diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
index ae433e3db14c68..b10ad949c49443 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.links.md
@@ -106,6 +106,7 @@ readonly links: {
         };
         readonly search: {
             readonly sessions: string;
+            readonly sessionLimits: string;
         };
         readonly indexPatterns: {
             readonly introduction: string;
diff --git a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
index b0800c7dfc65ea..c020f57faa8825 100644
--- a/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.doclinksstart.md
@@ -17,5 +17,5 @@ export interface DocLinksStart
 |  --- | --- | --- |
 |  [DOC\_LINK\_VERSION](./kibana-plugin-core-public.doclinksstart.doc_link_version.md) | <code>string</code> |  |
 |  [ELASTIC\_WEBSITE\_URL](./kibana-plugin-core-public.doclinksstart.elastic_website_url.md) | <code>string</code> |  |
-|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly canvas: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly search: {</code><br/><code>            readonly sessions: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>            readonly runtimeFields: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly rollupJobs: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            byteSizeUnits: string;</code><br/><code>            createAutoFollowPattern: string;</code><br/><code>            createFollower: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createRollupJobsRequest: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            timeUnits: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Record&lt;string, string&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>        readonly fleet: Readonly&lt;{</code><br/><code>            guide: string;</code><br/><code>            fleetServer: string;</code><br/><code>            fleetServerAddFleetServer: string;</code><br/><code>            settings: string;</code><br/><code>            settingsFleetServerHostSettings: string;</code><br/><code>            troubleshooting: string;</code><br/><code>            elasticAgent: string;</code><br/><code>            datastreams: string;</code><br/><code>            datastreamsNamingScheme: string;</code><br/><code>            upgradeElasticAgent: string;</code><br/><code>            upgradeElasticAgent712lower: string;</code><br/><code>        }&gt;;</code><br/><code>    }</code> |  |
+|  [links](./kibana-plugin-core-public.doclinksstart.links.md) | <code>{</code><br/><code>        readonly canvas: {</code><br/><code>            readonly guide: string;</code><br/><code>        };</code><br/><code>        readonly dashboard: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly drilldowns: string;</code><br/><code>            readonly drilldownsTriggerPicker: string;</code><br/><code>            readonly urlDrilldownTemplateSyntax: string;</code><br/><code>            readonly urlDrilldownVariables: string;</code><br/><code>        };</code><br/><code>        readonly discover: Record&lt;string, string&gt;;</code><br/><code>        readonly filebeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly installation: string;</code><br/><code>            readonly configuration: string;</code><br/><code>            readonly elasticsearchOutput: string;</code><br/><code>            readonly elasticsearchModule: string;</code><br/><code>            readonly startup: string;</code><br/><code>            readonly exportedFields: string;</code><br/><code>        };</code><br/><code>        readonly auditbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly metricbeat: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly configure: string;</code><br/><code>            readonly httpEndpoint: string;</code><br/><code>            readonly install: string;</code><br/><code>            readonly start: string;</code><br/><code>        };</code><br/><code>        readonly enterpriseSearch: {</code><br/><code>            readonly base: string;</code><br/><code>            readonly appSearchBase: string;</code><br/><code>            readonly workplaceSearchBase: string;</code><br/><code>        };</code><br/><code>        readonly heartbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly logstash: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly functionbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly winlogbeat: {</code><br/><code>            readonly base: string;</code><br/><code>        };</code><br/><code>        readonly aggs: {</code><br/><code>            readonly composite: string;</code><br/><code>            readonly composite_missing_bucket: string;</code><br/><code>            readonly date_histogram: string;</code><br/><code>            readonly date_range: string;</code><br/><code>            readonly date_format_pattern: string;</code><br/><code>            readonly filter: string;</code><br/><code>            readonly filters: string;</code><br/><code>            readonly geohash_grid: string;</code><br/><code>            readonly histogram: string;</code><br/><code>            readonly ip_range: string;</code><br/><code>            readonly range: string;</code><br/><code>            readonly significant_terms: string;</code><br/><code>            readonly terms: string;</code><br/><code>            readonly avg: string;</code><br/><code>            readonly avg_bucket: string;</code><br/><code>            readonly max_bucket: string;</code><br/><code>            readonly min_bucket: string;</code><br/><code>            readonly sum_bucket: string;</code><br/><code>            readonly cardinality: string;</code><br/><code>            readonly count: string;</code><br/><code>            readonly cumulative_sum: string;</code><br/><code>            readonly derivative: string;</code><br/><code>            readonly geo_bounds: string;</code><br/><code>            readonly geo_centroid: string;</code><br/><code>            readonly max: string;</code><br/><code>            readonly median: string;</code><br/><code>            readonly min: string;</code><br/><code>            readonly moving_avg: string;</code><br/><code>            readonly percentile_ranks: string;</code><br/><code>            readonly serial_diff: string;</code><br/><code>            readonly std_dev: string;</code><br/><code>            readonly sum: string;</code><br/><code>            readonly top_hits: string;</code><br/><code>        };</code><br/><code>        readonly runtimeFields: {</code><br/><code>            readonly overview: string;</code><br/><code>            readonly mapping: string;</code><br/><code>        };</code><br/><code>        readonly scriptedFields: {</code><br/><code>            readonly scriptFields: string;</code><br/><code>            readonly scriptAggs: string;</code><br/><code>            readonly painless: string;</code><br/><code>            readonly painlessApi: string;</code><br/><code>            readonly painlessLangSpec: string;</code><br/><code>            readonly painlessSyntax: string;</code><br/><code>            readonly painlessWalkthrough: string;</code><br/><code>            readonly luceneExpressions: string;</code><br/><code>        };</code><br/><code>        readonly search: {</code><br/><code>            readonly sessions: string;</code><br/><code>            readonly sessionLimits: string;</code><br/><code>        };</code><br/><code>        readonly indexPatterns: {</code><br/><code>            readonly introduction: string;</code><br/><code>            readonly fieldFormattersNumber: string;</code><br/><code>            readonly fieldFormattersString: string;</code><br/><code>            readonly runtimeFields: string;</code><br/><code>        };</code><br/><code>        readonly addData: string;</code><br/><code>        readonly kibana: string;</code><br/><code>        readonly upgradeAssistant: string;</code><br/><code>        readonly elasticsearch: Record&lt;string, string&gt;;</code><br/><code>        readonly siem: {</code><br/><code>            readonly guide: string;</code><br/><code>            readonly gettingStarted: string;</code><br/><code>        };</code><br/><code>        readonly query: {</code><br/><code>            readonly eql: string;</code><br/><code>            readonly kueryQuerySyntax: string;</code><br/><code>            readonly luceneQuerySyntax: string;</code><br/><code>            readonly percolate: string;</code><br/><code>            readonly queryDsl: string;</code><br/><code>        };</code><br/><code>        readonly date: {</code><br/><code>            readonly dateMath: string;</code><br/><code>            readonly dateMathIndexNames: string;</code><br/><code>        };</code><br/><code>        readonly management: Record&lt;string, string&gt;;</code><br/><code>        readonly ml: Record&lt;string, string&gt;;</code><br/><code>        readonly transforms: Record&lt;string, string&gt;;</code><br/><code>        readonly visualize: Record&lt;string, string&gt;;</code><br/><code>        readonly apis: Readonly&lt;{</code><br/><code>            bulkIndexAlias: string;</code><br/><code>            byteSizeUnits: string;</code><br/><code>            createAutoFollowPattern: string;</code><br/><code>            createFollower: string;</code><br/><code>            createIndex: string;</code><br/><code>            createSnapshotLifecyclePolicy: string;</code><br/><code>            createRoleMapping: string;</code><br/><code>            createRoleMappingTemplates: string;</code><br/><code>            createRollupJobsRequest: string;</code><br/><code>            createApiKey: string;</code><br/><code>            createPipeline: string;</code><br/><code>            createTransformRequest: string;</code><br/><code>            cronExpressions: string;</code><br/><code>            executeWatchActionModes: string;</code><br/><code>            indexExists: string;</code><br/><code>            openIndex: string;</code><br/><code>            putComponentTemplate: string;</code><br/><code>            painlessExecute: string;</code><br/><code>            painlessExecuteAPIContexts: string;</code><br/><code>            putComponentTemplateMetadata: string;</code><br/><code>            putSnapshotLifecyclePolicy: string;</code><br/><code>            putIndexTemplateV1: string;</code><br/><code>            putWatch: string;</code><br/><code>            simulatePipeline: string;</code><br/><code>            timeUnits: string;</code><br/><code>            updateTransform: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly observability: Record&lt;string, string&gt;;</code><br/><code>        readonly alerting: Record&lt;string, string&gt;;</code><br/><code>        readonly maps: Record&lt;string, string&gt;;</code><br/><code>        readonly monitoring: Record&lt;string, string&gt;;</code><br/><code>        readonly security: Readonly&lt;{</code><br/><code>            apiKeyServiceSettings: string;</code><br/><code>            clusterPrivileges: string;</code><br/><code>            elasticsearchSettings: string;</code><br/><code>            elasticsearchEnableSecurity: string;</code><br/><code>            indicesPrivileges: string;</code><br/><code>            kibanaTLS: string;</code><br/><code>            kibanaPrivileges: string;</code><br/><code>            mappingRoles: string;</code><br/><code>            mappingRolesFieldRules: string;</code><br/><code>            runAsPrivilege: string;</code><br/><code>        }&gt;;</code><br/><code>        readonly watcher: Record&lt;string, string&gt;;</code><br/><code>        readonly ccs: Record&lt;string, string&gt;;</code><br/><code>        readonly plugins: Record&lt;string, string&gt;;</code><br/><code>        readonly snapshotRestore: Record&lt;string, string&gt;;</code><br/><code>        readonly ingest: Record&lt;string, string&gt;;</code><br/><code>    }</code> |  |
 
