [{ id: 'default', name: 'Default' }],
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: 'alerts',
     };
     http.get.mockResolvedValueOnce([alertType]);
 
@@ -80,7 +80,7 @@ describe('loadAlertType', () => {
         actionVariables: [],
         actionGroups: [{ id: 'default', name: 'Default' }],
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: 'alerts',
       },
     ]);
 
diff --git a/x-pack/plugins/alerts/public/alert_navigation_registry/alert_navigation_registry.test.ts b/x-pack/plugins/alerts/public/alert_navigation_registry/alert_navigation_registry.test.ts
index ff8a3a1c311c1..72c955923a0cc 100644
--- a/x-pack/plugins/alerts/public/alert_navigation_registry/alert_navigation_registry.test.ts
+++ b/x-pack/plugins/alerts/public/alert_navigation_registry/alert_navigation_registry.test.ts
@@ -16,7 +16,7 @@ const mockAlertType = (id: string): AlertType => ({
   actionGroups: [],
   actionVariables: [],
   defaultActionGroupId: 'default',
-  producer: 'alerting',
+  producer: 'alerts',
 });
 
 describe('AlertNavigationRegistry', () => {
diff --git a/x-pack/plugins/alerts/server/alert_type_registry.test.ts b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
index 6d7cf621ab0ca..c740390713715 100644
--- a/x-pack/plugins/alerts/server/alert_type_registry.test.ts
+++ b/x-pack/plugins/alerts/server/alert_type_registry.test.ts
@@ -36,13 +36,67 @@ describe('has()', () => {
       ],
       defaultActionGroupId: 'default',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     });
     expect(registry.has('foo')).toEqual(true);
   });
 });
 
 describe('register()', () => {
+  test('throws if AlertType Id contains invalid characters', () => {
+    const alertType = {
+      id: 'test',
+      name: 'Test',
+      actionGroups: [
+        {
+          id: 'default',
+          name: 'Default',
+        },
+      ],
+      defaultActionGroupId: 'default',
+      executor: jest.fn(),
+      producer: 'alerts',
+    };
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const registry = new AlertTypeRegistry(alertTypeRegistryParams);
+
+    const invalidCharacters = [' ', ':', '*', '*', '/'];
+    for (const char of invalidCharacters) {
+      expect(() => registry.register({ ...alertType, id: `${alertType.id}${char}` })).toThrowError(
+        new Error(`expected AlertType Id not to include invalid character: ${char}`)
+      );
+    }
+
+    const [first, second] = invalidCharacters;
+    expect(() =>
+      registry.register({ ...alertType, id: `${first}${alertType.id}${second}` })
+    ).toThrowError(
+      new Error(`expected AlertType Id not to include invalid characters: ${first}, ${second}`)
+    );
+  });
+
+  test('throws if AlertType Id isnt a string', () => {
+    const alertType = {
+      id: (123 as unknown) as string,
+      name: 'Test',
+      actionGroups: [
+        {
+          id: 'default',
+          name: 'Default',
+        },
+      ],
+      defaultActionGroupId: 'default',
+      executor: jest.fn(),
+      producer: 'alerts',
+    };
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const registry = new AlertTypeRegistry(alertTypeRegistryParams);
+
+    expect(() => registry.register(alertType)).toThrowError(
+      new Error(`expected value of type [string] but got [number]`)
+    );
+  });
+
   test('registers the executor with the task manager', () => {
     const alertType = {
       id: 'test',
@@ -55,7 +109,7 @@ describe('register()', () => {
       ],
       defaultActionGroupId: 'default',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     };
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     const registry = new AlertTypeRegistry(alertTypeRegistryParams);
@@ -86,7 +140,7 @@ describe('register()', () => {
       ],
       defaultActionGroupId: 'default',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     };
     const registry = new AlertTypeRegistry(alertTypeRegistryParams);
     registry.register(alertType);
@@ -107,7 +161,7 @@ describe('register()', () => {
       ],
       defaultActionGroupId: 'default',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     });
     expect(() =>
       registry.register({
@@ -121,7 +175,7 @@ describe('register()', () => {
         ],
         defaultActionGroupId: 'default',
         executor: jest.fn(),
-        producer: 'alerting',
+        producer: 'alerts',
       })
     ).toThrowErrorMatchingInlineSnapshot(`"Alert type \\"test\\" is already registered."`);
   });
@@ -141,7 +195,7 @@ describe('get()', () => {
       ],
       defaultActionGroupId: 'default',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     });
     const alertType = registry.get('test');
     expect(alertType).toMatchInlineSnapshot(`
@@ -160,7 +214,7 @@ describe('get()', () => {
         "executor": [MockFunction],
         "id": "test",
         "name": "Test",
-        "producer": "alerting",
+        "producer": "alerts",
       }
     `);
   });
@@ -177,7 +231,7 @@ describe('list()', () => {
   test('should return empty when nothing is registered', () => {
     const registry = new AlertTypeRegistry(alertTypeRegistryParams);
     const result = registry.list();
-    expect(result).toMatchInlineSnapshot(`Array []`);
+    expect(result).toMatchInlineSnapshot(`Set {}`);
   });
 
   test('should return registered types', () => {
@@ -193,11 +247,11 @@ describe('list()', () => {
       ],
       defaultActionGroupId: 'testActionGroup',
       executor: jest.fn(),
-      producer: 'alerting',
+      producer: 'alerts',
     });
     const result = registry.list();
     expect(result).toMatchInlineSnapshot(`
-      Array [
+      Set {
         Object {
           "actionGroups": Array [
             Object {
@@ -212,9 +266,9 @@ describe('list()', () => {
           "defaultActionGroupId": "testActionGroup",
           "id": "test",
           "name": "Test",
-          "producer": "alerting",
+          "producer": "alerts",
         },
-      ]
+      }
     `);
   });
 
@@ -260,7 +314,7 @@ function alertTypeWithVariables(id: string, context: string, state: string): Ale
     actionGroups: [],
     defaultActionGroupId: id,
     async executor() {},
-    producer: 'alerting',
+    producer: 'alerts',
   };
 
   if (!context && !state) {
diff --git a/x-pack/plugins/alerts/server/alert_type_registry.ts b/x-pack/plugins/alerts/server/alert_type_registry.ts
index 8f36afe062aa5..c466d0e96382c 100644
--- a/x-pack/plugins/alerts/server/alert_type_registry.ts
+++ b/x-pack/plugins/alerts/server/alert_type_registry.ts
@@ -6,6 +6,8 @@
 
 import Boom from 'boom';
 import { i18n } from '@kbn/i18n';
+import { schema } from '@kbn/config-schema';
+import typeDetect from 'type-detect';
 import { RunContext, TaskManagerSetupContract } from '../../task_manager/server';
 import { TaskRunnerFactory } from './task_runner';
 import { AlertType } from './types';
@@ -15,6 +17,34 @@ interface ConstructorOptions {
   taskRunnerFactory: TaskRunnerFactory;
 }
 
+export interface RegistryAlertType
+  extends Pick<
+    AlertType,
+    'name' | 'actionGroups' | 'defaultActionGroupId' | 'actionVariables' | 'producer'
+  > {
+  id: string;
+}
+
+/**
+ * AlertType IDs are used as part of the authorization strings used to
+ * grant users privileged operations. There is a limited range of characters
+ * we can use in these auth strings, so we apply these same limitations to
+ * the AlertType Ids.
+ * If you wish to change this, please confer with the Kibana security team.
+ */
+const alertIdSchema = schema.string({
+  validate(value: string): string | void {
+    if (typeof value !== 'string') {
+      return `expected AlertType Id of type [string] but got [${typeDetect(value)}]`;
+    } else if (!value.match(/^[a-zA-Z0-9_\-\.]*$/)) {
+      const invalid = value.match(/[^a-zA-Z0-9_\-\.]+/g)!;
+      return `expected AlertType Id not to include invalid character${
+        invalid.length > 1 ? `s` : ``
+      }: ${invalid?.join(`, `)}`;
+    }
+  },
+});
+
 export class AlertTypeRegistry {
   private readonly taskManager: TaskManagerSetupContract;
   private readonly alertTypes: Map<string, AlertType> = new Map();
@@ -41,7 +71,7 @@ export class AlertTypeRegistry {
       );
     }
     alertType.actionVariables = normalizedActionVariables(alertType.actionVariables);
-    this.alertTypes.set(alertType.id, { ...alertType });
+    this.alertTypes.set(alertIdSchema.validate(alertType.id), { ...alertType });
     this.taskManager.registerTaskDefinitions({
       [`alerting:${alertType.id}`]: {
         title: alertType.name,
@@ -66,15 +96,22 @@ export class AlertTypeRegistry {
     return this.alertTypes.get(id)!;
   }
 
-  public list() {
-    return Array.from(this.alertTypes).map(([alertTypeId, alertType]) => ({
-      id: alertTypeId,
-      name: alertType.name,
-      actionGroups: alertType.actionGroups,
-      defaultActionGroupId: alertType.defaultActionGroupId,
-      actionVariables: alertType.actionVariables,
-      producer: alertType.producer,
-    }));
+  public list(): Set<RegistryAlertType> {
+    return new Set(
+      Array.from(this.alertTypes).map(
+        ([id, { name, actionGroups, defaultActionGroupId, actionVariables, producer }]: [
+          string,
+          AlertType
+        ]) => ({
+          id,
+          name,
+          actionGroups,
+          defaultActionGroupId,
+          actionVariables,
+          producer,
+        })
+      )
+    );
   }
 }
 
diff --git a/x-pack/plugins/alerts/server/alerts_client.mock.ts b/x-pack/plugins/alerts/server/alerts_client.mock.ts
index 1848b3432ae5a..be70e441b6fc5 100644
--- a/x-pack/plugins/alerts/server/alerts_client.mock.ts
+++ b/x-pack/plugins/alerts/server/alerts_client.mock.ts
@@ -24,6 +24,7 @@ const createAlertsClientMock = () => {
     unmuteAll: jest.fn(),
     muteInstance: jest.fn(),
     unmuteInstance: jest.fn(),
+    listAlertTypes: jest.fn(),
   };
   return mocked;
 };
diff --git a/x-pack/plugins/alerts/server/alerts_client.test.ts b/x-pack/plugins/alerts/server/alerts_client.test.ts
index d69d04f71ce9e..c25e040ad09ce 100644
--- a/x-pack/plugins/alerts/server/alerts_client.test.ts
+++ b/x-pack/plugins/alerts/server/alerts_client.test.ts
@@ -5,25 +5,32 @@
  */
 import uuid from 'uuid';
 import { schema } from '@kbn/config-schema';
-import { AlertsClient, CreateOptions } from './alerts_client';
+import { AlertsClient, CreateOptions, ConstructorOptions } from './alerts_client';
 import { savedObjectsClientMock, loggingSystemMock } from '../../../../src/core/server/mocks';
 import { taskManagerMock } from '../../task_manager/server/task_manager.mock';
 import { alertTypeRegistryMock } from './alert_type_registry.mock';
+import { alertsAuthorizationMock } from './authorization/alerts_authorization.mock';
 import { TaskStatus } from '../../task_manager/server';
 import { IntervalSchedule } from './types';
 import { resolvable } from './test_utils';
 import { encryptedSavedObjectsMock } from '../../encrypted_saved_objects/server/mocks';
-import { actionsClientMock } from '../../actions/server/mocks';
+import { actionsClientMock, actionsAuthorizationMock } from '../../actions/server/mocks';
+import { AlertsAuthorization } from './authorization/alerts_authorization';
+import { ActionsAuthorization } from '../../actions/server';
 
 const taskManager = taskManagerMock.start();
 const alertTypeRegistry = alertTypeRegistryMock.create();
-const savedObjectsClient = savedObjectsClientMock.create();
+const unsecuredSavedObjectsClient = savedObjectsClientMock.create();
 const encryptedSavedObjects = encryptedSavedObjectsMock.createClient();
+const authorization = alertsAuthorizationMock.create();
+const actionsAuthorization = actionsAuthorizationMock.create();
 
-const alertsClientParams = {
+const alertsClientParams: jest.Mocked<ConstructorOptions> = {
   taskManager,
   alertTypeRegistry,
-  savedObjectsClient,
+  unsecuredSavedObjectsClient,
+  authorization: (authorization as unknown) as AlertsAuthorization,
+  actionsAuthorization: (actionsAuthorization as unknown) as ActionsAuthorization,
   spaceId: 'default',
   namespace: 'default',
   getUserName: jest.fn(),
@@ -39,7 +46,11 @@ beforeEach(() => {
   alertsClientParams.createAPIKey.mockResolvedValue({ apiKeysEnabled: false });
   alertsClientParams.invalidateAPIKey.mockResolvedValue({
     apiKeysEnabled: true,
-    result: { error_count: 0 },
+    result: {
+      invalidated_api_keys: [],
+      previously_invalidated_api_keys: [],
+      error_count: 0,
+    },
   });
   alertsClientParams.getUserName.mockResolvedValue('elastic');
   taskManager.runNow.mockResolvedValue({ id: '' });
@@ -71,6 +82,15 @@ beforeEach(() => {
     },
   ]);
   alertsClientParams.getActionsClient.mockResolvedValue(actionsClient);
+
+  alertTypeRegistry.get.mockImplementation((id) => ({
+    id: '123',
+    name: 'Test',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    defaultActionGroupId: 'default',
+    async executor() {},
+    producer: 'alerts',
+  }));
 });
 
 const mockedDate = new Date('2019-02-12T21:01:22.479Z');
@@ -114,19 +134,116 @@ describe('create()', () => {
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
-    alertTypeRegistry.get.mockReturnValue({
-      id: '123',
-      name: 'Test',
-      actionGroups: [{ id: 'default', name: 'Default' }],
-      defaultActionGroupId: 'default',
-      async executor() {},
-      producer: 'alerting',
+  });
+
+  describe('authorization', () => {
+    function tryToExecuteOperation(options: CreateOptions): Promise<unknown> {
+      unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
+        saved_objects: [
+          {
+            id: '1',
+            type: 'action',
+            attributes: {
+              actions: [],
+              actionTypeId: 'test',
+            },
+            references: [],
+          },
+        ],
+      });
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          alertTypeId: '123',
+          schedule: { interval: '10s' },
+          params: {
+            bar: true,
+          },
+          createdAt: '2019-02-12T21:01:22.479Z',
+          actions: [
+            {
+              group: 'default',
+              actionRef: 'action_0',
+              actionTypeId: 'test',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+        },
+        references: [
+          {
+            name: 'action_0',
+            type: 'action',
+            id: '1',
+          },
+        ],
+      });
+      taskManager.schedule.mockResolvedValueOnce({
+        id: 'task-123',
+        taskType: 'alerting:123',
+        scheduledAt: new Date(),
+        attempts: 1,
+        status: TaskStatus.Idle,
+        runAt: new Date(),
+        startedAt: null,
+        retryAt: null,
+        state: {},
+        params: {},
+        ownerId: null,
+      });
+      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          actions: [],
+          scheduledTaskId: 'task-123',
+        },
+        references: [
+          {
+            id: '1',
+            name: 'action_0',
+            type: 'action',
+          },
+        ],
+      });
+
+      return alertsClient.create(options);
+    }
+
+    test('ensures user is authorised to create this type of alert under the consumer', async () => {
+      const data = getMockData({
+        alertTypeId: 'myType',
+        consumer: 'myApp',
+      });
+
+      await tryToExecuteOperation({ data });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'create');
+    });
+
+    test('throws when user is not authorised to create this type of alert', async () => {
+      const data = getMockData({
+        alertTypeId: 'myType',
+        consumer: 'myApp',
+      });
+
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to create a "myType" alert for "myApp"`)
+      );
+
+      await expect(tryToExecuteOperation({ data })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to create a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'create');
     });
   });
 
   test('creates an alert', async () => {
     const data = getMockData();
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -168,10 +285,11 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         scheduledTaskId: 'task-123',
       },
       references: [
@@ -183,6 +301,7 @@ describe('create()', () => {
       ],
     });
     const result = await alertsClient.create({ data });
+    expect(authorization.ensureAuthorized).toHaveBeenCalledWith('123', 'bar', 'create');
     expect(result).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
@@ -208,10 +327,10 @@ describe('create()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(savedObjectsClient.create).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.create.mock.calls[0]).toHaveLength(3);
-    expect(savedObjectsClient.create.mock.calls[0][0]).toEqual('alert');
-    expect(savedObjectsClient.create.mock.calls[0][1]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0]).toHaveLength(3);
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][1]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -246,7 +365,7 @@ describe('create()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(savedObjectsClient.create.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.create.mock.calls[0][2]).toMatchInlineSnapshot(`
                                                                                                                   Object {
                                                                                                                     "references": Array [
                                                                                                                       Object {
@@ -277,11 +396,11 @@ describe('create()', () => {
                                                                           },
                                                                         ]
                                                 `);
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toHaveLength(3);
-    expect(savedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(savedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(savedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(3);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
                                                                                                                   Object {
                                                                                                                     "scheduledTaskId": "task-123",
                                                                                                                   }
@@ -314,7 +433,7 @@ describe('create()', () => {
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -382,10 +501,11 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         scheduledTaskId: 'task-123',
       },
       references: [],
@@ -436,19 +556,20 @@ describe('create()', () => {
 
   test('creates a disabled alert', async () => {
     const data = getMockData({ enabled: false });
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -504,7 +625,7 @@ describe('create()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(savedObjectsClient.create).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledTimes(1);
     expect(taskManager.schedule).toHaveBeenCalledTimes(0);
   });
 
@@ -527,7 +648,7 @@ describe('create()', () => {
         }),
       },
       async executor() {},
-      producer: 'alerting',
+      producer: 'alerts',
     });
     await expect(alertsClient.create({ data })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"params invalid: [param1]: expected value of type [string] but got [undefined]"`
@@ -542,25 +663,26 @@ describe('create()', () => {
     await expect(alertsClient.create({ data })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Test Error"`
     );
-    expect(savedObjectsClient.create).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.create).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
 
   test('throws error if create saved object fails', async () => {
     const data = getMockData();
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockRejectedValueOnce(new Error('Test failure'));
+    unsecuredSavedObjectsClient.create.mockRejectedValueOnce(new Error('Test failure'));
     await expect(alertsClient.create({ data })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Test failure"`
     );
@@ -569,19 +691,20 @@ describe('create()', () => {
 
   test('attempts to remove saved object if scheduling failed', async () => {
     const data = getMockData();
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -610,12 +733,12 @@ describe('create()', () => {
       ],
     });
     taskManager.schedule.mockRejectedValueOnce(new Error('Test failure'));
-    savedObjectsClient.delete.mockResolvedValueOnce({});
+    unsecuredSavedObjectsClient.delete.mockResolvedValueOnce({});
     await expect(alertsClient.create({ data })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Test failure"`
     );
-    expect(savedObjectsClient.delete).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.delete.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.delete).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.delete.mock.calls[0]).toMatchInlineSnapshot(`
                                                                                                                   Array [
                                                                                                                     "alert",
                                                                                                                     "1",
@@ -625,19 +748,20 @@ describe('create()', () => {
 
   test('returns task manager error if cleanup fails, logs to console', async () => {
     const data = getMockData();
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -666,7 +790,9 @@ describe('create()', () => {
       ],
     });
     taskManager.schedule.mockRejectedValueOnce(new Error('Task manager error'));
-    savedObjectsClient.delete.mockRejectedValueOnce(new Error('Saved object delete error'));
+    unsecuredSavedObjectsClient.delete.mockRejectedValueOnce(
+      new Error('Saved object delete error')
+    );
     await expect(alertsClient.create({ data })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Task manager error"`
     );
@@ -689,21 +815,22 @@ describe('create()', () => {
     const data = getMockData();
     alertsClientParams.createAPIKey.mockResolvedValueOnce({
       apiKeysEnabled: true,
-      result: { id: '123', api_key: 'abc' },
+      result: { id: '123', name: '123', api_key: 'abc' },
     });
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -744,10 +871,11 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         scheduledTaskId: 'task-123',
       },
       references: [
@@ -761,7 +889,7 @@ describe('create()', () => {
     await alertsClient.create({ data });
 
     expect(alertsClientParams.createAPIKey).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.create).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledWith(
       'alert',
       {
         actions: [
@@ -802,19 +930,20 @@ describe('create()', () => {
 
   test(`doesn't create API key for disabled alerts`, async () => {
     const data = getMockData({ enabled: false });
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.create.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -855,10 +984,11 @@ describe('create()', () => {
       params: {},
       ownerId: null,
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         scheduledTaskId: 'task-123',
       },
       references: [
@@ -872,7 +1002,7 @@ describe('create()', () => {
     await alertsClient.create({ data });
 
     expect(alertsClientParams.createAPIKey).not.toHaveBeenCalled();
-    expect(savedObjectsClient.create).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.create).toHaveBeenCalledWith(
       'alert',
       {
         actions: [
@@ -918,9 +1048,21 @@ describe('enable()', () => {
     id: '1',
     type: 'alert',
     attributes: {
+      consumer: 'myApp',
       schedule: { interval: '10s' },
-      alertTypeId: '2',
+      alertTypeId: 'myType',
       enabled: false,
+      actions: [
+        {
+          group: 'default',
+          id: '1',
+          actionTypeId: '1',
+          actionRef: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
     },
     version: '123',
     references: [],
@@ -929,7 +1071,7 @@ describe('enable()', () => {
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
     encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingAlert);
-    savedObjectsClient.get.mockResolvedValue(existingAlert);
+    unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
     alertsClientParams.createAPIKey.mockResolvedValue({
       apiKeysEnabled: false,
     });
@@ -948,31 +1090,85 @@ describe('enable()', () => {
     });
   });
 
+  describe('authorization', () => {
+    beforeEach(() => {
+      encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingAlert);
+      unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
+      alertsClientParams.createAPIKey.mockResolvedValue({
+        apiKeysEnabled: false,
+      });
+      taskManager.schedule.mockResolvedValue({
+        id: 'task-123',
+        scheduledAt: new Date(),
+        attempts: 0,
+        status: TaskStatus.Idle,
+        runAt: new Date(),
+        state: {},
+        params: {},
+        taskType: '',
+        startedAt: null,
+        retryAt: null,
+        ownerId: null,
+      });
+    });
+
+    test('ensures user is authorised to enable this type of alert under the consumer', async () => {
+      await alertsClient.enable({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'enable');
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to enable this type of alert', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to enable a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.enable({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to enable a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'enable');
+    });
+  });
+
   test('enables an alert', async () => {
     await alertsClient.enable({ id: '1' });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).toHaveBeenCalled();
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
+        consumer: 'myApp',
         enabled: true,
         updatedBy: 'elastic',
         apiKey: null,
         apiKeyOwner: null,
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       {
         version: '123',
       }
     );
     expect(taskManager.schedule).toHaveBeenCalledWith({
-      taskType: `alerting:2`,
+      taskType: `alerting:myType`,
       params: {
         alertId: '1',
         spaceId: 'default',
@@ -984,7 +1180,7 @@ describe('enable()', () => {
       },
       scope: ['alerting'],
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
       scheduledTaskId: 'task-123',
     });
   });
@@ -999,7 +1195,7 @@ describe('enable()', () => {
     });
 
     await alertsClient.enable({ id: '1' });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
@@ -1018,27 +1214,39 @@ describe('enable()', () => {
     await alertsClient.enable({ id: '1' });
     expect(alertsClientParams.getUserName).not.toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).not.toHaveBeenCalled();
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
 
   test('sets API key when createAPIKey returns one', async () => {
     alertsClientParams.createAPIKey.mockResolvedValueOnce({
       apiKeysEnabled: true,
-      result: { id: '123', api_key: 'abc' },
+      result: { id: '123', name: '123', api_key: 'abc' },
     });
 
     await alertsClient.enable({ id: '1' });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
+        consumer: 'myApp',
         enabled: true,
         apiKey: Buffer.from('123:abc').toString('base64'),
         apiKeyOwner: 'elastic',
         updatedBy: 'elastic',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       {
         version: '123',
@@ -1050,7 +1258,7 @@ describe('enable()', () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
 
     await alertsClient.enable({ id: '1' });
-    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
       'enable(): Failed to load API key to invalidate on alert 1: Fail'
     );
@@ -1058,45 +1266,47 @@ describe('enable()', () => {
 
   test('throws error when failing to load the saved object using SOC', async () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
-    savedObjectsClient.get.mockRejectedValueOnce(new Error('Fail to get'));
+    unsecuredSavedObjectsClient.get.mockRejectedValueOnce(new Error('Fail to get'));
 
     await expect(alertsClient.enable({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Fail to get"`
     );
     expect(alertsClientParams.getUserName).not.toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).not.toHaveBeenCalled();
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
 
   test('throws error when failing to update the first time', async () => {
-    savedObjectsClient.update.mockRejectedValueOnce(new Error('Fail to update'));
+    unsecuredSavedObjectsClient.update.mockRejectedValueOnce(new Error('Fail to update'));
 
     await expect(alertsClient.enable({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Fail to update"`
     );
     expect(alertsClientParams.getUserName).toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).toHaveBeenCalled();
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
     expect(taskManager.schedule).not.toHaveBeenCalled();
   });
 
   test('throws error when failing to update the second time', async () => {
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       ...existingAlert,
       attributes: {
         ...existingAlert.attributes,
         enabled: true,
       },
     });
-    savedObjectsClient.update.mockRejectedValueOnce(new Error('Fail to update second time'));
+    unsecuredSavedObjectsClient.update.mockRejectedValueOnce(
+      new Error('Fail to update second time')
+    );
 
     await expect(alertsClient.enable({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Fail to update second time"`
     );
     expect(alertsClientParams.getUserName).toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).toHaveBeenCalled();
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(2);
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(2);
     expect(taskManager.schedule).toHaveBeenCalled();
   });
 
@@ -1108,7 +1318,7 @@ describe('enable()', () => {
     );
     expect(alertsClientParams.getUserName).toHaveBeenCalled();
     expect(alertsClientParams.createAPIKey).toHaveBeenCalled();
-    expect(savedObjectsClient.update).toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalled();
   });
 });
 
@@ -1118,10 +1328,22 @@ describe('disable()', () => {
     id: '1',
     type: 'alert',
     attributes: {
+      consumer: 'myApp',
       schedule: { interval: '10s' },
-      alertTypeId: '2',
+      alertTypeId: 'myType',
       enabled: true,
       scheduledTaskId: 'task-123',
+      actions: [
+        {
+          group: 'default',
+          id: '1',
+          actionTypeId: '1',
+          actionRef: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
     },
     version: '123',
     references: [],
@@ -1136,27 +1358,59 @@ describe('disable()', () => {
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValue(existingAlert);
+    unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
     encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingDecryptedAlert);
   });
 
+  describe('authorization', () => {
+    test('ensures user is authorised to disable this type of alert under the consumer', async () => {
+      await alertsClient.disable({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'disable');
+    });
+
+    test('throws when user is not authorised to disable this type of alert', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to disable a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.disable({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to disable a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'disable');
+    });
+  });
+
   test('disables an alert', async () => {
     await alertsClient.disable({ id: '1' });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
+        consumer: 'myApp',
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
         apiKey: null,
         apiKeyOwner: null,
         enabled: false,
         scheduledTaskId: null,
         updatedBy: 'elastic',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       {
         version: '123',
@@ -1170,21 +1424,33 @@ describe('disable()', () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValueOnce(new Error('Fail'));
 
     await alertsClient.disable({ id: '1' });
-    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
+        consumer: 'myApp',
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
         apiKey: null,
         apiKeyOwner: null,
         enabled: false,
         scheduledTaskId: null,
         updatedBy: 'elastic',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       {
         version: '123',
@@ -1199,12 +1465,13 @@ describe('disable()', () => {
       ...existingDecryptedAlert,
       attributes: {
         ...existingDecryptedAlert.attributes,
+        actions: [],
         enabled: false,
       },
     });
 
     await alertsClient.disable({ id: '1' });
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
     expect(taskManager.remove).not.toHaveBeenCalled();
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
   });
@@ -1220,7 +1487,7 @@ describe('disable()', () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValueOnce(new Error('Fail'));
 
     await alertsClient.disable({ id: '1' });
-    expect(savedObjectsClient.update).toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalled();
     expect(taskManager.remove).toHaveBeenCalled();
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
@@ -1228,8 +1495,8 @@ describe('disable()', () => {
     );
   });
 
-  test('throws when savedObjectsClient update fails', async () => {
-    savedObjectsClient.update.mockRejectedValueOnce(new Error('Failed to update'));
+  test('throws when unsecuredSavedObjectsClient update fails', async () => {
+    unsecuredSavedObjectsClient.update.mockRejectedValueOnce(new Error('Failed to update'));
 
     await expect(alertsClient.disable({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Failed to update"`
@@ -1257,52 +1524,181 @@ describe('disable()', () => {
 describe('muteAll()', () => {
   test('mutes an alert', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
         muteAll: false,
       },
       references: [],
     });
 
     await alertsClient.muteAll({ id: '1' });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
       muteAll: true,
       mutedInstanceIds: [],
       updatedBy: 'elastic',
     });
   });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          actions: [
+            {
+              group: 'default',
+              id: '1',
+              actionTypeId: '1',
+              actionRef: '1',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+          consumer: 'myApp',
+          schedule: { interval: '10s' },
+          alertTypeId: 'myType',
+          apiKey: null,
+          apiKeyOwner: null,
+          enabled: false,
+          scheduledTaskId: null,
+          updatedBy: 'elastic',
+          muteAll: false,
+        },
+        references: [],
+      });
+    });
+
+    test('ensures user is authorised to muteAll this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.muteAll({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'muteAll');
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to muteAll this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to muteAll a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.muteAll({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to muteAll a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'muteAll');
+    });
+  });
 });
 
 describe('unmuteAll()', () => {
   test('unmutes an alert', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
         muteAll: true,
       },
       references: [],
     });
 
     await alertsClient.unmuteAll({ id: '1' });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith('alert', '1', {
       muteAll: false,
       mutedInstanceIds: [],
       updatedBy: 'elastic',
     });
   });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          actions: [
+            {
+              group: 'default',
+              id: '1',
+              actionTypeId: '1',
+              actionRef: '1',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+          consumer: 'myApp',
+          schedule: { interval: '10s' },
+          alertTypeId: 'myType',
+          apiKey: null,
+          apiKeyOwner: null,
+          enabled: false,
+          scheduledTaskId: null,
+          updatedBy: 'elastic',
+          muteAll: false,
+        },
+        references: [],
+      });
+    });
+
+    test('ensures user is authorised to unmuteAll this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.unmuteAll({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'unmuteAll');
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to unmuteAll this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to unmuteAll a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.unmuteAll({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to unmuteAll a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'unmuteAll');
+    });
+  });
 });
 
 describe('muteInstance()', () => {
   test('mutes an alert instance', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1314,7 +1710,7 @@ describe('muteInstance()', () => {
     });
 
     await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
@@ -1327,10 +1723,11 @@ describe('muteInstance()', () => {
 
   test('skips muting when alert instance already muted', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1341,15 +1738,16 @@ describe('muteInstance()', () => {
     });
 
     await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
   });
 
   test('skips muting when alert is muted', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1361,17 +1759,79 @@ describe('muteInstance()', () => {
     });
 
     await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+  });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          actions: [
+            {
+              group: 'default',
+              id: '1',
+              actionTypeId: '1',
+              actionRef: '1',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+          schedule: { interval: '10s' },
+          alertTypeId: 'myType',
+          consumer: 'myApp',
+          enabled: true,
+          scheduledTaskId: 'task-123',
+          mutedInstanceIds: [],
+        },
+        version: '123',
+        references: [],
+      });
+    });
+
+    test('ensures user is authorised to muteInstance this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' });
+
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'muteInstance'
+      );
+    });
+
+    test('throws when user is not authorised to muteInstance this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to muteInstance a "myType" alert for "myApp"`)
+      );
+
+      await expect(
+        alertsClient.muteInstance({ alertId: '1', alertInstanceId: '2' })
+      ).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to muteInstance a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'muteInstance'
+      );
+    });
   });
 });
 
 describe('unmuteInstance()', () => {
   test('unmutes an alert instance', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1383,7 +1843,7 @@ describe('unmuteInstance()', () => {
     });
 
     await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
@@ -1396,10 +1856,11 @@ describe('unmuteInstance()', () => {
 
   test('skips unmuting when alert instance not muted', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1410,15 +1871,16 @@ describe('unmuteInstance()', () => {
     });
 
     await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
   });
 
   test('skips unmuting when alert is muted', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
+        actions: [],
         schedule: { interval: '10s' },
         alertTypeId: '2',
         enabled: true,
@@ -1430,14 +1892,75 @@ describe('unmuteInstance()', () => {
     });
 
     await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
-    expect(savedObjectsClient.update).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).not.toHaveBeenCalled();
+  });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          actions: [
+            {
+              group: 'default',
+              id: '1',
+              actionTypeId: '1',
+              actionRef: '1',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+          alertTypeId: 'myType',
+          consumer: 'myApp',
+          schedule: { interval: '10s' },
+          enabled: true,
+          scheduledTaskId: 'task-123',
+          mutedInstanceIds: ['2'],
+        },
+        version: '123',
+        references: [],
+      });
+    });
+
+    test('ensures user is authorised to unmuteInstance this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' });
+
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'unmuteInstance'
+      );
+    });
+
+    test('throws when user is not authorised to unmuteInstance this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to unmuteInstance a "myType" alert for "myApp"`)
+      );
+
+      await expect(
+        alertsClient.unmuteInstance({ alertId: '1', alertInstanceId: '2' })
+      ).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to unmuteInstance a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'unmuteInstance'
+      );
+    });
   });
 });
 
 describe('get()', () => {
   test('calls saved objects client with given params', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1446,6 +1969,7 @@ describe('get()', () => {
         params: {
           bar: true,
         },
+        createdAt: new Date().toISOString(),
         actions: [
           {
             group: 'default',
@@ -1488,8 +2012,8 @@ describe('get()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(savedObjectsClient.get).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
                                                                                                                   Array [
                                                                                                                     "alert",
                                                                                                                     "1",
@@ -1499,7 +2023,7 @@ describe('get()', () => {
 
   test(`throws an error when references aren't found`, async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1517,19 +2041,72 @@ describe('get()', () => {
             },
           },
         ],
-      },
-      references: [],
+      },
+      references: [],
+    });
+    await expect(alertsClient.get({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
+      `"Action reference \\"action_0\\" not found in alert id: 1"`
+    );
+  });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          alertTypeId: 'myType',
+          consumer: 'myApp',
+          schedule: { interval: '10s' },
+          params: {
+            bar: true,
+          },
+          actions: [
+            {
+              group: 'default',
+              actionRef: 'action_0',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+        },
+        references: [
+          {
+            name: 'action_0',
+            type: 'action',
+            id: '1',
+          },
+        ],
+      });
+    });
+
+    test('ensures user is authorised to get this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.get({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'get');
+    });
+
+    test('throws when user is not authorised to get this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to get a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.get({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to get a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'get');
     });
-    await expect(alertsClient.get({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
-      `"Reference action_0 not found"`
-    );
   });
 });
 
 describe('getAlertState()', () => {
   test('calls saved objects client with given params', async () => {
     const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1572,8 +2149,8 @@ describe('getAlertState()', () => {
     });
 
     await alertsClient.getAlertState({ id: '1' });
-    expect(savedObjectsClient.get).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.get.mock.calls[0]).toMatchInlineSnapshot(`
                                                                                                                   Array [
                                                                                                                     "alert",
                                                                                                                     "1",
@@ -1586,7 +2163,7 @@ describe('getAlertState()', () => {
 
     const scheduledTaskId = 'task-123';
 
-    savedObjectsClient.get.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -1638,12 +2215,103 @@ describe('getAlertState()', () => {
     expect(taskManager.get).toHaveBeenCalledTimes(1);
     expect(taskManager.get).toHaveBeenCalledWith(scheduledTaskId);
   });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.get.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          alertTypeId: 'myType',
+          consumer: 'myApp',
+          schedule: { interval: '10s' },
+          params: {
+            bar: true,
+          },
+          actions: [
+            {
+              group: 'default',
+              actionRef: 'action_0',
+              params: {
+                foo: true,
+              },
+            },
+          ],
+        },
+        references: [
+          {
+            name: 'action_0',
+            type: 'action',
+            id: '1',
+          },
+        ],
+      });
+
+      taskManager.get.mockResolvedValueOnce({
+        id: '1',
+        taskType: 'alerting:123',
+        scheduledAt: new Date(),
+        attempts: 1,
+        status: TaskStatus.Idle,
+        runAt: new Date(),
+        startedAt: null,
+        retryAt: null,
+        state: {},
+        params: {},
+        ownerId: null,
+      });
+    });
+
+    test('ensures user is authorised to get this type of alert under the consumer', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.getAlertState({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'getAlertState'
+      );
+    });
+
+    test('throws when user is not authorised to getAlertState this type of alert', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      // `get` check
+      authorization.ensureAuthorized.mockResolvedValueOnce();
+      // `getAlertState` check
+      authorization.ensureAuthorized.mockRejectedValueOnce(
+        new Error(`Unauthorized to getAlertState a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.getAlertState({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to getAlertState a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'getAlertState'
+      );
+    });
+  });
 });
 
 describe('find()', () => {
-  test('calls saved objects client with given params', async () => {
-    const alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.find.mockResolvedValueOnce({
+  const listedTypes = new Set([
+    {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'myType',
+      name: 'myType',
+      producer: 'myApp',
+    },
+  ]);
+  beforeEach(() => {
+    authorization.getFindAuthorizationFilter.mockResolvedValue({
+      ensureAlertTypeIsAuthorized() {},
+      logSuccessfulAuthorization() {},
+    });
+    unsecuredSavedObjectsClient.find.mockResolvedValueOnce({
       total: 1,
       per_page: 10,
       page: 1,
@@ -1652,11 +2320,12 @@ describe('find()', () => {
           id: '1',
           type: 'alert',
           attributes: {
-            alertTypeId: '123',
+            alertTypeId: 'myType',
             schedule: { interval: '10s' },
             params: {
               bar: true,
             },
+            createdAt: new Date().toISOString(),
             actions: [
               {
                 group: 'default',
@@ -1678,6 +2347,25 @@ describe('find()', () => {
         },
       ],
     });
+    alertTypeRegistry.list.mockReturnValue(listedTypes);
+    authorization.filterByAlertTypeAuthorization.mockResolvedValue(
+      new Set([
+        {
+          id: 'myType',
+          name: 'Test',
+          actionGroups: [{ id: 'default', name: 'Default' }],
+          defaultActionGroupId: 'default',
+          producer: 'alerts',
+          authorizedConsumers: {
+            myApp: { read: true, all: true },
+          },
+        },
+      ])
+    );
+  });
+
+  test('calls saved objects client with given params', async () => {
+    const alertsClient = new AlertsClient(alertsClientParams);
     const result = await alertsClient.find({ options: {} });
     expect(result).toMatchInlineSnapshot(`
       Object {
@@ -1692,7 +2380,7 @@ describe('find()', () => {
                 },
               },
             ],
-            "alertTypeId": "123",
+            "alertTypeId": "myType",
             "createdAt": 2019-02-12T21:01:22.479Z,
             "id": "1",
             "params": Object {
@@ -1709,14 +2397,100 @@ describe('find()', () => {
         "total": 1,
       }
     `);
-    expect(savedObjectsClient.find).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.find.mock.calls[0]).toMatchInlineSnapshot(`
-                                                                                                                  Array [
-                                                                                                                    Object {
-                                                                                                                      "type": "alert",
-                                                                                                                    },
-                                                                                                                  ]
-                                                                            `);
+    expect(unsecuredSavedObjectsClient.find).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.find.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "fields": undefined,
+          "type": "alert",
+        },
+      ]
+    `);
+  });
+
+  describe('authorization', () => {
+    test('ensures user is query filter types down to those the user is authorized to find', async () => {
+      authorization.getFindAuthorizationFilter.mockResolvedValue({
+        filter:
+          '((alert.attributes.alertTypeId:myType and alert.attributes.consumer:myApp) or (alert.attributes.alertTypeId:myOtherType and alert.attributes.consumer:myApp) or (alert.attributes.alertTypeId:myOtherType and alert.attributes.consumer:myOtherApp))',
+        ensureAlertTypeIsAuthorized() {},
+        logSuccessfulAuthorization() {},
+      });
+
+      const alertsClient = new AlertsClient(alertsClientParams);
+      await alertsClient.find({ options: { filter: 'someTerm' } });
+
+      const [options] = unsecuredSavedObjectsClient.find.mock.calls[0];
+      expect(options.filter).toMatchInlineSnapshot(
+        `"someTerm and ((alert.attributes.alertTypeId:myType and alert.attributes.consumer:myApp) or (alert.attributes.alertTypeId:myOtherType and alert.attributes.consumer:myApp) or (alert.attributes.alertTypeId:myOtherType and alert.attributes.consumer:myOtherApp))"`
+      );
+      expect(authorization.getFindAuthorizationFilter).toHaveBeenCalledTimes(1);
+    });
+
+    test('throws if user is not authorized to find any types', async () => {
+      const alertsClient = new AlertsClient(alertsClientParams);
+      authorization.getFindAuthorizationFilter.mockRejectedValue(new Error('not authorized'));
+      await expect(alertsClient.find({ options: {} })).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"not authorized"`
+      );
+    });
+
+    test('ensures authorization even when the fields required to authorize are omitted from the find', async () => {
+      const ensureAlertTypeIsAuthorized = jest.fn();
+      const logSuccessfulAuthorization = jest.fn();
+      authorization.getFindAuthorizationFilter.mockResolvedValue({
+        filter: '',
+        ensureAlertTypeIsAuthorized,
+        logSuccessfulAuthorization,
+      });
+
+      unsecuredSavedObjectsClient.find.mockReset();
+      unsecuredSavedObjectsClient.find.mockResolvedValue({
+        total: 1,
+        per_page: 10,
+        page: 1,
+        saved_objects: [
+          {
+            id: '1',
+            type: 'alert',
+            attributes: {
+              actions: [],
+              alertTypeId: 'myType',
+              consumer: 'myApp',
+              tags: ['myTag'],
+            },
+            score: 1,
+            references: [],
+          },
+        ],
+      });
+
+      const alertsClient = new AlertsClient(alertsClientParams);
+      expect(await alertsClient.find({ options: { fields: ['tags'] } })).toMatchInlineSnapshot(`
+        Object {
+          "data": Array [
+            Object {
+              "actions": Array [],
+              "id": "1",
+              "schedule": undefined,
+              "tags": Array [
+                "myTag",
+              ],
+            },
+          ],
+          "page": 1,
+          "perPage": 10,
+          "total": 1,
+        }
+      `);
+
+      expect(unsecuredSavedObjectsClient.find).toHaveBeenCalledWith({
+        fields: ['tags', 'alertTypeId', 'consumer'],
+        type: 'alert',
+      });
+      expect(ensureAlertTypeIsAuthorized).toHaveBeenCalledWith('myType', 'myApp');
+      expect(logSuccessfulAuthorization).toHaveBeenCalled();
+    });
   });
 });
 
@@ -1726,7 +2500,8 @@ describe('delete()', () => {
     id: '1',
     type: 'alert',
     attributes: {
-      alertTypeId: '123',
+      alertTypeId: 'myType',
+      consumer: 'myApp',
       schedule: { interval: '10s' },
       params: {
         bar: true,
@@ -1735,6 +2510,7 @@ describe('delete()', () => {
       actions: [
         {
           group: 'default',
+          actionTypeId: '.no-op',
           actionRef: 'action_0',
           params: {
             foo: true,
@@ -1760,8 +2536,8 @@ describe('delete()', () => {
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValue(existingAlert);
-    savedObjectsClient.delete.mockResolvedValue({
+    unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
+    unsecuredSavedObjectsClient.delete.mockResolvedValue({
       success: true,
     });
     encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingDecryptedAlert);
@@ -1770,13 +2546,13 @@ describe('delete()', () => {
   test('successfully removes an alert', async () => {
     const result = await alertsClient.delete({ id: '1' });
     expect(result).toEqual({ success: true });
-    expect(savedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
     expect(taskManager.remove).toHaveBeenCalledWith('task-123');
     expect(alertsClientParams.invalidateAPIKey).toHaveBeenCalledWith({ id: '123' });
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
   });
 
   test('falls back to SOC.get when getDecryptedAsInternalUser throws an error', async () => {
@@ -1784,10 +2560,10 @@ describe('delete()', () => {
 
     const result = await alertsClient.delete({ id: '1' });
     expect(result).toEqual({ success: true });
-    expect(savedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.delete).toHaveBeenCalledWith('alert', '1');
     expect(taskManager.remove).toHaveBeenCalledWith('task-123');
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
-    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
       'delete(): Failed to load API key to invalidate on alert 1: Fail'
     );
@@ -1839,9 +2615,9 @@ describe('delete()', () => {
     );
   });
 