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.isrestored.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.isrestored.md
new file mode 100644
index 00000000000000..d649212ae05477
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.isrestored.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [IKibanaSearchResponse](./kibana-plugin-plugins-data-public.ikibanasearchresponse.md) &gt; [isRestored](./kibana-plugin-plugins-data-public.ikibanasearchresponse.isrestored.md)
+
+## IKibanaSearchResponse.isRestored property
+
+Indicates whether the results returned are from the async-search index
+
+<b>Signature:</b>
+
+```typescript
+isRestored?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.md
index 1d3e0c08dfc18d..c7046902dac72b 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.ikibanasearchresponse.md
@@ -16,6 +16,7 @@ export interface IKibanaSearchResponse<RawResponse = any>
 |  --- | --- | --- |
 |  [id](./kibana-plugin-plugins-data-public.ikibanasearchresponse.id.md) | <code>string</code> | Some responses may contain a unique id to identify the request this response came from. |
 |  [isPartial](./kibana-plugin-plugins-data-public.ikibanasearchresponse.ispartial.md) | <code>boolean</code> | Indicates whether the results returned are complete or partial |
+|  [isRestored](./kibana-plugin-plugins-data-public.ikibanasearchresponse.isrestored.md) | <code>boolean</code> | Indicates whether the results returned are from the async-search index |
 |  [isRunning](./kibana-plugin-plugins-data-public.ikibanasearchresponse.isrunning.md) | <code>boolean</code> | Indicates whether search is still in flight |
 |  [loaded](./kibana-plugin-plugins-data-public.ikibanasearchresponse.loaded.md) | <code>number</code> | If relevant to the search strategy, return a loaded number that represents how progress is indicated. |
 |  [rawResponse](./kibana-plugin-plugins-data-public.ikibanasearchresponse.rawresponse.md) | <code>RawResponse</code> | The raw response returned by the internal search method (usually the raw ES response) |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
index b1745b298e27e8..9816b884c46144 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
@@ -13,6 +13,7 @@
 |  [IndexPatternsFetcher](./kibana-plugin-plugins-data-server.indexpatternsfetcher.md) |  |
 |  [IndexPatternsService](./kibana-plugin-plugins-data-server.indexpatternsservice.md) |  |
 |  [IndexPatternsServiceProvider](./kibana-plugin-plugins-data-server.indexpatternsserviceprovider.md) |  |
+|  [NoSearchIdInSessionError](./kibana-plugin-plugins-data-server.nosearchidinsessionerror.md) |  |
 |  [OptionedParamType](./kibana-plugin-plugins-data-server.optionedparamtype.md) |  |
 |  [Plugin](./kibana-plugin-plugins-data-server.plugin.md) |  |
 
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror._constructor_.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror._constructor_.md
new file mode 100644
index 00000000000000..e48a1c98f85785
--- /dev/null
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror._constructor_.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [NoSearchIdInSessionError](./kibana-plugin-plugins-data-server.nosearchidinsessionerror.md) &gt; [(constructor)](./kibana-plugin-plugins-data-server.nosearchidinsessionerror._constructor_.md)
+
+## NoSearchIdInSessionError.(constructor)
+
+Constructs a new instance of the `NoSearchIdInSessionError` class
+
+<b>Signature:</b>
+
+```typescript
+constructor();
+```
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror.md
new file mode 100644
index 00000000000000..707739f845cd14
--- /dev/null
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.nosearchidinsessionerror.md
@@ -0,0 +1,18 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-server](./kibana-plugin-plugins-data-server.md) &gt; [NoSearchIdInSessionError](./kibana-plugin-plugins-data-server.nosearchidinsessionerror.md)
+
+## NoSearchIdInSessionError class
+
+<b>Signature:</b>
+
+```typescript
+export declare class NoSearchIdInSessionError extends KbnError 
+```
+
+## Constructors
+
+|  Constructor | Modifiers | Description |
+|  --- | --- | --- |
+|  [(constructor)()](./kibana-plugin-plugins-data-server.nosearchidinsessionerror._constructor_.md) |  | Constructs a new instance of the <code>NoSearchIdInSessionError</code> class |
+
diff --git a/docs/user/dashboard/aggregation-reference.asciidoc b/docs/user/dashboard/aggregation-reference.asciidoc
index cb5c484def3b9d..17bfc19c2e0c9d 100644
--- a/docs/user/dashboard/aggregation-reference.asciidoc
+++ b/docs/user/dashboard/aggregation-reference.asciidoc
@@ -12,91 +12,168 @@ This reference can help simplify the comparison if you need a specific feature.
 [options="header"]
 |===
 
-| Type | Aggregation-based | Lens | TSVB | Timelion | Vega
+| Type | Lens | TSVB | Agg-based | Vega | Timelion
 
 | Table
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 |
 |
 
-| Table with summary row
-^| X
-^| X
-|
+| Bar, line, and area
+| &check;
+| &check;
+| &check;
+| &check;
+| &check;
+
+| Split chart/small multiples
 |
+| &check;
+| &check;
+| &check;
 |
 