-  test('throws error when savedObjectsClient.get throws an error', async () => {
+  test('throws error when unsecuredSavedObjectsClient.get throws an error', async () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
-    savedObjectsClient.get.mockRejectedValue(new Error('SOC Fail'));
+    unsecuredSavedObjectsClient.get.mockRejectedValue(new Error('SOC Fail'));
 
     await expect(alertsClient.delete({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"SOC Fail"`
@@ -1855,6 +2631,26 @@ describe('delete()', () => {
       `"TM Fail"`
     );
   });
+
+  describe('authorization', () => {
+    test('ensures user is authorised to delete this type of alert under the consumer', async () => {
+      await alertsClient.delete({ id: '1' });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'delete');
+    });
+
+    test('throws when user is not authorised to delete this type of alert', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to delete a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.delete({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to delete a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'delete');
+    });
+  });
 });
 
 describe('update()', () => {
@@ -1864,8 +2660,20 @@ describe('update()', () => {
     type: 'alert',
     attributes: {
       enabled: true,
-      alertTypeId: '123',
+      alertTypeId: 'myType',
+      consumer: 'myApp',
       scheduledTaskId: 'task-123',
+      actions: [
+        {
+          group: 'default',
+          id: '1',
+          actionTypeId: '1',
+          actionRef: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
     },
     references: [],
     version: '123',
@@ -1880,7 +2688,7 @@ describe('update()', () => {
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValue(existingAlert);
+    unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
     encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingDecryptedAlert);
     alertTypeRegistry.get.mockReturnValue({
       id: '123',
@@ -1888,12 +2696,12 @@ describe('update()', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       defaultActionGroupId: 'default',
       async executor() {},
-      producer: 'alerting',
+      producer: 'alerts',
     });
   });
 
   test('updates given parameters', async () => {
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -2029,12 +2837,12 @@ describe('update()', () => {
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(savedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(savedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(savedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -2062,9 +2870,10 @@ describe('update()', () => {
             },
           },
         ],
-        "alertTypeId": "123",
+        "alertTypeId": "myType",
         "apiKey": null,
         "apiKeyOwner": null,
+        "consumer": "myApp",
         "enabled": true,
         "name": "abc",
         "params": Object {
@@ -2081,7 +2890,7 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(savedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
       Object {
         "references": Array [
           Object {
@@ -2106,12 +2915,13 @@ describe('update()', () => {
   });
 
   it('calls the createApiKey function', async () => {
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
@@ -2120,9 +2930,9 @@ describe('update()', () => {
     });
     alertsClientParams.createAPIKey.mockResolvedValueOnce({
       apiKeysEnabled: true,
-      result: { id: '123', api_key: 'abc' },
+      result: { id: '123', name: '123', api_key: 'abc' },
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -2201,11 +3011,11 @@ describe('update()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(savedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(savedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(savedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -2217,9 +3027,10 @@ describe('update()', () => {
             },
           },
         ],
-        "alertTypeId": "123",
+        "alertTypeId": "myType",
         "apiKey": "MTIzOmFiYw==",
         "apiKeyOwner": "elastic",
+        "consumer": "myApp",
         "enabled": true,
         "name": "abc",
         "params": Object {
@@ -2236,7 +3047,7 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(savedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
                                                 Object {
                                                   "references": Array [
                                                     Object {
@@ -2258,19 +3069,20 @@ describe('update()', () => {
         enabled: false,
       },
     });
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -2350,11 +3162,11 @@ describe('update()', () => {
         "updatedAt": 2019-02-12T21:01:22.479Z,
       }
     `);
-    expect(savedObjectsClient.update).toHaveBeenCalledTimes(1);
-    expect(savedObjectsClient.update.mock.calls[0]).toHaveLength(4);
-    expect(savedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
-    expect(savedObjectsClient.update.mock.calls[0][1]).toEqual('1');
-    expect(savedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledTimes(1);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0]).toHaveLength(4);
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][0]).toEqual('alert');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][1]).toEqual('1');
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][2]).toMatchInlineSnapshot(`
       Object {
         "actions": Array [
           Object {
@@ -2366,9 +3178,10 @@ describe('update()', () => {
             },
           },
         ],
-        "alertTypeId": "123",
+        "alertTypeId": "myType",
         "apiKey": null,
         "apiKeyOwner": null,
+        "consumer": "myApp",
         "enabled": false,
         "name": "abc",
         "params": Object {
@@ -2385,7 +3198,7 @@ describe('update()', () => {
         "updatedBy": "elastic",
       }
     `);
-    expect(savedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
+    expect(unsecuredSavedObjectsClient.update.mock.calls[0][3]).toMatchInlineSnapshot(`
                                                 Object {
                                                   "references": Array [
                                                     Object {
@@ -2411,7 +3224,7 @@ describe('update()', () => {
         }),
       },
       async executor() {},
-      producer: 'alerting',
+      producer: 'alerts',
     });
     await expect(
       alertsClient.update({
@@ -2442,19 +3255,20 @@ describe('update()', () => {
 
   it('swallows error when invalidate API key throws', async () => {
     alertsClientParams.invalidateAPIKey.mockRejectedValueOnce(new Error('Fail'));
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -2511,12 +3325,13 @@ describe('update()', () => {
 
   it('swallows error when getDecryptedAsInternalUser throws', async () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValue(new Error('Fail'));
-    savedObjectsClient.bulkGet.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
       saved_objects: [
         {
           id: '1',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test',
           },
           references: [],
@@ -2525,13 +3340,14 @@ describe('update()', () => {
           id: '2',
           type: 'action',
           attributes: {
+            actions: [],
             actionTypeId: 'test2',
           },
           references: [],
         },
       ],
     });
-    savedObjectsClient.update.mockResolvedValueOnce({
+    unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
       attributes: {
@@ -2623,7 +3439,7 @@ describe('update()', () => {
         ],
       },
     });
-    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
       'update(): Failed to load API key to invalidate on alert 1: Fail'
     );
@@ -2643,14 +3459,15 @@ describe('update()', () => {
         actionGroups: [{ id: 'default', name: 'Default' }],
         defaultActionGroupId: 'default',
         async executor() {},
-        producer: 'alerting',
+        producer: 'alerts',
       });
-      savedObjectsClient.bulkGet.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.bulkGet.mockResolvedValueOnce({
         saved_objects: [
           {
             id: '1',
             type: 'action',
             attributes: {
+              actions: [],
               actionTypeId: 'test',
             },
             references: [],
@@ -2661,6 +3478,7 @@ describe('update()', () => {
         id: alertId,
         type: 'alert',
         attributes: {
+          actions: [],
           enabled: true,
           alertTypeId: '123',
           schedule: currentSchedule,
@@ -2683,7 +3501,7 @@ describe('update()', () => {
         params: {},
         ownerId: null,
       });
-      savedObjectsClient.update.mockResolvedValueOnce({
+      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
         id: alertId,
         type: 'alert',
         attributes: {
@@ -2852,6 +3670,73 @@ describe('update()', () => {
       );
     });
   });
+
+  describe('authorization', () => {
+    beforeEach(() => {
+      unsecuredSavedObjectsClient.update.mockResolvedValueOnce({
+        id: '1',
+        type: 'alert',
+        attributes: {
+          alertTypeId: 'myType',
+          consumer: 'myApp',
+          enabled: true,
+          schedule: { interval: '10s' },
+          params: {
+            bar: true,
+          },
+          actions: [],
+          scheduledTaskId: 'task-123',
+          createdAt: new Date().toISOString(),
+        },
+        updated_at: new Date().toISOString(),
+        references: [],
+      });
+    });
+
+    test('ensures user is authorised to update this type of alert under the consumer', async () => {
+      await alertsClient.update({
+        id: '1',
+        data: {
+          schedule: { interval: '10s' },
+          name: 'abc',
+          tags: ['foo'],
+          params: {
+            bar: true,
+          },
+          throttle: null,
+          actions: [],
+        },
+      });
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'update');
+    });
+
+    test('throws when user is not authorised to update this type of alert', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to update a "myType" alert for "myApp"`)
+      );
+
+      await expect(
+        alertsClient.update({
+          id: '1',
+          data: {
+            schedule: { interval: '10s' },
+            name: 'abc',
+            tags: ['foo'],
+            params: {
+              bar: true,
+            },
+            throttle: null,
+            actions: [],
+          },
+        })
+      ).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to update a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('myType', 'myApp', 'update');
+    });
+  });
 });
 
 describe('updateApiKey()', () => {
@@ -2861,8 +3746,20 @@ describe('updateApiKey()', () => {
     type: 'alert',
     attributes: {
       schedule: { interval: '10s' },
-      alertTypeId: '2',
+      alertTypeId: 'myType',
+      consumer: 'myApp',
       enabled: true,
+      actions: [
+        {
+          group: 'default',
+          id: '1',
+          actionTypeId: '1',
+          actionRef: '1',
+          params: {
+            foo: true,
+          },
+        },
+      ],
     },
     version: '123',
     references: [],
@@ -2877,30 +3774,42 @@ describe('updateApiKey()', () => {
 
   beforeEach(() => {
     alertsClient = new AlertsClient(alertsClientParams);
-    savedObjectsClient.get.mockResolvedValue(existingAlert);
+    unsecuredSavedObjectsClient.get.mockResolvedValue(existingAlert);
     encryptedSavedObjects.getDecryptedAsInternalUser.mockResolvedValue(existingEncryptedAlert);
     alertsClientParams.createAPIKey.mockResolvedValueOnce({
       apiKeysEnabled: true,
-      result: { id: '234', api_key: 'abc' },
+      result: { id: '234', name: '123', api_key: 'abc' },
     });
   });
 
   test('updates the API key for the alert', async () => {
     await alertsClient.updateApiKey({ id: '1' });
-    expect(savedObjectsClient.get).not.toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.get).not.toHaveBeenCalled();
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
+        consumer: 'myApp',
         enabled: true,
         apiKey: Buffer.from('234:abc').toString('base64'),
         apiKeyOwner: 'elastic',
         updatedBy: 'elastic',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       { version: '123' }
     );
@@ -2911,20 +3820,32 @@ describe('updateApiKey()', () => {
     encryptedSavedObjects.getDecryptedAsInternalUser.mockRejectedValueOnce(new Error('Fail'));
 
     await alertsClient.updateApiKey({ id: '1' });
-    expect(savedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
+    expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledWith('alert', '1');
     expect(encryptedSavedObjects.getDecryptedAsInternalUser).toHaveBeenCalledWith('alert', '1', {
       namespace: 'default',
     });
-    expect(savedObjectsClient.update).toHaveBeenCalledWith(
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalledWith(
       'alert',
       '1',
       {
         schedule: { interval: '10s' },
-        alertTypeId: '2',
+        alertTypeId: 'myType',
+        consumer: 'myApp',
         enabled: true,
         apiKey: Buffer.from('234:abc').toString('base64'),
         apiKeyOwner: 'elastic',
         updatedBy: 'elastic',
+        actions: [
+          {
+            group: 'default',
+            id: '1',
+            actionTypeId: '1',
+            actionRef: '1',
+            params: {
+              foo: true,
+            },
+          },
+        ],
       },
       { version: '123' }
     );
@@ -2938,7 +3859,7 @@ describe('updateApiKey()', () => {
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
       'Failed to invalidate API Key: Fail'
     );
-    expect(savedObjectsClient.update).toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalled();
   });
 
   test('swallows error when getting decrypted object throws', async () => {
@@ -2948,16 +3869,133 @@ describe('updateApiKey()', () => {
     expect(alertsClientParams.logger.error).toHaveBeenCalledWith(
       'updateApiKey(): Failed to load API key to invalidate on alert 1: Fail'
     );
-    expect(savedObjectsClient.update).toHaveBeenCalled();
+    expect(unsecuredSavedObjectsClient.update).toHaveBeenCalled();
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
   });
 
-  test('throws when savedObjectsClient update fails', async () => {
-    savedObjectsClient.update.mockRejectedValueOnce(new Error('Fail'));
+  test('throws when unsecuredSavedObjectsClient update fails', async () => {
+    unsecuredSavedObjectsClient.update.mockRejectedValueOnce(new Error('Fail'));
 
     await expect(alertsClient.updateApiKey({ id: '1' })).rejects.toThrowErrorMatchingInlineSnapshot(
       `"Fail"`
     );
     expect(alertsClientParams.invalidateAPIKey).not.toHaveBeenCalled();
   });
+
+  describe('authorization', () => {
+    test('ensures user is authorised to updateApiKey this type of alert under the consumer', async () => {
+      await alertsClient.updateApiKey({ id: '1' });
+
+      expect(actionsAuthorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'updateApiKey'
+      );
+    });
+
+    test('throws when user is not authorised to updateApiKey this type of alert', async () => {
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to updateApiKey a "myType" alert for "myApp"`)
+      );
+
+      await expect(alertsClient.updateApiKey({ id: '1' })).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to updateApiKey a "myType" alert for "myApp"]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith(
+        'myType',
+        'myApp',
+        'updateApiKey'
+      );
+    });
+  });
+});
+
+describe('listAlertTypes', () => {
+  let alertsClient: AlertsClient;
+  const alertingAlertType = {
+    actionGroups: [],
+    actionVariables: undefined,
+    defaultActionGroupId: 'default',
+    id: 'alertingAlertType',
+    name: 'alertingAlertType',
+    producer: 'alerts',
+  };
+  const myAppAlertType = {
+    actionGroups: [],
+    actionVariables: undefined,
+    defaultActionGroupId: 'default',
+    id: 'myAppAlertType',
+    name: 'myAppAlertType',
+    producer: 'myApp',
+  };
+  const setOfAlertTypes = new Set([myAppAlertType, alertingAlertType]);
+
+  const authorizedConsumers = {
+    alerts: { read: true, all: true },
+    myApp: { read: true, all: true },
+    myOtherApp: { read: true, all: true },
+  };
+
+  beforeEach(() => {
+    alertsClient = new AlertsClient(alertsClientParams);
+  });
+
+  test('should return a list of AlertTypes that exist in the registry', async () => {
+    alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+    authorization.filterByAlertTypeAuthorization.mockResolvedValue(
+      new Set([
+        { ...myAppAlertType, authorizedConsumers },
+        { ...alertingAlertType, authorizedConsumers },
+      ])
+    );
+    expect(await alertsClient.listAlertTypes()).toEqual(
+      new Set([
+        { ...myAppAlertType, authorizedConsumers },
+        { ...alertingAlertType, authorizedConsumers },
+      ])
+    );
+  });
+
+  describe('authorization', () => {
+    const listedTypes = new Set([
+      {
+        actionGroups: [],
+        actionVariables: undefined,
+        defaultActionGroupId: 'default',
+        id: 'myType',
+        name: 'myType',
+        producer: 'myApp',
+      },
+      {
+        id: 'myOtherType',
+        name: 'Test',
+        actionGroups: [{ id: 'default', name: 'Default' }],
+        defaultActionGroupId: 'default',
+        producer: 'alerts',
+      },
+    ]);
+    beforeEach(() => {
+      alertTypeRegistry.list.mockReturnValue(listedTypes);
+    });
+
+    test('should return a list of AlertTypes that exist in the registry only if the user is authorised to get them', async () => {
+      const authorizedTypes = new Set([
+        {
+          id: 'myType',
+          name: 'Test',
+          actionGroups: [{ id: 'default', name: 'Default' }],
+          defaultActionGroupId: 'default',
+          producer: 'alerts',
+          authorizedConsumers: {
+            myApp: { read: true, all: true },
+          },
+        },
+      ]);
+      authorization.filterByAlertTypeAuthorization.mockResolvedValue(authorizedTypes);
+
+      expect(await alertsClient.listAlertTypes()).toEqual(authorizedTypes);
+    });
+  });
 });
diff --git a/x-pack/plugins/alerts/server/alerts_client.ts b/x-pack/plugins/alerts/server/alerts_client.ts
index e49745b186bb3..eec60f924bf38 100644
--- a/x-pack/plugins/alerts/server/alerts_client.ts
+++ b/x-pack/plugins/alerts/server/alerts_client.ts
@@ -5,7 +5,7 @@
  */
 
 import Boom from 'boom';
-import { omit, isEqual, map, truncate } from 'lodash';
+import { omit, isEqual, map, uniq, pick, truncate } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import {
   Logger,
@@ -13,7 +13,7 @@ import {
   SavedObjectReference,
   SavedObject,
 } from 'src/core/server';
-import { ActionsClient } from '../../actions/server';
+import { ActionsClient, ActionsAuthorization } from '../../actions/server';
 import {
   Alert,
   PartialAlert,
@@ -35,7 +35,16 @@ import { EncryptedSavedObjectsClient } from '../../encrypted_saved_objects/serve
 import { TaskManagerStartContract } from '../../task_manager/server';
 import { taskInstanceToAlertTaskInstance } from './task_runner/alert_task_instance';
 import { deleteTaskIfItExists } from './lib/delete_task_if_it_exists';
+import { RegistryAlertType } from './alert_type_registry';
+import {
+  AlertsAuthorization,
+  WriteOperations,
+  ReadOperations,
+} from './authorization/alerts_authorization';
 
+export interface RegistryAlertTypeWithAuth extends RegistryAlertType {
+  authorizedConsumers: string[];
+}
 type NormalizedAlertAction = Omit<AlertAction, 'actionTypeId'>;
 export type CreateAPIKeyResult =
   | { apiKeysEnabled: false }
@@ -44,10 +53,12 @@ export type InvalidateAPIKeyResult =
   | { apiKeysEnabled: false }
   | { apiKeysEnabled: true; result: SecurityPluginInvalidateAPIKeyResult };
 
-interface ConstructorOptions {
+export interface ConstructorOptions {
   logger: Logger;
   taskManager: TaskManagerStartContract;
-  savedObjectsClient: SavedObjectsClientContract;
+  unsecuredSavedObjectsClient: SavedObjectsClientContract;
+  authorization: AlertsAuthorization;
+  actionsAuthorization: ActionsAuthorization;
   alertTypeRegistry: AlertTypeRegistry;
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
   spaceId?: string;
@@ -127,18 +138,21 @@ export class AlertsClient {
   private readonly spaceId?: string;
   private readonly namespace?: string;
   private readonly taskManager: TaskManagerStartContract;
-  private readonly savedObjectsClient: SavedObjectsClientContract;
+  private readonly unsecuredSavedObjectsClient: SavedObjectsClientContract;
+  private readonly authorization: AlertsAuthorization;
   private readonly alertTypeRegistry: AlertTypeRegistry;
   private readonly createAPIKey: (name: string) => Promise<CreateAPIKeyResult>;
   private readonly invalidateAPIKey: (
     params: InvalidateAPIKeyParams
   ) => Promise<InvalidateAPIKeyResult>;
   private readonly getActionsClient: () => Promise<ActionsClient>;
+  private readonly actionsAuthorization: ActionsAuthorization;
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
 
   constructor({
     alertTypeRegistry,
-    savedObjectsClient,
+    unsecuredSavedObjectsClient,
+    authorization,
     taskManager,
     logger,
     spaceId,
@@ -148,6 +162,7 @@ export class AlertsClient {
     invalidateAPIKey,
     encryptedSavedObjectsClient,
     getActionsClient,
+    actionsAuthorization,
   }: ConstructorOptions) {
     this.logger = logger;
     this.getUserName = getUserName;
@@ -155,16 +170,25 @@ export class AlertsClient {
     this.namespace = namespace;
     this.taskManager = taskManager;
     this.alertTypeRegistry = alertTypeRegistry;
-    this.savedObjectsClient = savedObjectsClient;
+    this.unsecuredSavedObjectsClient = unsecuredSavedObjectsClient;
+    this.authorization = authorization;
     this.createAPIKey = createAPIKey;
     this.invalidateAPIKey = invalidateAPIKey;
     this.encryptedSavedObjectsClient = encryptedSavedObjectsClient;
     this.getActionsClient = getActionsClient;
+    this.actionsAuthorization = actionsAuthorization;
   }
 
   public async create({ data, options }: CreateOptions): Promise<Alert> {
+    await this.authorization.ensureAuthorized(
+      data.alertTypeId,
+      data.consumer,
+      WriteOperations.Create
+    );
+
     // Throws an error if alert type isn't registered
     const alertType = this.alertTypeRegistry.get(data.alertTypeId);
+
     const validatedAlertTypeParams = validateAlertTypeParams(alertType, data.params);
     const username = await this.getUserName();
 
@@ -186,7 +210,7 @@ export class AlertsClient {
       muteAll: false,
       mutedInstanceIds: [],
     };
-    const createdAlert = await this.savedObjectsClient.create('alert', rawAlert, {
+    const createdAlert = await this.unsecuredSavedObjectsClient.create('alert', rawAlert, {
       ...options,
       references,
     });
@@ -197,7 +221,7 @@ export class AlertsClient {
       } catch (e) {
         // Cleanup data, something went wrong scheduling the task
         try {
-          await this.savedObjectsClient.delete('alert', createdAlert.id);
+          await this.unsecuredSavedObjectsClient.delete('alert', createdAlert.id);
         } catch (err) {
           // Skip the cleanup error and throw the task manager error to avoid confusion
           this.logger.error(
@@ -206,7 +230,7 @@ export class AlertsClient {
         }
         throw e;
       }
-      await this.savedObjectsClient.update('alert', createdAlert.id, {
+      await this.unsecuredSavedObjectsClient.update('alert', createdAlert.id, {
         scheduledTaskId: scheduledTask.id,
       });
       createdAlert.attributes.scheduledTaskId = scheduledTask.id;
@@ -220,12 +244,22 @@ export class AlertsClient {
   }
 
   public async get({ id }: { id: string }): Promise<SanitizedAlert> {
-    const result = await this.savedObjectsClient.get<RawAlert>('alert', id);
+    const result = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
+    await this.authorization.ensureAuthorized(
+      result.attributes.alertTypeId,
+      result.attributes.consumer,
+      ReadOperations.Get
+    );
     return this.getAlertFromRaw(result.id, result.attributes, result.updated_at, result.references);
   }
 
   public async getAlertState({ id }: { id: string }): Promise<AlertTaskState | void> {
     const alert = await this.get({ id });
+    await this.authorization.ensureAuthorized(
+      alert.alertTypeId,
+      alert.consumer,
+      ReadOperations.GetAlertState
+    );
     if (alert.scheduledTaskId) {
       const { state } = taskInstanceToAlertTaskInstance(
         await this.taskManager.get(alert.scheduledTaskId),
@@ -235,30 +269,56 @@ export class AlertsClient {
     }
   }
 
-  public async find({ options = {} }: { options: FindOptions }): Promise<FindResult> {
+  public async find({
+    options: { fields, ...options } = {},
+  }: { options?: FindOptions } = {}): Promise<FindResult> {
+    const {
+      filter: authorizationFilter,
+      ensureAlertTypeIsAuthorized,
+      logSuccessfulAuthorization,
+    } = await this.authorization.getFindAuthorizationFilter();
+
+    if (authorizationFilter) {
+      options.filter = options.filter
+        ? `${options.filter} and ${authorizationFilter}`
+        : authorizationFilter;
+    }
+
     const {
       page,
       per_page: perPage,
       total,
       saved_objects: data,
-    } = await this.savedObjectsClient.find<RawAlert>({
+    } = await this.unsecuredSavedObjectsClient.find<RawAlert>({
       ...options,
+      fields: fields ? this.includeFieldsRequiredForAuthentication(fields) : fields,
       type: 'alert',
     });
 
+    const authorizedData = data.map(({ id, attributes, updated_at, references }) => {
+      ensureAlertTypeIsAuthorized(attributes.alertTypeId, attributes.consumer);
+      return this.getAlertFromRaw(
+        id,
+        fields ? (pick(attributes, fields) as RawAlert) : attributes,
+        updated_at,
+        references
+      );
+    });
+
+    logSuccessfulAuthorization();
+
     return {
       page,
       perPage,
       total,
-      data: data.map(({ id, attributes, updated_at, references }) =>
-        this.getAlertFromRaw(id, attributes, updated_at, references)
-      ),
+      data: authorizedData,
     };
   }
 
   public async delete({ id }: { id: string }) {
     let taskIdToRemove: string | undefined;
     let apiKeyToInvalidate: string | null = null;
+    let attributes: RawAlert;
 
     try {
       const decryptedAlert = await this.encryptedSavedObjectsClient.getDecryptedAsInternalUser<
@@ -266,17 +326,25 @@ export class AlertsClient {
       >('alert', id, { namespace: this.namespace });
       apiKeyToInvalidate = decryptedAlert.attributes.apiKey;
       taskIdToRemove = decryptedAlert.attributes.scheduledTaskId;
+      attributes = decryptedAlert.attributes;
     } catch (e) {
       // We'll skip invalidating the API key since we failed to load the decrypted saved object
       this.logger.error(
         `delete(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
       );
       // Still attempt to load the scheduledTaskId using SOC
-      const alert = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      const alert = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
       taskIdToRemove = alert.attributes.scheduledTaskId;
+      attributes = alert.attributes;
     }
 
-    const removeResult = await this.savedObjectsClient.delete('alert', id);
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.Delete
+    );
+
+    const removeResult = await this.unsecuredSavedObjectsClient.delete('alert', id);
 
     await Promise.all([
       taskIdToRemove ? deleteTaskIfItExists(this.taskManager, taskIdToRemove) : null,
@@ -299,8 +367,13 @@ export class AlertsClient {
         `update(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
       );
       // Still attempt to load the object using SOC
-      alertSavedObject = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      alertSavedObject = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
     }
+    await this.authorization.ensureAuthorized(
+      alertSavedObject.attributes.alertTypeId,
+      alertSavedObject.attributes.consumer,
+      WriteOperations.Update
+    );
 
     const updateResult = await this.updateAlert({ id, data }, alertSavedObject);
 
@@ -342,7 +415,7 @@ export class AlertsClient {
       : null;
     const apiKeyAttributes = this.apiKeyAsAlertAttributes(createdAPIKey, username);
 
-    const updatedObject = await this.savedObjectsClient.update<RawAlert>(
+    const updatedObject = await this.unsecuredSavedObjectsClient.update<RawAlert>(
       'alert',
       id,
       {
@@ -400,13 +473,22 @@ export class AlertsClient {
         `updateApiKey(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
       );
       // Still attempt to load the attributes and version using SOC
-      const alert = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      const alert = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
       attributes = alert.attributes;
       version = alert.version;
     }
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.UpdateApiKey
+    );
+
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
 
     const username = await this.getUserName();
-    await this.savedObjectsClient.update(
+    await this.unsecuredSavedObjectsClient.update(
       'alert',
       id,
       {
@@ -459,14 +541,24 @@ export class AlertsClient {
         `enable(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
       );
       // Still attempt to load the attributes and version using SOC
-      const alert = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      const alert = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
       attributes = alert.attributes;
       version = alert.version;
     }
 
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.Enable
+    );
+
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
+
     if (attributes.enabled === false) {
       const username = await this.getUserName();
-      await this.savedObjectsClient.update(
+      await this.unsecuredSavedObjectsClient.update(
         'alert',
         id,
         {
@@ -483,7 +575,9 @@ export class AlertsClient {
         { version }
       );
       const scheduledTask = await this.scheduleAlert(id, attributes.alertTypeId);
-      await this.savedObjectsClient.update('alert', id, { scheduledTaskId: scheduledTask.id });
+      await this.unsecuredSavedObjectsClient.update('alert', id, {
+        scheduledTaskId: scheduledTask.id,
+      });
       if (apiKeyToInvalidate) {
         await this.invalidateApiKey({ apiKey: apiKeyToInvalidate });
       }
@@ -508,13 +602,19 @@ export class AlertsClient {
         `disable(): Failed to load API key to invalidate on alert ${id}: ${e.message}`
       );
       // Still attempt to load the attributes and version using SOC
-      const alert = await this.savedObjectsClient.get<RawAlert>('alert', id);
+      const alert = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
       attributes = alert.attributes;
       version = alert.version;
     }
 
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.Disable
+    );
+
     if (attributes.enabled === true) {
-      await this.savedObjectsClient.update(
+      await this.unsecuredSavedObjectsClient.update(
         'alert',
         id,
         {
@@ -538,7 +638,18 @@ export class AlertsClient {
   }
 
   public async muteAll({ id }: { id: string }) {
-    await this.savedObjectsClient.update('alert', id, {
+    const { attributes } = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.MuteAll
+    );
+
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
+
+    await this.unsecuredSavedObjectsClient.update('alert', id, {
       muteAll: true,
       mutedInstanceIds: [],
       updatedBy: await this.getUserName(),
@@ -546,7 +657,18 @@ export class AlertsClient {
   }
 
   public async unmuteAll({ id }: { id: string }) {
-    await this.savedObjectsClient.update('alert', id, {
+    const { attributes } = await this.unsecuredSavedObjectsClient.get<RawAlert>('alert', id);
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.UnmuteAll
+    );
+
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
+
+    await this.unsecuredSavedObjectsClient.update('alert', id, {
       muteAll: false,
       mutedInstanceIds: [],
       updatedBy: await this.getUserName(),
@@ -554,11 +676,25 @@ export class AlertsClient {
   }
 
   public async muteInstance({ alertId, alertInstanceId }: MuteOptions) {
-    const { attributes, version } = await this.savedObjectsClient.get<Alert>('alert', alertId);
+    const { attributes, version } = await this.unsecuredSavedObjectsClient.get<Alert>(
+      'alert',
+      alertId
+    );
+
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.MuteInstance
+    );
+
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
+
     const mutedInstanceIds = attributes.mutedInstanceIds || [];
     if (!attributes.muteAll && !mutedInstanceIds.includes(alertInstanceId)) {
       mutedInstanceIds.push(alertInstanceId);
-      await this.savedObjectsClient.update(
+      await this.unsecuredSavedObjectsClient.update(
         'alert',
         alertId,
         {
@@ -577,10 +713,22 @@ export class AlertsClient {
     alertId: string;
     alertInstanceId: string;
   }) {
-    const { attributes, version } = await this.savedObjectsClient.get<Alert>('alert', alertId);
+    const { attributes, version } = await this.unsecuredSavedObjectsClient.get<Alert>(
+      'alert',
+      alertId
+    );
+    await this.authorization.ensureAuthorized(
+      attributes.alertTypeId,
+      attributes.consumer,
+      WriteOperations.UnmuteInstance
+    );
+    if (attributes.actions.length) {
+      await this.actionsAuthorization.ensureAuthorized('execute');
+    }
+
     const mutedInstanceIds = attributes.mutedInstanceIds || [];
     if (!attributes.muteAll && mutedInstanceIds.includes(alertInstanceId)) {
-      await this.savedObjectsClient.update(
+      await this.unsecuredSavedObjectsClient.update(
         'alert',
         alertId,
         {
@@ -593,6 +741,13 @@ export class AlertsClient {
     }
   }
 
+  public async listAlertTypes() {
+    return await this.authorization.filterByAlertTypeAuthorization(this.alertTypeRegistry.list(), [
+      ReadOperations.Get,
+      WriteOperations.Create,
+    ]);
+  }
+
   private async scheduleAlert(id: string, alertTypeId: string) {
     return await this.taskManager.schedule({
       taskType: `alerting:${alertTypeId}`,
@@ -610,13 +765,14 @@ export class AlertsClient {
   }
 
   private injectReferencesIntoActions(
+    alertId: string,
     actions: RawAlert['actions'],
     references: SavedObjectReference[]
   ) {
     return actions.map((action) => {
       const reference = references.find((ref) => ref.name === action.actionRef);
       if (!reference) {
-        throw new Error(`Reference ${action.actionRef} not found`);
+        throw new Error(`Action reference "${action.actionRef}" not found in alert id: ${alertId}`);
       }
       return {
         ...omit(action, 'actionRef'),
@@ -639,8 +795,8 @@ export class AlertsClient {
 
   private getPartialAlertFromRaw(
     id: string,
-    rawAlert: Partial<RawAlert>,
-    updatedAt: SavedObject['updated_at'],
+    { createdAt, ...rawAlert }: Partial<RawAlert>,
+    updatedAt: SavedObject['updated_at'] = createdAt,
     references: SavedObjectReference[] | undefined
   ): PartialAlert {
     return {
@@ -649,11 +805,11 @@ export class AlertsClient {
       // we currently only support the Interval Schedule type
       // Once we support additional types, this type signature will likely change
       schedule: rawAlert.schedule as IntervalSchedule,
-      updatedAt: updatedAt ? new Date(updatedAt) : new Date(rawAlert.createdAt!),
-      createdAt: new Date(rawAlert.createdAt!),
       actions: rawAlert.actions
-        ? this.injectReferencesIntoActions(rawAlert.actions, references || [])
+        ? this.injectReferencesIntoActions(id, rawAlert.actions, references || [])
         : [],
+      ...(updatedAt ? { updatedAt: new Date(updatedAt) } : {}),
+      ...(createdAt ? { createdAt: new Date(createdAt) } : {}),
     };
   }
 
@@ -679,38 +835,45 @@ export class AlertsClient {
   private async denormalizeActions(
     alertActions: NormalizedAlertAction[]
   ): Promise<{ actions: RawAlert['actions']; references: SavedObjectReference[] }> {
-    const actionsClient = await this.getActionsClient();
-    const actionIds = [...new Set(alertActions.map((alertAction) => alertAction.id))];
-    const actionResults = await actionsClient.getBulk(actionIds);
     const references: SavedObjectReference[] = [];
-    const actions = alertActions.map(({ id, ...alertAction }, i) => {
-      const actionResultValue = actionResults.find((action) => action.id === id);
-      if (actionResultValue) {
-        const actionRef = `action_${i}`;
-        references.push({
-          id,
-          name: actionRef,
-          type: 'action',
-        });
-        return {
-          ...alertAction,
-          actionRef,
-          actionTypeId: actionResultValue.actionTypeId,
-        };
-      } else {
-        return {
-          ...alertAction,
-          actionRef: '',
-          actionTypeId: '',
-        };
-      }
-    });
+    const actions: RawAlert['actions'] = [];
+    if (alertActions.length) {
+      const actionsClient = await this.getActionsClient();
+      const actionIds = [...new Set(alertActions.map((alertAction) => alertAction.id))];
+      const actionResults = await actionsClient.getBulk(actionIds);
+      alertActions.forEach(({ id, ...alertAction }, i) => {
+        const actionResultValue = actionResults.find((action) => action.id === id);
+        if (actionResultValue) {
+          const actionRef = `action_${i}`;
+          references.push({
+            id,
+            name: actionRef,
+            type: 'action',
+          });
+          actions.push({
+            ...alertAction,
+            actionRef,
+            actionTypeId: actionResultValue.actionTypeId,
+          });
+        } else {
+          actions.push({
+            ...alertAction,
+            actionRef: '',
+            actionTypeId: '',
+          });
+        }
+      });
+    }
     return {
       actions,
       references,
     };
   }
 
+  private includeFieldsRequiredForAuthentication(fields: string[]): string[] {
+    return uniq([...fields, 'alertTypeId', 'consumer']);
+  }
+
   private generateAPIKeyName(alertTypeId: string, alertName: string) {
     return truncate(`Alerting: ${alertTypeId}/${alertName}`, { length: 256 });
   }
diff --git a/x-pack/plugins/alerts/server/alerts_client_factory.test.ts b/x-pack/plugins/alerts/server/alerts_client_factory.test.ts
index 128d54c10b66a..16b5af499bb90 100644
--- a/x-pack/plugins/alerts/server/alerts_client_factory.test.ts
+++ b/x-pack/plugins/alerts/server/alerts_client_factory.test.ts
@@ -9,24 +9,39 @@ import { AlertsClientFactory, AlertsClientFactoryOpts } from './alerts_client_fa
 import { alertTypeRegistryMock } from './alert_type_registry.mock';
 import { taskManagerMock } from '../../task_manager/server/task_manager.mock';
 import { KibanaRequest } from '../../../../src/core/server';
-import { loggingSystemMock, savedObjectsClientMock } from '../../../../src/core/server/mocks';
+import {
+  savedObjectsClientMock,
+  savedObjectsServiceMock,
+  loggingSystemMock,
+} from '../../../../src/core/server/mocks';
 import { encryptedSavedObjectsMock } from '../../encrypted_saved_objects/server/mocks';
 import { AuthenticatedUser } from '../../../plugins/security/common/model';
 import { securityMock } from '../../security/server/mocks';
-import { actionsMock } from '../../actions/server/mocks';
+import { PluginStartContract as ActionsStartContract } from '../../actions/server';
+import { actionsMock, actionsAuthorizationMock } from '../../actions/server/mocks';
+import { featuresPluginMock } from '../../features/server/mocks';
+import { AuditLogger } from '../../security/server';
+import { ALERTS_FEATURE_ID } from '../common';
 
 jest.mock('./alerts_client');
+jest.mock('./authorization/alerts_authorization');
+jest.mock('./authorization/audit_logger');
 
 const savedObjectsClient = savedObjectsClientMock.create();
+const savedObjectsService = savedObjectsServiceMock.createInternalStartContract();
+const features = featuresPluginMock.createStart();
+
 const securityPluginSetup = securityMock.createSetup();
 const alertsClientFactoryParams: jest.Mocked<AlertsClientFactoryOpts> = {
   logger: loggingSystemMock.create().get(),
   taskManager: taskManagerMock.start(),
   alertTypeRegistry: alertTypeRegistryMock.create(),
   getSpaceId: jest.fn(),
+  getSpace: jest.fn(),
   spaceIdToNamespace: jest.fn(),
   encryptedSavedObjectsClient: encryptedSavedObjectsMock.createClient(),
   actions: actionsMock.createStart(),
+  features,
 };
 const fakeRequest = ({
   headers: {},
@@ -44,19 +59,101 @@ const fakeRequest = ({
   getSavedObjectsClient: () => savedObjectsClient,
 } as unknown) as Request;
 
+const actionsAuthorization = actionsAuthorizationMock.create();
+
 beforeEach(() => {
   jest.resetAllMocks();
+  alertsClientFactoryParams.actions = actionsMock.createStart();
+  (alertsClientFactoryParams.actions as jest.Mocked<
+    ActionsStartContract
+  >).getActionsAuthorizationWithRequest.mockReturnValue(actionsAuthorization);
   alertsClientFactoryParams.getSpaceId.mockReturnValue('default');
   alertsClientFactoryParams.spaceIdToNamespace.mockReturnValue('default');
 });
 
+test('creates an alerts client with proper constructor arguments when security is enabled', async () => {
+  const factory = new AlertsClientFactory();
+  factory.initialize({ securityPluginSetup, ...alertsClientFactoryParams });
+  const request = KibanaRequest.from(fakeRequest);
+
+  const { AlertsAuthorizationAuditLogger } = jest.requireMock('./authorization/audit_logger');
+  savedObjectsService.getScopedClient.mockReturnValue(savedObjectsClient);
+
+  const logger = {
+    log: jest.fn(),
+  } as jest.Mocked<AuditLogger>;
+  securityPluginSetup.audit.getLogger.mockReturnValue(logger);
+
+  factory.create(request, savedObjectsService);
+
+  expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request, {
+    excludedWrappers: ['security'],
+    includedHiddenTypes: ['alert'],
+  });
+
+  const { AlertsAuthorization } = jest.requireMock('./authorization/alerts_authorization');
+  expect(AlertsAuthorization).toHaveBeenCalledWith({
+    request,
+    authorization: securityPluginSetup.authz,
+    alertTypeRegistry: alertsClientFactoryParams.alertTypeRegistry,
+    features: alertsClientFactoryParams.features,
+    auditLogger: expect.any(AlertsAuthorizationAuditLogger),
+    getSpace: expect.any(Function),
+  });
+
+  expect(AlertsAuthorizationAuditLogger).toHaveBeenCalledWith(logger);
+  expect(securityPluginSetup.audit.getLogger).toHaveBeenCalledWith(ALERTS_FEATURE_ID);
+
+  expect(alertsClientFactoryParams.actions.getActionsAuthorizationWithRequest).toHaveBeenCalledWith(
+    request
+  );
+
+  expect(jest.requireMock('./alerts_client').AlertsClient).toHaveBeenCalledWith({
+    unsecuredSavedObjectsClient: savedObjectsClient,
+    authorization: expect.any(AlertsAuthorization),
+    actionsAuthorization,
+    logger: alertsClientFactoryParams.logger,
+    taskManager: alertsClientFactoryParams.taskManager,
+    alertTypeRegistry: alertsClientFactoryParams.alertTypeRegistry,
+    spaceId: 'default',
+    namespace: 'default',
+    getUserName: expect.any(Function),
+    getActionsClient: expect.any(Function),
+    createAPIKey: expect.any(Function),
+    invalidateAPIKey: expect.any(Function),
+    encryptedSavedObjectsClient: alertsClientFactoryParams.encryptedSavedObjectsClient,
+  });
+});
+
 test('creates an alerts client with proper constructor arguments', async () => {
   const factory = new AlertsClientFactory();
   factory.initialize(alertsClientFactoryParams);
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  const request = KibanaRequest.from(fakeRequest);
+
+  savedObjectsService.getScopedClient.mockReturnValue(savedObjectsClient);
+
+  factory.create(request, savedObjectsService);
+
+  expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request, {
+    excludedWrappers: ['security'],
+    includedHiddenTypes: ['alert'],
+  });
+
+  const { AlertsAuthorization } = jest.requireMock('./authorization/alerts_authorization');
+  const { AlertsAuthorizationAuditLogger } = jest.requireMock('./authorization/audit_logger');
+  expect(AlertsAuthorization).toHaveBeenCalledWith({
+    request,
+    authorization: undefined,
+    alertTypeRegistry: alertsClientFactoryParams.alertTypeRegistry,
+    features: alertsClientFactoryParams.features,
+    auditLogger: expect.any(AlertsAuthorizationAuditLogger),
+    getSpace: expect.any(Function),
+  });
 
   expect(jest.requireMock('./alerts_client').AlertsClient).toHaveBeenCalledWith({
-    savedObjectsClient,
+    unsecuredSavedObjectsClient: savedObjectsClient,
+    authorization: expect.any(AlertsAuthorization),
+    actionsAuthorization,
     logger: alertsClientFactoryParams.logger,
     taskManager: alertsClientFactoryParams.taskManager,
     alertTypeRegistry: alertsClientFactoryParams.alertTypeRegistry,
@@ -73,7 +170,7 @@ test('creates an alerts client with proper constructor arguments', async () => {
 test('getUserName() returns null when security is disabled', async () => {
   const factory = new AlertsClientFactory();
   factory.initialize(alertsClientFactoryParams);
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   const userNameResult = await constructorCall.getUserName();
@@ -86,7 +183,7 @@ test('getUserName() returns a name when security is enabled', async () => {
     ...alertsClientFactoryParams,
     securityPluginSetup,
   });
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   securityPluginSetup.authc.getCurrentUser.mockReturnValueOnce(({
@@ -99,7 +196,7 @@ test('getUserName() returns a name when security is enabled', async () => {
 test('getActionsClient() returns ActionsClient', async () => {
   const factory = new AlertsClientFactory();
   factory.initialize(alertsClientFactoryParams);
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   const actionsClient = await constructorCall.getActionsClient();
@@ -109,7 +206,7 @@ test('getActionsClient() returns ActionsClient', async () => {
 test('createAPIKey() returns { apiKeysEnabled: false } when security is disabled', async () => {
   const factory = new AlertsClientFactory();
   factory.initialize(alertsClientFactoryParams);
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   const createAPIKeyResult = await constructorCall.createAPIKey();
@@ -119,7 +216,7 @@ test('createAPIKey() returns { apiKeysEnabled: false } when security is disabled
 test('createAPIKey() returns { apiKeysEnabled: false } when security is enabled but ES security is disabled', async () => {
   const factory = new AlertsClientFactory();
   factory.initialize(alertsClientFactoryParams);
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   securityPluginSetup.authc.grantAPIKeyAsInternalUser.mockResolvedValueOnce(null);
@@ -133,7 +230,7 @@ test('createAPIKey() returns an API key when security is enabled', async () => {
     ...alertsClientFactoryParams,
     securityPluginSetup,
   });
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   securityPluginSetup.authc.grantAPIKeyAsInternalUser.mockResolvedValueOnce({
@@ -154,7 +251,7 @@ test('createAPIKey() throws when security plugin createAPIKey throws an error',
     ...alertsClientFactoryParams,
     securityPluginSetup,
   });
-  factory.create(KibanaRequest.from(fakeRequest), savedObjectsClient);
+  factory.create(KibanaRequest.from(fakeRequest), savedObjectsService);
   const constructorCall = jest.requireMock('./alerts_client').AlertsClient.mock.calls[0][0];
 
   securityPluginSetup.authc.grantAPIKeyAsInternalUser.mockRejectedValueOnce(
diff --git a/x-pack/plugins/alerts/server/alerts_client_factory.ts b/x-pack/plugins/alerts/server/alerts_client_factory.ts
index 30fcd1b949f2b..79b0ccaf1f0bc 100644
--- a/x-pack/plugins/alerts/server/alerts_client_factory.ts
+++ b/x-pack/plugins/alerts/server/alerts_client_factory.ts
@@ -6,11 +6,16 @@
 
 import { PluginStartContract as ActionsPluginStartContract } from '../../actions/server';
 import { AlertsClient } from './alerts_client';
+import { ALERTS_FEATURE_ID } from '../common';
 import { AlertTypeRegistry, SpaceIdToNamespaceFunction } from './types';
-import { KibanaRequest, Logger, SavedObjectsClientContract } from '../../../../src/core/server';
+import { KibanaRequest, Logger, SavedObjectsServiceStart } from '../../../../src/core/server';
 import { InvalidateAPIKeyParams, SecurityPluginSetup } from '../../security/server';
 import { EncryptedSavedObjectsClient } from '../../encrypted_saved_objects/server';
 import { TaskManagerStartContract } from '../../task_manager/server';
+import { PluginStartContract as FeaturesPluginStart } from '../../features/server';
+import { AlertsAuthorization } from './authorization/alerts_authorization';
+import { AlertsAuthorizationAuditLogger } from './authorization/audit_logger';
+import { Space } from '../../spaces/server';
 
 export interface AlertsClientFactoryOpts {
   logger: Logger;
@@ -18,9 +23,11 @@ export interface AlertsClientFactoryOpts {
   alertTypeRegistry: AlertTypeRegistry;
   securityPluginSetup?: SecurityPluginSetup;
   getSpaceId: (request: KibanaRequest) => string | undefined;
+  getSpace: (request: KibanaRequest) => Promise<Space | undefined>;
   spaceIdToNamespace: SpaceIdToNamespaceFunction;
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
   actions: ActionsPluginStartContract;
+  features: FeaturesPluginStart;
 }
 
 export class AlertsClientFactory {
@@ -30,9 +37,11 @@ export class AlertsClientFactory {
   private alertTypeRegistry!: AlertTypeRegistry;
   private securityPluginSetup?: SecurityPluginSetup;
   private getSpaceId!: (request: KibanaRequest) => string | undefined;
+  private getSpace!: (request: KibanaRequest) => Promise<Space | undefined>;
   private spaceIdToNamespace!: SpaceIdToNamespaceFunction;
   private encryptedSavedObjectsClient!: EncryptedSavedObjectsClient;
   private actions!: ActionsPluginStartContract;
+  private features!: FeaturesPluginStart;
 
   public initialize(options: AlertsClientFactoryOpts) {
     if (this.isInitialized) {
@@ -41,26 +50,41 @@ export class AlertsClientFactory {
     this.isInitialized = true;
     this.logger = options.logger;
     this.getSpaceId = options.getSpaceId;
+    this.getSpace = options.getSpace;
     this.taskManager = options.taskManager;
     this.alertTypeRegistry = options.alertTypeRegistry;
     this.securityPluginSetup = options.securityPluginSetup;
     this.spaceIdToNamespace = options.spaceIdToNamespace;
     this.encryptedSavedObjectsClient = options.encryptedSavedObjectsClient;
     this.actions = options.actions;
+    this.features = options.features;
   }
 