-| Bar, line, and area charts
-^| X
-^| X
-^| X
-^| X
-^| X
+| Pie and donut
+| &check;
+|
+| &check;
+| &check;
+|
 
-| Percentage bar or area chart
+| Sunburst
+| &check;
 |
-^| X
-^| X
+| &check;
+| &check;
 |
-^| X
 
-| Split bar, line, and area charts
-^| X
+| Treemap
+| &check;
+|
 |
+| &check;
 |
+
+| Heat map
+| &check;
+| &check;
+| &check;
+| &check;
 |
-^| X
 
-| Pie and donut charts
-^| X
-^| X
+| Gauge and Goal
 |
+| &check;
+| &check;
+| &check;
 |
-^| X
 
-| Sunburst chart
-^| X
-^| X
+| Markdown
+|
+| &check;
 |
 |
 |
 
-| Heat map
-^| X
-^| X
+| Metric
+| &check;
+| &check;
+| &check;
+| &check;
+|
+
+| Tag cloud
 |
 |
-^| X
+| &check;
+| &check;
+|
 
-| Gauge and Goal
-^| X
+|===
+
+[float]
+[[table-features]]
+=== Table features
+
+[options="header"]
+|===
+
+| Type | Lens | TSVB | Agg-based
+
+| Summary row
+| &check;
 |
-^| X
+| &check;
+
+| Pivot table
+| &check;
 |
 |
 
-| Markdown
+| Calculated column
+| Formula
+| &check;
+| Percent only
+
+| Color by value
+| &check;
+| &check;
 |
+
+|===
+
+[float]
+[[xy-features]]
+=== Bar, line, area features
+
+[options="header"]
+|===
+
+| Type | Lens | TSVB | Agg-based | Vega | Timelion
+
+| Dense time series
+| Customizable
+| &check;
+| Customizable
+| &check;
+| &check;
+
+| Percentage mode
+| &check;
+| &check;
+| &check;
+| &check;
 |
-^| X
+
+| Break downs
+| 1
+| 1
+| 3
+| &infin;
+| 1
+
+| Custom color with break downs
 |
+| Only for Filters
+| &check;
+| &check;
 |
 
-| Metric
-^| X
-^| X
-^| X
+| Fit missing values
+| &check;
 |
-^| X
+| &check;
+| &check;
+| &check;
 
-| Tag cloud
-^| X
+| Synchronized tooltips
+|
+| &check;
 |
 |
 |
-^| X
 
 |===
 
@@ -111,67 +188,57 @@ For information about {es} bucket aggregations, refer to {ref}/search-aggregatio
 [options="header"]
 |===
 
-| Type | Agg-based | Markdown | Lens | TSVB
+| Type | Lens | TSVB | Agg-based
 
 | Histogram
-^| X
-^| X
-^| X 
+| &check;
 | 
+| &check;
 
 | Date histogram
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Date range
-^| X
-^| X
-| 
+| Use filters
 | 
+| &check;
 
 | Filter
-^| X
-^| X
 |
-^| X
+| &check;
+|
 
 | Filters
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | GeoHash grid
-^| X
-^| X
 | 
 | 
+| &check;
 
 | IP range
-^| X
-^| X
-| 
-| 
+| Use filters
+| Use filters
+| &check;
 
 | Range
-^| X
-^| X
-^| X
-| 
+| &check;
+| Use filters
+| &check;
 
 | Terms
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Significant terms
-^| X
-^| X
 |
-^| X
+|
+| &check;
 
 |===
 
@@ -186,67 +253,57 @@ For information about {es} metrics aggregations, refer to {ref}/search-aggregati
 [options="header"]
 |===
 
-| Type | Agg-based | Markdown | Lens | TSVB
+| Type | Lens | TSVB | Agg-based
 
 | Metrics with filters
+| &check;
 |
 |
-^| X
-|
-
-| Average
-^| X
-^| X
-^| X
-^| X
 
-| Sum 
-^| X
-^| X
-^| X
-^| X
+| Average, Sum, Max, Min
+| &check;
+| &check;
+| &check;
 
 | Unique count (Cardinality)
-^| X
-^| X
-^| X
-^| X
-
-| Max
-^| X
-^| X
-^| X
-^| X
-
-| Min
-^| X
-^| X
-^| X
-^| X
-
-| Percentiles
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
+
+| Percentiles and Median
+| &check;
+| &check;
+| &check;
 
 | Percentiles Rank
-^| X
-^| X
-| 
-^| X
+|
+| &check;
+| &check;
+
+| Standard deviation
+|
+| &check;
+| &check;
+
+| Sum of squares
+|
+| &check;
+|
 
 | Top hit (Last value)
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Value count 
 | 
 | 
+| &check;
+
+| Variance
+| 
+| &check;
 | 
-^| X
 
 |===
 
@@ -261,61 +318,94 @@ For information about {es} pipeline aggregations, refer to {ref}/search-aggregat
 [options="header"]
 |===
 
-| Type | Agg-based | Markdown | Lens | TSVB
+| Type | Lens | TSVB | Agg-based
 
 | Avg bucket  
-^| X
-^| X
-| 
-^| X
+| <<lens-formulas, `overall_average` formula>>
+| &check;
+| &check;
 
 | Derivative  
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Max bucket   
-^| X
-^| X
-| 
-^| X
+| <<lens-formulas, `overall_max` formula>>
+| &check;
+| &check;
 
 | Min bucket   
-^| X
-^| X
-| 
-^| X
+| <<lens-formulas, `overall_min` formula>>
+| &check;
+| &check;
 
 | Sum bucket  
-^| X
-^| X
-| 
-^| X
+| <<lens-formulas, `overall_sum` formula>>
+| &check;
+| &check;
  
 | Moving average  
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Cumulative sum 
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
+| &check;
 
 | Bucket script 
 | 
 | 
+| &check;
+
+| Bucket selector
+| 
 | 
-^| X
+|
 
 | Serial differencing 
-^| X
-^| X
 | 
-^| X
+| &check;
+| &check;
+
+|===
+
+[float]
+[[custom-functions]]
+=== Additional functions
+
+[options="header"]
+|===
+
+| Type | Lens | TSVB | Agg-based
+
+| Counter rate
+| &check;
+| &check;
+|
+
+| <<tsvb-function-reference, Filter ratio>>
+| Use <<lens-formulas, formula>>
+| &check;
+|
+
+| <<tsvb-function-reference, Positive only>>
+|
+| &check;
+|
+
+| <<tsvb-function-reference, Series agg>>
+|
+| &check;
+|
+
+| Static value
+|
+| &check;
+|
+
 
 |===
 
@@ -329,41 +419,49 @@ build their advanced visualization.
 [options="header"]
 |===
 
-| Type | Agg-based | Lens | TSVB | Timelion | Vega
+| Type | Lens | TSVB | Agg-based | Vega | Timelion
 
-| Math on aggregated data
+| Math
+| &check;
+| &check;
 |
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
 
 | Visualize two indices
+| &check;
+| &check;
 |
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
 
 | Math across indices
 |
 |
 |
-^| X
-^| X
+| &check;
+| &check;
 
 | Time shifts
+| &check;
+| &check;
 |
-^| X
-^| X
-^| X
-^| X
+| &check;
+| &check;
 
 | Fully custom {es} queries
 |
 |
 |
+| &check;
 |
-^| X
+
+| Normalize by time
+| &check;
+| &check;
+|
+|
+|
+
 
 |===
diff --git a/docs/user/dashboard/lens.asciidoc b/docs/user/dashboard/lens.asciidoc
index 4ecfcc92501228..2071f17ecff3d5 100644
--- a/docs/user/dashboard/lens.asciidoc
+++ b/docs/user/dashboard/lens.asciidoc
@@ -139,6 +139,42 @@ image::images/lens_drag_drop_3.gif[Using drag and drop to reorder]
 
 . Press Space bar to confirm, or to cancel, press Esc.
 
+[float]
+[[lens-formulas]]
+==== Use formulas to perform math
+
+Formulas let you perform math on aggregated data in Lens by typing
+math and quick functions. To access formulas,
+click the *Formula* tab in the dimension editor. Access the complete
+reference for formulas from the help menu.
+
+The most common formulas are dividing two values to produce a percent.
+To display accurately, set *Value format* to *Percent*.
+
+Filter ratio::
+
+Use `kql=''` to filter one set of documents and compare it to other documents within the same grouping.
+For example, to see how the error rate changes over time:
++
+```
+count(kql='response.status_code > 400') / count()
+```
+
+Week over week:: Use `shift='1w'` to get the value of each grouping from
+the previous week. Time shift should not be used with the *Top values* function.
++
+```
+percentile(system.network.in.bytes, percentile=99) /
+percentile(system.network.in.bytes, percentile=99, shift='1w')
+```
+
+Percent of total:: Formulas can calculate `overall_sum` for all the groupings,
+which lets you convert each grouping into a percent of total:
++
+```
+sum(products.base_price) / overall_sum(sum(products.base_price))
+```
+
 [float]
 [[lens-faq]]
 ==== Frequently asked questions
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
index f75f0dcebf4f67..1909bcb1bcc2e6 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts
@@ -42,6 +42,7 @@ export interface UseExceptionListsProps {
   notifications: NotificationsStart;
   pagination?: Pagination;
   showTrustedApps: boolean;
+  showEventFilters: boolean;
 }
 