-  public create(
-    request: KibanaRequest,
-    savedObjectsClient: SavedObjectsClientContract
-  ): AlertsClient {
-    const { securityPluginSetup, actions } = this;
+  public create(request: KibanaRequest, savedObjects: SavedObjectsServiceStart): AlertsClient {
+    const { securityPluginSetup, actions, features } = this;
     const spaceId = this.getSpaceId(request);
+    const authorization = new AlertsAuthorization({
+      authorization: securityPluginSetup?.authz,
+      request,
+      getSpace: this.getSpace,
+      alertTypeRegistry: this.alertTypeRegistry,
+      features: features!,
+      auditLogger: new AlertsAuthorizationAuditLogger(
+        securityPluginSetup?.audit.getLogger(ALERTS_FEATURE_ID)
+      ),
+    });
+
     return new AlertsClient({
       spaceId,
       logger: this.logger,
       taskManager: this.taskManager,
       alertTypeRegistry: this.alertTypeRegistry,
-      savedObjectsClient,
+      unsecuredSavedObjectsClient: savedObjects.getScopedClient(request, {
+        excludedWrappers: ['security'],
+        includedHiddenTypes: ['alert'],
+      }),
+      authorization,
+      actionsAuthorization: actions.getActionsAuthorizationWithRequest(request),
       namespace: this.spaceIdToNamespace(spaceId),
       encryptedSavedObjectsClient: this.encryptedSavedObjectsClient,
       async getUserName() {
diff --git a/x-pack/plugins/alerts/server/authorization/alerts_authorization.mock.ts b/x-pack/plugins/alerts/server/authorization/alerts_authorization.mock.ts
new file mode 100644
index 0000000000000..d7705f834ad41
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/alerts_authorization.mock.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AlertsAuthorization } from './alerts_authorization';
+
+type Schema = PublicMethodsOf<AlertsAuthorization>;
+export type AlertsAuthorizationMock = jest.Mocked<Schema>;
+
+const createAlertsAuthorizationMock = () => {
+  const mocked: AlertsAuthorizationMock = {
+    ensureAuthorized: jest.fn(),
+    filterByAlertTypeAuthorization: jest.fn(),
+    getFindAuthorizationFilter: jest.fn(),
+  };
+  return mocked;
+};
+
+export const alertsAuthorizationMock: {
+  create: () => AlertsAuthorizationMock;
+} = {
+  create: createAlertsAuthorizationMock,
+};
diff --git a/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts b/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
new file mode 100644
index 0000000000000..b164d27ded648
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/alerts_authorization.test.ts
@@ -0,0 +1,1256 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { KibanaRequest } from 'kibana/server';
+import { alertTypeRegistryMock } from '../alert_type_registry.mock';
+import { securityMock } from '../../../../plugins/security/server/mocks';
+import { PluginStartContract as FeaturesStartContract, Feature } from '../../../features/server';
+import { featuresPluginMock } from '../../../features/server/mocks';
+import {
+  AlertsAuthorization,
+  ensureFieldIsSafeForQuery,
+  WriteOperations,
+  ReadOperations,
+} from './alerts_authorization';
+import { alertsAuthorizationAuditLoggerMock } from './audit_logger.mock';
+import { AlertsAuthorizationAuditLogger, AuthorizationResult } from './audit_logger';
+import uuid from 'uuid';
+
+const alertTypeRegistry = alertTypeRegistryMock.create();
+const features: jest.Mocked<FeaturesStartContract> = featuresPluginMock.createStart();
+const request = {} as KibanaRequest;
+
+const auditLogger = alertsAuthorizationAuditLoggerMock.create();
+const realAuditLogger = new AlertsAuthorizationAuditLogger();
+
+const getSpace = jest.fn();
+
+const mockAuthorizationAction = (type: string, app: string, operation: string) =>
+  `${type}/${app}/${operation}`;
+function mockSecurity() {
+  const security = securityMock.createSetup();
+  const authorization = security.authz;
+  // typescript is having trouble inferring jest's automocking
+  (authorization.actions.alerting.get as jest.MockedFunction<
+    typeof authorization.actions.alerting.get
+  >).mockImplementation(mockAuthorizationAction);
+  authorization.mode.useRbacForRequest.mockReturnValue(true);
+  return { authorization };
+}
+
+function mockFeature(appName: string, typeName?: string) {
+  return new Feature({
+    id: appName,
+    name: appName,
+    app: [],
+    ...(typeName
+      ? {
+          alerting: [typeName],
+        }
+      : {}),
+    privileges: {
+      all: {
+        ...(typeName
+          ? {
+              alerting: {
+                all: [typeName],
+              },
+            }
+          : {}),
+        savedObject: {
+          all: [],
+          read: [],
+        },
+        ui: [],
+      },
+      read: {
+        ...(typeName
+          ? {
+              alerting: {
+                read: [typeName],
+              },
+            }
+          : {}),
+        savedObject: {
+          all: [],
+          read: [],
+        },
+        ui: [],
+      },
+    },
+  });
+}
+
+function mockFeatureWithSubFeature(appName: string, typeName: string) {
+  return new Feature({
+    id: appName,
+    name: appName,
+    app: [],
+    ...(typeName
+      ? {
+          alerting: [typeName],
+        }
+      : {}),
+    privileges: {
+      all: {
+        savedObject: {
+          all: [],
+          read: [],
+        },
+        ui: [],
+      },
+      read: {
+        savedObject: {
+          all: [],
+          read: [],
+        },
+        ui: [],
+      },
+    },
+    subFeatures: [
+      {
+        name: appName,
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'doSomethingAlertRelated',
+                name: 'sub feature alert',
+                includeIn: 'all',
+                alerting: {
+                  all: [typeName],
+                },
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['doSomethingAlertRelated'],
+              },
+              {
+                id: 'doSomethingAlertRelated',
+                name: 'sub feature alert',
+                includeIn: 'read',
+                alerting: {
+                  read: [typeName],
+                },
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['doSomethingAlertRelated'],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  });
+}
+
+const myAppFeature = mockFeature('myApp', 'myType');
+const myOtherAppFeature = mockFeature('myOtherApp', 'myType');
+const myAppWithSubFeature = mockFeatureWithSubFeature('myAppWithSubFeature', 'myType');
+const myFeatureWithoutAlerting = mockFeature('myOtherApp');
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  auditLogger.alertsAuthorizationFailure.mockImplementation((username, ...args) =>
+    realAuditLogger.getAuthorizationMessage(AuthorizationResult.Unauthorized, ...args)
+  );
+  auditLogger.alertsAuthorizationSuccess.mockImplementation((username, ...args) =>
+    realAuditLogger.getAuthorizationMessage(AuthorizationResult.Authorized, ...args)
+  );
+  auditLogger.alertsUnscopedAuthorizationFailure.mockImplementation(
+    (username, operation) => `Unauthorized ${username}/${operation}`
+  );
+  alertTypeRegistry.get.mockImplementation((id) => ({
+    id,
+    name: 'My Alert Type',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    defaultActionGroupId: 'default',
+    async executor() {},
+    producer: 'myApp',
+  }));
+  features.getFeatures.mockReturnValue([
+    myAppFeature,
+    myOtherAppFeature,
+    myAppWithSubFeature,
+    myFeatureWithoutAlerting,
+  ]);
+  getSpace.mockResolvedValue(undefined);
+});
+
+describe('AlertsAuthorization', () => {
+  describe('constructor', () => {
+    test(`fetches the user's current space`, async () => {
+      const space = {
+        id: uuid.v4(),
+        name: uuid.v4(),
+        disabledFeatures: [],
+      };
+      getSpace.mockResolvedValue(space);
+
+      new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      expect(getSpace).toHaveBeenCalledWith(request);
+    });
+  });
+
+  describe('ensureAuthorized', () => {
+    test('is a no-op when there is no authorization api', async () => {
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      await alertAuthorization.ensureAuthorized('myType', 'myApp', WriteOperations.Create);
+
+      expect(alertTypeRegistry.get).toHaveBeenCalledTimes(0);
+    });
+
+    test('is a no-op when the security license is disabled', async () => {
+      const { authorization } = mockSecurity();
+      authorization.mode.useRbacForRequest.mockReturnValue(false);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        authorization,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      await alertAuthorization.ensureAuthorized('myType', 'myApp', WriteOperations.Create);
+
+      expect(alertTypeRegistry.get).toHaveBeenCalledTimes(0);
+    });
+
+    test('ensures the user has privileges to execute the specified type, operation and consumer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: true,
+        privileges: [],
+      });
+
+      await alertAuthorization.ensureAuthorized('myType', 'myApp', WriteOperations.Create);
+
+      expect(alertTypeRegistry.get).toHaveBeenCalledWith('myType');
+
+      expect(authorization.actions.alerting.get).toHaveBeenCalledWith('myType', 'myApp', 'create');
+      expect(checkPrivileges).toHaveBeenCalledWith([
+        mockAuthorizationAction('myType', 'myApp', 'create'),
+      ]);
+
+      expect(auditLogger.alertsAuthorizationSuccess).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          0,
+          "myApp",
+          "create",
+        ]
+      `);
+    });
+
+    test('ensures the user has privileges to execute the specified type and operation without consumer when consumer is alerts', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: true,
+        privileges: [],
+      });
+
+      await alertAuthorization.ensureAuthorized('myType', 'alerts', WriteOperations.Create);
+
+      expect(alertTypeRegistry.get).toHaveBeenCalledWith('myType');
+
+      expect(authorization.actions.alerting.get).toHaveBeenCalledWith('myType', 'myApp', 'create');
+      expect(checkPrivileges).toHaveBeenCalledWith([
+        mockAuthorizationAction('myType', 'myApp', 'create'),
+      ]);
+
+      expect(auditLogger.alertsAuthorizationSuccess).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          0,
+          "alerts",
+          "create",
+        ]
+      `);
+    });
+
+    test('ensures the user has privileges to execute the specified type, operation and producer when producer is different from consumer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: true,
+        privileges: [],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      await alertAuthorization.ensureAuthorized('myType', 'myOtherApp', WriteOperations.Create);
+
+      expect(alertTypeRegistry.get).toHaveBeenCalledWith('myType');
+
+      expect(authorization.actions.alerting.get).toHaveBeenCalledWith('myType', 'myApp', 'create');
+      expect(authorization.actions.alerting.get).toHaveBeenCalledWith(
+        'myType',
+        'myOtherApp',
+        'create'
+      );
+      expect(checkPrivileges).toHaveBeenCalledWith([
+        mockAuthorizationAction('myType', 'myOtherApp', 'create'),
+        mockAuthorizationAction('myType', 'myApp', 'create'),
+      ]);
+
+      expect(auditLogger.alertsAuthorizationSuccess).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          0,
+          "myOtherApp",
+          "create",
+        ]
+      `);
+    });
+
+    test('throws if user lacks the required privieleges for the consumer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myType', 'myApp', 'create'),
+            authorized: true,
+          },
+        ],
+      });
+
+      await expect(
+        alertAuthorization.ensureAuthorized('myType', 'myOtherApp', WriteOperations.Create)
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"Unauthorized to create a \\"myType\\" alert for \\"myOtherApp\\""`
+      );
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          0,
+          "myOtherApp",
+          "create",
+        ]
+      `);
+    });
+
+    test('throws if user lacks the required privieleges for the producer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myType', 'myOtherApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myType', 'myApp', 'create'),
+            authorized: false,
+          },
+        ],
+      });
+
+      await expect(
+        alertAuthorization.ensureAuthorized('myType', 'myOtherApp', WriteOperations.Create)
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"Unauthorized to create a \\"myType\\" alert by \\"myApp\\""`
+      );
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          1,
+          "myApp",
+          "create",
+        ]
+      `);
+    });
+
+    test('throws if user lacks the required privieleges for both consumer and producer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myType', 'myApp', 'create'),
+            authorized: false,
+          },
+        ],
+      });
+
+      await expect(
+        alertAuthorization.ensureAuthorized('myType', 'myOtherApp', WriteOperations.Create)
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"Unauthorized to create a \\"myType\\" alert for \\"myOtherApp\\""`
+      );
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myType",
+          0,
+          "myOtherApp",
+          "create",
+        ]
+      `);
+    });
+  });
+
+  describe('getFindAuthorizationFilter', () => {
+    const myOtherAppAlertType = {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'myOtherAppAlertType',
+      name: 'myOtherAppAlertType',
+      producer: 'alerts',
+    };
+    const myAppAlertType = {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'myAppAlertType',
+      name: 'myAppAlertType',
+      producer: 'myApp',
+    };
+    const mySecondAppAlertType = {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'mySecondAppAlertType',
+      name: 'mySecondAppAlertType',
+      producer: 'myApp',
+    };
+    const setOfAlertTypes = new Set([myAppAlertType, myOtherAppAlertType, mySecondAppAlertType]);
+
+    test('omits filter when there is no authorization api', async () => {
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      const {
+        filter,
+        ensureAlertTypeIsAuthorized,
+      } = await alertAuthorization.getFindAuthorizationFilter();
+
+      expect(() => ensureAlertTypeIsAuthorized('someMadeUpType', 'myApp')).not.toThrow();
+
+      expect(filter).toEqual(undefined);
+    });
+
+    test('ensureAlertTypeIsAuthorized is no-op when there is no authorization api', async () => {
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+
+      const { ensureAlertTypeIsAuthorized } = await alertAuthorization.getFindAuthorizationFilter();
+
+      ensureAlertTypeIsAuthorized('someMadeUpType', 'myApp');
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+    });
+
+    test('creates a filter based on the privileged types', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: true,
+        privileges: [],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      expect((await alertAuthorization.getFindAuthorizationFilter()).filter).toMatchInlineSnapshot(
+        `"((alert.attributes.alertTypeId:myAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:myOtherAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)) or (alert.attributes.alertTypeId:mySecondAppAlertType and alert.attributes.consumer:(alerts or myApp or myOtherApp or myAppWithSubFeature)))"`
+      );
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+    });
+
+    test('creates an `ensureAlertTypeIsAuthorized` function which throws if type is unauthorized', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'find'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'find'),
+            authorized: false,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      const { ensureAlertTypeIsAuthorized } = await alertAuthorization.getFindAuthorizationFilter();
+      expect(() => {
+        ensureAlertTypeIsAuthorized('myAppAlertType', 'myOtherApp');
+      }).toThrowErrorMatchingInlineSnapshot(
+        `"Unauthorized to find a \\"myAppAlertType\\" alert for \\"myOtherApp\\""`
+      );
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsAuthorizationFailure.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          "myAppAlertType",
+          0,
+          "myOtherApp",
+          "find",
+        ]
+      `);
+    });
+
+    test('creates an `ensureAlertTypeIsAuthorized` function which is no-op if type is authorized', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'find'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'find'),
+            authorized: true,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      const { ensureAlertTypeIsAuthorized } = await alertAuthorization.getFindAuthorizationFilter();
+      expect(() => {
+        ensureAlertTypeIsAuthorized('myAppAlertType', 'myOtherApp');
+      }).not.toThrow();
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+    });
+
+    test('creates an `logSuccessfulAuthorization` function which logs every authorized type', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'find'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('mySecondAppAlertType', 'myApp', 'find'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('mySecondAppAlertType', 'myOtherApp', 'find'),
+            authorized: true,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      const {
+        ensureAlertTypeIsAuthorized,
+        logSuccessfulAuthorization,
+      } = await alertAuthorization.getFindAuthorizationFilter();
+      expect(() => {
+        ensureAlertTypeIsAuthorized('myAppAlertType', 'myOtherApp');
+        ensureAlertTypeIsAuthorized('mySecondAppAlertType', 'myOtherApp');
+        ensureAlertTypeIsAuthorized('myAppAlertType', 'myOtherApp');
+      }).not.toThrow();
+
+      expect(auditLogger.alertsAuthorizationSuccess).not.toHaveBeenCalled();
+      expect(auditLogger.alertsAuthorizationFailure).not.toHaveBeenCalled();
+
+      logSuccessfulAuthorization();
+
+      expect(auditLogger.alertsBulkAuthorizationSuccess).toHaveBeenCalledTimes(1);
+      expect(auditLogger.alertsBulkAuthorizationSuccess.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          "some-user",
+          Array [
+            Array [
+              "myAppAlertType",
+              "myOtherApp",
+            ],
+            Array [
+              "mySecondAppAlertType",
+              "myOtherApp",
+            ],
+          ],
+          0,
+          "find",
+        ]
+      `);
+    });
+  });
+
+  describe('filterByAlertTypeAuthorization', () => {
+    const myOtherAppAlertType = {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'myOtherAppAlertType',
+      name: 'myOtherAppAlertType',
+      producer: 'myOtherApp',
+    };
+    const myAppAlertType = {
+      actionGroups: [],
+      actionVariables: undefined,
+      defaultActionGroupId: 'default',
+      id: 'myAppAlertType',
+      name: 'myAppAlertType',
+      producer: 'myApp',
+    };
+    const setOfAlertTypes = new Set([myAppAlertType, myOtherAppAlertType]);
+
+    test('augments a list of types with all features when there is no authorization api', async () => {
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      await expect(
+        alertAuthorization.filterByAlertTypeAuthorization(
+          new Set([myAppAlertType, myOtherAppAlertType]),
+          [WriteOperations.Create]
+        )
+      ).resolves.toMatchInlineSnapshot(`
+              Set {
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myAppWithSubFeature": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myAppAlertType",
+                  "name": "myAppAlertType",
+                  "producer": "myApp",
+                },
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myAppWithSubFeature": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myOtherAppAlertType",
+                  "name": "myOtherAppAlertType",
+                  "producer": "myOtherApp",
+                },
+              }
+            `);
+    });
+
+    test('augments a list of types with consumers under which the operation is authorized', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'create'),
+            authorized: true,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      await expect(
+        alertAuthorization.filterByAlertTypeAuthorization(
+          new Set([myAppAlertType, myOtherAppAlertType]),
+          [WriteOperations.Create]
+        )
+      ).resolves.toMatchInlineSnapshot(`
+              Set {
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myOtherAppAlertType",
+                  "name": "myOtherAppAlertType",
+                  "producer": "myOtherApp",
+                },
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myAppAlertType",
+                  "name": "myAppAlertType",
+                  "producer": "myApp",
+                },
+              }
+            `);
+    });
+
+    test('authorizes user under the Alerts consumer when they are authorized by the producer', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      await expect(
+        alertAuthorization.filterByAlertTypeAuthorization(new Set([myAppAlertType]), [
+          WriteOperations.Create,
+        ])
+      ).resolves.toMatchInlineSnapshot(`
+              Set {
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myAppAlertType",
+                  "name": "myAppAlertType",
+                  "producer": "myApp",
+                },
+              }
+            `);
+    });
+
+    test('augments a list of types with consumers under which multiple operations are authorized', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'get'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'get'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'get'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'get'),
+            authorized: true,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      await expect(
+        alertAuthorization.filterByAlertTypeAuthorization(
+          new Set([myAppAlertType, myOtherAppAlertType]),
+          [WriteOperations.Create, ReadOperations.Get]
+        )
+      ).resolves.toMatchInlineSnapshot(`
+              Set {
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": false,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": false,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myOtherAppAlertType",
+                  "name": "myOtherAppAlertType",
+                  "producer": "myOtherApp",
+                },
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": false,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": false,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": false,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myAppAlertType",
+                  "name": "myAppAlertType",
+                  "producer": "myApp",
+                },
+              }
+            `);
+    });
+
+    test('omits types which have no consumers under which the operation is authorized', async () => {
+      const { authorization } = mockSecurity();
+      const checkPrivileges: jest.MockedFunction<ReturnType<
+        typeof authorization.checkPrivilegesDynamicallyWithRequest
+      >> = jest.fn();
+      authorization.checkPrivilegesDynamicallyWithRequest.mockReturnValue(checkPrivileges);
+      checkPrivileges.mockResolvedValueOnce({
+        username: 'some-user',
+        hasAllRequested: false,
+        privileges: [
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myOtherAppAlertType', 'myOtherApp', 'create'),
+            authorized: true,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myApp', 'create'),
+            authorized: false,
+          },
+          {
+            privilege: mockAuthorizationAction('myAppAlertType', 'myOtherApp', 'create'),
+            authorized: false,
+          },
+        ],
+      });
+
+      const alertAuthorization = new AlertsAuthorization({
+        request,
+        authorization,
+        alertTypeRegistry,
+        features,
+        auditLogger,
+        getSpace,
+      });
+      alertTypeRegistry.list.mockReturnValue(setOfAlertTypes);
+
+      await expect(
+        alertAuthorization.filterByAlertTypeAuthorization(
+          new Set([myAppAlertType, myOtherAppAlertType]),
+          [WriteOperations.Create]
+        )
+      ).resolves.toMatchInlineSnapshot(`
+              Set {
+                Object {
+                  "actionGroups": Array [],
+                  "actionVariables": undefined,
+                  "authorizedConsumers": Object {
+                    "alerts": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                    "myOtherApp": Object {
+                      "all": true,
+                      "read": true,
+                    },
+                  },
+                  "defaultActionGroupId": "default",
+                  "id": "myOtherAppAlertType",
+                  "name": "myOtherAppAlertType",
+                  "producer": "myOtherApp",
+                },
+              }
+            `);
+    });
+  });
+
+  describe('ensureFieldIsSafeForQuery', () => {
+    test('throws if field contains character that isnt safe in a KQL query', () => {
+      expect(() => ensureFieldIsSafeForQuery('id', 'alert-*')).toThrowError(
+        `expected id not to include invalid character: *`
+      );
+
+      expect(() => ensureFieldIsSafeForQuery('id', '<=""')).toThrowError(
+        `expected id not to include invalid character: <=`
+      );
+
+      expect(() => ensureFieldIsSafeForQuery('id', '>=""')).toThrowError(
+        `expected id not to include invalid character: >=`
+      );
+
+      expect(() => ensureFieldIsSafeForQuery('id', '1 or alertid:123')).toThrowError(
+        `expected id not to include whitespace and invalid character: :`
+      );
+
+      expect(() => ensureFieldIsSafeForQuery('id', ') or alertid:123')).toThrowError(
+        `expected id not to include whitespace and invalid characters: ), :`
+      );
+
+      expect(() => ensureFieldIsSafeForQuery('id', 'some space')).toThrowError(
+        `expected id not to include whitespace`
+      );
+    });
+
+    test('doesnt throws if field is safe as part of a KQL query', () => {
+      expect(() => ensureFieldIsSafeForQuery('id', '123-0456-678')).not.toThrow();
+    });
+  });
+});
diff --git a/x-pack/plugins/alerts/server/authorization/alerts_authorization.ts b/x-pack/plugins/alerts/server/authorization/alerts_authorization.ts
new file mode 100644
index 0000000000000..33a9a0bf0396e
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/alerts_authorization.ts
@@ -0,0 +1,457 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { map, mapValues, remove, fromPairs, has } from 'lodash';
+import { KibanaRequest } from 'src/core/server';
+import { ALERTS_FEATURE_ID } from '../../common';
+import { AlertTypeRegistry } from '../types';
+import { SecurityPluginSetup } from '../../../security/server';
+import { RegistryAlertType } from '../alert_type_registry';
+import { PluginStartContract as FeaturesPluginStart } from '../../../features/server';
+import { AlertsAuthorizationAuditLogger, ScopeType } from './audit_logger';
+import { Space } from '../../../spaces/server';
+
+export enum ReadOperations {
+  Get = 'get',
+  GetAlertState = 'getAlertState',
+  Find = 'find',
+}
+
+export enum WriteOperations {
+  Create = 'create',
+  Delete = 'delete',
+  Update = 'update',
+  UpdateApiKey = 'updateApiKey',
+  Enable = 'enable',
+  Disable = 'disable',
+  MuteAll = 'muteAll',
+  UnmuteAll = 'unmuteAll',
+  MuteInstance = 'muteInstance',
+  UnmuteInstance = 'unmuteInstance',
+}
+
+interface HasPrivileges {
+  read: boolean;
+  all: boolean;
+}
+type AuthorizedConsumers = Record<string, HasPrivileges>;
+export interface RegistryAlertTypeWithAuth extends RegistryAlertType {
+  authorizedConsumers: AuthorizedConsumers;
+}
+
+type IsAuthorizedAtProducerLevel = boolean;
+
+export interface ConstructorOptions {
+  alertTypeRegistry: AlertTypeRegistry;
+  request: KibanaRequest;
+  features: FeaturesPluginStart;
+  getSpace: (request: KibanaRequest) => Promise<Space | undefined>;
+  auditLogger: AlertsAuthorizationAuditLogger;
+  authorization?: SecurityPluginSetup['authz'];
+}
+
+export class AlertsAuthorization {
+  private readonly alertTypeRegistry: AlertTypeRegistry;
+  private readonly request: KibanaRequest;
+  private readonly authorization?: SecurityPluginSetup['authz'];
+  private readonly auditLogger: AlertsAuthorizationAuditLogger;
+  private readonly featuresIds: Promise<Set<string>>;
+  private readonly allPossibleConsumers: Promise<AuthorizedConsumers>;
+
+  constructor({
+    alertTypeRegistry,
+    request,
+    authorization,
+    features,
+    auditLogger,
+    getSpace,
+  }: ConstructorOptions) {
+    this.request = request;
+    this.authorization = authorization;
+    this.alertTypeRegistry = alertTypeRegistry;
+    this.auditLogger = auditLogger;
+
+    this.featuresIds = getSpace(request)
+      .then((maybeSpace) => new Set(maybeSpace?.disabledFeatures ?? []))
+      .then(
+        (disabledFeatures) =>
+          new Set(
+            features
+              .getFeatures()
+              .filter(
+                ({ id, alerting }) =>
+                  // ignore features which are disabled in the user's space
+                  !disabledFeatures.has(id) &&
+                  // ignore features which don't grant privileges to alerting
+                  (alerting?.length ?? 0 > 0)
+              )
+              .map((feature) => feature.id)
+          )
+      )
+      .catch(() => {
+        // failing to fetch the space means the user is likely not privileged in the
+        // active space at all, which means that their list of features should be empty
+        return new Set();
+      });
+
+    this.allPossibleConsumers = this.featuresIds.then((featuresIds) =>
+      featuresIds.size
+        ? asAuthorizedConsumers([ALERTS_FEATURE_ID, ...featuresIds], {
+            read: true,
+            all: true,
+          })
+        : {}
+    );
+  }
+
+  private shouldCheckAuthorization(): boolean {
+    return this.authorization?.mode?.useRbacForRequest(this.request) ?? false;
+  }
+
+  public async ensureAuthorized(
+    alertTypeId: string,
+    consumer: string,
+    operation: ReadOperations | WriteOperations
+  ) {
+    const { authorization } = this;
+
+    const isAvailableConsumer = has(await this.allPossibleConsumers, consumer);
+    if (authorization && this.shouldCheckAuthorization()) {
+      const alertType = this.alertTypeRegistry.get(alertTypeId);
+      const requiredPrivilegesByScope = {
+        consumer: authorization.actions.alerting.get(alertTypeId, consumer, operation),
+        producer: authorization.actions.alerting.get(alertTypeId, alertType.producer, operation),
+      };
+
+      // We special case the Alerts Management `consumer` as we don't want to have to
+      // manually authorize each alert type in the management UI
+      const shouldAuthorizeConsumer = consumer !== ALERTS_FEATURE_ID;
+
+      const checkPrivileges = authorization.checkPrivilegesDynamicallyWithRequest(this.request);
+      const { hasAllRequested, username, privileges } = await checkPrivileges(
+        shouldAuthorizeConsumer && consumer !== alertType.producer
+          ? [
+              // check for access at consumer level
+              requiredPrivilegesByScope.consumer,
+              // check for access at producer level
+              requiredPrivilegesByScope.producer,
+            ]
+          : [
+              // skip consumer privilege checks under `alerts` as all alert types can
+              // be created under `alerts` if you have producer level privileges
+              requiredPrivilegesByScope.producer,
+            ]
+      );
+
+      if (!isAvailableConsumer) {
+        /**
+         * Under most circumstances this would have been caught by `checkPrivileges` as
+         * a user can't have Privileges to an unknown consumer, but super users
+         * don't actually get "privilege checked" so the made up consumer *will* return
+         * as Privileged.
+         * This check will ensure we don't accidentally let these through
+         */
+        throw Boom.forbidden(
+          this.auditLogger.alertsAuthorizationFailure(
+            username,
+            alertTypeId,
+            ScopeType.Consumer,
+            consumer,
+            operation
+          )
+        );
+      }
+
+      if (hasAllRequested) {
+        this.auditLogger.alertsAuthorizationSuccess(
+          username,
+          alertTypeId,
+          ScopeType.Consumer,
+          consumer,
+          operation
+        );
+      } else {
+        const authorizedPrivileges = map(
+          privileges.filter((privilege) => privilege.authorized),
+          'privilege'
+        );
+        const unauthorizedScopes = mapValues(
+          requiredPrivilegesByScope,
+          (privilege) => !authorizedPrivileges.includes(privilege)
+        );
+
+        const [unauthorizedScopeType, unauthorizedScope] =
+          shouldAuthorizeConsumer && unauthorizedScopes.consumer
+            ? [ScopeType.Consumer, consumer]
+            : [ScopeType.Producer, alertType.producer];
+
+        throw Boom.forbidden(
+          this.auditLogger.alertsAuthorizationFailure(
+            username,
+            alertTypeId,
+            unauthorizedScopeType,
+            unauthorizedScope,
+            operation
+          )
+        );
+      }
+    } else if (!isAvailableConsumer) {
+      throw Boom.forbidden(
+        this.auditLogger.alertsAuthorizationFailure(
+          '',
+          alertTypeId,
+          ScopeType.Consumer,
+          consumer,
+          operation
+        )
+      );
+    }
+  }
+
+  public async getFindAuthorizationFilter(): Promise<{
+    filter?: string;
+    ensureAlertTypeIsAuthorized: (alertTypeId: string, consumer: string) => void;
+    logSuccessfulAuthorization: () => void;
+  }> {
+    if (this.authorization && this.shouldCheckAuthorization()) {
+      const {
+        username,
+        authorizedAlertTypes,
+      } = await this.augmentAlertTypesWithAuthorization(this.alertTypeRegistry.list(), [
+        ReadOperations.Find,
+      ]);
+
+      if (!authorizedAlertTypes.size) {
+        throw Boom.forbidden(
+          this.auditLogger.alertsUnscopedAuthorizationFailure(username!, 'find')
+        );
+      }
+
+      const authorizedAlertTypeIdsToConsumers = new Set<string>(
+        [...authorizedAlertTypes].reduce<string[]>((alertTypeIdConsumerPairs, alertType) => {
+          for (const consumer of Object.keys(alertType.authorizedConsumers)) {
+            alertTypeIdConsumerPairs.push(`${alertType.id}/${consumer}`);
+          }
+          return alertTypeIdConsumerPairs;
+        }, [])
+      );
+
+      const authorizedEntries: Map<string, Set<string>> = new Map();
+      return {
+        filter: `(${this.asFiltersByAlertTypeAndConsumer(authorizedAlertTypes).join(' or ')})`,
+        ensureAlertTypeIsAuthorized: (alertTypeId: string, consumer: string) => {
+          if (!authorizedAlertTypeIdsToConsumers.has(`${alertTypeId}/${consumer}`)) {
+            throw Boom.forbidden(
+              this.auditLogger.alertsAuthorizationFailure(
+                username!,
+                alertTypeId,
+                ScopeType.Consumer,
+                consumer,
+                'find'
+              )
+            );
+          } else {
+            if (authorizedEntries.has(alertTypeId)) {
+              authorizedEntries.get(alertTypeId)!.add(consumer);
+            } else {
+              authorizedEntries.set(alertTypeId, new Set([consumer]));
+            }
+          }
+        },
+        logSuccessfulAuthorization: () => {
+          if (authorizedEntries.size) {
+            this.auditLogger.alertsBulkAuthorizationSuccess(
+              username!,
+              [...authorizedEntries.entries()].reduce<Array<[string, string]>>(
+                (authorizedPairs, [alertTypeId, consumers]) => {
+                  for (const consumer of consumers) {
+                    authorizedPairs.push([alertTypeId, consumer]);
+                  }
+                  return authorizedPairs;
+                },
+                []
+              ),
+              ScopeType.Consumer,
+              'find'
+            );
+          }
+        },
+      };
+    }
+    return {
+      ensureAlertTypeIsAuthorized: (alertTypeId: string, consumer: string) => {},
+      logSuccessfulAuthorization: () => {},
+    };
+  }
+
+  public async filterByAlertTypeAuthorization(
+    alertTypes: Set<RegistryAlertType>,
+    operations: Array<ReadOperations | WriteOperations>
+  ): Promise<Set<RegistryAlertTypeWithAuth>> {
+    const { authorizedAlertTypes } = await this.augmentAlertTypesWithAuthorization(
+      alertTypes,
+      operations
+    );
+    return authorizedAlertTypes;
+  }
+
+  private async augmentAlertTypesWithAuthorization(
+    alertTypes: Set<RegistryAlertType>,
+    operations: Array<ReadOperations | WriteOperations>
+  ): Promise<{
+    username?: string;
+    hasAllRequested: boolean;
+    authorizedAlertTypes: Set<RegistryAlertTypeWithAuth>;
+  }> {
+    const featuresIds = await this.featuresIds;
+    if (this.authorization && this.shouldCheckAuthorization()) {
+      const checkPrivileges = this.authorization.checkPrivilegesDynamicallyWithRequest(
+        this.request
+      );
+
+      // add an empty `authorizedConsumers` array on each alertType
+      const alertTypesWithAuthorization = this.augmentWithAuthorizedConsumers(alertTypes, {});
+
+      // map from privilege to alertType which we can refer back to when analyzing the result
+      // of checkPrivileges
+      const privilegeToAlertType = new Map<
+        string,
+        [RegistryAlertTypeWithAuth, string, HasPrivileges, IsAuthorizedAtProducerLevel]
+      >();
+      // as we can't ask ES for the user's individual privileges we need to ask for each feature
+      // and alertType in the system whether this user has this privilege
+      for (const alertType of alertTypesWithAuthorization) {
+        for (const feature of featuresIds) {
+          for (const operation of operations) {
+            privilegeToAlertType.set(
+              this.authorization!.actions.alerting.get(alertType.id, feature, operation),
+              [
+                alertType,
+                feature,
+                hasPrivilegeByOperation(operation),
+                alertType.producer === feature,
+              ]
+            );
+          }
+        }
+      }
+
+      const { username, hasAllRequested, privileges } = await checkPrivileges([
+        ...privilegeToAlertType.keys(),
+      ]);
+
+      return {
+        username,
+        hasAllRequested,
+        authorizedAlertTypes: hasAllRequested
+          ? // has access to all features
+            this.augmentWithAuthorizedConsumers(alertTypes, await this.allPossibleConsumers)
+          : // only has some of the required privileges
+            privileges.reduce((authorizedAlertTypes, { authorized, privilege }) => {
+              if (authorized && privilegeToAlertType.has(privilege)) {
+                const [
+                  alertType,
+                  feature,
+                  hasPrivileges,
+                  isAuthorizedAtProducerLevel,
+                ] = privilegeToAlertType.get(privilege)!;
+                alertType.authorizedConsumers[feature] = mergeHasPrivileges(
+                  hasPrivileges,
+                  alertType.authorizedConsumers[feature]
+                );
+
+                if (isAuthorizedAtProducerLevel) {
+                  // granting privileges under the producer automatically authorized the Alerts Management UI as well
+                  alertType.authorizedConsumers[ALERTS_FEATURE_ID] = mergeHasPrivileges(
+                    hasPrivileges,
+                    alertType.authorizedConsumers[ALERTS_FEATURE_ID]
+                  );
+                }
+                authorizedAlertTypes.add(alertType);
+              }
+              return authorizedAlertTypes;
+            }, new Set<RegistryAlertTypeWithAuth>()),
+      };
+    } else {
+      return {
+        hasAllRequested: true,
+        authorizedAlertTypes: this.augmentWithAuthorizedConsumers(
+          new Set([...alertTypes].filter((alertType) => featuresIds.has(alertType.producer))),
+          await this.allPossibleConsumers
+        ),
+      };
+    }
+  }
+
+  private augmentWithAuthorizedConsumers(
+    alertTypes: Set<RegistryAlertType>,
+    authorizedConsumers: AuthorizedConsumers
+  ): Set<RegistryAlertTypeWithAuth> {
+    return new Set(
+      Array.from(alertTypes).map((alertType) => ({
+        ...alertType,
+        authorizedConsumers: { ...authorizedConsumers },
+      }))
+    );
+  }
+
+  private asFiltersByAlertTypeAndConsumer(alertTypes: Set<RegistryAlertTypeWithAuth>): string[] {
+    return Array.from(alertTypes).reduce<string[]>((filters, { id, authorizedConsumers }) => {
+      ensureFieldIsSafeForQuery('alertTypeId', id);
+      filters.push(
+        `(alert.attributes.alertTypeId:${id} and alert.attributes.consumer:(${Object.keys(
+          authorizedConsumers
+        )
+          .map((consumer) => {
+            ensureFieldIsSafeForQuery('alertTypeId', id);
+            return consumer;
+          })
+          .join(' or ')}))`
+      );
+      return filters;
+    }, []);
+  }
+}
+
+export function ensureFieldIsSafeForQuery(field: string, value: string): boolean {
+  const invalid = value.match(/([>=<\*:()]+|\s+)/g);
+  if (invalid) {
+    const whitespace = remove(invalid, (chars) => chars.trim().length === 0);
+    const errors = [];
+    if (whitespace.length) {
+      errors.push(`whitespace`);
+    }
+    if (invalid.length) {
+      errors.push(`invalid character${invalid.length > 1 ? `s` : ``}: ${invalid?.join(`, `)}`);
+    }
+    throw new Error(`expected ${field} not to include ${errors.join(' and ')}`);
+  }
+  return true;
+}
+
+function mergeHasPrivileges(left: HasPrivileges, right?: HasPrivileges): HasPrivileges {
+  return {
+    read: (left.read || right?.read) ?? false,
+    all: (left.all || right?.all) ?? false,
+  };
+}
+
+function hasPrivilegeByOperation(operation: ReadOperations | WriteOperations): HasPrivileges {
+  const read = Object.values(ReadOperations).includes((operation as unknown) as ReadOperations);
+  const all = Object.values(WriteOperations).includes((operation as unknown) as WriteOperations);
+  return {
+    read: read || all,
+    all,
+  };
+}
+
+function asAuthorizedConsumers(
+  consumers: string[],
+  hasPrivileges: HasPrivileges
+): AuthorizedConsumers {
+  return fromPairs(consumers.map((feature) => [feature, hasPrivileges]));
+}
diff --git a/x-pack/plugins/alerts/server/authorization/audit_logger.mock.ts b/x-pack/plugins/alerts/server/authorization/audit_logger.mock.ts
new file mode 100644
index 0000000000000..ca6a35b24bcac
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/audit_logger.mock.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AlertsAuthorizationAuditLogger } from './audit_logger';
+
+const createAlertsAuthorizationAuditLoggerMock = () => {
+  const mocked = ({
+    getAuthorizationMessage: jest.fn(),
+    alertsAuthorizationFailure: jest.fn(),
+    alertsUnscopedAuthorizationFailure: jest.fn(),
+    alertsAuthorizationSuccess: jest.fn(),
+    alertsBulkAuthorizationSuccess: jest.fn(),
+  } as unknown) as jest.Mocked<AlertsAuthorizationAuditLogger>;
+  return mocked;
+};
+
+export const alertsAuthorizationAuditLoggerMock: {
+  create: () => jest.Mocked<AlertsAuthorizationAuditLogger>;
+} = {
+  create: createAlertsAuthorizationAuditLoggerMock,
+};
diff --git a/x-pack/plugins/alerts/server/authorization/audit_logger.test.ts b/x-pack/plugins/alerts/server/authorization/audit_logger.test.ts
new file mode 100644
index 0000000000000..40973a3a67a51
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/audit_logger.test.ts
@@ -0,0 +1,311 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { AlertsAuthorizationAuditLogger, ScopeType } from './audit_logger';
+
+const createMockAuditLogger = () => {
+  return {
+    log: jest.fn(),
+  };
+};
+
+describe(`#constructor`, () => {
+  test('initializes a noop auditLogger if security logger is unavailable', () => {
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(undefined);
+
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Consumer;
+    const scope = 'myApp';
+    const operation = 'create';
+    expect(() => {
+      alertsAuditLogger.alertsAuthorizationFailure(
+        username,
+        alertTypeId,
+        scopeType,
+        scope,
+        operation
+      );
+
+      alertsAuditLogger.alertsAuthorizationSuccess(
+        username,
+        alertTypeId,
+        scopeType,
+        scope,
+        operation
+      );
+    }).not.toThrow();
+  });
+});
+
+describe(`#alertsUnscopedAuthorizationFailure`, () => {
+  test('logs auth failure of operation', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsUnscopedAuthorizationFailure(username, operation);
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_unscoped_authorization_failure",
+        "foo-user Unauthorized to create any alert types",
+        Object {
+          "operation": "create",
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+
+  test('logs auth failure with producer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Producer;
+    const scope = 'myOtherApp';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsAuthorizationFailure(
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_failure",
+        "foo-user Unauthorized to create a \\"alert-type-id\\" alert by \\"myOtherApp\\"",
+        Object {
+          "alertTypeId": "alert-type-id",
+          "operation": "create",
+          "scope": "myOtherApp",
+          "scopeType": 1,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
+
+describe(`#alertsAuthorizationFailure`, () => {
+  test('logs auth failure with consumer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Consumer;
+    const scope = 'myApp';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsAuthorizationFailure(
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_failure",
+        "foo-user Unauthorized to create a \\"alert-type-id\\" alert for \\"myApp\\"",
+        Object {
+          "alertTypeId": "alert-type-id",
+          "operation": "create",
+          "scope": "myApp",
+          "scopeType": 0,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+
+  test('logs auth failure with producer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Producer;
+    const scope = 'myOtherApp';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsAuthorizationFailure(
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_failure",
+        "foo-user Unauthorized to create a \\"alert-type-id\\" alert by \\"myOtherApp\\"",
+        Object {
+          "alertTypeId": "alert-type-id",
+          "operation": "create",
+          "scope": "myOtherApp",
+          "scopeType": 1,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
+
+describe(`#alertsBulkAuthorizationSuccess`, () => {
+  test('logs auth success with consumer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const scopeType = ScopeType.Consumer;
+    const authorizedEntries: Array<[string, string]> = [
+      ['alert-type-id', 'myApp'],
+      ['other-alert-type-id', 'myOtherApp'],
+    ];
+    const operation = 'create';
+
+    alertsAuditLogger.alertsBulkAuthorizationSuccess(
+      username,
+      authorizedEntries,
+      scopeType,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_success",
+        "foo-user Authorized to create: \\"alert-type-id\\" alert for \\"myApp\\", \\"other-alert-type-id\\" alert for \\"myOtherApp\\"",
+        Object {
+          "authorizedEntries": Array [
+            Array [
+              "alert-type-id",
+              "myApp",
+            ],
+            Array [
+              "other-alert-type-id",
+              "myOtherApp",
+            ],
+          ],
+          "operation": "create",
+          "scopeType": 0,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+
+  test('logs auth success with producer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const scopeType = ScopeType.Producer;
+    const authorizedEntries: Array<[string, string]> = [
+      ['alert-type-id', 'myApp'],
+      ['other-alert-type-id', 'myOtherApp'],
+    ];
+    const operation = 'create';
+
+    alertsAuditLogger.alertsBulkAuthorizationSuccess(
+      username,
+      authorizedEntries,
+      scopeType,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_success",
+        "foo-user Authorized to create: \\"alert-type-id\\" alert by \\"myApp\\", \\"other-alert-type-id\\" alert by \\"myOtherApp\\"",
+        Object {
+          "authorizedEntries": Array [
+            Array [
+              "alert-type-id",
+              "myApp",
+            ],
+            Array [
+              "other-alert-type-id",
+              "myOtherApp",
+            ],
+          ],
+          "operation": "create",
+          "scopeType": 1,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
+
+describe(`#savedObjectsAuthorizationSuccess`, () => {
+  test('logs auth success with consumer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Consumer;
+    const scope = 'myApp';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsAuthorizationSuccess(
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_success",
+        "foo-user Authorized to create a \\"alert-type-id\\" alert for \\"myApp\\"",
+        Object {
+          "alertTypeId": "alert-type-id",
+          "operation": "create",
+          "scope": "myApp",
+          "scopeType": 0,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+
+  test('logs auth success with producer scope', () => {
+    const auditLogger = createMockAuditLogger();
+    const alertsAuditLogger = new AlertsAuthorizationAuditLogger(auditLogger);
+    const username = 'foo-user';
+    const alertTypeId = 'alert-type-id';
+    const scopeType = ScopeType.Producer;
+    const scope = 'myOtherApp';
+    const operation = 'create';
+
+    alertsAuditLogger.alertsAuthorizationSuccess(
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+
+    expect(auditLogger.log.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "alerts_authorization_success",
+        "foo-user Authorized to create a \\"alert-type-id\\" alert by \\"myOtherApp\\"",
+        Object {
+          "alertTypeId": "alert-type-id",
+          "operation": "create",
+          "scope": "myOtherApp",
+          "scopeType": 1,
+          "username": "foo-user",
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/alerts/server/authorization/audit_logger.ts b/x-pack/plugins/alerts/server/authorization/audit_logger.ts
new file mode 100644
index 0000000000000..f930da2ce428c
--- /dev/null
+++ b/x-pack/plugins/alerts/server/authorization/audit_logger.ts
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AuditLogger } from '../../../security/server';
+
+export enum ScopeType {
+  Consumer,
+  Producer,
+}
+
+export enum AuthorizationResult {
+  Unauthorized = 'Unauthorized',
+  Authorized = 'Authorized',
+}
+
+export class AlertsAuthorizationAuditLogger {
+  private readonly auditLogger: AuditLogger;
+
+  constructor(auditLogger: AuditLogger = { log() {} }) {
+    this.auditLogger = auditLogger;
+  }
+
+  public getAuthorizationMessage(
+    authorizationResult: AuthorizationResult,
+    alertTypeId: string,
+    scopeType: ScopeType,
+    scope: string,
+    operation: string
+  ): string {
+    return `${authorizationResult} to ${operation} a "${alertTypeId}" alert ${
+      scopeType === ScopeType.Consumer ? `for "${scope}"` : `by "${scope}"`
+    }`;
+  }
+
+  public alertsAuthorizationFailure(
+    username: string,
+    alertTypeId: string,
+    scopeType: ScopeType,
+    scope: string,
+    operation: string
+  ): string {
+    const message = this.getAuthorizationMessage(
+      AuthorizationResult.Unauthorized,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+    this.auditLogger.log('alerts_authorization_failure', `${username} ${message}`, {
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation,
+    });
+    return message;
+  }
+
+  public alertsUnscopedAuthorizationFailure(username: string, operation: string): string {
+    const message = `Unauthorized to ${operation} any alert types`;
+    this.auditLogger.log('alerts_unscoped_authorization_failure', `${username} ${message}`, {
+      username,
+      operation,
+    });
+    return message;
+  }
+
+  public alertsAuthorizationSuccess(
+    username: string,
+    alertTypeId: string,
+    scopeType: ScopeType,
+    scope: string,
+    operation: string
+  ): string {
+    const message = this.getAuthorizationMessage(
+      AuthorizationResult.Authorized,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation
+    );
+    this.auditLogger.log('alerts_authorization_success', `${username} ${message}`, {
+      username,
+      alertTypeId,
+      scopeType,
+      scope,
+      operation,
+    });
+    return message;
+  }
+
+  public alertsBulkAuthorizationSuccess(
+    username: string,
+    authorizedEntries: Array<[string, string]>,
+    scopeType: ScopeType,
+    operation: string
+  ): string {
+    const message = `${AuthorizationResult.Authorized} to ${operation}: ${authorizedEntries
+      .map(
+        ([alertTypeId, scope]) =>
+          `"${alertTypeId}" alert ${
+            scopeType === ScopeType.Consumer ? `for "${scope}"` : `by "${scope}"`
+          }`
+      )
+      .join(', ')}`;
+    this.auditLogger.log('alerts_authorization_success', `${username} ${message}`, {
+      username,
+      scopeType,
+      authorizedEntries,
+      operation,
+    });
+    return message;
+  }
+}
diff --git a/x-pack/plugins/alerts/server/index.ts b/x-pack/plugins/alerts/server/index.ts
index 727e38d9ba56b..515de771e7d6b 100644
--- a/x-pack/plugins/alerts/server/index.ts
+++ b/x-pack/plugins/alerts/server/index.ts
@@ -21,7 +21,7 @@ export {
   PartialAlert,
 } from './types';
 export { PluginSetupContract, PluginStartContract } from './plugin';
-export { FindOptions, FindResult } from './alerts_client';
+export { FindResult } from './alerts_client';
 export { AlertInstance } from './alert_instance';
 export { parseDuration } from './lib';
 
diff --git a/x-pack/plugins/alerts/server/lib/validate_alert_type_params.test.ts b/x-pack/plugins/alerts/server/lib/validate_alert_type_params.test.ts
index d31b15030fd3a..1e6c26c02e65b 100644
--- a/x-pack/plugins/alerts/server/lib/validate_alert_type_params.test.ts
+++ b/x-pack/plugins/alerts/server/lib/validate_alert_type_params.test.ts
@@ -20,7 +20,7 @@ test('should return passed in params when validation not defined', () => {
       ],
       defaultActionGroupId: 'default',
       async executor() {},
-      producer: 'alerting',
+      producer: 'alerts',
     },
     {
       foo: true,
@@ -48,7 +48,7 @@ test('should validate and apply defaults when params is valid', () => {
         }),
       },
       async executor() {},
-      producer: 'alerting',
+      producer: 'alerts',
     },
     { param1: 'value' }
   );
@@ -77,7 +77,7 @@ test('should validate and throw error when params is invalid', () => {
           }),
         },
         async executor() {},
-        producer: 'alerting',
+        producer: 'alerts',
       },
       {}
     )
diff --git a/x-pack/plugins/alerts/server/plugin.test.ts b/x-pack/plugins/alerts/server/plugin.test.ts
index 008a9bb804c5b..e65d195290259 100644
--- a/x-pack/plugins/alerts/server/plugin.test.ts
+++ b/x-pack/plugins/alerts/server/plugin.test.ts
@@ -11,6 +11,8 @@ import { encryptedSavedObjectsMock } from '../../encrypted_saved_objects/server/
 import { taskManagerMock } from '../../task_manager/server/mocks';
 import { eventLogServiceMock } from '../../event_log/server/event_log_service.mock';
 import { KibanaRequest, CoreSetup } from 'kibana/server';
+import { featuresPluginMock } from '../../features/server/mocks';
+import { Feature } from '../../features/server';
 
 describe('Alerting Plugin', () => {
   describe('setup()', () => {
@@ -80,8 +82,10 @@ describe('Alerting Plugin', () => {
             actions: {
               execute: jest.fn(),
               getActionsClientWithRequest: jest.fn(),
+              getActionsAuthorizationWithRequest: jest.fn(),
             },
             encryptedSavedObjects: encryptedSavedObjectsMock.createStart(),
+            features: mockFeatures(),
           } as unknown) as AlertingPluginsStart
         );
 