 export interface UseExceptionListProps {
diff --git a/packages/kbn-securitysolution-list-hooks/src/use_exception_lists/index.ts b/packages/kbn-securitysolution-list-hooks/src/use_exception_lists/index.ts
index a9a93aa8df49a6..0bd4c6c705668d 100644
--- a/packages/kbn-securitysolution-list-hooks/src/use_exception_lists/index.ts
+++ b/packages/kbn-securitysolution-list-hooks/src/use_exception_lists/index.ts
@@ -28,6 +28,7 @@ export type ReturnExceptionLists = [boolean, ExceptionListSchema[], Pagination,
  * @param namespaceTypes spaces to be searched
  * @param notifications kibana service for displaying toasters
  * @param showTrustedApps boolean - include/exclude trusted app lists
+ * @param showEventFilters boolean - include/exclude event filters lists
  * @param pagination
  *
  */
@@ -43,6 +44,7 @@ export const useExceptionLists = ({
   namespaceTypes,
   notifications,
   showTrustedApps = false,
+  showEventFilters = false,
 }: UseExceptionListsProps): ReturnExceptionLists => {
   const [exceptionLists, setExceptionLists] = useState<ExceptionListSchema[]>([]);
   const [paginationInfo, setPagination] = useState<Pagination>(pagination);
@@ -51,8 +53,9 @@ export const useExceptionLists = ({
 
   const namespaceTypesAsString = useMemo(() => namespaceTypes.join(','), [namespaceTypes]);
   const filters = useMemo(
-    (): string => getFilters(filterOptions, namespaceTypes, showTrustedApps),
-    [namespaceTypes, filterOptions, showTrustedApps]
+    (): string =>
+      getFilters({ filters: filterOptions, namespaceTypes, showTrustedApps, showEventFilters }),
+    [namespaceTypes, filterOptions, showTrustedApps, showEventFilters]
   );
 
   useEffect(() => {
diff --git a/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.test.ts b/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.test.ts
new file mode 100644
index 00000000000000..934a9cbff56a64
--- /dev/null
+++ b/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { getEventFiltersFilter } from '.';
+
+describe('getEventFiltersFilter', () => {
+  test('it returns filter to search for "exception-list" namespace trusted apps', () => {
+    const filter = getEventFiltersFilter(true, ['exception-list']);
+
+    expect(filter).toEqual('(exception-list.attributes.list_id: endpoint_event_filters*)');
+  });
+
+  test('it returns filter to search for "exception-list" and "agnostic" namespace trusted apps', () => {
+    const filter = getEventFiltersFilter(true, ['exception-list', 'exception-list-agnostic']);
+
+    expect(filter).toEqual(
+      '(exception-list.attributes.list_id: endpoint_event_filters* OR exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+    );
+  });
+
+  test('it returns filter to exclude "exception-list" namespace trusted apps', () => {
+    const filter = getEventFiltersFilter(false, ['exception-list']);
+
+    expect(filter).toEqual('(not exception-list.attributes.list_id: endpoint_event_filters*)');
+  });
+
+  test('it returns filter to exclude "exception-list" and "agnostic" namespace trusted apps', () => {
+    const filter = getEventFiltersFilter(false, ['exception-list', 'exception-list-agnostic']);
+
+    expect(filter).toEqual(
+      '(not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+    );
+  });
+});
diff --git a/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.ts b/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.ts
new file mode 100644
index 00000000000000..7e55073228fcab
--- /dev/null
+++ b/packages/kbn-securitysolution-list-utils/src/get_event_filters_filter/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ENDPOINT_EVENT_FILTERS_LIST_ID } from '@kbn/securitysolution-list-constants';
+import { SavedObjectType } from '../types';
+
+export const getEventFiltersFilter = (
+  showEventFilter: boolean,
+  namespaceTypes: SavedObjectType[]
+): string => {
+  if (showEventFilter) {
+    const filters = namespaceTypes.map((namespace) => {
+      return `${namespace}.attributes.list_id: ${ENDPOINT_EVENT_FILTERS_LIST_ID}*`;
+    });
+    return `(${filters.join(' OR ')})`;
+  } else {
+    const filters = namespaceTypes.map((namespace) => {
+      return `not ${namespace}.attributes.list_id: ${ENDPOINT_EVENT_FILTERS_LIST_ID}*`;
+    });
+    return `(${filters.join(' AND ')})`;
+  }
+};
diff --git a/packages/kbn-securitysolution-list-utils/src/get_filters/index.test.ts b/packages/kbn-securitysolution-list-utils/src/get_filters/index.test.ts
index 327a29dc1b987a..bfaad52ee81472 100644
--- a/packages/kbn-securitysolution-list-utils/src/get_filters/index.test.ts
+++ b/packages/kbn-securitysolution-list-utils/src/get_filters/index.test.ts
@@ -11,106 +11,318 @@ import { getFilters } from '.';
 describe('getFilters', () => {
   describe('single', () => {
     test('it properly formats when no filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters({}, ['single'], false);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
-      expect(filter).toEqual('(not exception-list.attributes.list_id: endpoint_trusted_apps*)');
+      expect(filter).toEqual(
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
     });
 
     test('it properly formats when no filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({}, ['single'], true);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
 
-      expect(filter).toEqual('(exception-list.attributes.list_id: endpoint_trusted_apps*)');
+      expect(filter).toEqual(
+        '(exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
     });
 
     test('it properly formats when filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters({ created_by: 'moi', name: 'Sample' }, ['single'], false);
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it if filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({ created_by: 'moi', name: 'Sample' }, ['single'], true);
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it if filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
 
       expect(filter).toEqual(
-        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (exception-list.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps*) AND (exception-list.attributes.list_id: endpoint_event_filters*)'
       );
     });
   });
 
   describe('agnostic', () => {
     test('it properly formats when no filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters({}, ['agnostic'], false);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it properly formats when no filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({}, ['agnostic'], true);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it properly formats when filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters({ created_by: 'moi', name: 'Sample' }, ['agnostic'], false);
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it if filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({ created_by: 'moi', name: 'Sample' }, ['agnostic'], true);
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it if filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['agnostic'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
 
       expect(filter).toEqual(
-        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list-agnostic.attributes.created_by:moi) AND (exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
   });
 
   describe('single, agnostic', () => {
     test('it properly formats when no filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters({}, ['single', 'agnostic'], false);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it properly formats when no filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters({}, ['single', 'agnostic'], true);
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it properly formats when filters passed and "showTrustedApps" is false', () => {
-      const filter = getFilters(
-        { created_by: 'moi', name: 'Sample' },
-        ['single', 'agnostic'],
-        false
-      );
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
 
       expect(filter).toEqual(
-        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
 
     test('it properly formats when filters passed and "showTrustedApps" is true', () => {
-      const filter = getFilters(
-        { created_by: 'moi', name: 'Sample' },
-        ['single', 'agnostic'],
-        true
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: true,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when no filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: {},
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
+
+      expect(filter).toEqual(
+        '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (exception-list.attributes.list_id: endpoint_event_filters* OR exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
+      );
+    });
+
+    test('it properly formats when filters passed and "showEventFilters" is false', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: false,
+      });
+
+      expect(filter).toEqual(
+        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
+    });
+
+    test('it properly formats when filters passed and "showEventFilters" is true', () => {
+      const filter = getFilters({
+        filters: { created_by: 'moi', name: 'Sample' },
+        namespaceTypes: ['single', 'agnostic'],
+        showTrustedApps: false,
+        showEventFilters: true,
+      });
 
       expect(filter).toEqual(
-        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)'
+        '(exception-list.attributes.created_by:moi OR exception-list-agnostic.attributes.created_by:moi) AND (exception-list.attributes.name.text:Sample OR exception-list-agnostic.attributes.name.text:Sample) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (exception-list.attributes.list_id: endpoint_event_filters* OR exception-list-agnostic.attributes.list_id: endpoint_event_filters*)'
       );
     });
   });
diff --git a/packages/kbn-securitysolution-list-utils/src/get_filters/index.ts b/packages/kbn-securitysolution-list-utils/src/get_filters/index.ts
index c9dd6ccae484c2..238ae5541343cf 100644
--- a/packages/kbn-securitysolution-list-utils/src/get_filters/index.ts
+++ b/packages/kbn-securitysolution-list-utils/src/get_filters/index.ts
@@ -10,14 +10,26 @@ import { ExceptionListFilter, NamespaceType } from '@kbn/securitysolution-io-ts-
 import { getGeneralFilters } from '../get_general_filters';
 import { getSavedObjectTypes } from '../get_saved_object_types';
 import { getTrustedAppsFilter } from '../get_trusted_apps_filter';
+import { getEventFiltersFilter } from '../get_event_filters_filter';
 
-export const getFilters = (
-  filters: ExceptionListFilter,
-  namespaceTypes: NamespaceType[],
-  showTrustedApps: boolean
-): string => {
+export interface GetFiltersParams {
+  filters: ExceptionListFilter;
+  namespaceTypes: NamespaceType[];
+  showTrustedApps: boolean;
+  showEventFilters: boolean;
+}
+
+export const getFilters = ({
+  filters,
+  namespaceTypes,
+  showTrustedApps,
+  showEventFilters,
+}: GetFiltersParams): string => {
   const namespaces = getSavedObjectTypes({ namespaceType: namespaceTypes });
   const generalFilters = getGeneralFilters(filters, namespaces);
   const trustedAppsFilter = getTrustedAppsFilter(showTrustedApps, namespaces);
-  return [generalFilters, trustedAppsFilter].filter((filter) => filter.trim() !== '').join(' AND ');
+  const eventFiltersFilter = getEventFiltersFilter(showEventFilters, namespaces);
+  return [generalFilters, trustedAppsFilter, eventFiltersFilter]
+    .filter((filter) => filter.trim() !== '')
+    .join(' AND ');
 };
diff --git a/src/core/public/chrome/chrome_service.test.ts b/src/core/public/chrome/chrome_service.test.ts
index 0264c8a1acf754..92f5a854f6b00f 100644
--- a/src/core/public/chrome/chrome_service.test.ts
+++ b/src/core/public/chrome/chrome_service.test.ts
@@ -53,8 +53,21 @@ function defaultStartDeps(availableApps?: App[]) {
   return deps;
 }
 