@@ -124,9 +128,11 @@ describe('Alerting Plugin', () => {
             actions: {
               execute: jest.fn(),
               getActionsClientWithRequest: jest.fn(),
+              getActionsAuthorizationWithRequest: jest.fn(),
             },
             spaces: () => null,
             encryptedSavedObjects: encryptedSavedObjectsMock.createStart(),
+            features: mockFeatures(),
           } as unknown) as AlertingPluginsStart
         );
 
@@ -150,3 +156,31 @@ describe('Alerting Plugin', () => {
     });
   });
 });
+
+function mockFeatures() {
+  const features = featuresPluginMock.createSetup();
+  features.getFeatures.mockReturnValue([
+    new Feature({
+      id: 'appName',
+      name: 'appName',
+      app: [],
+      privileges: {
+        all: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+        read: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+      },
+    }),
+  ]);
+  return features;
+}
diff --git a/x-pack/plugins/alerts/server/plugin.ts b/x-pack/plugins/alerts/server/plugin.ts
index 07ed021d8ca84..cf6e1c9aebba6 100644
--- a/x-pack/plugins/alerts/server/plugin.ts
+++ b/x-pack/plugins/alerts/server/plugin.ts
@@ -58,6 +58,7 @@ import { Services } from './types';
 import { registerAlertsUsageCollector } from './usage';
 import { initializeAlertingTelemetry, scheduleAlertingTelemetry } from './usage/task';
 import { IEventLogger, IEventLogService } from '../../event_log/server';
+import { PluginStartContract as FeaturesPluginStart } from '../../features/server';
 import { setupSavedObjects } from './saved_objects';
 
 const EVENT_LOG_PROVIDER = 'alerting';
@@ -90,6 +91,7 @@ export interface AlertingPluginsStart {
   actions: ActionsPluginStartContract;
   taskManager: TaskManagerStartContract;
   encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
+  features: FeaturesPluginStart;
 }
 
 export class AlertingPlugin {
@@ -216,12 +218,26 @@ export class AlertingPlugin {
       getSpaceId(request: KibanaRequest) {
         return spaces?.getSpaceId(request);
       },
+      async getSpace(request: KibanaRequest) {
+        return spaces?.getActiveSpace(request);
+      },
       actions: plugins.actions,
+      features: plugins.features,
     });
 
+    const getAlertsClientWithRequest = (request: KibanaRequest) => {
+      if (isESOUsingEphemeralEncryptionKey === true) {
+        throw new Error(
+          `Unable to create alerts client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml`
+        );
+      }
+      return alertsClientFactory!.create(request, core.savedObjects);
+    };
+
     taskRunnerFactory.initialize({
       logger,
       getServices: this.getServicesFactory(core.savedObjects, core.elasticsearch),
+      getAlertsClientWithRequest,
       spaceIdToNamespace: this.spaceIdToNamespace,
       actionsPlugin: plugins.actions,
       encryptedSavedObjectsClient,
@@ -233,18 +249,7 @@ export class AlertingPlugin {
 
     return {
       listTypes: alertTypeRegistry!.list.bind(this.alertTypeRegistry!),
-      // Ability to get an alerts client from legacy code
-      getAlertsClientWithRequest: (request: KibanaRequest) => {
-        if (isESOUsingEphemeralEncryptionKey === true) {
-          throw new Error(
-            `Unable to create alerts client due to the Encrypted Saved Objects plugin using an ephemeral encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in kibana.yml`
-          );
-        }
-        return alertsClientFactory!.create(
-          request,
-          this.getScopedClientWithAlertSavedObjectType(core.savedObjects, request)
-        );
-      },
+      getAlertsClientWithRequest,
     };
   }
 
@@ -252,14 +257,11 @@ export class AlertingPlugin {
     core: CoreSetup
   ): IContextProvider<RequestHandler<unknown, unknown, unknown>, 'alerting'> => {
     const { alertTypeRegistry, alertsClientFactory } = this;
-    return async (context, request) => {
+    return async function alertsRouteHandlerContext(context, request) {
       const [{ savedObjects }] = await core.getStartServices();
       return {
         getAlertsClient: () => {
-          return alertsClientFactory!.create(
-            request,
-            this.getScopedClientWithAlertSavedObjectType(savedObjects, request)
-          );
+          return alertsClientFactory!.create(request, savedObjects);
         },
         listTypes: alertTypeRegistry!.list.bind(alertTypeRegistry!),
       };
diff --git a/x-pack/plugins/alerts/server/routes/create.test.ts b/x-pack/plugins/alerts/server/routes/create.test.ts
index 9e941903eeaed..274acaf01c475 100644
--- a/x-pack/plugins/alerts/server/routes/create.test.ts
+++ b/x-pack/plugins/alerts/server/routes/create.test.ts
@@ -75,13 +75,6 @@ describe('createAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.create.mockResolvedValueOnce(createResult);
 
diff --git a/x-pack/plugins/alerts/server/routes/create.ts b/x-pack/plugins/alerts/server/routes/create.ts
index 6238fca024e55..91a81f6d84b71 100644
--- a/x-pack/plugins/alerts/server/routes/create.ts
+++ b/x-pack/plugins/alerts/server/routes/create.ts
@@ -47,9 +47,6 @@ export const createAlertRoute = (router: IRouter, licenseState: LicenseState) =>
       validate: {
         body: bodySchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     handleDisabledApiKeysError(
       router.handleLegacyErrors(async function (
diff --git a/x-pack/plugins/alerts/server/routes/delete.test.ts b/x-pack/plugins/alerts/server/routes/delete.test.ts
index 9ba4e20312e17..d9c5aa2d59c87 100644
--- a/x-pack/plugins/alerts/server/routes/delete.test.ts
+++ b/x-pack/plugins/alerts/server/routes/delete.test.ts
@@ -30,13 +30,6 @@ describe('deleteAlertRoute', () => {
     const [config, handler] = router.delete.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.delete.mockResolvedValueOnce({});
 
diff --git a/x-pack/plugins/alerts/server/routes/delete.ts b/x-pack/plugins/alerts/server/routes/delete.ts
index 2034bd21fbed6..b073c59149171 100644
--- a/x-pack/plugins/alerts/server/routes/delete.ts
+++ b/x-pack/plugins/alerts/server/routes/delete.ts
@@ -27,9 +27,6 @@ export const deleteAlertRoute = (router: IRouter, licenseState: LicenseState) =>
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/disable.test.ts b/x-pack/plugins/alerts/server/routes/disable.test.ts
index a82d09854a604..74f7b2eb8a570 100644
--- a/x-pack/plugins/alerts/server/routes/disable.test.ts
+++ b/x-pack/plugins/alerts/server/routes/disable.test.ts
@@ -30,13 +30,6 @@ describe('disableAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_disable"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.disable.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/disable.ts b/x-pack/plugins/alerts/server/routes/disable.ts
index dfc5dfbdd5aa2..234f8ed959a5d 100644
--- a/x-pack/plugins/alerts/server/routes/disable.ts
+++ b/x-pack/plugins/alerts/server/routes/disable.ts
@@ -27,9 +27,6 @@ export const disableAlertRoute = (router: IRouter, licenseState: LicenseState) =
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/enable.test.ts b/x-pack/plugins/alerts/server/routes/enable.test.ts
index 4ee3a12a59dc7..c9575ef87f767 100644
--- a/x-pack/plugins/alerts/server/routes/enable.test.ts
+++ b/x-pack/plugins/alerts/server/routes/enable.test.ts
@@ -29,13 +29,6 @@ describe('enableAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_enable"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.enable.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/enable.ts b/x-pack/plugins/alerts/server/routes/enable.ts
index b6f86b97d6a3a..c162b4a9844b3 100644
--- a/x-pack/plugins/alerts/server/routes/enable.ts
+++ b/x-pack/plugins/alerts/server/routes/enable.ts
@@ -28,9 +28,6 @@ export const enableAlertRoute = (router: IRouter, licenseState: LicenseState) =>
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     handleDisabledApiKeysError(
       router.handleLegacyErrors(async function (
diff --git a/x-pack/plugins/alerts/server/routes/find.test.ts b/x-pack/plugins/alerts/server/routes/find.test.ts
index f20ee0a54dcd9..46702f96a2e10 100644
--- a/x-pack/plugins/alerts/server/routes/find.test.ts
+++ b/x-pack/plugins/alerts/server/routes/find.test.ts
@@ -31,13 +31,6 @@ describe('findAlertRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_find"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     const findResult = {
       page: 1,
diff --git a/x-pack/plugins/alerts/server/routes/find.ts b/x-pack/plugins/alerts/server/routes/find.ts
index 80c9c20eec7da..ef3b16dc9e517 100644
--- a/x-pack/plugins/alerts/server/routes/find.ts
+++ b/x-pack/plugins/alerts/server/routes/find.ts
@@ -16,7 +16,7 @@ import { LicenseState } from '../lib/license_state';
 import { verifyApiAccess } from '../lib/license_api_access';
 import { BASE_ALERT_API_PATH } from '../../common';
 import { renameKeys } from './lib/rename_keys';
-import { FindOptions } from '..';
+import { FindOptions } from '../alerts_client';
 
 // config definition
 const querySchema = schema.object({
@@ -50,9 +50,6 @@ export const findAlertRoute = (router: IRouter, licenseState: LicenseState) => {
       validate: {
         query: querySchema,
       },
-      options: {
-        tags: ['access:alerting-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/get.test.ts b/x-pack/plugins/alerts/server/routes/get.test.ts
index b11224ff4794e..8c4b06adf70f7 100644
--- a/x-pack/plugins/alerts/server/routes/get.test.ts
+++ b/x-pack/plugins/alerts/server/routes/get.test.ts
@@ -61,13 +61,6 @@ describe('getAlertRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     alertsClient.get.mockResolvedValueOnce(mockedAlert);
 
diff --git a/x-pack/plugins/alerts/server/routes/get.ts b/x-pack/plugins/alerts/server/routes/get.ts
index ae9ebe1299371..0f3fc4b2f3e41 100644
--- a/x-pack/plugins/alerts/server/routes/get.ts
+++ b/x-pack/plugins/alerts/server/routes/get.ts
@@ -27,9 +27,6 @@ export const getAlertRoute = (router: IRouter, licenseState: LicenseState) => {
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/get_alert_state.test.ts b/x-pack/plugins/alerts/server/routes/get_alert_state.test.ts
index 8c9051093f85b..d5bf9737d39ab 100644
--- a/x-pack/plugins/alerts/server/routes/get_alert_state.test.ts
+++ b/x-pack/plugins/alerts/server/routes/get_alert_state.test.ts
@@ -48,13 +48,6 @@ describe('getAlertStateRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/state"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     alertsClient.getAlertState.mockResolvedValueOnce(mockedAlertState);
 
@@ -91,13 +84,6 @@ describe('getAlertStateRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/state"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     alertsClient.getAlertState.mockResolvedValueOnce(undefined);
 
@@ -134,13 +120,6 @@ describe('getAlertStateRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/state"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     alertsClient.getAlertState = jest
       .fn()
diff --git a/x-pack/plugins/alerts/server/routes/get_alert_state.ts b/x-pack/plugins/alerts/server/routes/get_alert_state.ts
index b27ae3758e1b9..089fc80fca355 100644
--- a/x-pack/plugins/alerts/server/routes/get_alert_state.ts
+++ b/x-pack/plugins/alerts/server/routes/get_alert_state.ts
@@ -27,9 +27,6 @@ export const getAlertStateRoute = (router: IRouter, licenseState: LicenseState)
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/list_alert_types.test.ts b/x-pack/plugins/alerts/server/routes/list_alert_types.test.ts
index 3192154f6664c..af20dd6e202ba 100644
--- a/x-pack/plugins/alerts/server/routes/list_alert_types.test.ts
+++ b/x-pack/plugins/alerts/server/routes/list_alert_types.test.ts
@@ -9,6 +9,9 @@ import { httpServiceMock } from 'src/core/server/mocks';
 import { mockLicenseState } from '../lib/license_state.mock';
 import { verifyApiAccess } from '../lib/license_api_access';
 import { mockHandlerArguments } from './_mock_handler_arguments';
+import { alertsClientMock } from '../alerts_client.mock';
+
+const alertsClient = alertsClientMock.create();
 
 jest.mock('../lib/license_api_access.ts', () => ({
   verifyApiAccess: jest.fn(),
@@ -28,13 +31,6 @@ describe('listAlertTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/list_alert_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
@@ -47,12 +43,17 @@ describe('listAlertTypesRoute', () => {
           },
         ],
         defaultActionGroupId: 'default',
-        actionVariables: [],
+        authorizedConsumers: {},
+        actionVariables: {
+          context: [],
+          state: [],
+        },
         producer: 'test',
       },
     ];
+    alertsClient.listAlertTypes.mockResolvedValueOnce(new Set(listTypes));
 
-    const [context, req, res] = mockHandlerArguments({ listTypes }, {}, ['ok']);
+    const [context, req, res] = mockHandlerArguments({ alertsClient }, {}, ['ok']);
 
     expect(await handler(context, req, res)).toMatchInlineSnapshot(`
       Object {
@@ -64,7 +65,11 @@ describe('listAlertTypesRoute', () => {
                 "name": "Default",
               },
             ],
-            "actionVariables": Array [],
+            "actionVariables": Object {
+              "context": Array [],
+              "state": Array [],
+            },
+            "authorizedConsumers": Object {},
             "defaultActionGroupId": "default",
             "id": "1",
             "name": "name",
@@ -74,7 +79,7 @@ describe('listAlertTypesRoute', () => {
       }
     `);
 
-    expect(context.alerting!.listTypes).toHaveBeenCalledTimes(1);
+    expect(alertsClient.listAlertTypes).toHaveBeenCalledTimes(1);
 
     expect(res.ok).toHaveBeenCalledWith({
       body: listTypes,
@@ -90,19 +95,11 @@ describe('listAlertTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/list_alert_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
         id: '1',
         name: 'name',
-        enabled: true,
         actionGroups: [
           {
             id: 'default',
@@ -110,13 +107,19 @@ describe('listAlertTypesRoute', () => {
           },
         ],
         defaultActionGroupId: 'default',
-        actionVariables: [],
-        producer: 'alerting',
+        authorizedConsumers: {},
+        actionVariables: {
+          context: [],
+          state: [],
+        },
+        producer: 'alerts',
       },
     ];
 
+    alertsClient.listAlertTypes.mockResolvedValueOnce(new Set(listTypes));
+
     const [context, req, res] = mockHandlerArguments(
-      { listTypes },
+      { alertsClient },
       {
         params: { id: '1' },
       },
@@ -141,13 +144,6 @@ describe('listAlertTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/list_alert_types"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-read",
-        ],
-      }
-    `);
 
     const listTypes = [
       {
@@ -160,13 +156,19 @@ describe('listAlertTypesRoute', () => {
           },
         ],
         defaultActionGroupId: 'default',
-        actionVariables: [],
-        producer: 'alerting',
+        authorizedConsumers: {},
+        actionVariables: {
+          context: [],
+          state: [],
+        },
+        producer: 'alerts',
       },
     ];
 
+    alertsClient.listAlertTypes.mockResolvedValueOnce(new Set(listTypes));
+
     const [context, req, res] = mockHandlerArguments(
-      { listTypes },
+      { alertsClient },
       {
         params: { id: '1' },
       },
diff --git a/x-pack/plugins/alerts/server/routes/list_alert_types.ts b/x-pack/plugins/alerts/server/routes/list_alert_types.ts
index 51a4558108e29..bf516120fbe93 100644
--- a/x-pack/plugins/alerts/server/routes/list_alert_types.ts
+++ b/x-pack/plugins/alerts/server/routes/list_alert_types.ts
@@ -20,9 +20,6 @@ export const listAlertTypesRoute = (router: IRouter, licenseState: LicenseState)
     {
       path: `${BASE_ALERT_API_PATH}/list_alert_types`,
       validate: {},
-      options: {
-        tags: ['access:alerting-read'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
@@ -34,7 +31,7 @@ export const listAlertTypesRoute = (router: IRouter, licenseState: LicenseState)
         return res.badRequest({ body: 'RouteHandlerContext is not registered for alerting' });
       }
       return res.ok({
-        body: context.alerting.listTypes(),
+        body: Array.from(await context.alerting.getAlertsClient().listAlertTypes()),
       });
     })
   );
diff --git a/x-pack/plugins/alerts/server/routes/mute_all.test.ts b/x-pack/plugins/alerts/server/routes/mute_all.test.ts
index bcdb8cbd022ac..efa3cdebad8ff 100644
--- a/x-pack/plugins/alerts/server/routes/mute_all.test.ts
+++ b/x-pack/plugins/alerts/server/routes/mute_all.test.ts
@@ -29,13 +29,6 @@ describe('muteAllAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_mute_all"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.muteAll.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/mute_all.ts b/x-pack/plugins/alerts/server/routes/mute_all.ts
index 5b05d7231c385..6735121d4edb0 100644
--- a/x-pack/plugins/alerts/server/routes/mute_all.ts
+++ b/x-pack/plugins/alerts/server/routes/mute_all.ts
@@ -27,9 +27,6 @@ export const muteAllAlertRoute = (router: IRouter, licenseState: LicenseState) =
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/mute_instance.test.ts b/x-pack/plugins/alerts/server/routes/mute_instance.test.ts
index c382c12de21cd..6e700e4e3fd46 100644
--- a/x-pack/plugins/alerts/server/routes/mute_instance.test.ts
+++ b/x-pack/plugins/alerts/server/routes/mute_instance.test.ts
@@ -31,13 +31,6 @@ describe('muteAlertInstanceRoute', () => {
     expect(config.path).toMatchInlineSnapshot(
       `"/api/alerts/alert/{alert_id}/alert_instance/{alert_instance_id}/_mute"`
     );
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.muteInstance.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/mute_instance.ts b/x-pack/plugins/alerts/server/routes/mute_instance.ts
index 00550f4af3418..5e2ffc7d519ed 100644
--- a/x-pack/plugins/alerts/server/routes/mute_instance.ts
+++ b/x-pack/plugins/alerts/server/routes/mute_instance.ts
@@ -30,9 +30,6 @@ export const muteAlertInstanceRoute = (router: IRouter, licenseState: LicenseSta
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/unmute_all.test.ts b/x-pack/plugins/alerts/server/routes/unmute_all.test.ts
index e13af38fe4cb1..81fdc5bb4dd76 100644
--- a/x-pack/plugins/alerts/server/routes/unmute_all.test.ts
+++ b/x-pack/plugins/alerts/server/routes/unmute_all.test.ts
@@ -28,13 +28,6 @@ describe('unmuteAllAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_unmute_all"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.unmuteAll.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/unmute_all.ts b/x-pack/plugins/alerts/server/routes/unmute_all.ts
index 1efc9ed40054e..a987380541696 100644
--- a/x-pack/plugins/alerts/server/routes/unmute_all.ts
+++ b/x-pack/plugins/alerts/server/routes/unmute_all.ts
@@ -27,9 +27,6 @@ export const unmuteAllAlertRoute = (router: IRouter, licenseState: LicenseState)
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/unmute_instance.test.ts b/x-pack/plugins/alerts/server/routes/unmute_instance.test.ts
index b2e2f24e91de9..04e97dbe5e538 100644
--- a/x-pack/plugins/alerts/server/routes/unmute_instance.test.ts
+++ b/x-pack/plugins/alerts/server/routes/unmute_instance.test.ts
@@ -31,13 +31,6 @@ describe('unmuteAlertInstanceRoute', () => {
     expect(config.path).toMatchInlineSnapshot(
       `"/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute"`
     );
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.unmuteInstance.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/unmute_instance.ts b/x-pack/plugins/alerts/server/routes/unmute_instance.ts
index 967f9f890c9fb..15b882e585804 100644
--- a/x-pack/plugins/alerts/server/routes/unmute_instance.ts
+++ b/x-pack/plugins/alerts/server/routes/unmute_instance.ts
@@ -28,9 +28,6 @@ export const unmuteAlertInstanceRoute = (router: IRouter, licenseState: LicenseS
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     router.handleLegacyErrors(async function (
       context: RequestHandlerContext,
diff --git a/x-pack/plugins/alerts/server/routes/update.test.ts b/x-pack/plugins/alerts/server/routes/update.test.ts
index c7d23f2670b45..dedb08a9972c2 100644
--- a/x-pack/plugins/alerts/server/routes/update.test.ts
+++ b/x-pack/plugins/alerts/server/routes/update.test.ts
@@ -52,13 +52,6 @@ describe('updateAlertRoute', () => {
     const [config, handler] = router.put.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.update.mockResolvedValueOnce(mockedResponse);
 
diff --git a/x-pack/plugins/alerts/server/routes/update.ts b/x-pack/plugins/alerts/server/routes/update.ts
index 99b81dfc5b56e..9b2fe9a43810b 100644
--- a/x-pack/plugins/alerts/server/routes/update.ts
+++ b/x-pack/plugins/alerts/server/routes/update.ts
@@ -49,9 +49,6 @@ export const updateAlertRoute = (router: IRouter, licenseState: LicenseState) =>
         body: bodySchema,
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     handleDisabledApiKeysError(
       router.handleLegacyErrors(async function (
diff --git a/x-pack/plugins/alerts/server/routes/update_api_key.test.ts b/x-pack/plugins/alerts/server/routes/update_api_key.test.ts
index babae59553b5b..5aa91d215be90 100644
--- a/x-pack/plugins/alerts/server/routes/update_api_key.test.ts
+++ b/x-pack/plugins/alerts/server/routes/update_api_key.test.ts
@@ -29,13 +29,6 @@ describe('updateApiKeyRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_update_api_key"`);
-    expect(config.options).toMatchInlineSnapshot(`
-      Object {
-        "tags": Array [
-          "access:alerting-all",
-        ],
-      }
-    `);
 
     alertsClient.updateApiKey.mockResolvedValueOnce();
 
diff --git a/x-pack/plugins/alerts/server/routes/update_api_key.ts b/x-pack/plugins/alerts/server/routes/update_api_key.ts
index 4736351a25cbd..d44649b05b929 100644
--- a/x-pack/plugins/alerts/server/routes/update_api_key.ts
+++ b/x-pack/plugins/alerts/server/routes/update_api_key.ts
@@ -28,9 +28,6 @@ export const updateApiKeyRoute = (router: IRouter, licenseState: LicenseState) =
       validate: {
         params: paramSchema,
       },
-      options: {
-        tags: ['access:alerting-all'],
-      },
     },
     handleDisabledApiKeysError(
       router.handleLegacyErrors(async function (
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
index 38cda5a9a0f7c..19f4e918b7862 100644
--- a/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.test.ts
@@ -47,6 +47,40 @@ describe('7.9.0', () => {
   });
 });
 
+describe('7.10.0', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    encryptedSavedObjectsSetup.createMigration.mockImplementation(
+      (shouldMigrateWhenPredicate, migration) => migration
+    );
+  });
+
+  test('changes nothing on alerts by other plugins', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({});
+    expect(migration710(alert, { log })).toMatchObject(alert);
+
+    expect(encryptedSavedObjectsSetup.createMigration).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.any(Function)
+    );
+  });
+
+  test('migrates the consumer for metrics', () => {
+    const migration710 = getMigrations(encryptedSavedObjectsSetup)['7.10.0'];
+    const alert = getMockData({
+      consumer: 'metrics',
+    });
+    expect(migration710(alert, { log })).toMatchObject({
+      ...alert,
+      attributes: {
+        ...alert.attributes,
+        consumer: 'infrastructure',
+      },
+    });
+  });
+});
+
 function getMockData(
   overwrites: Record<string, unknown> = {}
 ): SavedObjectUnsanitizedDoc<RawAlert> {
diff --git a/x-pack/plugins/alerts/server/saved_objects/migrations.ts b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
index 142102dd711c7..57a4005887093 100644
--- a/x-pack/plugins/alerts/server/saved_objects/migrations.ts
+++ b/x-pack/plugins/alerts/server/saved_objects/migrations.ts
@@ -15,23 +15,27 @@ export function getMigrations(
   encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
 ): SavedObjectMigrationMap {
   return {
-    '7.9.0': changeAlertingConsumer(encryptedSavedObjects),
+    /**
+     * In v7.9.0 we changed the Alerting plugin so it uses the `consumer` value of `alerts`
+     * prior to that we were using `alerting` and we need to keep these in sync
+     */
+    '7.9.0': changeAlertingConsumer(encryptedSavedObjects, 'alerting', 'alerts'),
+    /**
+     * In v7.10.0 we changed the Matrics plugin so it uses the `consumer` value of `infrastructure`
+     * prior to that we were using `metrics` and we need to keep these in sync
+     */
+    '7.10.0': changeAlertingConsumer(encryptedSavedObjects, 'metrics', 'infrastructure'),
   };
 }
 
-/**
- * In v7.9.0 we changed the Alerting plugin so it uses the `consumer` value of `alerts`
- * prior to that we were using `alerting` and we need to keep these in sync
- */
 function changeAlertingConsumer(
-  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup,
+  from: string,
+  to: string
 ): SavedObjectMigrationFn<RawAlert, RawAlert> {
-  const consumerMigration = new Map<string, string>();
-  consumerMigration.set('alerting', 'alerts');
-
   return encryptedSavedObjects.createMigration<RawAlert, RawAlert>(
     function shouldBeMigrated(doc): doc is SavedObjectUnsanitizedDoc<RawAlert> {
-      return consumerMigration.has(doc.attributes.consumer);
+      return doc.attributes.consumer === from;
     },
     (doc: SavedObjectUnsanitizedDoc<RawAlert>): SavedObjectUnsanitizedDoc<RawAlert> => {
       const {
@@ -41,7 +45,7 @@ function changeAlertingConsumer(
         ...doc,
         attributes: {
           ...doc.attributes,
-          consumer: consumerMigration.get(consumer) ?? consumer,
+          consumer: consumer === from ? to : consumer,
         },
       };
     }
diff --git a/x-pack/plugins/alerts/server/task_runner/create_execution_handler.test.ts b/x-pack/plugins/alerts/server/task_runner/create_execution_handler.test.ts
index 3b1948c5e7ad7..3ea40fe4c3086 100644
--- a/x-pack/plugins/alerts/server/task_runner/create_execution_handler.test.ts
+++ b/x-pack/plugins/alerts/server/task_runner/create_execution_handler.test.ts
@@ -20,7 +20,7 @@ const alertType: AlertType = {
   ],
   defaultActionGroupId: 'default',
   executor: jest.fn(),
-  producer: 'alerting',
+  producer: 'alerts',
 };
 
 const actionsClient = actionsClientMock.create();
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
index 7a031c6671fd0..4abe58de5a904 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.test.ts
@@ -14,7 +14,7 @@ import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/serv
 import { loggingSystemMock } from '../../../../../src/core/server/mocks';
 import { PluginStartContract as ActionsPluginStart } from '../../../actions/server';
 import { actionsMock, actionsClientMock } from '../../../actions/server/mocks';
-import { alertsMock } from '../mocks';
+import { alertsMock, alertsClientMock } from '../mocks';
 import { eventLoggerMock } from '../../../event_log/server/event_logger.mock';
 import { IEventLogger } from '../../../event_log/server';
 import { SavedObjectsErrorHelpers } from '../../../../../src/core/server';
@@ -25,7 +25,7 @@ const alertType = {
   actionGroups: [{ id: 'default', name: 'Default' }],
   defaultActionGroupId: 'default',
   executor: jest.fn(),
-  producer: 'alerting',
+  producer: 'alerts',
 };
 let fakeTimer: sinon.SinonFakeTimers;
 
@@ -56,8 +56,8 @@ describe('Task Runner', () => {
 
   const encryptedSavedObjectsClient = encryptedSavedObjectsMock.createClient();
   const services = alertsMock.createAlertServices();
-  const savedObjectsClient = services.savedObjectsClient;
   const actionsClient = actionsClientMock.create();
+  const alertsClient = alertsClientMock.create();
 
   const taskRunnerFactoryInitializerParams: jest.Mocked<TaskRunnerContext> & {
     actionsPlugin: jest.Mocked<ActionsPluginStart>;
@@ -65,6 +65,7 @@ describe('Task Runner', () => {
   } = {
     getServices: jest.fn().mockReturnValue(services),
     actionsPlugin: actionsMock.createStart(),
+    getAlertsClientWithRequest: jest.fn().mockReturnValue(alertsClient),
     encryptedSavedObjectsClient,
     logger: loggingSystemMock.create().get(),
     spaceIdToNamespace: jest.fn().mockReturnValue(undefined),
@@ -74,34 +75,31 @@ describe('Task Runner', () => {
 
   const mockedAlertTypeSavedObject = {
     id: '1',
-    type: 'alert',
-    attributes: {
-      enabled: true,
-      alertTypeId: '123',
-      schedule: { interval: '10s' },
-      name: 'alert-name',
-      tags: ['alert-', '-tags'],
-      createdBy: 'alert-creator',
-      updatedBy: 'alert-updater',
-      mutedInstanceIds: [],
-      params: {
-        bar: true,
-      },
-      actions: [
-        {
-          group: 'default',
-          actionRef: 'action_0',
-          params: {
-            foo: true,
-          },
-        },
-      ],
+    consumer: 'bar',
+    createdAt: new Date('2019-02-12T21:01:22.479Z'),
+    updatedAt: new Date('2019-02-12T21:01:22.479Z'),
+    throttle: null,
+    muteAll: false,
+    enabled: true,
+    alertTypeId: '123',
+    apiKeyOwner: 'elastic',
+    schedule: { interval: '10s' },
+    name: 'alert-name',
+    tags: ['alert-', '-tags'],
+    createdBy: 'alert-creator',
+    updatedBy: 'alert-updater',
+    mutedInstanceIds: [],
+    params: {
+      bar: true,
     },
-    references: [
+    actions: [
       {
-        name: 'action_0',
-        type: 'action',
+        group: 'default',
         id: '1',
+        actionTypeId: 'action',
+        params: {
+          foo: true,
+        },
       },
     ],
   };
@@ -109,6 +107,7 @@ describe('Task Runner', () => {
   beforeEach(() => {
     jest.resetAllMocks();
     taskRunnerFactoryInitializerParams.getServices.mockReturnValue(services);
+    taskRunnerFactoryInitializerParams.getAlertsClientWithRequest.mockReturnValue(alertsClient);
     taskRunnerFactoryInitializerParams.actionsPlugin.getActionsClientWithRequest.mockResolvedValue(
       actionsClient
     );
@@ -126,7 +125,7 @@ describe('Task Runner', () => {
       },
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -200,7 +199,7 @@ describe('Task Runner', () => {
       mockedTaskInstance,
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -285,7 +284,7 @@ describe('Task Runner', () => {
         ],
       },
       message:
-        "alert: test:1: 'alert-name' instanceId: '1' scheduled actionGroup: 'default' action: undefined:1",
+        "alert: test:1: 'alert-name' instanceId: '1' scheduled actionGroup: 'default' action: action:1",
     });
   });
 
@@ -302,7 +301,7 @@ describe('Task Runner', () => {
       mockedTaskInstance,
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -412,7 +411,7 @@ describe('Task Runner', () => {
                 },
               ],
             },
-            "message": "alert: test:1: 'alert-name' instanceId: '1' scheduled actionGroup: 'default' action: undefined:1",
+            "message": "alert: test:1: 'alert-name' instanceId: '1' scheduled actionGroup: 'default' action: action:1",
           },
         ],
       ]
@@ -439,7 +438,7 @@ describe('Task Runner', () => {
       },
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -526,7 +525,7 @@ describe('Task Runner', () => {
       mockedTaskInstance,
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -548,44 +547,13 @@ describe('Task Runner', () => {
     );
   });
 
-  test('throws error if reference not found', async () => {
-    const taskRunner = new TaskRunner(
-      alertType,
-      mockedTaskInstance,
-      taskRunnerFactoryInitializerParams
-    );
-    savedObjectsClient.get.mockResolvedValueOnce({
-      ...mockedAlertTypeSavedObject,
-      references: [],
-    });
-    encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
-      id: '1',
-      type: 'alert',
-      attributes: {
-        apiKey: Buffer.from('123:abc').toString('base64'),
-      },
-      references: [],
-    });
-    expect(await taskRunner.run()).toMatchInlineSnapshot(`
-      Object {
-        "runAt": 1970-01-01T00:00:10.000Z,
-        "state": Object {
-          "previousStartedAt": 1970-01-01T00:00:00.000Z,
-        },
-      }
-    `);
-    expect(taskRunnerFactoryInitializerParams.logger.error).toHaveBeenCalledWith(
-      `Executing Alert \"1\" has resulted in Error: Action reference \"action_0\" not found in alert id: 1`
-    );
-  });
-
   test('uses API key when provided', async () => {
     const taskRunner = new TaskRunner(
       alertType,
       mockedTaskInstance,
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -621,7 +589,7 @@ describe('Task Runner', () => {
       mockedTaskInstance,
       taskRunnerFactoryInitializerParams
     );
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -660,7 +628,7 @@ describe('Task Runner', () => {
       taskRunnerFactoryInitializerParams
     );
 
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -722,7 +690,7 @@ describe('Task Runner', () => {
       taskRunnerFactoryInitializerParams
     );
 
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
 
     const runnerResult = await taskRunner.run();
 
@@ -747,7 +715,7 @@ describe('Task Runner', () => {
       taskRunnerFactoryInitializerParams
     );
 
-    savedObjectsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
+    alertsClient.get.mockResolvedValueOnce(mockedAlertTypeSavedObject);
     encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValueOnce({
       id: '1',
       type: 'alert',
@@ -770,7 +738,7 @@ describe('Task Runner', () => {
   });
 
   test('recovers gracefully when the Alert Task Runner throws an exception when fetching attributes', async () => {
-    savedObjectsClient.get.mockImplementation(() => {
+    alertsClient.get.mockImplementation(() => {
       throw new Error('OMG');
     });
 
@@ -802,7 +770,7 @@ describe('Task Runner', () => {
   });
 
   test('avoids rescheduling a failed Alert Task Runner when it throws due to failing to fetch the alert', async () => {
-    savedObjectsClient.get.mockImplementation(() => {
+    alertsClient.get.mockImplementation(() => {
       throw SavedObjectsErrorHelpers.createGenericNotFoundError('task', '1');
     });
 
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner.ts b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
index 3c66b57bb9416..e4d04a005c986 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner.ts
@@ -5,7 +5,7 @@
  */
 
 import { pickBy, mapValues, omit, without } from 'lodash';
-import { Logger, SavedObject, KibanaRequest } from '../../../../../src/core/server';
+import { Logger, KibanaRequest } from '../../../../../src/core/server';
 import { TaskRunnerContext } from './task_runner_factory';
 import { ConcreteTaskInstance } from '../../../task_manager/server';
 import { createExecutionHandler } from './create_execution_handler';
@@ -17,15 +17,18 @@ import {
   RawAlert,
   IntervalSchedule,
   Services,
-  AlertInfoParams,
-  AlertTaskState,
   RawAlertInstance,
+  AlertTaskState,
+  Alert,
+  AlertExecutorOptions,
+  SanitizedAlert,
 } from '../types';
 import { promiseResult, map, Resultable, asOk, asErr, resolveErr } from '../lib/result_type';
 import { taskInstanceToAlertTaskInstance } from './alert_task_instance';
 import { EVENT_LOG_ACTIONS } from '../plugin';
 import { IEvent, IEventLogger, SAVED_OBJECT_REL_PRIMARY } from '../../../event_log/server';
 import { isAlertSavedObjectNotFoundError } from '../lib/is_alert_not_found_error';
+import { AlertsClient } from '../alerts_client';
 
 const FALLBACK_RETRY_INTERVAL: IntervalSchedule = { interval: '5m' };
 
@@ -93,8 +96,12 @@ export class TaskRunner {
     } as unknown) as KibanaRequest;
   }
 
-  async getServicesWithSpaceLevelPermissions(spaceId: string, apiKey: string | null) {
-    return this.context.getServices(this.getFakeKibanaRequest(spaceId, apiKey));
+  private getServicesWithSpaceLevelPermissions(
+    spaceId: string,
+    apiKey: string | null
+  ): [Services, PublicMethodsOf<AlertsClient>] {
+    const request = this.getFakeKibanaRequest(spaceId, apiKey);
+    return [this.context.getServices(request), this.context.getAlertsClientWithRequest(request)];
   }
 
   private getExecutionHandler(
@@ -103,21 +110,8 @@ export class TaskRunner {
     tags: string[] | undefined,
     spaceId: string,
     apiKey: string | null,
-    actions: RawAlert['actions'],
-    references: SavedObject['references']
+    actions: Alert['actions']
   ) {
-    // Inject ids into actions
-    const actionsWithIds = actions.map((action) => {
-      const actionReference = references.find((obj) => obj.name === action.actionRef);
-      if (!actionReference) {
-        throw new Error(`Action reference "${action.actionRef}" not found in alert id: ${alertId}`);
-      }
-      return {
-        ...action,
-        id: actionReference.id,
-      };
-    });
-
     return createExecutionHandler({
       alertId,
       alertName,
@@ -125,7 +119,7 @@ export class TaskRunner {
       logger: this.logger,
       actionsPlugin: this.context.actionsPlugin,
       apiKey,
-      actions: actionsWithIds,
+      actions,
       spaceId,
       alertType: this.alertType,
       eventLogger: this.context.eventLogger,
@@ -146,20 +140,12 @@ export class TaskRunner {
 
   async executeAlertInstances(
     services: Services,
-    alertInfoParams: AlertInfoParams,
+    alert: SanitizedAlert,
+    params: AlertExecutorOptions['params'],
     executionHandler: ReturnType<typeof createExecutionHandler>,
     spaceId: string
   ): Promise<AlertTaskState> {
-    const {
-      params,
-      throttle,
-      muteAll,
-      mutedInstanceIds,
-      name,
-      tags,
-      createdBy,
-      updatedBy,
-    } = alertInfoParams;
+    const { throttle, muteAll, mutedInstanceIds, name, tags, createdBy, updatedBy } = alert;
     const {
       params: { alertId },
       state: { alertInstances: alertRawInstances = {}, alertTypeState = {}, previousStartedAt },
@@ -262,33 +248,22 @@ export class TaskRunner {
     };
   }
 
-  async validateAndExecuteAlert(
-    services: Services,
-    apiKey: string | null,
-    attributes: RawAlert,
-    references: SavedObject['references']
-  ) {
+  async validateAndExecuteAlert(services: Services, apiKey: string | null, alert: SanitizedAlert) {
     const {
       params: { alertId, spaceId },
     } = this.taskInstance;
 
     // Validate
-    const params = validateAlertTypeParams(this.alertType, attributes.params);
+    const validatedParams = validateAlertTypeParams(this.alertType, alert.params);
     const executionHandler = this.getExecutionHandler(
       alertId,
-      attributes.name,
-      attributes.tags,
+      alert.name,
+      alert.tags,
       spaceId,
       apiKey,
-      attributes.actions,
-      references
-    );
-    return this.executeAlertInstances(
-      services,
-      { ...attributes, params },
-      executionHandler,
-      spaceId
+      alert.actions
     );
+    return this.executeAlertInstances(services, alert, validatedParams, executionHandler, spaceId);
   }
 
   async loadAlertAttributesAndRun(): Promise<Resultable<AlertTaskRunResult, Error>> {
@@ -297,17 +272,17 @@ export class TaskRunner {
     } = this.taskInstance;
 
     const apiKey = await this.getApiKeyForAlertPermissions(alertId, spaceId);
-    const services = await this.getServicesWithSpaceLevelPermissions(spaceId, apiKey);
+    const [services, alertsClient] = await this.getServicesWithSpaceLevelPermissions(
+      spaceId,
+      apiKey
+    );
 
     // Ensure API key is still valid and user has access
-    const { attributes, references } = await services.savedObjectsClient.get<RawAlert>(
-      'alert',
-      alertId
-    );
+    const alert = await alertsClient.get({ id: alertId });
 
     return {
       state: await promiseResult<AlertTaskState, Error>(
-        this.validateAndExecuteAlert(services, apiKey, attributes, references)
+        this.validateAndExecuteAlert(services, apiKey, alert)
       ),
       runAt: asOk(
         getNextRunAt(
@@ -315,7 +290,7 @@ export class TaskRunner {
           // we do not currently have a good way of returning the type
           // from SavedObjectsClient, and as we currenrtly require a schedule
           // and we only support `interval`, we can cast this safely
-          attributes.schedule as IntervalSchedule
+          alert.schedule
         )
       ),
     };
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner_factory.test.ts b/x-pack/plugins/alerts/server/task_runner/task_runner_factory.test.ts
index 8f3e44b1cf42d..9af7d9ddc44eb 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner_factory.test.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner_factory.test.ts
@@ -10,7 +10,7 @@ import { TaskRunnerContext, TaskRunnerFactory } from './task_runner_factory';
 import { encryptedSavedObjectsMock } from '../../../encrypted_saved_objects/server/mocks';
 import { loggingSystemMock } from '../../../../../src/core/server/mocks';
 import { actionsMock } from '../../../actions/server/mocks';
-import { alertsMock } from '../mocks';
+import { alertsMock, alertsClientMock } from '../mocks';
 import { eventLoggerMock } from '../../../event_log/server/event_logger.mock';
 
 const alertType = {
@@ -19,7 +19,7 @@ const alertType = {
   actionGroups: [{ id: 'default', name: 'Default' }],
   defaultActionGroupId: 'default',
   executor: jest.fn(),
-  producer: 'alerting',
+  producer: 'alerts',
 };
 let fakeTimer: sinon.SinonFakeTimers;
 
@@ -52,9 +52,11 @@ describe('Task Runner Factory', () => {
 
   const encryptedSavedObjectsPlugin = encryptedSavedObjectsMock.createStart();
   const services = alertsMock.createAlertServices();
+  const alertsClient = alertsClientMock.create();
 
   const taskRunnerFactoryInitializerParams: jest.Mocked<TaskRunnerContext> = {
     getServices: jest.fn().mockReturnValue(services),
+    getAlertsClientWithRequest: jest.fn().mockReturnValue(alertsClient),
     actionsPlugin: actionsMock.createStart(),
     encryptedSavedObjectsClient: encryptedSavedObjectsPlugin.getClient(),
     logger: loggingSystemMock.create().get(),
diff --git a/x-pack/plugins/alerts/server/task_runner/task_runner_factory.ts b/x-pack/plugins/alerts/server/task_runner/task_runner_factory.ts
index ca762cf2b2105..6f83e34cdbe03 100644
--- a/x-pack/plugins/alerts/server/task_runner/task_runner_factory.ts
+++ b/x-pack/plugins/alerts/server/task_runner/task_runner_factory.ts
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { Logger } from '../../../../../src/core/server';
+import { Logger, KibanaRequest } from '../../../../../src/core/server';
 import { RunContext } from '../../../task_manager/server';
 import { EncryptedSavedObjectsClient } from '../../../encrypted_saved_objects/server';
 import { PluginStartContract as ActionsPluginStartContract } from '../../../actions/server';
@@ -15,10 +15,12 @@ import {
 } from '../types';
 import { TaskRunner } from './task_runner';
 import { IEventLogger } from '../../../event_log/server';
+import { AlertsClient } from '../alerts_client';
 
 export interface TaskRunnerContext {
   logger: Logger;
   getServices: GetServicesFunction;
+  getAlertsClientWithRequest(request: KibanaRequest): PublicMethodsOf<AlertsClient>;
   actionsPlugin: ActionsPluginStartContract;
   eventLogger: IEventLogger;
   encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
diff --git a/x-pack/plugins/apm/server/feature.ts b/x-pack/plugins/apm/server/feature.ts
index 80f722bae0868..38e75f75ad04b 100644
--- a/x-pack/plugins/apm/server/feature.ts
+++ b/x-pack/plugins/apm/server/feature.ts
@@ -5,6 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { AlertType } from '../common/alert_types';
 
 export const APM_FEATURE = {
   id: 'apm',
@@ -16,57 +17,34 @@ export const APM_FEATURE = {
   navLinkId: 'apm',
   app: ['apm', 'kibana'],
   catalogue: ['apm'],
+  alerting: Object.values(AlertType),
   // see x-pack/plugins/features/common/feature_kibana_privileges.ts
   privileges: {
     all: {
       app: ['apm', 'kibana'],
-      api: [
-        'apm',
-        'apm_write',
-        'actions-read',
-        'actions-all',
-        'alerting-read',
-        'alerting-all',
-      ],
+      api: ['apm', 'apm_write'],
       catalogue: ['apm'],
       savedObject: {
-        all: ['alert', 'action', 'action_task_params'],
+        all: [],
         read: [],
       },
-      ui: [
-        'show',
-        'save',
-        'alerting:show',
-        'actions:show',
-        'alerting:save',
-        'actions:save',
-        'alerting:delete',
-        'actions:delete',
-      ],
+      alerting: {
+        all: Object.values(AlertType),
+      },
+      ui: ['show', 'save', 'alerting:show', 'alerting:save'],
     },
     read: {
       app: ['apm', 'kibana'],
-      api: [
-        'apm',
-        'actions-read',
-        'actions-all',
-        'alerting-read',
-        'alerting-all',
-      ],
+      api: ['apm'],
       catalogue: ['apm'],
       savedObject: {
-        all: ['alert', 'action', 'action_task_params'],
+        all: [],
         read: [],
       },
-      ui: [
-        'show',
-        'alerting:show',
-        'actions:show',
-        'alerting:save',
-        'actions:save',
-        'alerting:delete',
-        'actions:delete',
-      ],
+      alerting: {
+        all: Object.values(AlertType),
+      },
+      ui: ['show', 'alerting:show', 'alerting:save'],
     },
   },
 };
diff --git a/x-pack/plugins/features/common/feature.ts b/x-pack/plugins/features/common/feature.ts
index 4a293e0c962cc..1b700fb1a6ad0 100644
--- a/x-pack/plugins/features/common/feature.ts
+++ b/x-pack/plugins/features/common/feature.ts
@@ -94,6 +94,13 @@ export interface FeatureConfig {
    */
   catalogue?: readonly string[];
 
+  /**
+   * If your feature grants access to specific Alert Types, you can specify them here to control visibility based on the current space.
+   * Include both Alert Types registered by the feature and external Alert Types such as built-in
+   * Alert Types and Alert Types provided by other features to which you wish to grant access.
+   */
+  alerting?: readonly string[];
+
   /**
    * Feature privilege definition.
    *
@@ -179,6 +186,10 @@ export class Feature {
     return this.config.privileges;
   }
 
+  public get alerting() {
+    return this.config.alerting;
+  }
+
   public get excludeFromBasePrivileges() {
     return this.config.excludeFromBasePrivileges ?? false;
   }
diff --git a/x-pack/plugins/features/common/feature_kibana_privileges.ts b/x-pack/plugins/features/common/feature_kibana_privileges.ts
index a9ba38e36f20b..c8faf75b348fd 100644
--- a/x-pack/plugins/features/common/feature_kibana_privileges.ts
+++ b/x-pack/plugins/features/common/feature_kibana_privileges.ts
@@ -75,6 +75,34 @@ export interface FeatureKibanaPrivileges {
    */
   app?: readonly string[];
 
+  /**
+   * If your feature requires access to specific Alert Types, then specify your access needs here.
+   * Include both Alert Types registered by the feature and external Alert Types such as built-in
+   * Alert Types and Alert Types provided by other features to which you wish to grant access.
+   */
+  alerting?: {
+    /**
+     * List of alert types which users should have full read/write access to when granted this privilege.
+     * @example
+     * ```ts
+     *  {
+     *    all: ['my-alert-type-within-my-feature']
+     *  }
+     * ```
+     */
+    all?: readonly string[];
+
+    /**
+     * List of alert types which users should have read-only access to when granted this privilege.
+     * @example
+     * ```ts
+     *  {
+     *    read: ['my-alert-type']
+     *  }
+     * ```
+     */
+    read?: readonly string[];
+  };
   /**
    * If your feature requires access to specific saved objects, then specify your access needs here.
    */
diff --git a/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap b/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap
index fe0a13fe702e5..2c98dc132f259 100644
--- a/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap
+++ b/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap
@@ -55,6 +55,10 @@ exports[`buildOSSFeatures returns the dashboard feature augmented with appropria
 Array [
   Object {
     "privilege": Object {
+      "alerting": Object {
+        "all": Array [],
+        "read": Array [],
+      },
       "api": Array [],
       "app": Array [
         "dashboards",
@@ -179,6 +183,10 @@ exports[`buildOSSFeatures returns the discover feature augmented with appropriat
 Array [
   Object {
     "privilege": Object {
+      "alerting": Object {
+        "all": Array [],
+        "read": Array [],
+      },
       "api": Array [],
       "app": Array [
         "discover",
@@ -403,6 +411,10 @@ exports[`buildOSSFeatures returns the visualize feature augmented with appropria
 Array [
   Object {
     "privilege": Object {
+      "alerting": Object {
+        "all": Array [],
+        "read": Array [],
+      },
       "api": Array [],
       "app": Array [
         "visualize",
diff --git a/x-pack/plugins/features/server/feature_registry.test.ts b/x-pack/plugins/features/server/feature_registry.test.ts
index 75022922917b3..f123068e41758 100644
--- a/x-pack/plugins/features/server/feature_registry.test.ts
+++ b/x-pack/plugins/features/server/feature_registry.test.ts
@@ -743,6 +743,168 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents privileges from specifying alerting entries that don't exist at the root level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      alerting: ['bar'],
+      privileges: {
+        all: {
+          alerting: {
+            all: ['foo', 'bar'],
+            read: ['baz'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+        read: {
+          alerting: { read: ['foo', 'bar', 'baz'] },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature privilege test-feature.all has unknown alerting entries: foo, baz"`
+    );
+  });
+
+  it(`prevents features from specifying alerting entries that don't exist at the privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      alerting: ['foo', 'bar', 'baz'],
+      privileges: {
+        all: {
+          alerting: { all: ['foo'] },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+        read: {
+          alerting: { all: ['foo'] },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'my sub feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'cool-sub-feature-privilege',
+                  name: 'cool privilege',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                  alerting: { all: ['bar'] },
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies alerting entries which are not granted to any privileges: baz"`
+    );
+  });
+
+  it(`prevents reserved privileges from specifying alerting entries that don't exist at the root level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      alerting: ['bar'],
+      privileges: null,
+      reserved: {
+        description: 'something',
+        privileges: [
+          {
+            id: 'reserved',
+            privilege: {
+              alerting: { all: ['foo', 'bar', 'baz'] },
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: [],
+              app: [],
+            },
+          },
+        ],
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature privilege test-feature.reserved has unknown alerting entries: foo, baz"`
+    );
+  });
+
+  it(`prevents features from specifying alerting entries that don't exist at the reserved privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      alerting: ['foo', 'bar', 'baz'],
+      privileges: null,
+      reserved: {
+        description: 'something',
+        privileges: [
+          {
+            id: 'reserved',
+            privilege: {
+              alerting: { all: ['foo', 'bar'] },
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: [],
+              app: [],
+            },
+          },
+        ],
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies alerting entries which are not granted to any privileges: baz"`
+    );
+  });
+
   it(`prevents privileges from specifying management sections that don't exist at the root level`, () => {
     const feature: FeatureConfig = {
       id: 'test-feature',
diff --git a/x-pack/plugins/features/server/feature_schema.ts b/x-pack/plugins/features/server/feature_schema.ts
index c45788b511cde..95298603d706a 100644
--- a/x-pack/plugins/features/server/feature_schema.ts
+++ b/x-pack/plugins/features/server/feature_schema.ts
@@ -26,6 +26,7 @@ const managementSchema = Joi.object().pattern(
   Joi.array().items(Joi.string().regex(uiCapabilitiesRegex))
 );
 const catalogueSchema = Joi.array().items(Joi.string().regex(uiCapabilitiesRegex));
+const alertingSchema = Joi.array().items(Joi.string());
 
 const privilegeSchema = Joi.object({
   excludeFromBasePrivileges: Joi.boolean(),
@@ -33,6 +34,10 @@ const privilegeSchema = Joi.object({
   catalogue: catalogueSchema,
   api: Joi.array().items(Joi.string()),
   app: Joi.array().items(Joi.string()),
+  alerting: Joi.object({
+    all: alertingSchema,
+    read: alertingSchema,
+  }),
   savedObject: Joi.object({
     all: Joi.array().items(Joi.string()).required(),
     read: Joi.array().items(Joi.string()).required(),
@@ -46,6 +51,10 @@ const subFeaturePrivilegeSchema = Joi.object({
   includeIn: Joi.string().allow('all', 'read', 'none').required(),
   management: managementSchema,
   catalogue: catalogueSchema,
+  alerting: Joi.object({
+    all: alertingSchema,
+    read: alertingSchema,
+  }),
   api: Joi.array().items(Joi.string()),
   app: Joi.array().items(Joi.string()),
   savedObject: Joi.object({
@@ -82,6 +91,7 @@ const schema = Joi.object({
   app: Joi.array().items(Joi.string()).required(),
   management: managementSchema,
   catalogue: catalogueSchema,
+  alerting: alertingSchema,
   privileges: Joi.object({
     all: privilegeSchema,
     read: privilegeSchema,
@@ -113,7 +123,7 @@ export function validateFeature(feature: FeatureConfig) {
     throw validateResult.error;
   }
   // the following validation can't be enforced by the Joi schema, since it'd require us looking "up" the object graph for the list of valid value, which they explicitly forbid.
-  const { app = [], management = {}, catalogue = [] } = feature;
+  const { app = [], management = {}, catalogue = [], alerting = [] } = feature;
 
   const unseenApps = new Set(app);
 
@@ -126,6 +136,8 @@ export function validateFeature(feature: FeatureConfig) {
 
   const unseenCatalogue = new Set(catalogue);
 
+  const unseenAlertTypes = new Set(alerting);
+
   function validateAppEntry(privilegeId: string, entry: readonly string[] = []) {
     entry.forEach((privilegeApp) => unseenApps.delete(privilegeApp));
 
@@ -152,6 +164,23 @@ export function validateFeature(feature: FeatureConfig) {
     }
   }
 
+  function validateAlertingEntry(privilegeId: string, entry: FeatureKibanaPrivileges['alerting']) {
+    const all = entry?.all ?? [];
+    const read = entry?.read ?? [];
+
+    all.forEach((privilegeAlertTypes) => unseenAlertTypes.delete(privilegeAlertTypes));
+    read.forEach((privilegeAlertTypes) => unseenAlertTypes.delete(privilegeAlertTypes));
+
+    const unknownAlertingEntries = difference([...all, ...read], alerting);
+    if (unknownAlertingEntries.length > 0) {
+      throw new Error(
+        `Feature privilege ${
+          feature.id
+        }.${privilegeId} has unknown alerting entries: ${unknownAlertingEntries.join(', ')}`
+      );
+    }
+  }
+
   function validateManagementEntry(
     privilegeId: string,
     managementEntry: Record<string, readonly string[]> = {}
@@ -212,6 +241,7 @@ export function validateFeature(feature: FeatureConfig) {
     validateCatalogueEntry(privilegeId, privilegeDefinition.catalogue);
 
     validateManagementEntry(privilegeId, privilegeDefinition.management);
+    validateAlertingEntry(privilegeId, privilegeDefinition.alerting);
   });
 
   const subFeatureEntries = feature.subFeatures ?? [];
@@ -221,6 +251,7 @@ export function validateFeature(feature: FeatureConfig) {
         validateAppEntry(subFeaturePrivilege.id, subFeaturePrivilege.app);
         validateCatalogueEntry(subFeaturePrivilege.id, subFeaturePrivilege.catalogue);
         validateManagementEntry(subFeaturePrivilege.id, subFeaturePrivilege.management);
+        validateAlertingEntry(subFeaturePrivilege.id, subFeaturePrivilege.alerting);
       });
     });
   });
@@ -261,4 +292,14 @@ export function validateFeature(feature: FeatureConfig) {
       )}`
     );
   }
+
+  if (unseenAlertTypes.size > 0) {
+    throw new Error(
+      `Feature ${
+        feature.id
+      } specifies alerting entries which are not granted to any privileges: ${Array.from(
+        unseenAlertTypes.values()
+      ).join(',')}`
+    );
+  }
 }
diff --git a/x-pack/plugins/infra/public/alerting/inventory/components/alert_flyout.tsx b/x-pack/plugins/infra/public/alerting/inventory/components/alert_flyout.tsx
index 7e85a2bdf7e9b..804ff9602c81c 100644
--- a/x-pack/plugins/infra/public/alerting/inventory/components/alert_flyout.tsx
+++ b/x-pack/plugins/infra/public/alerting/inventory/components/alert_flyout.tsx
@@ -44,7 +44,7 @@ export const AlertFlyout = (props: Props) => {
             setAddFlyoutVisibility={props.setVisible}
             alertTypeId={METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID}
             canChangeTrigger={false}
-            consumer={'metrics'}
+            consumer={'infrastructure'}
           />
         </AlertsContextProvider>
       )}
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_flyout.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_flyout.tsx
index b0c8cdb9d4195..b19a399b0e50d 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_flyout.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/alert_flyout.tsx
@@ -46,7 +46,7 @@ export const AlertFlyout = (props: Props) => {
             setAddFlyoutVisibility={props.setVisible}
             alertTypeId={METRIC_THRESHOLD_ALERT_TYPE_ID}
             canChangeTrigger={false}
-            consumer={'metrics'}
+            consumer={'infrastructure'}
           />
         </AlertsContextProvider>
       )}
diff --git a/x-pack/plugins/infra/server/features.ts b/x-pack/plugins/infra/server/features.ts
index fa228e03194a9..0de431186b151 100644
--- a/x-pack/plugins/infra/server/features.ts
+++ b/x-pack/plugins/infra/server/features.ts
@@ -5,6 +5,9 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { LOG_DOCUMENT_COUNT_ALERT_TYPE_ID } from '../common/alerting/logs/types';
+import { METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID } from './lib/alerting/inventory_metric_threshold/types';
+import { METRIC_THRESHOLD_ALERT_TYPE_ID } from './lib/alerting/metric_threshold/types';
 
 export const METRICS_FEATURE = {
   id: 'infrastructure',
@@ -16,44 +19,33 @@ export const METRICS_FEATURE = {
   navLinkId: 'metrics',
   app: ['infra', 'kibana'],
   catalogue: ['infraops'],
+  alerting: [METRIC_THRESHOLD_ALERT_TYPE_ID, METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID],
   privileges: {
     all: {
       app: ['infra', 'kibana'],
       catalogue: ['infraops'],
-      api: ['infra', 'actions-read', 'actions-all', 'alerting-read', 'alerting-all'],
+      api: ['infra'],
       savedObject: {
-        all: ['infrastructure-ui-source', 'alert', 'action', 'action_task_params'],
+        all: ['infrastructure-ui-source'],
         read: ['index-pattern'],
       },
-      ui: [
-        'show',
-        'configureSource',
-        'save',
-        'alerting:show',
-        'actions:show',
-        'alerting:save',
-        'actions:save',
-        'alerting:delete',
-        'actions:delete',
-      ],
+      alerting: {
+        all: [METRIC_THRESHOLD_ALERT_TYPE_ID, METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID],
+      },
+      ui: ['show', 'configureSource', 'save', 'alerting:show'],
     },
     read: {
       app: ['infra', 'kibana'],
       catalogue: ['infraops'],
-      api: ['infra', 'actions-read', 'actions-all', 'alerting-read', 'alerting-all'],
+      api: ['infra'],
       savedObject: {
-        all: ['alert', 'action', 'action_task_params'],
+        all: [],
         read: ['infrastructure-ui-source', 'index-pattern'],
       },
-      ui: [
-        'show',
-        'alerting:show',
-        'actions:show',
-        'alerting:save',
-        'actions:save',
-        'alerting:delete',
-        'actions:delete',
-      ],
+      alerting: {
+        all: [METRIC_THRESHOLD_ALERT_TYPE_ID, METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID],
+      },
+      ui: ['show', 'alerting:show'],
     },
   },
 };
@@ -68,6 +60,7 @@ export const LOGS_FEATURE = {
   navLinkId: 'logs',
   app: ['infra', 'kibana'],
   catalogue: ['infralogging'],
+  alerting: [LOG_DOCUMENT_COUNT_ALERT_TYPE_ID],
   privileges: {
     all: {
       app: ['infra', 'kibana'],
@@ -77,12 +70,18 @@ export const LOGS_FEATURE = {
         all: ['infrastructure-ui-source'],
         read: [],
       },
+      alerting: {
+        all: [LOG_DOCUMENT_COUNT_ALERT_TYPE_ID],
+      },
       ui: ['show', 'configureSource', 'save'],
     },
     read: {
       app: ['infra', 'kibana'],
       catalogue: ['infralogging'],
       api: ['infra'],
+      alerting: {
+        all: [LOG_DOCUMENT_COUNT_ALERT_TYPE_ID],
+      },
       savedObject: {
         all: [],
         read: ['infrastructure-ui-source'],
diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/register_inventory_metric_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/register_inventory_metric_threshold_alert_type.ts
index 85b38f48d9f22..fa5277cb09987 100644
--- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/register_inventory_metric_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/register_inventory_metric_threshold_alert_type.ts
@@ -40,7 +40,7 @@ export const registerMetricInventoryThresholdAlertType = (libs: InfraBackendLibs
   },
   defaultActionGroupId: FIRED_ACTIONS.id,
   actionGroups: [FIRED_ACTIONS],
-  producer: 'metrics',
+  producer: 'infrastructure',
   executor: createInventoryMetricThresholdExecutor(libs),
   actionVariables: {
     context: [
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
index 529a1d176c437..51a127e9345b4 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
@@ -117,6 +117,6 @@ export function registerMetricThresholdAlertType(libs: InfraBackendLibs) {
         { name: 'threshold', description: thresholdActionVariableDescription },
       ],
     },
-    producer: 'metrics',
+    producer: 'infrastructure',
   };
 }
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index 39ec5fe1ffaa7..86022a0e863d5 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -25,6 +25,7 @@ import {
   LOGGING_TAG,
   KIBANA_MONITORING_LOGGING_TAG,
   KIBANA_STATS_TYPE_MONITORING,
+  ALERTS,
 } from '../common/constants';
 import { MonitoringConfig, createConfig, configSchema } from './config';
 // @ts-ignore
@@ -242,6 +243,7 @@ export class Plugin {
       app: ['monitoring', 'kibana'],
       catalogue: ['monitoring'],
       privileges: null,
+      alerting: ALERTS,
       reserved: {
         description: i18n.translate('xpack.monitoring.feature.reserved.description', {
           defaultMessage: 'To grant users access, you should also assign the monitoring_user role.',
@@ -256,6 +258,9 @@ export class Plugin {
                 all: [],
                 read: [],
               },
+              alerting: {
+                all: ALERTS,
+              },
               ui: [],
             },
           },
diff --git a/x-pack/plugins/security/server/authorization/actions/__snapshots__/alerting.test.ts.snap b/x-pack/plugins/security/server/authorization/actions/__snapshots__/alerting.test.ts.snap
new file mode 100644
index 0000000000000..afa907fe09837
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/actions/__snapshots__/alerting.test.ts.snap
@@ -0,0 +1,37 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`#get alertType of "" throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get alertType of {} throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get alertType of 1 throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get alertType of null throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get alertType of true throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get alertType of undefined throws error 1`] = `"alertTypeId is required and must be a string"`;
+
+exports[`#get consumer of "" throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get consumer of {} throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get consumer of 1 throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get consumer of null throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get consumer of true throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get consumer of undefined throws error 1`] = `"consumer is required and must be a string"`;
+
+exports[`#get operation of "" throws error 1`] = `"operation is required and must be a string"`;
+
+exports[`#get operation of {} throws error 1`] = `"operation is required and must be a string"`;
+
+exports[`#get operation of 1 throws error 1`] = `"operation is required and must be a string"`;
+
+exports[`#get operation of null throws error 1`] = `"operation is required and must be a string"`;
+
+exports[`#get operation of true throws error 1`] = `"operation is required and must be a string"`;
+
+exports[`#get operation of undefined throws error 1`] = `"operation is required and must be a string"`;
diff --git a/x-pack/plugins/security/server/authorization/actions/actions.mock.ts b/x-pack/plugins/security/server/authorization/actions/actions.mock.ts
new file mode 100644
index 0000000000000..f41faaa3dd52c
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/actions/actions.mock.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { ApiActions } from './api';
+import { AppActions } from './app';
+import { SavedObjectActions } from './saved_object';
+import { SpaceActions } from './space';
+import { UIActions } from './ui';
+import { AlertingActions } from './alerting';
+import { Actions } from './actions';
+
+jest.mock('./api');
+jest.mock('./app');
+jest.mock('./saved_object');
+jest.mock('./space');
+jest.mock('./ui');
+jest.mock('./alerting');
+
+const create = (versionNumber: string) => {
+  const t = ({
+    api: new ApiActions(versionNumber),
+    app: new AppActions(versionNumber),
+    login: 'login:',
+    savedObject: new SavedObjectActions(versionNumber),
+    alerting: new AlertingActions(versionNumber),
+    space: new SpaceActions(versionNumber),
+    ui: new UIActions(versionNumber),
+    version: `version:${versionNumber}`,
+  } as unknown) as jest.Mocked<Actions>;
+  return t;
+};
+
+export const actionsMock = { create };
diff --git a/x-pack/plugins/security/server/authorization/actions/actions.ts b/x-pack/plugins/security/server/authorization/actions/actions.ts
index 00293e88abe76..34258bdcf972d 100644
--- a/x-pack/plugins/security/server/authorization/actions/actions.ts
+++ b/x-pack/plugins/security/server/authorization/actions/actions.ts
@@ -9,6 +9,7 @@ import { AppActions } from './app';
 import { SavedObjectActions } from './saved_object';
 import { SpaceActions } from './space';
 import { UIActions } from './ui';
+import { AlertingActions } from './alerting';
 
 /** Actions are used to create the "actions" that are associated with Elasticsearch's
  * application privileges, and are used to perform the authorization checks implemented
@@ -23,6 +24,8 @@ export class Actions {
 
   public readonly savedObject = new SavedObjectActions(this.versionNumber);
 
+  public readonly alerting = new AlertingActions(this.versionNumber);
+
   public readonly space = new SpaceActions(this.versionNumber);
 
   public readonly ui = new UIActions(this.versionNumber);
diff --git a/x-pack/plugins/security/server/authorization/actions/alerting.test.ts b/x-pack/plugins/security/server/authorization/actions/alerting.test.ts
new file mode 100644
index 0000000000000..744543f38a914
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/actions/alerting.test.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AlertingActions } from './alerting';
+
+const version = '1.0.0-zeta1';
+
+describe('#get', () => {
+  [null, undefined, '', 1, true, {}].forEach((alertType: any) => {
+    test(`alertType of ${JSON.stringify(alertType)} throws error`, () => {
+      const alertingActions = new AlertingActions(version);
+      expect(() =>
+        alertingActions.get(alertType, 'consumer', 'foo-action')
+      ).toThrowErrorMatchingSnapshot();
+    });
+  });
+
+  [null, undefined, '', 1, true, {}].forEach((operation: any) => {
+    test(`operation of ${JSON.stringify(operation)} throws error`, () => {
+      const alertingActions = new AlertingActions(version);
+      expect(() =>
+        alertingActions.get('foo-alertType', 'consumer', operation)
+      ).toThrowErrorMatchingSnapshot();
+    });
+  });
+
+  [null, '', 1, true, undefined, {}].forEach((consumer: any) => {
+    test(`consumer of ${JSON.stringify(consumer)} throws error`, () => {
+      const alertingActions = new AlertingActions(version);
+      expect(() =>
+        alertingActions.get('foo-alertType', consumer, 'operation')
+      ).toThrowErrorMatchingSnapshot();
+    });
+  });
+
+  test('returns `alerting:${alertType}/${consumer}/${operation}`', () => {
+    const alertingActions = new AlertingActions(version);
+    expect(alertingActions.get('foo-alertType', 'consumer', 'bar-operation')).toBe(
+      'alerting:1.0.0-zeta1:foo-alertType/consumer/bar-operation'
+    );
+  });
+});
diff --git a/x-pack/plugins/security/server/authorization/actions/alerting.ts b/x-pack/plugins/security/server/authorization/actions/alerting.ts
new file mode 100644
index 0000000000000..99d04efe6892d
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/actions/alerting.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isString } from 'lodash';
+
+export class AlertingActions {
+  private readonly prefix: string;
+
+  constructor(versionNumber: string) {
+    this.prefix = `alerting:${versionNumber}:`;
+  }
+
+  public get(alertTypeId: string, consumer: string, operation: string): string {
+    if (!alertTypeId || !isString(alertTypeId)) {
+      throw new Error('alertTypeId is required and must be a string');
+    }
+
+    if (!operation || !isString(operation)) {
+      throw new Error('operation is required and must be a string');
+    }
+
+    if (!consumer || !isString(consumer)) {
+      throw new Error('consumer is required and must be a string');
+    }
+
+    return `${this.prefix}${alertTypeId}/${consumer}/${operation}`;
+  }
+}
diff --git a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
index 45f55b34baf96..4aedac0757bc8 100644
--- a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
+++ b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
@@ -20,6 +20,9 @@ const mockRequest = httpServerMock.createKibanaRequest();
 
 const createMockAuthz = (options: MockAuthzOptions) => {
   const mock = authorizationMock.create({ version: '1.0.0-zeta1' });
+  // plug actual ui actions into mock Actions with
+  mock.actions = actions;
+
   mock.checkPrivilegesDynamicallyWithRequest.mockImplementation((request) => {
     expect(request).toBe(mockRequest);
 
diff --git a/x-pack/plugins/security/server/authorization/index.mock.ts b/x-pack/plugins/security/server/authorization/index.mock.ts
index 930ede4157723..62b254d132d9e 100644
--- a/x-pack/plugins/security/server/authorization/index.mock.ts
+++ b/x-pack/plugins/security/server/authorization/index.mock.ts
@@ -3,16 +3,15 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import { Actions } from '.';
 import { AuthorizationMode } from './mode';
+import { actionsMock } from './actions/actions.mock';
 
 export const authorizationMock = {
   create: ({
     version = 'mock-version',
     applicationName = 'mock-application',
   }: { version?: string; applicationName?: string } = {}) => ({
-    actions: new Actions(version),
+    actions: actionsMock.create(version),
     checkPrivilegesWithRequest: jest.fn(),
     checkPrivilegesDynamicallyWithRequest: jest.fn(),
     checkSavedObjectsPrivilegesWithRequest: jest.fn(),
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.test.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.test.ts
new file mode 100644
index 0000000000000..99d69602db137
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.test.ts
@@ -0,0 +1,178 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Actions } from '../../actions';
+import { FeaturePrivilegeAlertingBuilder } from './alerting';
+import { Feature, FeatureKibanaPrivileges } from '../../../../../features/server';
+
+const version = '1.0.0-zeta1';
+
+describe(`feature_privilege_builder`, () => {
+  describe(`alerting`, () => {
+    test('grants no privileges by default', () => {
+      const actions = new Actions(version);
+      const alertingFeaturePrivileges = new FeaturePrivilegeAlertingBuilder(actions);
+
+      const privilege: FeatureKibanaPrivileges = {
+        alerting: {
+          all: [],
+          read: [],
+        },
+
+        savedObject: {
+          all: [],
+          read: [],
+        },
+        ui: [],
+      };
+
+      const feature = new Feature({
+        id: 'my-feature',
+        name: 'my-feature',
+        app: [],
+        privileges: {
+          all: privilege,
+          read: privilege,
+        },
+      });
+
+      expect(alertingFeaturePrivileges.getActions(privilege, feature)).toEqual([]);
+    });
+
+    describe(`within feature`, () => {
+      test('grants `read` privileges under feature consumer', () => {
+        const actions = new Actions(version);
+        const alertingFeaturePrivileges = new FeaturePrivilegeAlertingBuilder(actions);
+
+        const privilege: FeatureKibanaPrivileges = {
+          alerting: {
+            all: [],
+            read: ['alert-type'],
+          },
+
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        };
+
+        const feature = new Feature({
+          id: 'my-feature',
+          name: 'my-feature',
+          app: [],
+          privileges: {
+            all: privilege,
+            read: privilege,
+          },
+        });
+
+        expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
+          Array [
+            "alerting:1.0.0-zeta1:alert-type/my-feature/get",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/getAlertState",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/find",
+          ]
+        `);
+      });
+
+      test('grants `all` privileges under feature consumer', () => {
+        const actions = new Actions(version);
+        const alertingFeaturePrivileges = new FeaturePrivilegeAlertingBuilder(actions);
+
+        const privilege: FeatureKibanaPrivileges = {
+          alerting: {
+            all: ['alert-type'],
+            read: [],
+          },
+
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        };
+
+        const feature = new Feature({
+          id: 'my-feature',
+          name: 'my-feature',
+          app: [],
+          privileges: {
+            all: privilege,
+            read: privilege,
+          },
+        });
+
+        expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
+          Array [
+            "alerting:1.0.0-zeta1:alert-type/my-feature/get",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/getAlertState",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/find",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/create",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/delete",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/update",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/updateApiKey",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/enable",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/disable",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/muteAll",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/unmuteAll",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/muteInstance",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/unmuteInstance",
+          ]
+        `);
+      });
+
+      test('grants both `all` and `read` privileges under feature consumer', () => {
+        const actions = new Actions(version);
+        const alertingFeaturePrivileges = new FeaturePrivilegeAlertingBuilder(actions);
+
+        const privilege: FeatureKibanaPrivileges = {
+          alerting: {
+            all: ['alert-type'],
+            read: ['readonly-alert-type'],
+          },
+
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        };
+
+        const feature = new Feature({
+          id: 'my-feature',
+          name: 'my-feature',
+          app: [],
+          privileges: {
+            all: privilege,
+            read: privilege,
+          },
+        });
+
+        expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
+          Array [
+            "alerting:1.0.0-zeta1:alert-type/my-feature/get",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/getAlertState",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/find",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/create",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/delete",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/update",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/updateApiKey",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/enable",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/disable",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/muteAll",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/unmuteAll",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/muteInstance",
+            "alerting:1.0.0-zeta1:alert-type/my-feature/unmuteInstance",
+            "alerting:1.0.0-zeta1:readonly-alert-type/my-feature/get",
+            "alerting:1.0.0-zeta1:readonly-alert-type/my-feature/getAlertState",
+            "alerting:1.0.0-zeta1:readonly-alert-type/my-feature/find",
+          ]
+        `);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.ts
new file mode 100644
index 0000000000000..42dd7794ba184
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/alerting.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { uniq } from 'lodash';
+import { Feature, FeatureKibanaPrivileges } from '../../../../../features/server';
+import { BaseFeaturePrivilegeBuilder } from './feature_privilege_builder';
+
+const readOperations: string[] = ['get', 'getAlertState', 'find'];
+const writeOperations: string[] = [
+  'create',
+  'delete',
+  'update',
+  'updateApiKey',
+  'enable',
+  'disable',
+  'muteAll',
+  'unmuteAll',
+  'muteInstance',
+  'unmuteInstance',
+];
+const allOperations: string[] = [...readOperations, ...writeOperations];
+
+export class FeaturePrivilegeAlertingBuilder extends BaseFeaturePrivilegeBuilder {
+  public getActions(privilegeDefinition: FeatureKibanaPrivileges, feature: Feature): string[] {
+    const getAlertingPrivilege = (
+      operations: string[],
+      privilegedTypes: readonly string[],
+      consumer: string
+    ) =>
+      privilegedTypes.flatMap((type) =>
+        operations.map((operation) => this.actions.alerting.get(type, consumer, operation))
+      );
+
+    return uniq([
+      ...getAlertingPrivilege(allOperations, privilegeDefinition.alerting?.all ?? [], feature.id),
+      ...getAlertingPrivilege(readOperations, privilegeDefinition.alerting?.read ?? [], feature.id),
+    ]);
+  }
+}
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
index 3d6dfbdac0251..76b664cbbe2a7 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
@@ -14,6 +14,7 @@ import { FeaturePrivilegeBuilder } from './feature_privilege_builder';
 import { FeaturePrivilegeManagementBuilder } from './management';
 import { FeaturePrivilegeNavlinkBuilder } from './navlink';
 import { FeaturePrivilegeSavedObjectBuilder } from './saved_object';
+import { FeaturePrivilegeAlertingBuilder } from './alerting';
 import { FeaturePrivilegeUIBuilder } from './ui';
 export { FeaturePrivilegeBuilder };
 
@@ -26,6 +27,7 @@ export const featurePrivilegeBuilderFactory = (actions: Actions): FeaturePrivile
     new FeaturePrivilegeNavlinkBuilder(actions),
     new FeaturePrivilegeSavedObjectBuilder(actions),
     new FeaturePrivilegeUIBuilder(actions),
+    new FeaturePrivilegeAlertingBuilder(actions),
   ];
 
   return {
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts
index 485783253d29d..bb1f0c33fdee9 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts
@@ -41,6 +41,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -54,6 +58,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -80,6 +87,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -96,6 +107,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -118,6 +132,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -131,6 +149,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -158,6 +179,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -181,6 +206,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -194,6 +223,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -218,6 +250,10 @@ describe('featurePrivilegeIterator', () => {
                     all: ['all-sub-type'],
                     read: ['read-sub-type'],
                   },
+                  alerting: {
+                    all: ['alerting-all-sub-type'],
+                    read: ['alerting-read-sub-type'],
+                  },
                   ui: ['ui-sub-type'],
                 },
               ],
@@ -247,6 +283,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -263,6 +303,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -286,6 +329,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -299,6 +346,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -323,6 +373,10 @@ describe('featurePrivilegeIterator', () => {
                     all: ['all-sub-type'],
                     read: ['read-sub-type'],
                   },
+                  alerting: {
+                    all: ['alerting-all-sub-type'],
+                    read: ['alerting-read-sub-type'],
+                  },
                   ui: ['ui-sub-type'],
                 },
               ],
@@ -352,6 +406,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -368,6 +426,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -391,6 +452,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -404,6 +469,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -429,6 +497,10 @@ describe('featurePrivilegeIterator', () => {
                     all: ['all-sub-type'],
                     read: ['read-sub-type'],
                   },
+                  alerting: {
+                    all: ['alerting-all-sub-type'],
+                    read: ['alerting-read-sub-type'],
+                  },
                   ui: ['ui-sub-type'],
                 },
               ],
@@ -459,6 +531,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type', 'all-sub-type'],
             read: ['read-type', 'read-sub-type'],
           },
+          alerting: {
+            all: ['alerting-all-type', 'alerting-all-sub-type'],
+            read: ['alerting-read-type', 'alerting-read-sub-type'],
+          },
           ui: ['ui-action', 'ui-sub-type'],
         },
       },
@@ -476,6 +552,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-sub-type'],
             read: ['read-type', 'read-sub-type'],
           },
+          alerting: {
+            all: ['alerting-all-sub-type'],
+            read: ['alerting-read-type', 'alerting-read-sub-type'],
+          },
           ui: ['ui-action', 'ui-sub-type'],
         },
       },
@@ -499,6 +579,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -512,6 +596,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -536,6 +623,9 @@ describe('featurePrivilegeIterator', () => {
                     all: [],
                     read: ['read-type'],
                   },
+                  alerting: {
+                    read: ['alerting-read-type'],
+                  },
                   ui: ['ui-action'],
                 },
               ],
@@ -565,6 +655,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -581,6 +675,10 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            all: [],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -604,6 +702,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -617,6 +719,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -642,6 +747,10 @@ describe('featurePrivilegeIterator', () => {
                     all: ['all-sub-type'],
                     read: ['read-sub-type'],
                   },
+                  alerting: {
+                    all: ['alerting-all-sub-type'],
+                    read: ['alerting-read-sub-type'],
+                  },
                   ui: ['ui-sub-type'],
                 },
               ],
@@ -672,6 +781,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type', 'all-sub-type'],
             read: ['read-type', 'read-sub-type'],
           },
+          alerting: {
+            all: ['alerting-all-type', 'alerting-all-sub-type'],
+            read: ['alerting-read-type', 'alerting-read-sub-type'],
+          },
           ui: ['ui-action', 'ui-sub-type'],
         },
       },
@@ -688,6 +801,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -737,6 +853,10 @@ describe('featurePrivilegeIterator', () => {
                     all: ['all-sub-type'],
                     read: ['read-sub-type'],
                   },
+                  alerting: {
+                    all: ['alerting-all-sub-type'],
+                    read: ['alerting-read-sub-type'],
+                  },
                   ui: ['ui-sub-type'],
                 },
               ],
@@ -767,6 +887,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-sub-type'],
             read: ['read-sub-type'],
           },
+          alerting: {
+            all: ['alerting-all-sub-type'],
+            read: ['alerting-read-sub-type'],
+          },
           ui: ['ui-sub-type'],
         },
       },
@@ -784,6 +908,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-sub-type'],
             read: ['read-sub-type'],
           },
+          alerting: {
+            all: ['alerting-all-sub-type'],
+            read: ['alerting-read-sub-type'],
+          },
           ui: ['ui-sub-type'],
         },
       },
@@ -807,6 +935,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
         read: {
@@ -820,6 +952,9 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -867,6 +1002,10 @@ describe('featurePrivilegeIterator', () => {
             all: ['all-type'],
             read: ['read-type'],
           },
+          alerting: {
+            all: ['alerting-all-type'],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
@@ -883,6 +1022,10 @@ describe('featurePrivilegeIterator', () => {
             all: [],
             read: ['read-type'],
           },
+          alerting: {
+            all: [],
+            read: ['alerting-read-type'],
+          },
           ui: ['ui-action'],
         },
       },
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts
index 029b2e77f7812..17c9464b14756 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts
@@ -72,6 +72,14 @@ function mergeWithSubFeatures(
       mergedConfig.savedObject.read,
       subFeaturePrivilege.savedObject.read
     );
+
+    mergedConfig.alerting = {
+      all: mergeArrays(mergedConfig.alerting?.all ?? [], subFeaturePrivilege.alerting?.all ?? []),
+      read: mergeArrays(
+        mergedConfig.alerting?.read ?? [],
+        subFeaturePrivilege.alerting?.read ?? []
+      ),
+    };
   }
   return mergedConfig;
 }
diff --git a/x-pack/plugins/security/server/authorization/privileges/privileges.ts b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
index f9ee5fc750127..5d8ef3f376cac 100644
--- a/x-pack/plugins/security/server/authorization/privileges/privileges.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
@@ -90,7 +90,6 @@ export function privilegesFactory(
           delete featurePrivileges[feature.id];
         }
       }
-
       return {
         features: featurePrivileges,
         global: {
diff --git a/x-pack/plugins/security/server/mocks.ts b/x-pack/plugins/security/server/mocks.ts
index c2d99433b0346..4ce0ec6e3c10e 100644
--- a/x-pack/plugins/security/server/mocks.ts
+++ b/x-pack/plugins/security/server/mocks.ts
@@ -17,6 +17,7 @@ function createSetupMock() {
     authz: {
       actions: mockAuthz.actions,
       checkPrivilegesWithRequest: mockAuthz.checkPrivilegesWithRequest,
+      checkPrivilegesDynamicallyWithRequest: mockAuthz.checkPrivilegesDynamicallyWithRequest,
       mode: mockAuthz.mode,
     },
     registerSpacesService: jest.fn(),
diff --git a/x-pack/plugins/security/server/plugin.test.ts b/x-pack/plugins/security/server/plugin.test.ts
index 243bad0ec3e71..db015d246f591 100644
--- a/x-pack/plugins/security/server/plugin.test.ts
+++ b/x-pack/plugins/security/server/plugin.test.ts
@@ -69,6 +69,9 @@ describe('Security Plugin', () => {
                 },
                 "authz": Object {
                   "actions": Actions {
+                    "alerting": AlertingActions {
+                      "prefix": "alerting:version:",
+                    },
                     "api": ApiActions {
                       "prefix": "api:version:",
                     },
@@ -88,6 +91,7 @@ describe('Security Plugin', () => {
                     "version": "version:version",
                     "versionNumber": "version",
                   },
+                  "checkPrivilegesDynamicallyWithRequest": [Function],
                   "checkPrivilegesWithRequest": [Function],
                   "mode": Object {
                     "useRbacForRequest": [Function],
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index c4b16c9eec872..1753eb7b62ed1 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -51,7 +51,10 @@ export interface SecurityPluginSetup {
     | 'grantAPIKeyAsInternalUser'
     | 'invalidateAPIKeyAsInternalUser'
   >;
-  authz: Pick<AuthorizationServiceSetup, 'actions' | 'checkPrivilegesWithRequest' | 'mode'>;
+  authz: Pick<
+    AuthorizationServiceSetup,
+    'actions' | 'checkPrivilegesDynamicallyWithRequest' | 'checkPrivilegesWithRequest' | 'mode'
+  >;
   license: SecurityLicense;
   audit: Pick<AuditServiceSetup, 'getLogger'>;
 
@@ -206,6 +209,7 @@ export class Plugin {
       authz: {
         actions: authz.actions,
         checkPrivilegesWithRequest: authz.checkPrivilegesWithRequest,
+        checkPrivilegesDynamicallyWithRequest: authz.checkPrivilegesDynamicallyWithRequest,
         mode: authz.mode,
       },
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/create_notifications.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/create_notifications.ts
index a472d8a4df4a4..8f6826cec5365 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/create_notifications.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/notifications/create_notifications.ts
@@ -5,7 +5,7 @@
  */
 
 import { Alert } from '../../../../../alerts/common';
-import { APP_ID, NOTIFICATIONS_ID } from '../../../../common/constants';
+import { SERVER_APP_ID, NOTIFICATIONS_ID } from '../../../../common/constants';
 import { CreateNotificationParams } from './types';
 import { addTags } from './add_tags';
 import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
@@ -23,7 +23,7 @@ export const createNotifications = async ({
       name,
       tags: addTags([], ruleAlertId),
       alertTypeId: NOTIFICATIONS_ID,
-      consumer: APP_ID,
+      consumer: SERVER_APP_ID,
       params: {
         ruleAlertId,
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules.ts
index ad4038b05dbd3..0c67d9ca77146 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules.ts
@@ -6,7 +6,7 @@
 
 import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { Alert } from '../../../../../alerts/common';
-import { APP_ID, SIGNALS_ID } from '../../../../common/constants';
+import { SERVER_APP_ID, SIGNALS_ID } from '../../../../common/constants';
 import { CreateRulesOptions } from './types';
 import { addTags } from './add_tags';
 
@@ -57,7 +57,7 @@ export const createRules = async ({
       name,
       tags: addTags(tags, ruleId, immutable),
       alertTypeId: SIGNALS_ID,
-      consumer: APP_ID,
+      consumer: SERVER_APP_ID,
       params: {
         anomalyThreshold,
         author,
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 611f35c6d402a..06cd3138ca564 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -40,7 +40,14 @@ import { initSavedObjects, savedObjectTypes } from './saved_objects';
 import { AppClientFactory } from './client';
 import { createConfig$, ConfigType } from './config';
 import { initUiSettings } from './ui_settings';
-import { APP_ID, APP_ICON, SERVER_APP_ID, SecurityPageName } from '../common/constants';
+import {
+  APP_ID,
+  APP_ICON,
+  SERVER_APP_ID,
+  SecurityPageName,
+  SIGNALS_ID,
+  NOTIFICATIONS_ID,
+} from '../common/constants';
 import { registerEndpointRoutes } from './endpoint/routes/metadata';
 import { registerLimitedConcurrencyRoutes } from './endpoint/routes/limited_concurrency';
 import { registerResolverRoutes } from './endpoint/routes/resolver';
@@ -167,23 +174,15 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       navLinkId: APP_ID,
       app: [...securitySubPlugins, 'kibana'],
       catalogue: ['securitySolution'],
+      alerting: [SIGNALS_ID, NOTIFICATIONS_ID],
       privileges: {
         all: {
           app: [...securitySubPlugins, 'kibana'],
           catalogue: ['securitySolution'],
-          api: [
-            'securitySolution',
-            'actions-read',
-            'actions-all',
-            'alerting-read',
-            'alerting-all',
-            'lists-all',
-          ],
+          api: ['securitySolution', 'lists-all'],
           savedObject: {
             all: [
               'alert',
-              'action',
-              'action_task_params',
               'cases',
               'cases-comments',
               'cases-configure',
@@ -192,30 +191,17 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             ],
             read: ['config'],
           },
-          ui: [
-            'show',
-            'crud',
-            'alerting:show',
-            'actions:show',
-            'alerting:save',
-            'actions:save',
-            'alerting:delete',
-            'actions:delete',
-          ],
+          alerting: {
+            all: [SIGNALS_ID, NOTIFICATIONS_ID],
+          },
+          ui: ['show', 'crud', 'alerting:show'],
         },
         read: {
           app: [...securitySubPlugins, 'kibana'],
           catalogue: ['securitySolution'],
-          api: [
-            'securitySolution',
-            'actions-read',
-            'actions-all',
-            'alerting-read',
-            'alerting-all',
-            'lists-read',
-          ],
+          api: ['securitySolution', 'lists-read'],
           savedObject: {
-            all: ['alert', 'action', 'action_task_params'],
+            all: ['alert'],
             read: [
               'config',
               'cases',
@@ -225,15 +211,10 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
               ...savedObjectTypes,
             ],
           },
-          ui: [
-            'show',
-            'alerting:show',
-            'actions:show',
-            'alerting:save',
-            'actions:save',
-            'alerting:delete',
-            'actions:delete',
-          ],
+          alerting: {
+            all: [SIGNALS_ID, NOTIFICATIONS_ID],
+          },
+          ui: ['show', 'alerting:show'],
         },
       },
     });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.test.tsx
index 8ee953c00795e..6856e553ab400 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.test.tsx
@@ -30,6 +30,7 @@ describe('EmailActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        readOnly={false}
       />
     );
     expect(wrapper.find('[data-test-subj="emailFromInput"]').length > 0).toBeTruthy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.tsx
index 8a15320d5de16..4ef9c2e0d4d2e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email/email_connector.tsx
@@ -21,7 +21,7 @@ import { EmailActionConnector } from '../types';
 
 export const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
   EmailActionConnector
->> = ({ action, editActionConfig, editActionSecrets, errors, docLinks }) => {
+>> = ({ action, editActionConfig, editActionSecrets, errors, readOnly, docLinks }) => {
   const { from, host, port, secure } = action.config;
   const { user, password } = action.secrets;
 
@@ -54,6 +54,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
           >
             <EuiFieldText
               fullWidth
+              readOnly={readOnly}
               isInvalid={errors.from.length > 0 && from !== undefined}
               name="from"
               value={from || ''}
@@ -86,6 +87,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
           >
             <EuiFieldText
               fullWidth
+              readOnly={readOnly}
               isInvalid={errors.host.length > 0 && host !== undefined}
               name="host"
               value={host || ''}
@@ -121,6 +123,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
                   prepend=":"
                   isInvalid={errors.port.length > 0 && port !== undefined}
                   fullWidth
+                  readOnly={readOnly}
                   name="port"
                   value={port || ''}
                   data-test-subj="emailPortInput"
@@ -145,6 +148,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
                         defaultMessage: 'Secure',
                       }
                     )}
+                    disabled={readOnly}
                     checked={secure || false}
                     onChange={(e) => {
                       editActionConfig('secure', e.target.checked);
@@ -174,6 +178,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
               fullWidth
               isInvalid={errors.user.length > 0}
               name="user"
+              readOnly={readOnly}
               value={user || ''}
               data-test-subj="emailUserInput"
               onChange={(e) => {
@@ -197,6 +202,7 @@ export const EmailActionConnectorFields: React.FunctionComponent<ActionConnector
           >
             <EuiFieldPassword
               fullWidth
+              readOnly={readOnly}
               isInvalid={errors.password.length > 0}
               name="password"
               value={password || ''}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.test.tsx
index 4cb397927b53e..f5f14cb041335 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.test.tsx
@@ -88,6 +88,7 @@ describe('IndexActionConnectorFields renders', () => {
         editActionSecrets={() => {}}
         http={deps!.http}
         docLinks={deps!.docLinks}
+        readOnly={false}
       />
     );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.tsx
index 6fb078f3c808f..9cfb9f1dc25b2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index/es_index_connector.tsx
@@ -29,7 +29,7 @@ import {
 
 const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
   EsIndexActionConnector
->> = ({ action, editActionConfig, errors, http, docLinks }) => {
+>> = ({ action, editActionConfig, errors, http, readOnly, docLinks }) => {
   const { index, refresh, executionTimeField } = action.config;
   const [hasTimeFieldCheckbox, setTimeFieldCheckboxState] = useState<boolean>(
     executionTimeField != null
@@ -115,6 +115,7 @@ const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
                 ]
               : []
           }
+          isDisabled={readOnly}
           onChange={async (selected: EuiComboBoxOptionOption[]) => {
             editActionConfig('index', selected.length > 0 ? selected[0].value : '');
             const indices = selected.map((s) => s.value as string);
@@ -145,6 +146,7 @@ const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
       <EuiSwitch
         data-test-subj="indexRefreshCheckbox"
         checked={refresh || false}
+        disabled={readOnly}
         onChange={(e) => {
           editActionConfig('refresh', e.target.checked);
         }}
@@ -172,6 +174,7 @@ const IndexActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
       <EuiSwitch
         data-test-subj="hasTimeFieldCheckbox"
         checked={hasTimeFieldCheckbox || false}
+        disabled={readOnly}
         onChange={() => {
           setTimeFieldCheckboxState(!hasTimeFieldCheckbox);
           // if changing from checked to not checked (hasTimeField === true),
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.test.tsx
index 86730c0ab4ac7..53e68e6453690 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.test.tsx
@@ -34,6 +34,7 @@ describe('PagerDutyActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        readOnly={false}
       />
     );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.tsx
index 48da3f1778b48..6399e1f80984c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/pagerduty/pagerduty_connectors.tsx
@@ -12,7 +12,7 @@ import { PagerDutyActionConnector } from '.././types';
 
 const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
   PagerDutyActionConnector
->> = ({ errors, action, editActionConfig, editActionSecrets, docLinks }) => {
+>> = ({ errors, action, editActionConfig, editActionSecrets, docLinks, readOnly }) => {
   const { apiUrl } = action.config;
   const { routingKey } = action.secrets;
   return (
@@ -31,6 +31,7 @@ const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFie
           fullWidth
           name="apiUrl"
           value={apiUrl || ''}
+          readOnly={readOnly}
           data-test-subj="pagerdutyApiUrlInput"
           onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
             editActionConfig('apiUrl', e.target.value);
@@ -69,6 +70,7 @@ const PagerDutyActionConnectorFields: React.FunctionComponent<ActionConnectorFie
           fullWidth
           isInvalid={errors.routingKey.length > 0 && routingKey !== undefined}
           name="routingKey"
+          readOnly={readOnly}
           value={routingKey || ''}
           data-test-subj="pagerdutyRoutingKeyInput"
           onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
index 25381614a6c07..216e6967833b2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
@@ -34,6 +34,7 @@ describe('ServiceNowActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        readOnly={false}
       />
     );
     expect(
@@ -72,6 +73,7 @@ describe('ServiceNowActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        readOnly={false}
         consumer={'case'}
       />
     );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
index 139ef8fa58ff3..f99a276305d75 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
@@ -25,7 +25,7 @@ import { FieldMapping } from './case_mappings/field_mapping';
 
 const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
   ServiceNowActionConnector
->> = ({ action, editActionSecrets, editActionConfig, errors, consumer, docLinks }) => {
+>> = ({ action, editActionSecrets, editActionConfig, errors, consumer, readOnly, docLinks }) => {
   // TODO: remove incidentConfiguration later, when Case ServiceNow will move their fields to the level of action execution
   const { apiUrl, incidentConfiguration, isCaseOwned } = action.config;
   const mapping = incidentConfiguration ? incidentConfiguration.mapping : [];
@@ -97,6 +97,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
               fullWidth
               isInvalid={isApiUrlInvalid}
               name="apiUrl"
+              readOnly={readOnly}
               value={apiUrl || ''} // Needed to prevent uncontrolled input error when value is undefined
               data-test-subj="apiUrlFromInput"
               placeholder="https://<site-url>"
@@ -123,6 +124,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
             <EuiFieldText
               fullWidth
               isInvalid={isUsernameInvalid}
+              readOnly={readOnly}
               name="connector-servicenow-username"
               value={username || ''} // Needed to prevent uncontrolled input error when value is undefined
               data-test-subj="connector-servicenow-username-form-input"
@@ -148,6 +150,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
           >
             <EuiFieldPassword
               fullWidth
+              readOnly={readOnly}
               isInvalid={isPasswordInvalid}
               name="connector-servicenow-password"
               value={password || ''} // Needed to prevent uncontrolled input error when value is undefined
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.test.tsx
index bd905c1c95650..5bc778830b6e6 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.test.tsx
@@ -31,6 +31,7 @@ describe('SlackActionFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        readOnly={false}
       />
     );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.tsx
index b6efd9fa93266..aa3a1932eacdb 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/slack/slack_connectors.tsx
@@ -12,7 +12,7 @@ import { SlackActionConnector } from '../types';
 
 const SlackActionFields: React.FunctionComponent<ActionConnectorFieldsProps<
   SlackActionConnector
->> = ({ action, editActionSecrets, errors, docLinks }) => {
+>> = ({ action, editActionSecrets, errors, readOnly, docLinks }) => {
   const { webhookUrl } = action.secrets;
 
   return (
@@ -44,6 +44,7 @@ const SlackActionFields: React.FunctionComponent<ActionConnectorFieldsProps<
           fullWidth
           isInvalid={errors.webhookUrl.length > 0 && webhookUrl !== undefined}
           name="webhookUrl"
+          readOnly={readOnly}
           placeholder="Example: https://hooks.slack.com/services"
           value={webhookUrl || ''}
           data-test-subj="slackWebhookUrlInput"
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
index 3a2afff03c58f..7f2bed6c41f3b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.test.tsx
@@ -33,6 +33,7 @@ describe('WebhookActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={{ ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' } as DocLinksStart}
+        readOnly={false}
       />
     );
     expect(wrapper.find('[data-test-subj="webhookViewHeadersSwitch"]').length > 0).toBeTruthy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
index 2321d5b4b5479..52160441adb5b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/webhook/webhook_connectors.tsx
@@ -30,7 +30,7 @@ const HTTP_VERBS = ['post', 'put'];
 
 const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsProps<
   WebhookActionConnector
->> = ({ action, editActionConfig, editActionSecrets, errors }) => {
+>> = ({ action, editActionConfig, editActionSecrets, errors, readOnly }) => {
   const { user, password } = action.secrets;
   const { method, url, headers } = action.config;
 
@@ -128,6 +128,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
                 fullWidth
                 isInvalid={hasHeaderErrors && httpHeaderKey !== undefined}
                 name="keyHeader"
+                readOnly={readOnly}
                 value={httpHeaderKey}
                 data-test-subj="webhookHeadersKeyInput"
                 onChange={(e) => {
@@ -153,6 +154,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
                 fullWidth
                 isInvalid={hasHeaderErrors && httpHeaderValue !== undefined}
                 name="valueHeader"
+                readOnly={readOnly}
                 value={httpHeaderValue}
                 data-test-subj="webhookHeadersValueInput"
                 onChange={(e) => {
@@ -222,6 +224,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
             <EuiSelect
               name="method"
               value={method || 'post'}
+              disabled={readOnly}
               data-test-subj="webhookMethodSelect"
               options={HTTP_VERBS.map((verb) => ({ text: verb.toUpperCase(), value: verb }))}
               onChange={(e) => {
@@ -247,6 +250,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
               name="url"
               isInvalid={errors.url.length > 0 && url !== undefined}
               fullWidth
+              readOnly={readOnly}
               value={url || ''}
               placeholder="https://<site-url> or http://<site-url>"
               data-test-subj="webhookUrlText"
@@ -280,6 +284,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
               fullWidth
               isInvalid={errors.user.length > 0 && user !== undefined}
               name="user"
+              readOnly={readOnly}
               value={user || ''}
               data-test-subj="webhookUserInput"
               onChange={(e) => {
@@ -309,6 +314,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
             <EuiFieldPassword
               fullWidth
               name="password"
+              readOnly={readOnly}
               isInvalid={errors.password.length > 0 && password !== undefined}
               value={password || ''}
               data-test-subj="webhookPasswordInput"
@@ -328,6 +334,7 @@ const WebhookActionConnectorFields: React.FunctionComponent<ActionConnectorField
       <EuiSpacer size="m" />
       <EuiSwitch
         data-test-subj="webhookViewHeadersSwitch"
+        disabled={readOnly}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.webhookAction.viewHeadersSwitch',
           {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts
index 578c93fc4cba8..ddd03df8bee6b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts
@@ -6,6 +6,7 @@
 
 import { AlertType, ActionVariables } from '../../types';
 import { actionVariablesFromAlertType } from './action_variables';
+import { ALERTS_FEATURE_ID } from '../../../../alerts/common';
 
 beforeEach(() => jest.resetAllMocks());
 
@@ -183,6 +184,7 @@ function getAlertType(actionVariables: ActionVariables): AlertType {
     actionVariables,
     actionGroups: [{ id: 'default', name: 'Default' }],
     defaultActionGroupId: 'default',
-    producer: 'alerting',
+    authorizedConsumers: {},
+    producer: ALERTS_FEATURE_ID,
   };
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
index 94d9166b40909..23caf2cfb31a8 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/alert_api.test.ts
@@ -27,6 +27,7 @@ import {
   health,
 } from './alert_api';
 import uuid from 'uuid';
+import { ALERTS_FEATURE_ID } from '../../../../alerts/common';
 
 const http = httpServiceMock.createStartContract();
 
@@ -42,9 +43,10 @@ describe('loadAlertTypes', () => {
           context: [{ name: 'var1', description: 'val1' }],
           state: [{ name: 'var2', description: 'val2' }],
         },
-        producer: 'alerting',
+        producer: ALERTS_FEATURE_ID,
         actionGroups: [{ id: 'default', name: 'Default' }],
         defaultActionGroupId: 'default',
+        authorizedConsumers: {},
       },
     ];
     http.get.mockResolvedValueOnce(resolvedValue);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
index 82d03be41e1aa..065a782ee96a2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
@@ -4,6 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { BUILT_IN_ALERTS_FEATURE_ID } from '../../../../alerting_builtins/common';
+import { Alert, AlertType } from '../../types';
+
 /**
  * NOTE: Applications that want to show the alerting UIs will need to add
  * check against their features here until we have a better solution. This
@@ -12,7 +15,7 @@
 
 type Capabilities = Record<string, any>;
 
-const apps = ['apm', 'siem', 'uptime', 'infrastructure'];
+const apps = ['apm', 'siem', 'uptime', 'infrastructure', 'actions', BUILT_IN_ALERTS_FEATURE_ID];
 
 function hasCapability(capabilities: Capabilities, capability: string) {
   return apps.some((app) => capabilities[app]?.[capability]);
@@ -23,8 +26,17 @@ function createCapabilityCheck(capability: string) {
 }
 
 export const hasShowAlertsCapability = createCapabilityCheck('alerting:show');
-export const hasShowActionsCapability = createCapabilityCheck('actions:show');
-export const hasSaveAlertsCapability = createCapabilityCheck('alerting:save');
-export const hasSaveActionsCapability = createCapabilityCheck('actions:save');
-export const hasDeleteAlertsCapability = createCapabilityCheck('alerting:delete');
-export const hasDeleteActionsCapability = createCapabilityCheck('actions:delete');
+
+export const hasShowActionsCapability = (capabilities: Capabilities) => capabilities?.actions?.show;
+export const hasSaveActionsCapability = (capabilities: Capabilities) => capabilities?.actions?.save;
+export const hasExecuteActionsCapability = (capabilities: Capabilities) =>
+  capabilities?.actions?.execute;
+export const hasDeleteActionsCapability = (capabilities: Capabilities) =>
+  capabilities?.actions?.delete;
+
+export function hasAllPrivilege(alert: Alert, alertType?: AlertType): boolean {
+  return alertType?.authorizedConsumers[alert.consumer]?.all ?? false;
+}
+export function hasReadPrivilege(alert: Alert, alertType?: AlertType): boolean {
+  return alertType?.authorizedConsumers[alert.consumer]?.read ?? false;
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx
index 17a1d929a0def..b7c9865cbd9d0 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.test.tsx
@@ -15,10 +15,16 @@ describe('action_connector_form', () => {
   let deps: any;
   beforeAll(async () => {
     const mocks = coreMock.createSetup();
+    const [
+      {
+        application: { capabilities },
+      },
+    ] = await mocks.getStartServices();
     deps = {
       http: mocks.http,
       actionTypeRegistry: actionTypeRegistry as any,
       docLinks: { ELASTIC_WEBSITE_URL: '', DOC_LINK_VERSION: '' },
+      capabilities,
     };
   });
 
@@ -56,6 +62,7 @@ describe('action_connector_form', () => {
           http={deps!.http}
           actionTypeRegistry={deps!.actionTypeRegistry}
           docLinks={deps!.docLinks}
+          capabilities={deps!.capabilities}
         />
       );
     }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx
index 794f5548c4b44..ed4edb0229c2b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx
@@ -18,10 +18,11 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { HttpSetup, DocLinksStart } from 'kibana/public';
+import { HttpSetup, ApplicationStart, DocLinksStart } from 'kibana/public';
 import { ReducerAction } from './connector_reducer';
 import { ActionConnector, IErrorObject, ActionTypeModel } from '../../../types';
 import { TypeRegistry } from '../../type_registry';
+import { hasSaveActionsCapability } from '../../lib/capabilities';
 
 export function validateBaseProperties(actionObject: ActionConnector) {
   const validationResult = { errors: {} };
@@ -53,6 +54,7 @@ interface ActionConnectorProps {
   http: HttpSetup;
   actionTypeRegistry: TypeRegistry<ActionTypeModel>;
   docLinks: DocLinksStart;
+  capabilities: ApplicationStart['capabilities'];
   consumer?: string;
 }
 
@@ -65,8 +67,11 @@ export const ActionConnectorForm = ({
   http,
   actionTypeRegistry,
   docLinks,
+  capabilities,
   consumer,
 }: ActionConnectorProps) => {
+  const canSave = hasSaveActionsCapability(capabilities);
+
   const setActionProperty = (key: string, value: any) => {
     dispatch({ command: { type: 'setProperty' }, payload: { key, value } });
   };
@@ -138,6 +143,7 @@ export const ActionConnectorForm = ({
       >
         <EuiFieldText
           fullWidth
+          readOnly={!canSave}
           isInvalid={errors.name.length > 0 && connector.name !== undefined}
           name="name"
           placeholder="Untitled"
@@ -167,6 +173,7 @@ export const ActionConnectorForm = ({
           <FieldsComponent
             action={connector}
             errors={errors}
+            readOnly={!canSave}
             editActionConfig={setActionConfigProperty}
             editActionSecrets={setActionSecretsProperty}
             http={http}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
index 67c7ca91156da..af10f583dd413 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
@@ -45,6 +45,7 @@ import { TypeRegistry } from '../../type_registry';
 import { actionTypeCompare } from '../../lib/action_type_compare';
 import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_enabled';
 import { VIEW_LICENSE_OPTIONS_LINK } from '../../../common/constants';
+import { hasSaveActionsCapability } from '../../lib/capabilities';
 
 interface ActionAccordionFormProps {
   actions: AlertAction[];
@@ -87,6 +88,8 @@ export const ActionForm = ({
   capabilities,
   docLinks,
 }: ActionAccordionFormProps) => {
+  const canSave = hasSaveActionsCapability(capabilities);
+
   const [addModalVisible, setAddModalVisibility] = useState<boolean>(false);
   const [activeActionItem, setActiveActionItem] = useState<ActiveActionConnectorState | undefined>(
     undefined
@@ -254,6 +257,7 @@ export const ActionForm = ({
                 />
               }
               labelAppend={
+                canSave &&
                 actionTypesIndex &&
                 actionTypesIndex[actionConnector.actionTypeId].enabledInConfig ? (
                   <EuiButtonEmpty
@@ -404,6 +408,16 @@ export const ActionForm = ({
       : actionItem.actionTypeId;
     const actionTypeRegistered = actionTypeRegistry.get(actionItem.actionTypeId);
     if (!actionTypeRegistered || actionItem.group !== defaultActionGroupId) return null;
+
+    const noConnectorsLabel = (
+      <FormattedMessage
+        id="xpack.triggersActionsUI.sections.alertForm.emptyConnectorsLabel"
+        defaultMessage="No {actionTypeName} connectors"
+        values={{
+          actionTypeName,
+        }}
+      />
+    );
     return (
       <Fragment key={index}>
         <EuiAccordion
@@ -458,46 +472,51 @@ export const ActionForm = ({
           }
           paddingSize="l"
         >
-          <EuiEmptyPrompt
-            title={
-              emptyActionsIds.find((emptyId: string) => actionItem.id === emptyId) ? (
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.alertForm.emptyConnectorsLabel"
-                  defaultMessage="No {actionTypeName} connectors."
-                  values={{
-                    actionTypeName,
+          {canSave ? (
+            <EuiEmptyPrompt
+              title={
+                emptyActionsIds.find((emptyId: string) => actionItem.id === emptyId) ? (
+                  noConnectorsLabel
+                ) : (
+                  <EuiCallOut
+                    title={i18n.translate(
+                      'xpack.triggersActionsUI.sections.alertForm.unableToLoadConnectorTitle',
+                      {
+                        defaultMessage: 'Unable to load connector.',
+                      }
+                    )}
+                    color="warning"
+                  />
+                )
+              }
+              actions={[
+                <EuiButton
+                  color="primary"
+                  fill
+                  size="s"
+                  data-test-subj="createActionConnectorButton"
+                  onClick={() => {
+                    setActiveActionItem({ actionTypeId: actionItem.actionTypeId, index });
+                    setAddModalVisibility(true);
                   }}
-                />
-              ) : (
-                <EuiCallOut
-                  title={i18n.translate(
-                    'xpack.triggersActionsUI.sections.alertForm.unableToLoadConnectorTitle',
-                    {
-                      defaultMessage: 'Unable to load connector.',
-                    }
-                  )}
-                  color="warning"
-                />
-              )
-            }
-            actions={[
-              <EuiButton
-                color="primary"
-                fill
-                size="s"
-                data-test-subj="createActionConnectorButton"
-                onClick={() => {
-                  setActiveActionItem({ actionTypeId: actionItem.actionTypeId, index });
-                  setAddModalVisibility(true);
-                }}
-              >
+                >
+                  <FormattedMessage
+                    id="xpack.triggersActionsUI.sections.alertForm.addConnectorButtonLabel"
+                    defaultMessage="Create a connector"
+                  />
+                </EuiButton>,
+              ]}
+            />
+          ) : (
+            <EuiCallOut title={noConnectorsLabel}>
+              <p>
                 <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.alertForm.addConnectorButtonLabel"
-                  defaultMessage="Create a connector"
+                  id="xpack.triggersActionsUI.sections.alertForm.unauthorizedToCreateForEmptyConnectors"
+                  defaultMessage="Only authorized users can configure a connector. Contact your administrator."
                 />
-              </EuiButton>,
-            ]}
-          />
+              </p>
+            </EuiCallOut>
+          )}
         </EuiAccordion>
         <EuiSpacer size="xs" />
       </Fragment>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx
index 60ec0cfa6955e..19ce653e465f1 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_flyout.tsx
@@ -118,6 +118,7 @@ export const ConnectorAddFlyout = ({
         actionTypeRegistry={actionTypeRegistry}
         http={http}
         docLinks={docLinks}
+        capabilities={capabilities}
         consumer={consumer}
       />
     );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx
index 1b35b5636872d..3d621367fc40a 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.test.tsx
@@ -26,10 +26,10 @@ describe('connector_add_modal', () => {
       http: mocks.http,
       capabilities: {
         ...capabilities,
-        siem: {
-          'actions:show': true,
-          'actions:save': true,
-          'actions:delete': true,
+        actions: {
+          show: true,
+          save: true,
+          delete: true,
         },
       },
       actionTypeRegistry: actionTypeRegistry as any,
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx
index 67c836fc12cf7..90abb986517d4 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_add_modal.tsx
@@ -166,6 +166,7 @@ export const ConnectorAddModal = ({
             actionTypeRegistry={actionTypeRegistry}
             docLinks={docLinks}
             http={http}
+            capabilities={capabilities}
             consumer={consumer}
           />
         </EuiModalBody>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
index 52425a616aad4..ca75e730062ab 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/connector_edit_flyout.tsx
@@ -195,6 +195,7 @@ export const ConnectorEditFlyout = ({
             actionTypeRegistry={actionTypeRegistry}
             http={http}
             docLinks={docLinks}
+            capabilities={capabilities}
             consumer={consumer}
           />
         ) : (
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
index 23a7223f9c21b..c96e62df71ce4 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.test.tsx
@@ -61,10 +61,10 @@ describe('actions_connectors_list component empty', () => {
       navigateToApp,
       capabilities: {
         ...capabilities,
-        siem: {
-          'actions:show': true,
-          'actions:save': true,
-          'actions:delete': true,
+        actions: {
+          show: true,
+          save: true,
+          delete: true,
         },
       },
       history: scopedHistoryMock.create(),
@@ -168,10 +168,10 @@ describe('actions_connectors_list component with items', () => {
       navigateToApp,
       capabilities: {
         ...capabilities,
-        securitySolution: {
-          'actions:show': true,
-          'actions:save': true,
-          'actions:delete': true,
+        actions: {
+          show: true,
+          save: true,
+          delete: true,
         },
       },
       history: scopedHistoryMock.create(),
@@ -256,10 +256,10 @@ describe('actions_connectors_list component empty with show only capability', ()
       navigateToApp,
       capabilities: {
         ...capabilities,
-        securitySolution: {
-          'actions:show': true,
-          'actions:save': false,
-          'actions:delete': false,
+        actions: {
+          show: true,
+          save: false,
+          delete: false,
         },
       },
       history: scopedHistoryMock.create(),
@@ -287,7 +287,7 @@ describe('actions_connectors_list component empty with show only capability', ()
 
   it('renders no permissions to create connector', async () => {
     await setup();
-    expect(wrapper.find('[defaultMessage="No permissions to create connector"]')).toHaveLength(1);
+    expect(wrapper.find('[defaultMessage="No permissions to create connectors"]')).toHaveLength(1);
     expect(wrapper.find('[data-test-subj="createActionButton"]')).toHaveLength(0);
   });
 });
@@ -345,10 +345,10 @@ describe('actions_connectors_list with show only capability', () => {
       navigateToApp,
       capabilities: {
         ...capabilities,
-        securitySolution: {
-          'actions:show': true,
-          'actions:save': false,
-          'actions:delete': false,
+        actions: {
+          show: true,
+          save: false,
+          delete: false,
         },
       },
       history: scopedHistoryMock.create(),
@@ -446,10 +446,10 @@ describe('actions_connectors_list component with disabled items', () => {
       navigateToApp,
       capabilities: {
         ...capabilities,
-        securitySolution: {
-          'actions:show': true,
-          'actions:save': true,
-          'actions:delete': true,
+        actions: {
+          show: true,
+          save: true,
+          delete: true,
         },
       },
       history: scopedHistoryMock.create(),
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
index 5d52896cc628f..837529bfc938d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
@@ -17,6 +17,7 @@ import {
   EuiBetaBadge,
   EuiToolTip,
   EuiButtonIcon,
+  EuiEmptyPrompt,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -324,30 +325,45 @@ export const ActionsConnectorsList: React.FunctionComponent = () => {
                   />
                 </EuiButton>,
               ],
-        toolsRight: [
-          <EuiButton
-            data-test-subj="createActionButton"
-            key="create-action"
-            fill
-            onClick={() => setAddFlyoutVisibility(true)}
-          >
-            <FormattedMessage
-              id="xpack.triggersActionsUI.sections.actionsConnectorsList.addActionButtonLabel"
-              defaultMessage="Create connector"
-            />
-          </EuiButton>,
-        ],
+        toolsRight: canSave
+          ? [
+              <EuiButton
+                data-test-subj="createActionButton"
+                key="create-action"
+                fill
+                onClick={() => setAddFlyoutVisibility(true)}
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.actionsConnectorsList.addActionButtonLabel"
+                  defaultMessage="Create connector"
+                />
+              </EuiButton>,
+            ]
+          : [],
       }}
     />
   );
 
   const noPermissionPrompt = (
-    <h2>
-      <FormattedMessage
-        id="xpack.triggersActionsUI.sections.actionsConnectorsList.noPermissionToCreateTitle"
-        defaultMessage="No permissions to create connector"
-      />
-    </h2>
+    <EuiEmptyPrompt
+      iconType="securityApp"
+      title={
+        <h1>
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.actionsConnectorsList.noPermissionToCreateTitle"
+            defaultMessage="No permissions to create connectors"
+          />
+        </h1>
+      }
+      body={
+        <p data-test-subj="permissionDeniedMessage">
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.actionsConnectorsList.noPermissionToCreateDescription"
+            defaultMessage="Contact your system administrator."
+          />
+        </p>
+      }
+    />
   );
 
   return (
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
index d8f0d0b6b20a0..ccaa180de0edc 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
@@ -20,6 +20,8 @@ import { i18n } from '@kbn/i18n';
 import { ViewInApp } from './view_in_app';
 import { PLUGIN } from '../../../constants/plugin';
 import { coreMock } from 'src/core/public/mocks';
+import { ALERTS_FEATURE_ID } from '../../../../../../alerts/common';
+
 const mockes = coreMock.createSetup();
 
 jest.mock('../../../app_context', () => ({
@@ -29,8 +31,6 @@ jest.mock('../../../app_context', () => ({
       get: jest.fn(() => ({})),
       securitySolution: {
         'alerting:show': true,
-        'alerting:save': true,
-        'alerting:delete': true,
       },
     },
     actionTypeRegistry: jest.fn(),
@@ -66,7 +66,9 @@ jest.mock('react-router-dom', () => ({
 }));
 
 jest.mock('../../../lib/capabilities', () => ({
+  hasAllPrivilege: jest.fn(() => true),
   hasSaveAlertsCapability: jest.fn(() => true),
+  hasExecuteActionsCapability: jest.fn(() => true),
 }));
 
 const mockAlertApis = {
@@ -77,6 +79,10 @@ const mockAlertApis = {
   requestRefresh: jest.fn(),
 };
 
+const authorizedConsumers = {
+  [ALERTS_FEATURE_ID]: { read: true, all: true },
+};
+
 // const AlertDetails = withBulkAlertOperations(RawAlertDetails);
 describe('alert_details', () => {
   // mock Api handlers
@@ -89,7 +95,8 @@ describe('alert_details', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     expect(
@@ -127,7 +134,8 @@ describe('alert_details', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     expect(
@@ -156,7 +164,8 @@ describe('alert_details', () => {
         actionGroups: [{ id: 'default', name: 'Default' }],
         actionVariables: { context: [], state: [] },
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: ALERTS_FEATURE_ID,
+        authorizedConsumers,
       };
 
       const actionTypes: ActionType[] = [
@@ -209,7 +218,8 @@ describe('alert_details', () => {
         actionGroups: [{ id: 'default', name: 'Default' }],
         actionVariables: { context: [], state: [] },
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: ALERTS_FEATURE_ID,
+        authorizedConsumers,
       };
       const actionTypes: ActionType[] = [
         {
@@ -267,7 +277,8 @@ describe('alert_details', () => {
         actionGroups: [{ id: 'default', name: 'Default' }],
         actionVariables: { context: [], state: [] },
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: ALERTS_FEATURE_ID,
+        authorizedConsumers,
       };
 
       expect(
@@ -286,7 +297,8 @@ describe('alert_details', () => {
         actionGroups: [{ id: 'default', name: 'Default' }],
         actionVariables: { context: [], state: [] },
         defaultActionGroupId: 'default',
-        producer: 'alerting',
+        producer: ALERTS_FEATURE_ID,
+        authorizedConsumers,
       };
 
       expect(
@@ -314,7 +326,8 @@ describe('disable button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableButton = shallow(
@@ -341,7 +354,8 @@ describe('disable button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableButton = shallow(
@@ -368,7 +382,8 @@ describe('disable button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const disableAlert = jest.fn();
@@ -404,7 +419,8 @@ describe('disable button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableAlert = jest.fn();
@@ -443,7 +459,8 @@ describe('mute button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableButton = shallow(
@@ -471,7 +488,8 @@ describe('mute button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableButton = shallow(
@@ -499,7 +517,8 @@ describe('mute button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const muteAlert = jest.fn();
@@ -536,7 +555,8 @@ describe('mute button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const unmuteAlert = jest.fn();
@@ -573,7 +593,8 @@ describe('mute button', () => {
       actionGroups: [{ id: 'default', name: 'Default' }],
       actionVariables: { context: [], state: [] },
       defaultActionGroupId: 'default',
-      producer: 'alerting',
+      producer: ALERTS_FEATURE_ID,
+      authorizedConsumers,
     };
 
     const enableButton = shallow(
@@ -590,6 +611,136 @@ describe('mute button', () => {
   });
 });
 
+describe('edit button', () => {
+  const actionTypes: ActionType[] = [
+    {
+      id: '.server-log',
+      name: 'Server log',
+      enabled: true,
+      enabledInConfig: true,
+      enabledInLicense: true,
+      minimumLicenseRequired: 'basic',
+    },
+  ];
+
+  it('should render an edit button when alert and actions are editable', () => {
+    const alert = mockAlert({
+      enabled: true,
+      muteAll: false,
+      actions: [
+        {
+          group: 'default',
+          id: uuid.v4(),
+          params: {},
+          actionTypeId: '.server-log',
+        },
+      ],
+    });
+
+    const alertType = {
+      id: '.noop',
+      name: 'No Op',
+      actionGroups: [{ id: 'default', name: 'Default' }],
+      actionVariables: { context: [], state: [] },
+      defaultActionGroupId: 'default',
+      producer: 'alerting',
+      authorizedConsumers,
+    };
+
+    expect(
+      shallow(
+        <AlertDetails
+          alert={alert}
+          alertType={alertType}
+          actionTypes={actionTypes}
+          {...mockAlertApis}
+        />
+      )
+        .find(EuiButtonEmpty)
+        .find('[name="edit"]')
+        .first()
+        .exists()
+    ).toBeTruthy();
+  });
+
+  it('should not render an edit button when alert editable but actions arent', () => {
+    const { hasExecuteActionsCapability } = jest.requireMock('../../../lib/capabilities');
+    hasExecuteActionsCapability.mockReturnValue(false);
+    const alert = mockAlert({
+      enabled: true,
+      muteAll: false,
+      actions: [
+        {
+          group: 'default',
+          id: uuid.v4(),
+          params: {},
+          actionTypeId: '.server-log',
+        },
+      ],
+    });
+
+    const alertType = {
+      id: '.noop',
+      name: 'No Op',
+      actionGroups: [{ id: 'default', name: 'Default' }],
+      actionVariables: { context: [], state: [] },
+      defaultActionGroupId: 'default',
+      producer: 'alerting',
+      authorizedConsumers,
+    };
+
+    expect(
+      shallow(
+        <AlertDetails
+          alert={alert}
+          alertType={alertType}
+          actionTypes={actionTypes}
+          {...mockAlertApis}
+        />
+      )
+        .find(EuiButtonEmpty)
+        .find('[name="edit"]')
+        .first()
+        .exists()
+    ).toBeFalsy();
+  });
+
+  it('should render an edit button when alert editable but actions arent when there are no actions on the alert', () => {
+    const { hasExecuteActionsCapability } = jest.requireMock('../../../lib/capabilities');
+    hasExecuteActionsCapability.mockReturnValue(false);
+    const alert = mockAlert({
+      enabled: true,
+      muteAll: false,
+      actions: [],
+    });
+
+    const alertType = {
+      id: '.noop',
+      name: 'No Op',
+      actionGroups: [{ id: 'default', name: 'Default' }],
+      actionVariables: { context: [], state: [] },
+      defaultActionGroupId: 'default',
+      producer: 'alerting',
+      authorizedConsumers,
+    };
+
+    expect(
+      shallow(
+        <AlertDetails
+          alert={alert}
+          alertType={alertType}
+          actionTypes={actionTypes}
+          {...mockAlertApis}
+        />
+      )
+        .find(EuiButtonEmpty)
+        .find('[name="edit"]')
+        .first()
+        .exists()
+    ).toBeTruthy();
+  });
+});
+
 function mockAlert(overloads: Partial<Alert> = {}): Alert {
   return {
     id: uuid.v4(),
@@ -597,7 +748,7 @@ function mockAlert(overloads: Partial<Alert> = {}): Alert {
     name: `alert-${uuid.v4()}`,
     tags: [],
     alertTypeId: '.noop',
-    consumer: 'consumer',
+    consumer: ALERTS_FEATURE_ID,
     schedule: { interval: '1m' },
     actions: [],
     params: {},
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
index 66a7ac25d4a70..b1dd78ff59f34 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
@@ -28,7 +28,7 @@ import {
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { useAppDependencies } from '../../../app_context';
-import { hasSaveAlertsCapability } from '../../../lib/capabilities';
+import { hasAllPrivilege, hasExecuteActionsCapability } from '../../../lib/capabilities';
 import { Alert, AlertType, ActionType } from '../../../../types';
 import {
   ComponentOpts as BulkOperationsComponentOpts,
@@ -71,12 +71,20 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
     dataPlugin,
   } = useAppDependencies();
 
-  const canSave = hasSaveAlertsCapability(capabilities);
+  const canExecuteActions = hasExecuteActionsCapability(capabilities);
+  const canSaveAlert =
+    hasAllPrivilege(alert, alertType) &&
+    // if the alert has actions, can the user save the alert's action params
+    (canExecuteActions || (!canExecuteActions && alert.actions.length === 0));
+
   const actionTypesByTypeId = keyBy(actionTypes, 'id');
   const hasEditButton =
-    canSave && alertTypeRegistry.has(alert.alertTypeId)
+    // can the user save the alert
+    canSaveAlert &&
+    // is this alert type editable from within Alerts Management
+    (alertTypeRegistry.has(alert.alertTypeId)
       ? !alertTypeRegistry.get(alert.alertTypeId).requiresAppContext
-      : false;
+      : false);
 
   const alertActions = alert.actions;
   const uniqueActions = Array.from(new Set(alertActions.map((item: any) => item.actionTypeId)));
@@ -124,6 +132,7 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
                         data-test-subj="openEditAlertFlyoutButton"
                         iconType="pencil"
                         onClick={() => setEditFlyoutVisibility(true)}
+                        name="edit"
                       >
                         <FormattedMessage
                           id="xpack.triggersActionsUI.sections.alertDetails.editAlertButtonLabel"
@@ -204,7 +213,7 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
                   <EuiFlexItem grow={false}>
                     <EuiSwitch
                       name="disable"
-                      disabled={!canSave}
+                      disabled={!canSaveAlert}
                       checked={!isEnabled}
                       data-test-subj="disableSwitch"
                       onChange={async () => {
@@ -229,7 +238,7 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
                     <EuiSwitch
                       name="mute"
                       checked={isMuted}
-                      disabled={!canSave || !isEnabled}
+                      disabled={!canSaveAlert || !isEnabled}
                       data-test-subj="muteSwitch"
                       onChange={async () => {
                         if (isMuted) {
@@ -255,7 +264,11 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
             <EuiFlexGroup>
               <EuiFlexItem>
                 {alert.enabled ? (
-                  <AlertInstancesRouteWithApi requestRefresh={requestRefresh} alert={alert} />
+                  <AlertInstancesRouteWithApi
+                    requestRefresh={requestRefresh}
+                    alert={alert}
+                    readOnly={!canSaveAlert}
+                  />
                 ) : (
                   <Fragment>
                     <EuiSpacer />
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.test.tsx
index 2531fd2625b4b..dd2ee48b7a620 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.test.tsx
@@ -52,7 +52,9 @@ describe('alert_instances', () => {
     ];
 
     expect(
-      shallow(<AlertInstances {...mockAPIs} alert={alert} alertState={alertState} />)
+      shallow(
+        <AlertInstances {...mockAPIs} alert={alert} alertState={alertState} readOnly={false} />
+      )
         .find(EuiBasicTable)
         .prop('items')
     ).toEqual(instances);
@@ -68,6 +70,7 @@ describe('alert_instances', () => {
           durationEpoch={fake2MinutesAgo.getTime()}
           {...mockAPIs}
           alert={alert}
+          readOnly={false}
           alertState={alertState}
         />
       )
@@ -95,6 +98,7 @@ describe('alert_instances', () => {
         <AlertInstances
           {...mockAPIs}
           alert={alert}
+          readOnly={false}
           alertState={mockAlertState({
             alertInstances: instances,
           })}
@@ -118,6 +122,7 @@ describe('alert_instances', () => {
         <AlertInstances
           {...mockAPIs}
           alert={alert}
+          readOnly={false}
           alertState={mockAlertState({
             alertInstances: {},
           })}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
index 799886d264547..e239188659178 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx
@@ -20,13 +20,15 @@ import { DEFAULT_SEARCH_PAGE_SIZE } from '../../../constants';
 
 type AlertInstancesProps = {
   alert: Alert;
+  readOnly: boolean;
   alertState: AlertTaskState;
   requestRefresh: () => Promise<void>;
   durationEpoch?: number;
 } & Pick<AlertApis, 'muteAlertInstance' | 'unmuteAlertInstance'>;
 
 export const alertInstancesTableColumns = (
-  onMuteAction: (instance: AlertInstanceListItem) => Promise<void>
+  onMuteAction: (instance: AlertInstanceListItem) => Promise<void>,
+  readOnly: boolean
 ) => [
   {
     field: 'instance',
@@ -90,6 +92,7 @@ export const alertInstancesTableColumns = (
             showLabel={false}
             compressed={true}
             checked={alertInstance.isMuted}
+            disabled={readOnly}
             data-test-subj={`muteAlertInstanceButton_${alertInstance.instance}`}
             onChange={() => onMuteAction(alertInstance)}
           />
@@ -109,6 +112,7 @@ function durationAsString(duration: Duration): string {
 
 export function AlertInstances({
   alert,
+  readOnly,
   alertState: { alertInstances = {} },
   muteAlertInstance,
   unmuteAlertInstance,
@@ -162,7 +166,7 @@ export function AlertInstances({
         cellProps={() => ({
           'data-test-subj': 'cell',
         })}
-        columns={alertInstancesTableColumns(onMuteAction)}
+        columns={alertInstancesTableColumns(onMuteAction, readOnly)}
         data-test-subj="alertInstancesList"
       />
     </Fragment>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.test.tsx
index 9bff33e4aa69c..975856beba556 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.test.tsx
@@ -22,9 +22,9 @@ describe('alert_state_route', () => {
     const alert = mockAlert();
 
     expect(
-      shallow(<AlertInstancesRoute alert={alert} {...mockApis()} />).containsMatchingElement(
-        <EuiLoadingSpinner size="l" />
-      )
+      shallow(
+        <AlertInstancesRoute readOnly={false} alert={alert} {...mockApis()} />
+      ).containsMatchingElement(<EuiLoadingSpinner size="l" />)
     ).toBeTruthy();
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx
index a02b44523e26c..d8a7d18eb87a9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx
@@ -18,11 +18,13 @@ import { AlertInstancesWithApi as AlertInstances } from './alert_instances';
 
 type WithAlertStateProps = {
   alert: Alert;
+  readOnly: boolean;
   requestRefresh: () => Promise<void>;
 } & Pick<AlertApis, 'loadAlertState'>;
 
 export const AlertInstancesRoute: React.FunctionComponent<WithAlertStateProps> = ({
   alert,
+  readOnly,
   requestRefresh,
   loadAlertState,
 }) => {
@@ -36,7 +38,12 @@ export const AlertInstancesRoute: React.FunctionComponent<WithAlertStateProps> =
   }, [alert]);
 
   return alertState ? (
-    <AlertInstances requestRefresh={requestRefresh} alert={alert} alertState={alertState} />
+    <AlertInstances
+      requestRefresh={requestRefresh}
+      alert={alert}
+      readOnly={readOnly}
+      alertState={alertState}
+    />
   ) : (
     <div
       style={{
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.test.tsx
index f6e8dc49ec275..10efabd70aded 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.test.tsx
@@ -18,6 +18,12 @@ import { chartPluginMock } from '../../../../../../../src/plugins/charts/public/
 import { dataPluginMock } from '../../../../../../../src/plugins/data/public/mocks';
 import { ReactWrapper } from 'enzyme';
 import { AppContextProvider } from '../../app_context';
+import { ALERTS_FEATURE_ID } from '../../../../../alerts/common';
+jest.mock('../../lib/alert_api', () => ({
+  loadAlertTypes: jest.fn(),
+  health: jest.fn((async) => ({ isSufficientlySecure: true, hasPermanentEncryptionKey: true })),
+}));
+
 const actionTypeRegistry = actionTypeRegistryMock.create();
 const alertTypeRegistry = alertTypeRegistryMock.create();
 
@@ -42,6 +48,30 @@ describe('alert_add', () => {
 
   async function setup() {
     const mocks = coreMock.createSetup();
+    const { loadAlertTypes } = jest.requireMock('../../lib/alert_api');
+    const alertTypes = [
+      {
+        id: 'my-alert-type',
+        name: 'Test',
+        actionGroups: [
+          {
+            id: 'testActionGroup',
+            name: 'Test Action Group',
+          },
+        ],
+        defaultActionGroupId: 'testActionGroup',
+        producer: ALERTS_FEATURE_ID,
+        authorizedConsumers: {
+          [ALERTS_FEATURE_ID]: { read: true, all: true },
+          test: { read: true, all: true },
+        },
+        actionVariables: {
+          context: [],
+          state: [],
+        },
+      },
+    ];
+    loadAlertTypes.mockResolvedValue(alertTypes);
     const [
       {
         application: { capabilities },
@@ -120,7 +150,11 @@ describe('alert_add', () => {
             },
           }}
         >
-          <AlertAdd consumer={'alerts'} addFlyoutVisible={true} setAddFlyoutVisibility={() => {}} />
+          <AlertAdd
+            consumer={ALERTS_FEATURE_ID}
+            addFlyoutVisible={true}
+            setAddFlyoutVisibility={() => {}}
+          />
         </AlertsContextProvider>
       </AppContextProvider>
     );
@@ -135,6 +169,10 @@ describe('alert_add', () => {
   it('renders alert add flyout', async () => {
     await setup();
 
+    await new Promise((resolve) => {
+      setTimeout(resolve, 1000);
+    });
+
     expect(wrapper.find('[data-test-subj="addAlertFlyoutTitle"]').exists()).toBeTruthy();
     expect(wrapper.find('[data-test-subj="saveAlertButton"]').exists()).toBeTruthy();
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx
index 52c281761f2c1..20cbd42e34b67 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx
@@ -168,6 +168,9 @@ export const AlertAdd = ({
               dispatch={dispatch}
               errors={errors}
               canChangeTrigger={canChangeTrigger}
+              operation={i18n.translate('xpack.triggersActionsUI.sections.alertAdd.operationName', {
+                defaultMessage: 'create',
+              })}
             />
           </EuiFlyoutBody>
           <EuiFlyoutFooter>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx
index 076f4b69fb496..f991cea9c009c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx
@@ -156,6 +156,9 @@ export const AlertEdit = ({ initialAlert, onClose }: AlertEditProps) => {
               errors={errors}
               canChangeTrigger={false}
               setHasActionsDisabled={setHasActionsDisabled}
+              operation="i18n.translate('xpack.triggersActionsUI.sections.alertEdit.operationName', {
+                defaultMessage: 'edit',
+              })"
             />
           </EuiFlyoutBody>
           <EuiFlyoutFooter>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.test.tsx
index c9ce2848c5670..6091519f5851e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.test.tsx
@@ -13,6 +13,8 @@ import { ValidationResult, Alert } from '../../../types';
 import { AlertForm } from './alert_form';
 import { AlertsContextProvider } from '../../context/alerts_context';
 import { coreMock } from 'src/core/public/mocks';
+import { ALERTS_FEATURE_ID } from '../../../../../alerts/common';
+
 const actionTypeRegistry = actionTypeRegistryMock.create();
 const alertTypeRegistry = alertTypeRegistryMock.create();
 jest.mock('../../lib/alert_api', () => ({
@@ -20,6 +22,10 @@ jest.mock('../../lib/alert_api', () => ({
 }));
 
 describe('alert_form', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
   let deps: any;
   const alertType = {
     id: 'my-alert-type',
@@ -63,6 +69,26 @@ describe('alert_form', () => {
 
     async function setup() {
       const mocks = coreMock.createSetup();
+      const { loadAlertTypes } = jest.requireMock('../../lib/alert_api');
+      const alertTypes = [
+        {
+          id: 'my-alert-type',
+          name: 'Test',
+          actionGroups: [
+            {
+              id: 'testActionGroup',
+              name: 'Test Action Group',
+            },
+          ],
+          defaultActionGroupId: 'testActionGroup',
+          producer: ALERTS_FEATURE_ID,
+          authorizedConsumers: {
+            [ALERTS_FEATURE_ID]: { read: true, all: true },
+            test: { read: true, all: true },
+          },
+        },
+      ];
+      loadAlertTypes.mockResolvedValue(alertTypes);
       const [
         {
           application: { capabilities },
@@ -85,7 +111,7 @@ describe('alert_form', () => {
       const initialAlert = ({
         name: 'test',
         params: {},
-        consumer: 'alerts',
+        consumer: ALERTS_FEATURE_ID,
         schedule: {
           interval: '1m',
         },
@@ -111,7 +137,12 @@ describe('alert_form', () => {
             capabilities: deps!.capabilities,
           }}
         >
-          <AlertForm alert={initialAlert} dispatch={() => {}} errors={{ name: [], interval: [] }} />
+          <AlertForm
+            alert={initialAlert}
+            dispatch={() => {}}
+            errors={{ name: [], interval: [] }}
+            operation="create"
+          />
         </AlertsContextProvider>
       );
 
@@ -167,7 +198,11 @@ describe('alert_form', () => {
             },
           ],
           defaultActionGroupId: 'testActionGroup',
-          producer: 'alerting',
+          producer: ALERTS_FEATURE_ID,
+          authorizedConsumers: {
+            [ALERTS_FEATURE_ID]: { read: true, all: true },
+            test: { read: true, all: true },
+          },
         },
         {
           id: 'same-consumer-producer-alert-type',
@@ -180,6 +215,10 @@ describe('alert_form', () => {
           ],
           defaultActionGroupId: 'testActionGroup',
           producer: 'test',
+          authorizedConsumers: {
+            [ALERTS_FEATURE_ID]: { read: true, all: true },
+            test: { read: true, all: true },
+          },
         },
       ]);
       const mocks = coreMock.createSetup();
@@ -250,7 +289,12 @@ describe('alert_form', () => {
             capabilities: deps!.capabilities,
           }}
         >
-          <AlertForm alert={initialAlert} dispatch={() => {}} errors={{ name: [], interval: [] }} />
+          <AlertForm
+            alert={initialAlert}
+            dispatch={() => {}}
+            errors={{ name: [], interval: [] }}
+            operation="create"
+          />
         </AlertsContextProvider>
       );
 
@@ -302,7 +346,7 @@ describe('alert_form', () => {
         name: 'test',
         alertTypeId: alertType.id,
         params: {},
-        consumer: 'alerts',
+        consumer: ALERTS_FEATURE_ID,
         schedule: {
           interval: '1m',
         },
@@ -328,7 +372,12 @@ describe('alert_form', () => {
             capabilities: deps!.capabilities,
           }}
         >
-          <AlertForm alert={initialAlert} dispatch={() => {}} errors={{ name: [], interval: [] }} />
+          <AlertForm
+            alert={initialAlert}
+            dispatch={() => {}}
+            errors={{ name: [], interval: [] }}
+            operation="create"
+          />
         </AlertsContextProvider>
       );
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
index 874091b2bb7a8..47ec2c436ca50 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx
@@ -24,6 +24,7 @@ import {
   EuiButtonIcon,
   EuiHorizontalRule,
   EuiLoadingSpinner,
+  EuiEmptyPrompt,
 } from '@elastic/eui';
 import { some, filter, map, fold } from 'fp-ts/lib/Option';
 import { pipe } from 'fp-ts/lib/pipeable';
@@ -38,6 +39,8 @@ import { AlertTypeModel, Alert, IErrorObject, AlertAction, AlertTypeIndex } from
 import { getTimeOptions } from '../../../common/lib/get_time_options';
 import { useAlertsContext } from '../../context/alerts_context';
 import { ActionForm } from '../action_connector_form';
+import { ALERTS_FEATURE_ID } from '../../../../../alerts/common';
+import { hasAllPrivilege, hasShowActionsCapability } from '../../lib/capabilities';
 
 export function validateBaseProperties(alertObject: Alert) {
   const validationResult = { errors: {} };
@@ -78,6 +81,7 @@ interface AlertFormProps {
   errors: IErrorObject;
   canChangeTrigger?: boolean; // to hide Change trigger button
   setHasActionsDisabled?: (value: boolean) => void;
+  operation: string;
 }
 
 export const AlertForm = ({
@@ -86,6 +90,7 @@ export const AlertForm = ({
   dispatch,
   errors,
   setHasActionsDisabled,
+  operation,
 }: AlertFormProps) => {
   const alertsContext = useAlertsContext();
   const {
@@ -96,6 +101,7 @@ export const AlertForm = ({
     docLinks,
     capabilities,
   } = alertsContext;
+  const canShowActions = hasShowActionsCapability(capabilities);
 
   const [alertTypeModel, setAlertTypeModel] = useState<AlertTypeModel | null>(
     alert.alertTypeId ? alertTypeRegistry.get(alert.alertTypeId) : null
@@ -121,12 +127,12 @@ export const AlertForm = ({
     (async () => {
       try {
         const alertTypes = await loadAlertTypes({ http });
-        const index: AlertTypeIndex = {};
+        const index: AlertTypeIndex = new Map();
         for (const alertTypeItem of alertTypes) {
-          index[alertTypeItem.id] = alertTypeItem;
+          index.set(alertTypeItem.id, alertTypeItem);
         }
-        if (alert.alertTypeId && index[alert.alertTypeId]) {
-          setDefaultActionGroupId(index[alert.alertTypeId].defaultActionGroupId);
+        if (alert.alertTypeId && index.has(alert.alertTypeId)) {
+          setDefaultActionGroupId(index.get(alert.alertTypeId)!.defaultActionGroupId);
         }
         setAlertTypesIndex(index);
       } catch (e) {
@@ -167,21 +173,21 @@ export const AlertForm = ({
     ? alertTypeModel.alertParamsExpression
     : null;
 
-  const alertTypeRegistryList =
-    alert.consumer === 'alerts'
-      ? alertTypeRegistry
-          .list()
-          .filter(
-            (alertTypeRegistryItem: AlertTypeModel) => !alertTypeRegistryItem.requiresAppContext
-          )
-      : alertTypeRegistry
-          .list()
-          .filter(
-            (alertTypeRegistryItem: AlertTypeModel) =>
-              alertTypesIndex &&
-              alertTypesIndex[alertTypeRegistryItem.id] &&
-              alertTypesIndex[alertTypeRegistryItem.id].producer === alert.consumer
-          );
+  const alertTypeRegistryList = alertTypesIndex
+    ? alertTypeRegistry
+        .list()
+        .filter(
+          (alertTypeRegistryItem: AlertTypeModel) =>
+            alertTypesIndex.has(alertTypeRegistryItem.id) &&
+            hasAllPrivilege(alert, alertTypesIndex.get(alertTypeRegistryItem.id))
+        )
+        .filter((alertTypeRegistryItem: AlertTypeModel) =>
+          alert.consumer === ALERTS_FEATURE_ID
+            ? !alertTypeRegistryItem.requiresAppContext
+            : alertTypesIndex.get(alertTypeRegistryItem.id)!.producer === alert.consumer
+        )
+    : [];
+
   const alertTypeNodes = alertTypeRegistryList.map(function (item, index) {
     return (
       <EuiKeyPadMenuItem
@@ -192,8 +198,8 @@ export const AlertForm = ({
           setAlertProperty('alertTypeId', item.id);
           setAlertTypeModel(item);
           setAlertProperty('params', {});
-          if (alertTypesIndex && alertTypesIndex[item.id]) {
-            setDefaultActionGroupId(alertTypesIndex[item.id].defaultActionGroupId);
+          if (alertTypesIndex && alertTypesIndex.has(item.id)) {
+            setDefaultActionGroupId(alertTypesIndex.get(item.id)!.defaultActionGroupId);
           }
         }}
       >
@@ -257,13 +263,13 @@ export const AlertForm = ({
           />
         </Suspense>
       ) : null}
-      {defaultActionGroupId ? (
+      {canShowActions && defaultActionGroupId ? (
         <ActionForm
           actions={alert.actions}
           setHasActionsDisabled={setHasActionsDisabled}
           messageVariables={
-            alertTypesIndex && alertTypesIndex[alert.alertTypeId]
-              ? actionVariablesFromAlertType(alertTypesIndex[alert.alertTypeId]).map(
+            alertTypesIndex && alertTypesIndex.has(alert.alertTypeId)
+              ? actionVariablesFromAlertType(alertTypesIndex.get(alert.alertTypeId)!).map(
                   (av) => av.name
                 )
               : undefined
@@ -487,7 +493,7 @@ export const AlertForm = ({
       <EuiSpacer size="m" />
       {alertTypeModel ? (
         <Fragment>{alertTypeDetails}</Fragment>
-      ) : (
+      ) : alertTypeNodes.length ? (
         <Fragment>
           <EuiHorizontalRule />
           <EuiTitle size="s">
@@ -503,7 +509,37 @@ export const AlertForm = ({
             {alertTypeNodes}
           </EuiFlexGroup>
         </Fragment>
+      ) : (
+        <NoAuthorizedAlertTypes operation={operation} />
       )}
     </EuiForm>
   );
 };
+
+const NoAuthorizedAlertTypes = ({ operation }: { operation: string }) => (
+  <EuiEmptyPrompt
+    iconType="lock"
+    data-test-subj="noAuthorizedAlertTypesPrompt"
+    titleSize="xs"
+    title={
+      <h2>
+        <FormattedMessage
+          id="xpack.triggersActionsUI.sections.alertForm.error.noAuthorizedAlertTypesTitle"
+          defaultMessage="You have not been authorized to {operation} any Alert types"
+          values={{ operation }}
+        />
+      </h2>
+    }
+    body={
+      <div>
+        <p role="banner">
+          <FormattedMessage
+            id="xpack.triggersActionsUI.sections.alertForm.error.noAuthorizedAlertTypes"
+            defaultMessage="In order to {operation} an Alert you need to have been granted the appropriate privileges."
+            values={{ operation }}
+          />
+        </p>
+      </div>
+    }
+  />
+);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
index 69b0856297bb5..b8278aa701293 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.test.tsx
@@ -17,6 +17,7 @@ import { AppContextProvider } from '../../../app_context';
 import { chartPluginMock } from '../../../../../../../../src/plugins/charts/public/mocks';
 import { dataPluginMock } from '../../../../../../../../src/plugins/data/public/mocks';
 import { alertingPluginMock } from '../../../../../../alerts/public/mocks';
+import { ALERTS_FEATURE_ID } from '../../../../../../alerts/common';
 
 jest.mock('../../../lib/action_connector_api', () => ({
   loadActionTypes: jest.fn(),
@@ -47,6 +48,17 @@ const alertType = {
   alertParamsExpression: () => null,
   requiresAppContext: false,
 };
+const alertTypeFromApi = {
+  id: 'test_alert_type',
+  name: 'some alert type',
+  actionGroups: [{ id: 'default', name: 'Default' }],
+  actionVariables: { context: [], state: [] },
+  defaultActionGroupId: 'default',
+  producer: ALERTS_FEATURE_ID,
+  authorizedConsumers: {
+    [ALERTS_FEATURE_ID]: { read: true, all: true },
+  },
+};
 alertTypeRegistry.list.mockReturnValue([alertType]);
 actionTypeRegistry.list.mockReturnValue([]);
 
@@ -73,7 +85,7 @@ describe('alerts_list component empty', () => {
         name: 'Test2',
       },
     ]);
-    loadAlertTypes.mockResolvedValue([{ id: 'test_alert_type', name: 'some alert type' }]);
+    loadAlertTypes.mockResolvedValue([alertTypeFromApi]);
     loadAllActions.mockResolvedValue([]);
 
     const mockes = coreMock.createSetup();
@@ -98,8 +110,6 @@ describe('alerts_list component empty', () => {
         ...capabilities,
         securitySolution: {
           'alerting:show': true,
-          'alerting:save': true,
-          'alerting:delete': true,
         },
       },
       history: scopedHistoryMock.create(),
@@ -193,7 +203,7 @@ describe('alerts_list component with items', () => {
         name: 'Test2',
       },
     ]);
-    loadAlertTypes.mockResolvedValue([{ id: 'test_alert_type', name: 'some alert type' }]);
+    loadAlertTypes.mockResolvedValue([alertTypeFromApi]);
     loadAllActions.mockResolvedValue([]);
     const mockes = coreMock.createSetup();
     const [
@@ -217,8 +227,6 @@ describe('alerts_list component with items', () => {
         ...capabilities,
         securitySolution: {
           'alerting:show': true,
-          'alerting:save': true,
-          'alerting:delete': true,
         },
       },
       history: scopedHistoryMock.create(),
@@ -299,8 +307,6 @@ describe('alerts_list component empty with show only capability', () => {
         ...capabilities,
         securitySolution: {
           'alerting:show': true,
-          'alerting:save': false,
-          'alerting:delete': false,
         },
       },
       history: scopedHistoryMock.create(),
@@ -390,7 +396,8 @@ describe('alerts_list with show only capability', () => {
         name: 'Test2',
       },
     ]);
-    loadAlertTypes.mockResolvedValue([{ id: 'test_alert_type', name: 'some alert type' }]);
+
+    loadAlertTypes.mockResolvedValue([alertTypeFromApi]);
     loadAllActions.mockResolvedValue([]);
     const mockes = coreMock.createSetup();
     const [
@@ -414,8 +421,6 @@ describe('alerts_list with show only capability', () => {
         ...capabilities,
         securitySolution: {
           'alerting:show': true,
-          'alerting:save': false,
-          'alerting:delete': false,
         },
       },
       history: scopedHistoryMock.create(),
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
index 2929ce6defeaf..8cb7afbda0e70 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx
@@ -18,6 +18,7 @@ import {
   EuiSpacer,
   EuiLink,
   EuiLoadingSpinner,
+  EuiEmptyPrompt,
 } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
 
@@ -33,10 +34,12 @@ import { TypeFilter } from './type_filter';
 import { ActionTypeFilter } from './action_type_filter';
 import { loadAlerts, loadAlertTypes, deleteAlerts } from '../../../lib/alert_api';
 import { loadActionTypes } from '../../../lib/action_connector_api';
-import { hasDeleteAlertsCapability, hasSaveAlertsCapability } from '../../../lib/capabilities';
+import { hasExecuteActionsCapability } from '../../../lib/capabilities';
 import { routeToAlertDetails, DEFAULT_SEARCH_PAGE_SIZE } from '../../../constants';
 import { DeleteModalConfirmation } from '../../../components/delete_modal_confirmation';
 import { EmptyPrompt } from '../../../components/prompts/empty_prompt';
+import { ALERTS_FEATURE_ID } from '../../../../../../alerts/common';
+import { hasAllPrivilege } from '../../../lib/capabilities';
 
 const ENTER_KEY = 13;
 
@@ -64,8 +67,7 @@ export const AlertsList: React.FunctionComponent = () => {
     charts,
     dataPlugin,
   } = useAppDependencies();
-  const canDelete = hasDeleteAlertsCapability(capabilities);
-  const canSave = hasSaveAlertsCapability(capabilities);
+  const canExecuteActions = hasExecuteActionsCapability(capabilities);
 
   const [actionTypes, setActionTypes] = useState<ActionType[]>([]);
   const [selectedIds, setSelectedIds] = useState<string[]>([]);
@@ -79,7 +81,7 @@ export const AlertsList: React.FunctionComponent = () => {
   const [alertTypesState, setAlertTypesState] = useState<AlertTypeState>({
     isLoading: false,
     isInitialized: false,
-    data: {},
+    data: new Map(),
   });
   const [alertsState, setAlertsState] = useState<AlertState>({
     isLoading: false,
@@ -98,9 +100,9 @@ export const AlertsList: React.FunctionComponent = () => {
       try {
         setAlertTypesState({ ...alertTypesState, isLoading: true });
         const alertTypes = await loadAlertTypes({ http });
-        const index: AlertTypeIndex = {};
+        const index: AlertTypeIndex = new Map();
         for (const alertType of alertTypes) {
-          index[alertType.id] = alertType;
+          index.set(alertType.id, alertType);
         }
         setAlertTypesState({ isLoading: false, data: index, isInitialized: true });
       } catch (e) {
@@ -245,11 +247,16 @@ export const AlertsList: React.FunctionComponent = () => {
     },
   ];
 
+  const authorizedAlertTypes = [...alertTypesState.data.values()];
+  const authorizedToCreateAnyAlerts = authorizedAlertTypes.some(
+    (alertType) => alertType.authorizedConsumers[ALERTS_FEATURE_ID]?.all
+  );
+
   const toolsRight = [
     <TypeFilter
       key="type-filter"
       onChange={(types: string[]) => setTypesFilter(types)}
-      options={Object.values(alertTypesState.data)
+      options={authorizedAlertTypes
         .map((alertType) => ({
           value: alertType.id,
           name: alertType.name,
@@ -263,7 +270,7 @@ export const AlertsList: React.FunctionComponent = () => {
     />,
   ];
 
-  if (canSave) {
+  if (authorizedToCreateAnyAlerts) {
     toolsRight.push(
       <EuiButton
         key="create-alert"
@@ -279,16 +286,23 @@ export const AlertsList: React.FunctionComponent = () => {
     );
   }
 
+  const authorizedToModifySelectedAlerts = selectedIds.length
+    ? filterAlertsById(alertsState.data, selectedIds).every((selectedAlert) =>
+        hasAllPrivilege(selectedAlert, alertTypesState.data.get(selectedAlert.alertTypeId))
+      )
+    : false;
+
   const table = (
     <Fragment>
       <EuiFlexGroup gutterSize="s">
-        {selectedIds.length > 0 && canDelete && (
+        {selectedIds.length > 0 && authorizedToModifySelectedAlerts && (
           <EuiFlexItem grow={false}>
             <BulkOperationPopover>
               <AlertQuickEditButtons
                 selectedItems={convertAlertsToTableItems(
                   filterAlertsById(alertsState.data, selectedIds),
-                  alertTypesState.data
+                  alertTypesState.data,
+                  canExecuteActions
                 )}
                 onPerformingAction={() => setIsPerformingAction(true)}
                 onActionPerformed={() => {
@@ -337,7 +351,7 @@ export const AlertsList: React.FunctionComponent = () => {
         items={
           alertTypesState.isInitialized === false
             ? []
-            : convertAlertsToTableItems(alertsState.data, alertTypesState.data)
+            : convertAlertsToTableItems(alertsState.data, alertTypesState.data, canExecuteActions)
         }
         itemId="id"
         columns={alertsTableColumns}
@@ -354,15 +368,12 @@ export const AlertsList: React.FunctionComponent = () => {
           /* Don't display alert count until we have the alert types initialized */
           totalItemCount: alertTypesState.isInitialized === false ? 0 : alertsState.totalItemCount,
         }}
-        selection={
-          canDelete
-            ? {
-                onSelectionChange(updatedSelectedItemsList: AlertTableItem[]) {
-                  setSelectedIds(updatedSelectedItemsList.map((item) => item.id));
-                },
-              }
-            : undefined
-        }
+        selection={{
+          selectable: (alert: AlertTableItem) => alert.isEditable,
+          onSelectionChange(updatedSelectedItemsList: AlertTableItem[]) {
+            setSelectedIds(updatedSelectedItemsList.map((item) => item.id));
+          },
+        }}
         onChange={({ page: changedPage }: { page: Pagination }) => {
           setPage(changedPage);
         }}
@@ -370,7 +381,11 @@ export const AlertsList: React.FunctionComponent = () => {
     </Fragment>
   );
 
-  const loadedItems = convertAlertsToTableItems(alertsState.data, alertTypesState.data);
+  const loadedItems = convertAlertsToTableItems(
+    alertsState.data,
+    alertTypesState.data,
+    canExecuteActions
+  );
 
   const isFilterApplied = !(
     isEmpty(searchText) &&
@@ -421,8 +436,10 @@ export const AlertsList: React.FunctionComponent = () => {
             <EuiLoadingSpinner size="xl" />
           </EuiFlexItem>
         </EuiFlexGroup>
-      ) : (
+      ) : authorizedToCreateAnyAlerts ? (
         <EmptyPrompt onCTAClicked={() => setAlertFlyoutVisibility(true)} />
+      ) : (
+        noPermissionPrompt
       )}
       <AlertsContextProvider
         value={{
@@ -439,7 +456,7 @@ export const AlertsList: React.FunctionComponent = () => {
         }}
       >
         <AlertAdd
-          consumer={'alerts'}
+          consumer={ALERTS_FEATURE_ID}
           addFlyoutVisible={alertFlyoutVisible}
           setAddFlyoutVisibility={setAlertFlyoutVisibility}
         />
@@ -448,15 +465,44 @@ export const AlertsList: React.FunctionComponent = () => {
   );
 };
 
+const noPermissionPrompt = (
+  <EuiEmptyPrompt
+    iconType="securityApp"
+    title={
+      <h1>
+        <FormattedMessage
+          id="xpack.triggersActionsUI.sections.alertsList.noPermissionToCreateTitle"
+          defaultMessage="No permissions to create alerts"
+        />
+      </h1>
+    }
+    body={
+      <p data-test-subj="permissionDeniedMessage">
+        <FormattedMessage
+          id="xpack.triggersActionsUI.sections.alertsList.noPermissionToCreateDescription"
+          defaultMessage="Contact your system administrator."
+        />
+      </p>
+    }
+  />
+);
+
 function filterAlertsById(alerts: Alert[], ids: string[]): Alert[] {
   return alerts.filter((alert) => ids.includes(alert.id));
 }
 
-function convertAlertsToTableItems(alerts: Alert[], alertTypesIndex: AlertTypeIndex) {
+function convertAlertsToTableItems(
+  alerts: Alert[],
+  alertTypesIndex: AlertTypeIndex,
+  canExecuteActions: boolean
+) {
   return alerts.map((alert) => ({
     ...alert,
     actionsText: alert.actions.length,
     tagsText: alert.tags.join(', '),
-    alertType: alertTypesIndex[alert.alertTypeId]?.name ?? alert.alertTypeId,
+    alertType: alertTypesIndex.get(alert.alertTypeId)?.name ?? alert.alertTypeId,
+    isEditable:
+      hasAllPrivilege(alert, alertTypesIndex.get(alert.alertTypeId)) &&
+      (canExecuteActions || (!canExecuteActions && !alert.actions.length)),
   }));
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
index 2b746e5dea457..9279f8a1745fc 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx
@@ -20,8 +20,6 @@ import {
 } from '@elastic/eui';
 
 import { AlertTableItem } from '../../../../types';
-import { useAppDependencies } from '../../../app_context';
-import { hasDeleteAlertsCapability, hasSaveAlertsCapability } from '../../../lib/capabilities';
 import {
   ComponentOpts as BulkOperationsComponentOpts,
   withBulkAlertOperations,
@@ -43,16 +41,11 @@ export const CollapsedItemActions: React.FunctionComponent<ComponentOpts> = ({
   muteAlert,
   setAlertsToDelete,
 }: ComponentOpts) => {
-  const { capabilities } = useAppDependencies();
-
-  const canDelete = hasDeleteAlertsCapability(capabilities);
-  const canSave = hasSaveAlertsCapability(capabilities);
-
   const [isPopoverOpen, setIsPopoverOpen] = useState<boolean>(false);
 
   const button = (
     <EuiButtonIcon
-      disabled={!canDelete && !canSave}
+      disabled={!item.isEditable}
       iconType="boxesVertical"
       onClick={() => setIsPopoverOpen(!isPopoverOpen)}
       aria-label={i18n.translate(
@@ -75,7 +68,7 @@ export const CollapsedItemActions: React.FunctionComponent<ComponentOpts> = ({
         <div className="actCollapsedItemActions__item">
           <EuiSwitch
             name="disable"
-            disabled={!canSave}
+            disabled={!item.isEditable}
             compressed
             checked={!item.enabled}
             data-test-subj="disableSwitch"
@@ -106,7 +99,7 @@ export const CollapsedItemActions: React.FunctionComponent<ComponentOpts> = ({
           <EuiSwitch
             name="mute"
             checked={item.muteAll}
-            disabled={!(canSave && item.enabled)}
+            disabled={!(item.isEditable && item.enabled)}
             compressed
             data-test-subj="muteSwitch"
             onChange={async () => {
@@ -134,7 +127,7 @@ export const CollapsedItemActions: React.FunctionComponent<ComponentOpts> = ({
         </div>
         <EuiHorizontalRule margin="none" />
         <EuiContextMenuItem
-          disabled={!canDelete}
+          disabled={!item.isEditable}
           data-test-subj="deleteAlert"
           onClick={() => setAlertsToDelete([item.id])}
         >
diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
index fe3bf98b03230..dd2b070956dbc 100644
--- a/x-pack/plugins/triggers_actions_ui/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -19,7 +19,7 @@ export { Alert, AlertAction, AlertTaskState, RawAlertInstance, AlertingFramework
 export { ActionType };
 
 export type ActionTypeIndex = Record<string, ActionType>;
-export type AlertTypeIndex = Record<string, AlertType>;
+export type AlertTypeIndex = Map<string, AlertType>;
 export type ActionTypeRegistryContract<ActionConnector = any, ActionParams = any> = PublicMethodsOf<
   TypeRegistry<ActionTypeModel<ActionConnector, ActionParams>>
 >;
@@ -32,6 +32,7 @@ export interface ActionConnectorFieldsProps<TActionConnector> {
   errors: IErrorObject;
   docLinks: DocLinksStart;
   http?: HttpSetup;
+  readOnly: boolean;
   consumer?: string;
 }
 
@@ -101,6 +102,7 @@ export interface AlertType {
   actionGroups: ActionGroup[];
   actionVariables: ActionVariables;
   defaultActionGroupId: ActionGroup['id'];
+  authorizedConsumers: Record<string, { read: boolean; all: boolean }>;
   producer: string;
 }
 
@@ -111,6 +113,7 @@ export type AlertWithoutId = Omit<Alert, 'id'>;
 export interface AlertTableItem extends Alert {
   alertType: AlertType['name'];
   tagsText: string;
+  isEditable: boolean;
 }
 
 export interface AlertTypeParamsExpressionProps<
diff --git a/x-pack/plugins/uptime/server/kibana.index.ts b/x-pack/plugins/uptime/server/kibana.index.ts
index d68bbabe82b86..a2d5f58bbec14 100644
--- a/x-pack/plugins/uptime/server/kibana.index.ts
+++ b/x-pack/plugins/uptime/server/kibana.index.ts
@@ -35,51 +35,33 @@ export const initServerWithKibana = (server: UptimeCoreSetup, plugins: UptimeCor
     icon: 'uptimeApp',
     app: ['uptime', 'kibana'],
     catalogue: ['uptime'],
+    alerting: ['xpack.uptime.alerts.tls', 'xpack.uptime.alerts.monitorStatus'],
     privileges: {
       all: {
         app: ['uptime', 'kibana'],
         catalogue: ['uptime'],
-        api: [
-          'uptime-read',
-          'uptime-write',
-          'actions-read',
-          'actions-all',
-          'alerting-read',
-          'alerting-all',
-        ],
+        api: ['uptime-read', 'uptime-write'],
         savedObject: {
-          all: [umDynamicSettings.name, 'alert', 'action', 'action_task_params'],
+          all: [umDynamicSettings.name, 'alert'],
           read: [],
         },
-        ui: [
-          'save',
-          'configureSettings',
-          'show',
-          'alerting:show',
-          'actions:show',
-          'alerting:save',
-          'actions:save',
-          'alerting:delete',
-          'actions:delete',
-        ],
+        alerting: {
+          all: ['xpack.uptime.alerts.tls', 'xpack.uptime.alerts.monitorStatus'],
+        },
+        ui: ['save', 'configureSettings', 'show', 'alerting:show'],
       },
       read: {
         app: ['uptime', 'kibana'],
         catalogue: ['uptime'],
-        api: ['uptime-read', 'actions-read', 'actions-all', 'alerting-read', 'alerting-all'],
+        api: ['uptime-read'],
         savedObject: {
-          all: ['alert', 'action', 'action_task_params'],
+          all: ['alert'],
           read: [umDynamicSettings.name],
         },
-        ui: [
-          'show',
-          'alerting:show',
-          'actions:show',
-          'alerting:save',
-          'actions:save',
-          'alerting:delete',
-          'actions:delete',
-        ],
+        alerting: {
+          all: ['xpack.uptime.alerts.tls', 'xpack.uptime.alerts.monitorStatus'],
+        },
+        ui: ['show', 'alerting:show'],
       },
     },
   });
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/plugin.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/plugin.ts
index b8b2cbdc03f39..cb1271494c294 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/plugin.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions_simulators/server/plugin.ts
@@ -61,27 +61,27 @@ export class FixturePlugin implements Plugin<void, void, FixtureSetupDeps, Fixtu
     };
     actions.registerType(notEnabledActionType);
     features.registerFeature({
-      id: 'actions',
-      name: 'Actions',
+      id: 'actionsSimulators',
+      name: 'actionsSimulators',
       app: ['actions', 'kibana'],
       privileges: {
         all: {
           app: ['actions', 'kibana'],
           savedObject: {
-            all: ['action', 'action_task_params'],
+            all: [],
             read: [],
           },
           ui: [],
-          api: ['actions-read', 'actions-all'],
+          api: [],
         },
         read: {
           app: ['actions', 'kibana'],
           savedObject: {
-            all: ['action_task_params'],
-            read: ['action'],
+            all: [],
+            read: [],
           },
           ui: [],
-          api: ['actions-read'],
+          api: [],
         },
       },
     });
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/kibana.json b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/kibana.json
index fc42e3199095d..083386480c540 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/kibana.json
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/kibana.json
@@ -1,5 +1,5 @@
 {
-  "id": "alerts-fixtures",
+  "id": "alertsFixtures",
   "version": "1.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["xpack"],
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
index ee3e0e6646112..26010e5a2c2e8 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
@@ -22,7 +22,7 @@ export function defineAlertTypes(
       { id: 'default', name: 'Default' },
       { id: 'other', name: 'Other' },
     ],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     actionVariables: {
       state: [{ name: 'instanceStateValue', description: 'the instance state value' }],
@@ -82,7 +82,7 @@ export function defineAlertTypes(
       { id: 'default', name: 'Default' },
       { id: 'other', name: 'Other' },
     ],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     async executor(alertExecutorOptions: AlertExecutorOptions) {
       const { services, state } = alertExecutorOptions;
@@ -111,7 +111,7 @@ export function defineAlertTypes(
         name: 'Default',
       },
     ],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     async executor({ services, params, state }: AlertExecutorOptions) {
       await services.callCluster('index', {
@@ -138,7 +138,7 @@ export function defineAlertTypes(
         name: 'Default',
       },
     ],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     async executor({ services, params, state }: AlertExecutorOptions) {
       await services.callCluster('index', {
@@ -164,7 +164,7 @@ export function defineAlertTypes(
       },
     ],
     defaultActionGroupId: 'default',
-    producer: 'alerting',
+    producer: 'alertsFixture',
     validate: {
       params: schema.object({
         callClusterAuthorizationIndex: schema.string(),
@@ -247,7 +247,7 @@ export function defineAlertTypes(
         name: 'Default',
       },
     ],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     validate: {
       params: schema.object({
@@ -260,7 +260,7 @@ export function defineAlertTypes(
     id: 'test.noop',
     name: 'Test: Noop',
     actionGroups: [{ id: 'default', name: 'Default' }],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     async executor({ services, params, state }: AlertExecutorOptions) {},
   };
@@ -268,7 +268,7 @@ export function defineAlertTypes(
     id: 'test.onlyContextVariables',
     name: 'Test: Only Context Variables',
     actionGroups: [{ id: 'default', name: 'Default' }],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     actionVariables: {
       context: [{ name: 'aContextVariable', description: 'this is a context variable' }],
@@ -279,7 +279,7 @@ export function defineAlertTypes(
     id: 'test.onlyStateVariables',
     name: 'Test: Only State Variables',
     actionGroups: [{ id: 'default', name: 'Default' }],
-    producer: 'alerting',
+    producer: 'alertsFixture',
     defaultActionGroupId: 'default',
     actionVariables: {
       state: [{ name: 'aStateVariable', description: 'this is a state variable' }],
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/plugin.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/plugin.ts
index 47563f8a5f078..5881201a82e09 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/plugin.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/plugin.ts
@@ -26,9 +26,21 @@ export interface FixtureStartDeps {
 export class FixturePlugin implements Plugin<void, void, FixtureSetupDeps, FixtureStartDeps> {
   public setup(core: CoreSetup<FixtureStartDeps>, { features, actions, alerts }: FixtureSetupDeps) {
     features.registerFeature({
-      id: 'alerts',
+      id: 'alertsFixture',
       name: 'Alerts',
       app: ['alerts', 'kibana'],
+      alerting: [
+        'test.always-firing',
+        'test.cumulative-firing',
+        'test.never-firing',
+        'test.failing',
+        'test.authorization',
+        'test.validation',
+        'test.onlyContextVariables',
+        'test.onlyStateVariables',
+        'test.noop',
+        'test.unrestricted-noop',
+      ],
       privileges: {
         all: {
           app: ['alerts', 'kibana'],
@@ -36,8 +48,21 @@ export class FixturePlugin implements Plugin<void, void, FixtureSetupDeps, Fixtu
             all: ['alert'],
             read: [],
           },
+          alerting: {
+            all: [
+              'test.always-firing',
+              'test.cumulative-firing',
+              'test.never-firing',
+              'test.failing',
+              'test.authorization',
+              'test.validation',
+              'test.onlyContextVariables',
+              'test.onlyStateVariables',
+              'test.noop',
+              'test.unrestricted-noop',
+            ],
+          },
           ui: [],
-          api: ['alerting-read', 'alerting-all'],
         },
         read: {
           app: ['alerts', 'kibana'],
@@ -45,8 +70,21 @@ export class FixturePlugin implements Plugin<void, void, FixtureSetupDeps, Fixtu
             all: [],
             read: ['alert'],
           },
+          alerting: {
+            read: [
+              'test.always-firing',
+              'test.cumulative-firing',
+              'test.never-firing',
+              'test.failing',
+              'test.authorization',
+              'test.validation',
+              'test.onlyContextVariables',
+              'test.onlyStateVariables',
+              'test.noop',
+              'test.unrestricted-noop',
+            ],
+          },
           ui: [],
-          api: ['alerting-read'],
         },
       },
     });
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/kibana.json b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/kibana.json
new file mode 100644
index 0000000000000..0e3d235293ac9
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "alertsRestrictedFixtures",
+  "version": "1.0.0",
+  "kibanaVersion": "kibana",
+  "configPath": ["xpack"],
+  "requiredPlugins": ["taskManager", "features", "actions", "alerts"],
+  "optionalPlugins": ["spaces"],
+  "server": true,
+  "ui": false
+}
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/package.json b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/package.json
new file mode 100644
index 0000000000000..fe3b905106ee0
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "alerts-restricted-fixtures",
+  "version": "1.0.0",
+  "kibana": {
+    "version": "kibana",
+    "templateVersion": "1.0.0"
+  },
+  "main": "target/test/plugin_api_integration/plugins/alerts_restricted",
+  "scripts": {
+    "kbn": "node ../../../../../scripts/kbn.js",
+    "build": "rm -rf './target' && tsc"
+  },
+  "devDependencies": {
+    "typescript": "3.7.2"
+  },
+  "license": "Apache-2.0",
+  "dependencies": {
+    "joi": "^13.5.2"
+  }
+}
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/alert_types.ts
new file mode 100644
index 0000000000000..00d06c30aa910
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/alert_types.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup } from 'src/core/server';
+import { FixtureStartDeps, FixtureSetupDeps } from './plugin';
+import { AlertType, AlertExecutorOptions } from '../../../../../../../plugins/alerts/server';
+
+export function defineAlertTypes(
+  core: CoreSetup<FixtureStartDeps>,
+  { alerts }: Pick<FixtureSetupDeps, 'alerts'>
+) {
+  const noopRestrictedAlertType: AlertType = {
+    id: 'test.restricted-noop',
+    name: 'Test: Restricted Noop',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alertsRestrictedFixture',
+    defaultActionGroupId: 'default',
+    async executor({ services, params, state }: AlertExecutorOptions) {},
+  };
+  const noopUnrestrictedAlertType: AlertType = {
+    id: 'test.unrestricted-noop',
+    name: 'Test: Unrestricted Noop',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alertsRestrictedFixture',
+    defaultActionGroupId: 'default',
+    async executor({ services, params, state }: AlertExecutorOptions) {},
+  };
+  alerts.registerType(noopRestrictedAlertType);
+  alerts.registerType(noopUnrestrictedAlertType);
+}
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/index.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/index.ts
new file mode 100644
index 0000000000000..54d6de50cff4d
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FixturePlugin } from './plugin';
+
+export const plugin = () => new FixturePlugin();
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/plugin.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/plugin.ts
new file mode 100644
index 0000000000000..e297733fb47eb
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts_restricted/server/plugin.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin, CoreSetup } from 'kibana/server';
+import { PluginSetupContract as ActionsPluginSetup } from '../../../../../../../plugins/actions/server/plugin';
+import { PluginSetupContract as AlertingPluginSetup } from '../../../../../../../plugins/alerts/server/plugin';
+import { EncryptedSavedObjectsPluginStart } from '../../../../../../../plugins/encrypted_saved_objects/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../../../../../../plugins/features/server';
+import { defineAlertTypes } from './alert_types';
+
+export interface FixtureSetupDeps {
+  features: FeaturesPluginSetup;
+  actions: ActionsPluginSetup;
+  alerts: AlertingPluginSetup;
+}
+
+export interface FixtureStartDeps {
+  encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
+}
+
+export class FixturePlugin implements Plugin<void, void, FixtureSetupDeps, FixtureStartDeps> {
+  public setup(core: CoreSetup<FixtureStartDeps>, { features, alerts }: FixtureSetupDeps) {
+    features.registerFeature({
+      id: 'alertsRestrictedFixture',
+      name: 'AlertRestricted',
+      app: ['alerts', 'kibana'],
+      alerting: ['test.restricted-noop', 'test.unrestricted-noop', 'test.noop'],
+      privileges: {
+        all: {
+          app: ['alerts', 'kibana'],
+          savedObject: {
+            all: ['alert'],
+            read: [],
+          },
+          alerting: {
+            all: ['test.restricted-noop', 'test.unrestricted-noop', 'test.noop'],
+          },
+          ui: [],
+        },
+        read: {
+          app: ['alerts', 'kibana'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          alerting: {
+            read: ['test.restricted-noop', 'test.unrestricted-noop', 'test.noop'],
+          },
+          ui: [],
+        },
+      },
+    });
+
+    defineAlertTypes(core, { alerts });
+  }
+
+  public start() {}
+  public stop() {}
+}
diff --git a/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts b/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
index 708e7e1b75b58..a68f8de39d48e 100644
--- a/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
@@ -252,7 +252,7 @@ export class AlertUtils {
       throttle: '30s',
       tags: [],
       alertTypeId: 'test.failing',
-      consumer: 'bar',
+      consumer: 'alertsFixture',
       params: {
         index: ES_TEST_INDEX_NAME,
         reference,
@@ -267,6 +267,22 @@ export class AlertUtils {
   }
 }
 
+export function getConsumerUnauthorizedErrorMessage(
+  operation: string,
+  alertType: string,
+  consumer: string
+) {
+  return `Unauthorized to ${operation} a "${alertType}" alert for "${consumer}"`;
+}
+
+export function getProducerUnauthorizedErrorMessage(
+  operation: string,
+  alertType: string,
+  producer: string
+) {
+  return `Unauthorized to ${operation} a "${alertType}" alert by "${producer}"`;
+}
+
 function getDefaultAlwaysFiringAlertData(reference: string, actionId: string) {
   const messageTemplate = `
 alertId: {{alertId}},
@@ -284,7 +300,7 @@ instanceStateValue: {{state.instanceStateValue}}
     throttle: '1m',
     tags: ['tag-A', 'tag-B'],
     alertTypeId: 'test.always-firing',
-    consumer: 'bar',
+    consumer: 'alertsFixture',
     params: {
       index: ES_TEST_INDEX_NAME,
       reference,
diff --git a/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts b/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
index 76f78809d5d11..2e7a4e325094c 100644
--- a/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/get_test_alert_data.ts
@@ -10,7 +10,7 @@ export function getTestAlertData(overwrites = {}) {
     name: 'abc',
     tags: ['foo'],
     alertTypeId: 'test.noop',
-    consumer: 'bar',
+    consumer: 'alertsFixture',
     schedule: { interval: '1m' },
     throttle: '1m',
     actions: [],
diff --git a/x-pack/test/alerting_api_integration/common/lib/index.ts b/x-pack/test/alerting_api_integration/common/lib/index.ts
index eae679cd38c11..94caf373c98d1 100644
--- a/x-pack/test/alerting_api_integration/common/lib/index.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/index.ts
@@ -8,7 +8,11 @@ export { ObjectRemover } from './object_remover';
 export { getUrlPrefix } from './space_test_utils';
 export { ES_TEST_INDEX_NAME, ESTestIndexTool } from './es_test_index_tool';
 export { getTestAlertData } from './get_test_alert_data';
-export { AlertUtils } from './alert_utils';
+export {
+  AlertUtils,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
+} from './alert_utils';
 export { TaskManagerUtils } from './task_manager_utils';
 export * from './test_assertions';
 export { checkAAD } from './check_aad';
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts b/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts
index c72ee6a192bf2..2f57d05be4227 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/scenarios.ts
@@ -47,8 +47,10 @@ const GlobalRead: User = {
     kibana: [
       {
         feature: {
-          alerts: ['read'],
           actions: ['read'],
+          alertsFixture: ['read'],
+          alertsRestrictedFixture: ['read'],
+          actionsSimulators: ['read'],
         },
         spaces: ['*'],
       },
@@ -75,8 +77,9 @@ const Space1All: User = {
     kibana: [
       {
         feature: {
-          alerts: ['all'],
           actions: ['all'],
+          alertsFixture: ['all'],
+          actionsSimulators: ['all'],
         },
         spaces: ['space1'],
       },
@@ -94,7 +97,71 @@ const Space1All: User = {
   },
 };
 
-export const Users: User[] = [NoKibanaPrivileges, Superuser, GlobalRead, Space1All];
+const Space1AllAlertingNoneActions: User = {
+  username: 'space_1_all_alerts_none_actions',
+  fullName: 'space_1_all_alerts_none_actions',
+  password: 'space_1_all_alerts_none_actions-password',
+  role: {
+    name: 'space_1_all_alerts_none_actions_role',
+    kibana: [
+      {
+        feature: {
+          alertsFixture: ['all'],
+          actionsSimulators: ['all'],
+        },
+        spaces: ['space1'],
+      },
+    ],
+    elasticsearch: {
+      // TODO: Remove once Elasticsearch doesn't require the permission for own keys
+      cluster: ['manage_api_key'],
+      indices: [
+        {
+          names: [`${ES_TEST_INDEX_NAME}*`],
+          privileges: ['all'],
+        },
+      ],
+    },
+  },
+};
+
+const Space1AllWithRestrictedFixture: User = {
+  username: 'space_1_all_with_restricted_fixture',
+  fullName: 'space_1_all_with_restricted_fixture',
+  password: 'space_1_all_with_restricted_fixture-password',
+  role: {
+    name: 'space_1_all_with_restricted_fixture_role',
+    kibana: [
+      {
+        feature: {
+          actions: ['all'],
+          alertsFixture: ['all'],
+          alertsRestrictedFixture: ['all'],
+        },
+        spaces: ['space1'],
+      },
+    ],
+    elasticsearch: {
+      // TODO: Remove once Elasticsearch doesn't require the permission for own keys
+      cluster: ['manage_api_key'],
+      indices: [
+        {
+          names: [`${ES_TEST_INDEX_NAME}*`],
+          privileges: ['all'],
+        },
+      ],
+    },
+  },
+};
+
+export const Users: User[] = [
+  NoKibanaPrivileges,
+  Superuser,
+  GlobalRead,
+  Space1All,
+  Space1AllWithRestrictedFixture,
+  Space1AllAlertingNoneActions,
+];
 
 const Space1: Space = {
   id: 'space1',
@@ -160,6 +227,23 @@ const Space1AllAtSpace1: Space1AllAtSpace1 = {
   user: Space1All,
   space: Space1,
 };
+interface Space1AllWithRestrictedFixtureAtSpace1 extends Scenario {
+  id: 'space_1_all_with_restricted_fixture at space1';
+}
+const Space1AllWithRestrictedFixtureAtSpace1: Space1AllWithRestrictedFixtureAtSpace1 = {
+  id: 'space_1_all_with_restricted_fixture at space1',
+  user: Space1AllWithRestrictedFixture,
+  space: Space1,
+};
+
+interface Space1AllAlertingNoneActionsAtSpace1 extends Scenario {
+  id: 'space_1_all_alerts_none_actions at space1';
+}
+const Space1AllAlertingNoneActionsAtSpace1: Space1AllAlertingNoneActionsAtSpace1 = {
+  id: 'space_1_all_alerts_none_actions at space1',
+  user: Space1AllAlertingNoneActions,
+  space: Space1,
+};
 
 interface Space1AllAtSpace2 extends Scenario {
   id: 'space_1_all at space2';
@@ -175,11 +259,15 @@ export const UserAtSpaceScenarios: [
   SuperuserAtSpace1,
   GlobalReadAtSpace1,
   Space1AllAtSpace1,
-  Space1AllAtSpace2
+  Space1AllAtSpace2,
+  Space1AllWithRestrictedFixtureAtSpace1,
+  Space1AllAlertingNoneActionsAtSpace1
 ] = [
   NoKibanaPrivilegesAtSpace1,
   SuperuserAtSpace1,
   GlobalReadAtSpace1,
   Space1AllAtSpace1,
   Space1AllAtSpace2,
+  Space1AllWithRestrictedFixtureAtSpace1,
+  Space1AllAlertingNoneActionsAtSpace1,
 ];
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
index 69dcb7c813815..75609d58f7792 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts
@@ -41,16 +41,18 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to create a "test.index-record" action',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'action', 'actions');
               expect(response.body).to.eql({
@@ -90,16 +92,18 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to create a "test.unregistered-action-type" action',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -122,16 +126,11 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -160,16 +159,18 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to create a "test.index-record" action',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -196,16 +197,18 @@ export default function createActionTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to create a "test.not-enabled" action',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
                 statusCode: 403,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/delete.ts
index d96ffc5bb3be3..97c933f2ef8c5 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/delete.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/delete.ts
@@ -46,18 +46,20 @@ export default function deleteActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to delete actions',
               });
               objectRemover.add(space.id, createdAction.id, 'action', 'actions');
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               break;
@@ -88,19 +90,22 @@ export default function deleteActionTests({ getService }: FtrProviderContext) {
             .auth(user.username, user.password)
             .set('kbn-xsrf', 'foo');
 
-          expect(response.statusCode).to.eql(404);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to delete actions',
               });
               break;
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
@@ -120,17 +125,19 @@ export default function deleteActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to delete actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(404);
               break;
             default:
@@ -146,17 +153,19 @@ export default function deleteActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to delete actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.body).to.eql({
                 statusCode: 400,
                 error: 'Bad Request',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
index 5d609d001ee5d..a45eee400b445 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
@@ -77,17 +77,19 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.be.an('object');
               const searchResult = await esTestIndexTool.search(
@@ -154,19 +156,22 @@ export default function ({ getService }: FtrProviderContext) {
               },
             });
 
-          expect(response.statusCode).to.eql(404);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
@@ -224,17 +229,19 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.be.an('object');
               const searchResult = await esTestIndexTool.search(
@@ -275,17 +282,19 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
@@ -307,17 +316,12 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -383,17 +387,19 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               break;
             default:
@@ -431,16 +437,18 @@ export default function ({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to execute actions',
               });
               break;
             case 'global_read at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               searchResult = await esTestIndexTool.search('action:test.authorization', reference);
               expect(searchResult.hits.total.value).to.eql(1);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
index c610ac670f690..fc08be3e30a6f 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get.ts
@@ -45,17 +45,19 @@ export default function getActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 id: createdAction.id,
@@ -93,19 +95,22 @@ export default function getActionTests({ getService }: FtrProviderContext) {
             .get(`${getUrlPrefix('other')}/api/actions/action/${createdAction.id}`)
             .auth(user.username, user.password);
 
-          expect(response.statusCode).to.eql(404);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
@@ -124,17 +129,19 @@ export default function getActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 id: 'my-slack1',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
index 45491aa2d28fc..994072d5cb03c 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/get_all.ts
@@ -45,17 +45,19 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql([
                 {
@@ -150,17 +152,19 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql([
                 {
@@ -231,13 +235,15 @@ export default function getAllActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
-              expect(response.statusCode).to.eql(404);
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to get actions',
               });
               break;
             case 'global_read at space1':
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/list_action_types.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/list_action_types.ts
index 22c89a1a8148f..83b7077cbaadd 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/list_action_types.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/list_action_types.ts
@@ -28,19 +28,15 @@ export default function listActionTypesTests({ getService }: FtrProviderContext)
             };
           }
 
+          expect(response.statusCode).to.eql(200);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               // Check for values explicitly in order to avoid this test failing each time plugins register
               // a new action type
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
index cb0e0efda0b1a..82b12e6ce9a22 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts
@@ -55,17 +55,19 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to update actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 id: createdAction.id,
@@ -120,19 +122,22 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
               },
             });
 
-          expect(response.statusCode).to.eql(404);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to update actions',
               });
               break;
             case 'superuser at space1':
+              expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
@@ -156,17 +161,12 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -196,17 +196,19 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to update actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
@@ -228,17 +230,12 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -285,17 +282,19 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to update actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -326,17 +325,19 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
 
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
+            case 'space_1_all_alerts_none_actions at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Unauthorized to update actions',
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.body).to.eql({
                 statusCode: 400,
                 error: 'Bad Request',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
index db1e59746162b..ffa9855478a05 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
@@ -14,6 +14,7 @@ import {
   getTestAlertData,
   ObjectRemover,
   AlertUtils,
+  getConsumerUnauthorizedErrorMessage,
   TaskManagerUtils,
   getEventLog,
 } from '../../../common/lib';
@@ -88,15 +89,28 @@ export default function alertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
 
               // Wait for the action to index a document before disabling the alert and waiting for tasks to finish
@@ -189,15 +203,28 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
 
               // Wait for the action to index a document before disabling the alert and waiting for tasks to finish
@@ -376,15 +403,28 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
 
@@ -460,14 +500,20 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.authorization',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
 
@@ -574,14 +620,19 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
 
@@ -614,6 +665,14 @@ instanceStateValue: true
                 },
               });
               break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
+              });
+              break;
             case 'superuser at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
@@ -658,14 +717,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               expect(response.statusCode).to.eql(200);
               // Wait until alerts scheduled actions 3 times before disabling the alert and waiting for tasks to finish
@@ -724,14 +796,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               expect(response.statusCode).to.eql(200);
               // Wait for actions to execute twice before disabling the alert and waiting for tasks to finish
@@ -774,14 +859,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               expect(response.statusCode).to.eql(200);
               // Actions should execute twice before widning things down
@@ -816,14 +914,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               await alertUtils.muteAll(response.body.id);
               await alertUtils.enable(response.body.id);
@@ -861,14 +972,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               await alertUtils.muteInstance(response.body.id, '1');
               await alertUtils.enable(response.body.id);
@@ -906,14 +1030,27 @@ instanceStateValue: true
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.always-firing',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               await alertUtils.muteInstance(response.body.id, '1');
               await alertUtils.muteAll(response.body.id);
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
index 4ca943f3e188a..8d7b9dec58cf1 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts
@@ -6,7 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { checkAAD, getTestAlertData, getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import {
+  checkAAD,
+  getTestAlertData,
+  getConsumerUnauthorizedErrorMessage,
+  getUrlPrefix,
+  ObjectRemover,
+  getProducerUnauthorizedErrorMessage,
+} from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -62,15 +69,28 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
               expect(response.body).to.eql({
@@ -87,7 +107,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 ],
                 enabled: true,
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
                 params: {},
                 createdBy: user.username,
                 schedule: { interval: '1m' },
@@ -124,6 +144,174 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
           }
         });
 
+        it('should handle create alert request appropriately when consumer is the same as producer', async () => {
+          const response = await supertestWithoutAuth
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            );
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'global_read at space1':
+            case 'space_1_all at space2':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle create alert request appropriately when consumer is not the producer', async () => {
+          const response = await supertestWithoutAuth
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(
+              getTestAlertData({ alertTypeId: 'test.unrestricted-noop', consumer: 'alertsFixture' })
+            );
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'global_read at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'create',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle create alert request appropriately when consumer is "alerts"', async () => {
+          const response = await supertestWithoutAuth
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.noop',
+                consumer: 'alerts',
+              })
+            );
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('create', 'test.noop', 'alerts'),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'create',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle create alert request appropriately when consumer is unknown', async () => {
+          const response = await supertestWithoutAuth
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.noop',
+                consumer: 'some consumer patrick invented',
+              })
+            );
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'global_read at space1':
+            case 'space_1_all at space2':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+            case 'superuser at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.noop',
+                  'some consumer patrick invented'
+                ),
+                statusCode: 403,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it('should handle create alert request appropriately when an alert is disabled ', async () => {
           const response = await supertestWithoutAuth
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
@@ -135,15 +323,21 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               objectRemover.add(space.id, response.body.id, 'alert', 'alerts');
               expect(response.body.scheduledTaskId).to.eql(undefined);
@@ -168,15 +362,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
-            case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+            case 'superuser at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -200,15 +389,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -236,15 +420,21 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'create',
+                  'test.validation',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -269,15 +459,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 error: 'Bad Request',
@@ -301,15 +486,10 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'global_read at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 error: 'Bad Request',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
index 6f8ae010b9cd8..fc453c8da72e7 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/delete.ts
@@ -6,7 +6,13 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import {
+  getUrlPrefix,
+  getTestAlertData,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
+  ObjectRemover,
+} from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -46,11 +52,15 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
               // Ensure task still exists
@@ -58,6 +68,185 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle delete alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+
+          const response = await supertestWithoutAuth
+            .delete(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+              // Ensure task still exists
+              await getScheduledTask(createdAlert.scheduledTaskId);
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle delete alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({ alertTypeId: 'test.unrestricted-noop', consumer: 'alertsFixture' })
+            )
+            .expect(200);
+
+          const response = await supertestWithoutAuth
+            .delete(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+              // Ensure task still exists
+              await getScheduledTask(createdAlert.scheduledTaskId);
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+              // Ensure task still exists
+              await getScheduledTask(createdAlert.scheduledTaskId);
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle delete alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+
+          const response = await supertestWithoutAuth
+            .delete(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('delete', 'test.noop', 'alerts'),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+              // Ensure task still exists
+              await getScheduledTask(createdAlert.scheduledTaskId);
+              break;
+            case 'superuser at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               try {
@@ -91,12 +280,8 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
             case 'space_1_all at space2':
             case 'global_read at space1':
             case 'space_1_all at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               expect(response.body).to.eql({
                 statusCode: 404,
@@ -137,11 +322,15 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'delete',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
               // Ensure task still exists
@@ -149,6 +338,8 @@ export default function createDeleteTests({ getService }: FtrProviderContext) {
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               try {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts
index 589942a7ac11c..4e4f9053bd24f 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -39,10 +41,32 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
 
       describe(scenario.id, () => {
         it('should handle disable alert request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: true }))
+            .send(
+              getTestAlertData({
+                enabled: true,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -52,17 +76,23 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               // Ensure task still exists
               await getScheduledTask(createdAlert.scheduledTaskId);
               break;
+            case 'space_1_all_alerts_none_actions at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               try {
@@ -84,6 +114,171 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
           }
         });
 
+        it('should handle disable alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+                enabled: true,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getDisableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle disable alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+                enabled: true,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getDisableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle disable alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.noop',
+                consumer: 'alerts',
+                enabled: true,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getDisableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('disable', 'test.noop', 'alerts'),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it('should still be able to disable alert when AAD is broken', async () => {
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
@@ -110,17 +305,23 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'disable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               // Ensure task still exists
               await getScheduledTask(createdAlert.scheduledTaskId);
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               try {
@@ -157,14 +358,10 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts
index 8cb0eeb0092a3..d7f6546bf34a9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -39,10 +41,32 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
 
       describe(scenario.id, () => {
         it('should handle enable alert request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: false }))
+            .send(
+              getTestAlertData({
+                enabled: false,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -51,16 +75,40 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
@@ -89,6 +137,165 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
           }
         });
 
+        it('should handle enable alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+                enabled: false,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getEnableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle enable alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+                enabled: false,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getEnableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle enable alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.noop',
+                consumer: 'alerts',
+                enabled: false,
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getEnableRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('enable', 'test.noop', 'alerts'),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              try {
+                await getScheduledTask(createdAlert.scheduledTaskId);
+                throw new Error('Should have removed scheduled task');
+              } catch (e) {
+                expect(e.status).to.eql(404);
+              }
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it('should still be able to enable alert when AAD is broken', async () => {
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
@@ -115,15 +322,21 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'enable',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
@@ -167,14 +380,10 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
index 5fe9edeb91ec9..268212d4294d0 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/find.ts
@@ -5,6 +5,8 @@
  */
 
 import expect from '@kbn/expect';
+import { chunk, omit } from 'lodash';
+import uuid from 'uuid';
 import { UserAtSpaceScenarios } from '../../scenarios';
 import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
@@ -41,16 +43,18 @@ export default function createFindTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to find any alert types`,
+                statusCode: 403,
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body.page).to.equal(1);
               expect(response.body.perPage).to.be.greaterThan(0);
@@ -61,7 +65,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
                 schedule: { interval: '1m' },
                 enabled: true,
                 actions: [],
@@ -84,6 +88,108 @@ export default function createFindTests({ getService }: FtrProviderContext) {
           }
         });
 
+        it('should filter out types that the user is not authorized to `get` retaining pagination', async () => {
+          async function createNoOpAlert(overrides = {}) {
+            const alert = getTestAlertData(overrides);
+            const { body: createdAlert } = await supertest
+              .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+              .set('kbn-xsrf', 'foo')
+              .send(alert)
+              .expect(200);
+            objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+            return {
+              id: createdAlert.id,
+              alertTypeId: alert.alertTypeId,
+            };
+          }
+          function createRestrictedNoOpAlert() {
+            return createNoOpAlert({
+              alertTypeId: 'test.restricted-noop',
+              consumer: 'alertsRestrictedFixture',
+            });
+          }
+          function createUnrestrictedNoOpAlert() {
+            return createNoOpAlert({
+              alertTypeId: 'test.unrestricted-noop',
+              consumer: 'alertsFixture',
+            });
+          }
+          const allAlerts = [];
+          allAlerts.push(await createNoOpAlert());
+          allAlerts.push(await createNoOpAlert());
+          allAlerts.push(await createRestrictedNoOpAlert());
+          allAlerts.push(await createUnrestrictedNoOpAlert());
+          allAlerts.push(await createUnrestrictedNoOpAlert());
+          allAlerts.push(await createRestrictedNoOpAlert());
+          allAlerts.push(await createNoOpAlert());
+          allAlerts.push(await createNoOpAlert());
+
+          const perPage = 4;
+
+          const response = await supertestWithoutAuth
+            .get(
+              `${getUrlPrefix(space.id)}/api/alerts/_find?per_page=${perPage}&sort_field=createdAt`
+            )
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to find any alert types`,
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body.page).to.equal(1);
+              expect(response.body.perPage).to.be.equal(perPage);
+              expect(response.body.total).to.be.equal(6);
+              {
+                const [firstPage] = chunk(
+                  allAlerts
+                    .filter((alert) => alert.alertTypeId !== 'test.restricted-noop')
+                    .map((alert) => alert.id),
+                  perPage
+                );
+                expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage);
+              }
+              break;
+            case 'global_read at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body.page).to.equal(1);
+              expect(response.body.perPage).to.be.equal(perPage);
+              expect(response.body.total).to.be.equal(8);
+
+              {
+                const [firstPage, secondPage] = chunk(
+                  allAlerts.map((alert) => alert.id),
+                  perPage
+                );
+                expect(response.body.data.map((alert: any) => alert.id)).to.eql(firstPage);
+
+                const secondResponse = await supertestWithoutAuth
+                  .get(
+                    `${getUrlPrefix(
+                      space.id
+                    )}/api/alerts/_find?per_page=${perPage}&sort_field=createdAt&page=2`
+                  )
+                  .auth(user.username, user.password);
+
+                expect(secondResponse.body.data.map((alert: any) => alert.id)).to.eql(secondPage);
+              }
+
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it('should handle find alert request with filter appropriately', async () => {
           const { body: createdAction } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/actions/action`)
@@ -125,16 +231,18 @@ export default function createFindTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to find any alert types`,
+                statusCode: 403,
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body.page).to.equal(1);
               expect(response.body.perPage).to.be.greaterThan(0);
@@ -145,7 +253,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
                 schedule: { interval: '1m' },
                 enabled: false,
                 actions: [
@@ -174,6 +282,83 @@ export default function createFindTests({ getService }: FtrProviderContext) {
           }
         });
 
+        it('should handle find alert request with fields appropriately', async () => {
+          const myTag = uuid.v4();
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                tags: [myTag],
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          // create another type with same tag
+          const { body: createdSecondAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                tags: [myTag],
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdSecondAlert.id, 'alert', 'alerts');
+
+          const response = await supertestWithoutAuth
+            .get(
+              `${getUrlPrefix(
+                space.id
+              )}/api/alerts/_find?filter=alert.attributes.alertTypeId:test.restricted-noop&fields=["tags"]&sort_field=createdAt`
+            )
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to find any alert types`,
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body.data).to.eql([]);
+              break;
+            case 'global_read at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body.page).to.equal(1);
+              expect(response.body.perPage).to.be.greaterThan(0);
+              expect(response.body.total).to.be.greaterThan(0);
+              const [matchFirst, matchSecond] = response.body.data;
+              expect(omit(matchFirst, 'updatedAt')).to.eql({
+                id: createdAlert.id,
+                actions: [],
+                tags: [myTag],
+              });
+              expect(omit(matchSecond, 'updatedAt')).to.eql({
+                id: createdSecondAlert.id,
+                actions: [],
+                tags: [myTag],
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it(`shouldn't find alert from another space`, async () => {
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
@@ -192,11 +377,13 @@ export default function createFindTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
-              expect(response.statusCode).to.eql(404);
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to find any alert types`,
+                statusCode: 403,
               });
               break;
             case 'global_read at space1':
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
index a203b7d7c151b..1043ece08a2ac 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get.ts
@@ -6,7 +6,13 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import {
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
+} from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -37,23 +43,25 @@ export default function createGetTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('get', 'test.noop', 'alertsFixture'),
+                statusCode: 403,
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 id: createdAlert.id,
                 name: 'abc',
                 tags: ['foo'],
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
                 schedule: { interval: '1m' },
                 enabled: true,
                 actions: [],
@@ -76,6 +84,157 @@ export default function createGetTests({ getService }: FtrProviderContext) {
           }
         });
 
+        it('should handle get alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await supertestWithoutAuth
+            .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'get',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle get alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await supertestWithoutAuth
+            .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'get',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'get',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'global_read at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle get alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await supertestWithoutAuth
+            .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'get',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'get',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
         it(`shouldn't get alert from another space`, async () => {
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
@@ -93,12 +252,8 @@ export default function createGetTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'global_read at space1':
             case 'superuser at space1':
               expect(response.body).to.eql({
@@ -120,16 +275,11 @@ export default function createGetTests({ getService }: FtrProviderContext) {
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get_alert_state.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get_alert_state.ts
index fd071bd55b377..2e89aa2961c73 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get_alert_state.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/get_alert_state.ts
@@ -5,7 +5,13 @@
  */
 
 import expect from '@kbn/expect';
-import { getUrlPrefix, ObjectRemover, getTestAlertData } from '../../../common/lib';
+import {
+  getUrlPrefix,
+  ObjectRemover,
+  getTestAlertData,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
+} from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 import { UserAtSpaceScenarios } from '../../scenarios';
 
@@ -37,16 +43,73 @@ export default function createGetAlertStateTests({ getService }: FtrProviderCont
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage('get', 'test.noop', 'alertsFixture'),
+                statusCode: 403,
               });
               break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body).to.key('alertInstances', 'previousStartedAt');
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle getAlertState alert request appropriately when unauthorized', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await supertestWithoutAuth
+            .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/state`)
+            .auth(user.username, user.password);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'get',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'get',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.key('alertInstances', 'previousStartedAt');
               break;
@@ -72,12 +135,8 @@ export default function createGetAlertStateTests({ getService }: FtrProviderCont
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'space_1_all at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'global_read at space1':
             case 'superuser at space1':
               expect(response.body).to.eql({
@@ -99,16 +158,11 @@ export default function createGetAlertStateTests({ getService }: FtrProviderCont
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'global_read at space1':
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(404);
               expect(response.body).to.eql({
                 statusCode: 404,
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/index.ts
index f14f66f66fe2f..4cd5f0805121c 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/index.ts
@@ -9,11 +9,11 @@ import { FtrProviderContext } from '../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function alertingTests({ loadTestFile }: FtrProviderContext) {
   describe('Alerts', () => {
+    loadTestFile(require.resolve('./find'));
     loadTestFile(require.resolve('./create'));
     loadTestFile(require.resolve('./delete'));
     loadTestFile(require.resolve('./disable'));
     loadTestFile(require.resolve('./enable'));
-    loadTestFile(require.resolve('./find'));
     loadTestFile(require.resolve('./get'));
     loadTestFile(require.resolve('./get_alert_state'));
     loadTestFile(require.resolve('./list_alert_types'));
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
index dd31e2dbbb5b8..c3e5af0d1f771 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/list_alert_types.ts
@@ -5,6 +5,7 @@
  */
 
 import expect from '@kbn/expect';
+import { omit } from 'lodash';
 import { UserAtSpaceScenarios } from '../../scenarios';
 import { getUrlPrefix } from '../../../common/lib/space_test_utils';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
@@ -13,42 +14,125 @@ import { FtrProviderContext } from '../../../common/ftr_provider_context';
 export default function listAlertTypes({ getService }: FtrProviderContext) {
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
+  const expectedNoOpType = {
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    defaultActionGroupId: 'default',
+    id: 'test.noop',
+    name: 'Test: Noop',
+    actionVariables: {
+      state: [],
+      context: [],
+    },
+    producer: 'alertsFixture',
+  };
+
+  const expectedRestrictedNoOpType = {
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    defaultActionGroupId: 'default',
+    id: 'test.restricted-noop',
+    name: 'Test: Restricted Noop',
+    actionVariables: {
+      state: [],
+      context: [],
+    },
+    producer: 'alertsRestrictedFixture',
+  };
+
   describe('list_alert_types', () => {
     for (const scenario of UserAtSpaceScenarios) {
       const { user, space } = scenario;
       describe(scenario.id, () => {
-        it('should return 200 with list of alert types', async () => {
+        it('should return 200 with list of globally available alert types', async () => {
           const response = await supertestWithoutAuth
             .get(`${getUrlPrefix(space.id)}/api/alerts/list_alert_types`)
             .auth(user.username, user.password);
 
+          expect(response.statusCode).to.eql(200);
+          const noOpAlertType = response.body.find(
+            (alertType: any) => alertType.id === 'test.noop'
+          );
+          const restrictedNoOpAlertType = response.body.find(
+            (alertType: any) => alertType.id === 'test.restricted-noop'
+          );
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+              expect(response.body).to.eql([]);
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(omit(noOpAlertType, 'authorizedConsumers')).to.eql(expectedNoOpType);
+              expect(restrictedNoOpAlertType).to.eql(undefined);
+              expect(noOpAlertType.authorizedConsumers).to.eql({
+                alerts: { read: true, all: true },
+                alertsFixture: { read: true, all: true },
               });
               break;
             case 'global_read at space1':
+              expect(omit(noOpAlertType, 'authorizedConsumers')).to.eql(expectedNoOpType);
+              expect(noOpAlertType.authorizedConsumers.alertsFixture).to.eql({
+                read: true,
+                all: false,
+              });
+              expect(noOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: false,
+              });
+
+              expect(omit(restrictedNoOpAlertType, 'authorizedConsumers')).to.eql(
+                expectedRestrictedNoOpType
+              );
+              expect(Object.keys(restrictedNoOpAlertType.authorizedConsumers)).not.to.contain(
+                'alertsFixture'
+              );
+              expect(restrictedNoOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: false,
+              });
+              break;
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(omit(noOpAlertType, 'authorizedConsumers')).to.eql(expectedNoOpType);
+              expect(noOpAlertType.authorizedConsumers.alertsFixture).to.eql({
+                read: true,
+                all: true,
+              });
+              expect(noOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: true,
+              });
+
+              expect(omit(restrictedNoOpAlertType, 'authorizedConsumers')).to.eql(
+                expectedRestrictedNoOpType
+              );
+              expect(Object.keys(restrictedNoOpAlertType.authorizedConsumers)).not.to.contain(
+                'alertsFixture'
+              );
+              expect(restrictedNoOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: true,
+              });
+              break;
             case 'superuser at space1':
-            case 'space_1_all at space1':
-              expect(response.statusCode).to.eql(200);
-              const fixtureAlertType = response.body.find(
-                (alertType: any) => alertType.id === 'test.noop'
+              expect(omit(noOpAlertType, 'authorizedConsumers')).to.eql(expectedNoOpType);
+              expect(noOpAlertType.authorizedConsumers.alertsFixture).to.eql({
+                read: true,
+                all: true,
+              });
+              expect(noOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: true,
+              });
+
+              expect(omit(restrictedNoOpAlertType, 'authorizedConsumers')).to.eql(
+                expectedRestrictedNoOpType
               );
-              expect(fixtureAlertType).to.eql({
-                actionGroups: [{ id: 'default', name: 'Default' }],
-                defaultActionGroupId: 'default',
-                id: 'test.noop',
-                name: 'Test: Noop',
-                actionVariables: {
-                  state: [],
-                  context: [],
-                },
-                producer: 'alerting',
+              expect(noOpAlertType.authorizedConsumers.alertsFixture).to.eql({
+                read: true,
+                all: true,
+              });
+              expect(noOpAlertType.authorizedConsumers.alertsRestrictedFixture).to.eql({
+                read: true,
+                all: true,
               });
               break;
             default:
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts
index 2416bc2ea1d12..a497affa266e4 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -31,10 +33,151 @@ export default function createMuteAlertTests({ getService }: FtrProviderContext)
 
       describe(scenario.id, () => {
         it('should handle mute alert request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(true);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(true);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert request appropriately when consumer is not the producer', async () => {
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: false }))
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -44,15 +187,99 @@ export default function createMuteAlertTests({ getService }: FtrProviderContext)
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(true);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'muteAll',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts
index c59b9f4503a03..b4277479d8fd9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -31,10 +33,32 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
 
       describe(scenario.id, () => {
         it('should handle mute alert instance request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: false }))
+            .send(
+              getTestAlertData({
+                enabled: false,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -44,15 +68,218 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert instance request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert instance request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle mute alert instance request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getMuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
@@ -95,15 +322,21 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'muteInstance',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts
index fd22752ccc11a..46653900cb1c7 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -31,10 +33,32 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex
 
       describe(scenario.id, () => {
         it('should handle unmute alert request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: false }))
+            .send(
+              getTestAlertData({
+                enabled: false,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -49,15 +73,233 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(false);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/_mute_all`)
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(false);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/_mute_all`)
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.muteAll).to.eql(false);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/_mute_all`)
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteAllRequest(createdAlert.id);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'unmuteAll',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts
index 72b524282354a..2bc501c9a7c72 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -31,10 +33,32 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
 
       describe(scenario.id, () => {
         it('should handle unmute alert instance request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData({ enabled: false }))
+            .send(
+              getTestAlertData({
+                enabled: false,
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
@@ -51,15 +75,239 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql([]);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert instance request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(
+              `${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/alert_instance/1/_mute`
+            )
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql([]);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert instance request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(
+              `${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/alert_instance/1/_mute`
+            )
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.mutedInstanceIds).to.eql([]);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle unmute alert instance request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                enabled: false,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          await supertest
+            .post(
+              `${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}/alert_instance/1/_mute`
+            )
+            .set('kbn-xsrf', 'foo')
+            .expect(204, '');
+
+          const response = await alertUtils.getUnmuteInstanceRequest(createdAlert.id, '1');
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'unmuteInstance',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
index 2bcc035beb7a9..ab3a92d0b3f70 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
@@ -13,6 +13,8 @@ import {
   getTestAlertData,
   ObjectRemover,
   ensureDatetimeIsWithinRange,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
@@ -38,6 +40,17 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
       const { user, space } = scenario;
       describe(scenario.id, () => {
         it('should handle update alert request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
@@ -52,7 +65,13 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
               foo: true,
             },
             schedule: { interval: '12s' },
-            actions: [],
+            actions: [
+              {
+                id: createdAction.id,
+                group: 'default',
+                params: {},
+              },
+            ],
             throttle: '1m',
           };
           const response = await supertestWithoutAuth
@@ -65,21 +84,310 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to get actions`,
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 ...updatedData,
                 id: createdAlert.id,
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
+                createdBy: 'elastic',
+                enabled: true,
+                updatedBy: user.username,
+                apiKeyOwner: user.username,
+                muteAll: false,
+                mutedInstanceIds: [],
+                actions: [
+                  {
+                    id: createdAction.id,
+                    actionTypeId: 'test.noop',
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+                scheduledTaskId: createdAlert.scheduledTaskId,
+                createdAt: response.body.createdAt,
+                updatedAt: response.body.updatedAt,
+              });
+              expect(Date.parse(response.body.createdAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(
+                Date.parse(response.body.createdAt)
+              );
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle update alert request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const updatedData = {
+            name: 'bcd',
+            tags: ['bar'],
+            params: {
+              foo: true,
+            },
+            schedule: { interval: '12s' },
+            actions: [],
+            throttle: '1m',
+          };
+          const response = await supertestWithoutAuth
+            .put(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(updatedData);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body).to.eql({
+                ...updatedData,
+                id: createdAlert.id,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+                createdBy: 'elastic',
+                enabled: true,
+                updatedBy: user.username,
+                apiKeyOwner: user.username,
+                muteAll: false,
+                mutedInstanceIds: [],
+                scheduledTaskId: createdAlert.scheduledTaskId,
+                createdAt: response.body.createdAt,
+                updatedAt: response.body.updatedAt,
+              });
+              expect(Date.parse(response.body.createdAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(
+                Date.parse(response.body.createdAt)
+              );
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle update alert request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const updatedData = {
+            name: 'bcd',
+            tags: ['bar'],
+            params: {
+              foo: true,
+            },
+            schedule: { interval: '12s' },
+            actions: [],
+            throttle: '1m',
+          };
+          const response = await supertestWithoutAuth
+            .put(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(updatedData);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'update',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body).to.eql({
+                ...updatedData,
+                id: createdAlert.id,
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+                createdBy: 'elastic',
+                enabled: true,
+                updatedBy: user.username,
+                apiKeyOwner: user.username,
+                muteAll: false,
+                mutedInstanceIds: [],
+                scheduledTaskId: createdAlert.scheduledTaskId,
+                createdAt: response.body.createdAt,
+                updatedAt: response.body.updatedAt,
+              });
+              expect(Date.parse(response.body.createdAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(0);
+              expect(Date.parse(response.body.updatedAt)).to.be.greaterThan(
+                Date.parse(response.body.createdAt)
+              );
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle update alert request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const updatedData = {
+            name: 'bcd',
+            tags: ['bar'],
+            params: {
+              foo: true,
+            },
+            schedule: { interval: '12s' },
+            actions: [],
+            throttle: '1m',
+          };
+          const response = await supertestWithoutAuth
+            .put(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+            .set('kbn-xsrf', 'foo')
+            .auth(user.username, user.password)
+            .send(updatedData);
+
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'update',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(200);
+              expect(response.body).to.eql({
+                ...updatedData,
+                id: createdAlert.id,
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
                 createdBy: 'elastic',
                 enabled: true,
                 updatedBy: user.username,
@@ -148,21 +456,27 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               expect(response.body).to.eql({
                 ...updatedData,
                 id: createdAlert.id,
                 alertTypeId: 'test.noop',
-                consumer: 'bar',
+                consumer: 'alertsFixture',
                 createdBy: 'elastic',
                 enabled: true,
                 updatedBy: user.username,
@@ -220,12 +534,8 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'space_1_all at space2':
             case 'global_read at space1':
             case 'space_1_all at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
             case 'superuser at space1':
               expect(response.body).to.eql({
                 statusCode: 404,
@@ -266,15 +576,10 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -298,15 +603,10 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -351,15 +651,21 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.validation',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -390,15 +696,10 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(400);
               expect(response.body).to.eql({
                 statusCode: 400,
@@ -450,15 +751,21 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'update',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(200);
               await retry.try(async () => {
                 const alertTask = (await getAlertingTaskById(createdAlert.scheduledTaskId)).docs[0];
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update_api_key.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update_api_key.ts
index bf72b970dc0f1..7dea591b895ee 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update_api_key.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update_api_key.ts
@@ -13,6 +13,8 @@ import {
   getUrlPrefix,
   getTestAlertData,
   ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+  getProducerUnauthorizedErrorMessage,
 } from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
@@ -31,28 +33,245 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte
 
       describe(scenario.id, () => {
         it('should handle update alert api key request appropriately', async () => {
+          const { body: createdAction } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/actions/action`)
+            .set('kbn-xsrf', 'foo')
+            .send({
+              name: 'MY action',
+              actionTypeId: 'test.noop',
+              config: {},
+              secrets: {},
+            })
+            .expect(200);
+
           const { body: createdAlert } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
             .set('kbn-xsrf', 'foo')
-            .send(getTestAlertData())
+            .send(
+              getTestAlertData({
+                actions: [
+                  {
+                    id: createdAction.id,
+                    group: 'default',
+                    params: {},
+                  },
+                ],
+              })
+            )
             .expect(200);
           objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
 
           const response = await alertUtils.getUpdateApiKeyRequest(createdAlert.id);
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: `Unauthorized to execute actions`,
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.apiKeyOwner).to.eql(user.username);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
 
+        it('should handle update alert api key request appropriately when consumer is the same as producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alertsRestrictedFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getUpdateApiKeyRequest(createdAlert.id);
           switch (scenario.id) {
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.apiKeyOwner).to.eql(user.username);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle update alert api key request appropriately when consumer is not the producer', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.unrestricted-noop',
+                consumer: 'alertsFixture',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getUpdateApiKeyRequest(createdAlert.id);
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+            case 'global_read at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.unrestricted-noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.unrestricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
+              expect(response.statusCode).to.eql(204);
+              expect(response.body).to.eql('');
+              const { body: updatedAlert } = await supertestWithoutAuth
+                .get(`${getUrlPrefix(space.id)}/api/alerts/alert/${createdAlert.id}`)
+                .set('kbn-xsrf', 'foo')
+                .auth(user.username, user.password)
+                .expect(200);
+              expect(updatedAlert.apiKeyOwner).to.eql(user.username);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
+              break;
+            default:
+              throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
+          }
+        });
+
+        it('should handle update alert api key request appropriately when consumer is "alerts"', async () => {
+          const { body: createdAlert } = await supertest
+            .post(`${getUrlPrefix(space.id)}/api/alerts/alert`)
+            .set('kbn-xsrf', 'foo')
+            .send(
+              getTestAlertData({
+                alertTypeId: 'test.restricted-noop',
+                consumer: 'alerts',
+              })
+            )
+            .expect(200);
+          objectRemover.add(space.id, createdAlert.id, 'alert', 'alerts');
+
+          const response = await alertUtils.getUpdateApiKeyRequest(createdAlert.id);
+          switch (scenario.id) {
+            case 'no_kibana_privileges at space1':
+            case 'space_1_all at space2':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.restricted-noop',
+                  'alerts'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'global_read at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+              expect(response.statusCode).to.eql(403);
+              expect(response.body).to.eql({
+                error: 'Forbidden',
+                message: getProducerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.restricted-noop',
+                  'alertsRestrictedFixture'
+                ),
+                statusCode: 403,
+              });
+              break;
+            case 'superuser at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
@@ -100,15 +319,21 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.statusCode).to.eql(404);
+              expect(response.statusCode).to.eql(403);
               expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
+                error: 'Forbidden',
+                message: getConsumerUnauthorizedErrorMessage(
+                  'updateApiKey',
+                  'test.noop',
+                  'alertsFixture'
+                ),
+                statusCode: 403,
               });
               break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.statusCode).to.eql(204);
               expect(response.body).to.eql('');
               const { body: updatedAlert } = await supertestWithoutAuth
@@ -145,14 +370,10 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte
             case 'no_kibana_privileges at space1':
             case 'space_1_all at space2':
             case 'global_read at space1':
-              expect(response.body).to.eql({
-                statusCode: 404,
-                error: 'Not Found',
-                message: 'Not Found',
-              });
-              break;
             case 'superuser at space1':
             case 'space_1_all at space1':
+            case 'space_1_all_alerts_none_actions at space1':
+            case 'space_1_all_with_restricted_fixture at space1':
               expect(response.body).to.eql({
                 statusCode: 404,
                 error: 'Not Found',
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index_threshold/alert.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index_threshold/alert.ts
index 8412c09eefcda..92db0458c0639 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index_threshold/alert.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index_threshold/alert.ts
@@ -346,7 +346,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
         .set('kbn-xsrf', 'foo')
         .send({
           name: params.name,
-          consumer: 'function test',
+          consumer: 'alerts',
           enabled: true,
           alertTypeId: ALERT_TYPE_ID,
           schedule: { interval: `${ALERT_INTERVAL_SECONDS}s` },
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
index fa256712a012b..86775f77a7671 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts
@@ -6,7 +6,13 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { checkAAD, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import {
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+  getConsumerUnauthorizedErrorMessage,
+} from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -69,7 +75,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
         ],
         enabled: true,
         alertTypeId: 'test.noop',
-        consumer: 'bar',
+        consumer: 'alertsFixture',
         params: {},
         createdBy: null,
         schedule: { interval: '1m' },
@@ -102,6 +108,24 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
       });
     });
 
+    it('should handle create alert request appropriately when consumer is unknown', async () => {
+      const response = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
+        .set('kbn-xsrf', 'foo')
+        .send(getTestAlertData({ consumer: 'some consumer patrick invented' }));
+
+      expect(response.status).to.eql(403);
+      expect(response.body).to.eql({
+        error: 'Forbidden',
+        message: getConsumerUnauthorizedErrorMessage(
+          'create',
+          'test.noop',
+          'some consumer patrick invented'
+        ),
+        statusCode: 403,
+      });
+    });
+
     it('should handle create alert request appropriately when an alert is disabled ', async () => {
       const response = await supertest
         .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
index 06f27d666c3da..b28ce89b30472 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/find.ts
@@ -42,7 +42,7 @@ export default function createFindTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
-        consumer: 'bar',
+        consumer: 'alertsFixture',
         schedule: { interval: '1m' },
         enabled: true,
         actions: [],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
index ff671e16654b5..165eaa09126a8 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get.ts
@@ -36,7 +36,7 @@ export default function createGetTests({ getService }: FtrProviderContext) {
         name: 'abc',
         tags: ['foo'],
         alertTypeId: 'test.noop',
-        consumer: 'bar',
+        consumer: 'alertsFixture',
         schedule: { interval: '1m' },
         enabled: true,
         actions: [],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_state.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_state.ts
index d3f08d7c509a0..e3f87a9be00ba 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_state.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/get_alert_state.ts
@@ -44,7 +44,7 @@ export default function createGetAlertStateTests({ getService }: FtrProviderCont
           name: 'abc',
           tags: ['foo'],
           alertTypeId: 'test.cumulative-firing',
-          consumer: 'bar',
+          consumer: 'alertsFixture',
           schedule: { interval: '5s' },
           throttle: '5s',
           actions: [],
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
index aef87eefba2ad..dd09a14b4cb81 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/list_alert_types.ts
@@ -19,7 +19,9 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
         `${getUrlPrefix(Spaces.space1.id)}/api/alerts/list_alert_types`
       );
       expect(response.status).to.eql(200);
-      const fixtureAlertType = response.body.find((alertType: any) => alertType.id === 'test.noop');
+      const { authorizedConsumers, ...fixtureAlertType } = response.body.find(
+        (alertType: any) => alertType.id === 'test.noop'
+      );
       expect(fixtureAlertType).to.eql({
         actionGroups: [{ id: 'default', name: 'Default' }],
         defaultActionGroupId: 'default',
@@ -29,8 +31,9 @@ export default function listAlertTypes({ getService }: FtrProviderContext) {
           state: [],
           context: [],
         },
-        producer: 'alerting',
+        producer: 'alertsFixture',
       });
+      expect(Object.keys(authorizedConsumers)).to.contain('alertsFixture');
     });
 
     it('should return actionVariables with both context and state', async () => {
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
index fc61f59d129d7..d0e1be12e762f 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/migrations.ts
@@ -30,5 +30,14 @@ export default function createGetTests({ getService }: FtrProviderContext) {
       expect(response.status).to.eql(200);
       expect(response.body.consumer).to.equal('alerts');
     });
+
+    it('7.10.0 migrates the `metrics` consumer to be the `infrastructure`', async () => {
+      const response = await supertest.get(
+        `${getUrlPrefix(``)}/api/alerts/alert/74f3e6d7-b7bb-477d-ac28-fdf248d5f2a4`
+      );
+
+      expect(response.status).to.eql(200);
+      expect(response.body.consumer).to.equal('infrastructure');
+    });
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
index b01a1b140f2d6..9c8e6f6b8d94c 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts
@@ -47,7 +47,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
         id: createdAlert.id,
         tags: ['bar'],
         alertTypeId: 'test.noop',
-        consumer: 'bar',
+        consumer: 'alertsFixture',
         createdBy: null,
         enabled: true,
         updatedBy: null,
diff --git a/x-pack/test/api_integration/apis/features/features/features.ts b/x-pack/test/api_integration/apis/features/features/features.ts
index df6eca795f801..9c44bfeb810fa 100644
--- a/x-pack/test/api_integration/apis/features/features/features.ts
+++ b/x-pack/test/api_integration/apis/features/features/features.ts
@@ -97,6 +97,7 @@ export default function ({ getService }: FtrProviderContext) {
             'visualize',
             'dashboard',
             'dev_tools',
+            'actions',
             'enterpriseSearch',
             'advancedSettings',
             'indexPatterns',
@@ -106,6 +107,7 @@ export default function ({ getService }: FtrProviderContext) {
             'savedObjectsManagement',
             'ml',
             'apm',
+            'builtInAlerts',
             'canvas',
             'infrastructure',
             'logs',
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 59fcfae5db3cf..1ad25a11be879 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -38,6 +38,8 @@ export default function ({ getService }: FtrProviderContext) {
             ml: ['all', 'read'],
             siem: ['all', 'read'],
             ingestManager: ['all', 'read'],
+            builtInAlerts: ['all', 'read'],
+            actions: ['all', 'read'],
           },
           global: ['all', 'read'],
           space: ['all', 'read'],
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
index 5c2a2875852d6..d5263aed26d0b 100644
--- a/x-pack/test/api_integration/apis/security/privileges_basic.ts
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -36,6 +36,8 @@ export default function ({ getService }: FtrProviderContext) {
             ml: ['all', 'read'],
             siem: ['all', 'read'],
             ingestManager: ['all', 'read'],
+            builtInAlerts: ['all', 'read'],
+            actions: ['all', 'read'],
           },
           global: ['all', 'read'],
           space: ['all', 'read'],
diff --git a/x-pack/test/functional/es_archives/alerts/data.json b/x-pack/test/functional/es_archives/alerts/data.json
index 3703473606ea2..cc246b0fe44da 100644
--- a/x-pack/test/functional/es_archives/alerts/data.json
+++ b/x-pack/test/functional/es_archives/alerts/data.json
@@ -38,4 +38,46 @@
       "updated_at": "2020-06-17T15:35:39.839Z"
     }
   }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "alert:74f3e6d7-b7bb-477d-ac28-fdf248d5f2a4",
+    "index": ".kibana_1",
+    "source": {
+      "alert": {
+        "actions": [
+        ],
+        "alertTypeId": "example.always-firing",
+        "apiKey": "XHcE1hfSJJCvu2oJrKErgbIbR7iu3XAX+c1kki8jESzWZNyBlD4+6yHhCDEx7rNLlP/Hvbut/V8N1BaQkaSpVpiNsW/UxshiCouqJ+cmQ9LbaYnca9eTTVUuPhbHwwsDjfYkakDPqW3gB8sonwZl6rpzZVacfp4=",
+        "apiKeyOwner": "elastic",
+        "consumer": "metrics",
+        "createdAt": "2020-06-17T15:35:38.497Z",
+        "createdBy": "elastic",
+        "enabled": true,
+        "muteAll": false,
+        "mutedInstanceIds": [
+        ],
+        "name": "always-firing-alert",
+        "params": {
+        },
+        "schedule": {
+          "interval": "1m"
+        },
+        "scheduledTaskId": "329798f0-b0b0-11ea-9510-fdf248d5f2a4",
+        "tags": [
+        ],
+        "throttle": null,
+        "updatedBy": "elastic"
+      },
+      "migrationVersion": {
+        "alert": "7.8.0"
+      },
+      "references": [
+      ],
+      "type": "alert",
+      "updated_at": "2020-06-17T15:35:39.839Z"
+    }
+  }
 }
\ No newline at end of file
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
index 2225316bba80f..09c4156854506 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
@@ -28,7 +28,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         name: generateUniqueKey(),
         tags: ['foo', 'bar'],
         alertTypeId: 'test.noop',
-        consumer: 'test',
+        consumer: 'alerts',
         schedule: { interval: '1m' },
         throttle: '1m',
         actions: [],
@@ -372,7 +372,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await testSubjects.click('deleteAll');
       await testSubjects.existOrFail('deleteIdsConfirmation');
       await testSubjects.click('deleteIdsConfirmation > confirmModalConfirmButton');
-      await testSubjects.missingOrFail('deleteIdsConfirmation');
+      await testSubjects.missingOrFail('deleteIdsConfirmation', { timeout: 5000 });
 
       await pageObjects.common.closeToast();
 
diff --git a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/kibana.json b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/kibana.json
index 74f740f52a8b2..4ad7aa3126e88 100644
--- a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/kibana.json
+++ b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/kibana.json
@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["xpack"],
-  "requiredPlugins": ["alerts", "triggers_actions_ui"],
+  "requiredPlugins": ["alerts", "triggers_actions_ui", "features"],
   "server": true,
   "ui": true
 }
diff --git a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts
index 2bc299ede930b..503c328017a9a 100644
--- a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts
+++ b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts
@@ -21,7 +21,7 @@ export interface AlertingExamplePublicSetupDeps {
 export class AlertingFixturePlugin implements Plugin<Setup, Start, AlertingExamplePublicSetupDeps> {
   public setup(core: CoreSetup, { alerts, triggers_actions_ui }: AlertingExamplePublicSetupDeps) {
     alerts.registerNavigation(
-      'consumer-noop',
+      'alerting_fixture',
       'test.noop',
       (alert: SanitizedAlert, alertType: AlertType) => `/alert/${alert.id}`
     );
@@ -49,8 +49,8 @@ export class AlertingFixturePlugin implements Plugin<Setup, Start, AlertingExamp
     });
 
     core.application.register({
-      id: 'consumer-noop',
-      title: 'No Op App',
+      id: 'alerting_fixture',
+      title: 'Alerting Fixture App',
       async mount(params: AppMountParameters) {
         const [coreStart, depsStart] = await core.getStartServices();
         const { renderApp } = await import('./application');
diff --git a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/server/plugin.ts b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/server/plugin.ts
index fb431351a382d..dd81c860e9fa8 100644
--- a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/server/plugin.ts
+++ b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/server/plugin.ts
@@ -9,16 +9,46 @@ import {
   PluginSetupContract as AlertingSetup,
   AlertType,
 } from '../../../../../../plugins/alerts/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../../../../../plugins/features/server';
 
 // this plugin's dependendencies
 export interface AlertingExampleDeps {
   alerts: AlertingSetup;
+  features: FeaturesPluginSetup;
 }
 
 export class AlertingFixturePlugin implements Plugin<void, void, AlertingExampleDeps> {
-  public setup(core: CoreSetup, { alerts }: AlertingExampleDeps) {
+  public setup(core: CoreSetup, { alerts, features }: AlertingExampleDeps) {
     createNoopAlertType(alerts);
     createAlwaysFiringAlertType(alerts);
+    features.registerFeature({
+      id: 'alerting_fixture',
+      name: 'alerting_fixture',
+      app: [],
+      alerting: ['test.always-firing', 'test.noop'],
+      privileges: {
+        all: {
+          alerting: {
+            all: ['test.always-firing', 'test.noop'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+        read: {
+          alerting: {
+            all: ['test.always-firing', 'test.noop'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+      },
+    });
   }
 
   public start() {}
@@ -32,7 +62,7 @@ function createNoopAlertType(alerts: AlertingSetup) {
     actionGroups: [{ id: 'default', name: 'Default' }],
     defaultActionGroupId: 'default',
     async executor() {},
-    producer: 'alerting',
+    producer: 'alerts',
   };
   alerts.registerType(noopAlertType);
 }
@@ -46,7 +76,7 @@ function createAlwaysFiringAlertType(alerts: AlertingSetup) {
       { id: 'default', name: 'Default' },
       { id: 'other', name: 'Other' },
     ],
-    producer: 'alerting',
+    producer: 'alerts',
     async executor(alertExecutorOptions: any) {
       const { services, state, params } = alertExecutorOptions;
 
diff --git a/x-pack/test/functional_with_es_ssl/services/alerting/alerts.ts b/x-pack/test/functional_with_es_ssl/services/alerting/alerts.ts
index 25f4c6a932d5e..23a4529139c53 100644
--- a/x-pack/test/functional_with_es_ssl/services/alerting/alerts.ts
+++ b/x-pack/test/functional_with_es_ssl/services/alerting/alerts.ts
@@ -43,7 +43,7 @@ export class Alerts {
       name,
       tags,
       alertTypeId,
-      consumer: consumer ?? 'bar',
+      consumer: consumer ?? 'alerts',
       schedule: schedule ?? { interval: '1m' },
       throttle: throttle ?? '1m',
       actions: actions ?? [],
@@ -68,7 +68,7 @@ export class Alerts {
       name,
       tags: ['foo'],
       alertTypeId: 'test.noop',
-      consumer: 'consumer-noop',
+      consumer: 'alerting_fixture',
       schedule: { interval: '1m' },
       throttle: '1m',
       actions: [],
@@ -101,7 +101,7 @@ export class Alerts {
       name,
       tags: ['foo'],
       alertTypeId: 'test.always-firing',
-      consumer: 'bar',
+      consumer: 'alerts',
       schedule: { interval: '1m' },
       throttle: '1m',
       actions,