+function defaultStartTestOptions({
+  browserSupportsCsp = true,
+  kibanaVersion = 'version',
+}: {
+  browserSupportsCsp?: boolean;
+  kibanaVersion?: string;
+}): any {
+  return {
+    browserSupportsCsp,
+    kibanaVersion,
+  };
+}
+
 async function start({
-  options = { browserSupportsCsp: true },
+  options = defaultStartTestOptions({}),
   cspConfigMock = { warnLegacyBrowsers: true },
   startDeps = defaultStartDeps(),
 }: { options?: any; cspConfigMock?: any; startDeps?: ReturnType<typeof defaultStartDeps> } = {}) {
@@ -82,7 +95,9 @@ afterAll(() => {
 
 describe('start', () => {
   it('adds legacy browser warning if browserSupportsCsp is disabled and warnLegacyBrowsers is enabled', async () => {
-    const { startDeps } = await start({ options: { browserSupportsCsp: false } });
+    const { startDeps } = await start({
+      options: { browserSupportsCsp: false, kibanaVersion: '7.0.0' },
+    });
 
     expect(startDeps.notifications.toasts.addWarning.mock.calls).toMatchInlineSnapshot(`
       Array [
@@ -95,6 +110,41 @@ describe('start', () => {
     `);
   });
 
+  it('adds the kibana versioned class to the document body', async () => {
+    const { chrome, service } = await start({
+      options: { browserSupportsCsp: false, kibanaVersion: '1.2.3' },
+    });
+    const promise = chrome.getBodyClasses$().pipe(toArray()).toPromise();
+    service.stop();
+    await expect(promise).resolves.toMatchInlineSnapshot(`
+            Array [
+              Array [
+                "kbnBody",
+                "kbnBody--noHeaderBanner",
+                "kbnBody--chromeHidden",
+                "kbnVersion-1-2-3",
+              ],
+            ]
+          `);
+  });
+  it('strips off "snapshot" from the kibana version if present', async () => {
+    const { chrome, service } = await start({
+      options: { browserSupportsCsp: false, kibanaVersion: '8.0.0-SnAPshot' },
+    });
+    const promise = chrome.getBodyClasses$().pipe(toArray()).toPromise();
+    service.stop();
+    await expect(promise).resolves.toMatchInlineSnapshot(`
+            Array [
+              Array [
+                "kbnBody",
+                "kbnBody--noHeaderBanner",
+                "kbnBody--chromeHidden",
+                "kbnVersion-8-0-0",
+              ],
+            ]
+          `);
+  });
+
   it('does not add legacy browser warning if browser supports CSP', async () => {
     const { startDeps } = await start();
 
diff --git a/src/core/public/chrome/chrome_service.tsx b/src/core/public/chrome/chrome_service.tsx
index 5ed447edde75a0..f1381c52ce7793 100644
--- a/src/core/public/chrome/chrome_service.tsx
+++ b/src/core/public/chrome/chrome_service.tsx
@@ -37,9 +37,11 @@ import {
 export type { ChromeNavControls, ChromeRecentlyAccessed, ChromeDocTitle };
 
 const IS_LOCKED_KEY = 'core.chrome.isLocked';
+const SNAPSHOT_REGEX = /-snapshot/i;
 
 interface ConstructorParams {
   browserSupportsCsp: boolean;
+  kibanaVersion: string;
 }
 
 interface StartDeps {
@@ -116,6 +118,16 @@ export class ChromeService {
     const helpSupportUrl$ = new BehaviorSubject<string>(KIBANA_ASK_ELASTIC_LINK);
     const isNavDrawerLocked$ = new BehaviorSubject(localStorage.getItem(IS_LOCKED_KEY) === 'true');
 
+    const getKbnVersionClass = () => {
+      // we assume that the version is valid and has the form 'X.X.X'
+      // strip out `SNAPSHOT` and reformat to 'X-X-X'
+      const formattedVersionClass = this.params.kibanaVersion
+        .replace(SNAPSHOT_REGEX, '')
+        .split('.')
+        .join('-');
+      return `kbnVersion-${formattedVersionClass}`;
+    };
+
     const headerBanner$ = new BehaviorSubject<ChromeUserBanner | undefined>(undefined);
     const bodyClasses$ = combineLatest([headerBanner$, this.isVisible$!]).pipe(
       map(([headerBanner, isVisible]) => {
@@ -123,6 +135,7 @@ export class ChromeService {
           'kbnBody',
           headerBanner ? 'kbnBody--hasHeaderBanner' : 'kbnBody--noHeaderBanner',
           isVisible ? 'kbnBody--chromeVisible' : 'kbnBody--chromeHidden',
+          getKbnVersionClass(),
         ];
       })
     );
diff --git a/src/core/public/core_system.test.ts b/src/core/public/core_system.test.ts
index 1c4e78f0a5c2ef..8ead0f50785bdc 100644
--- a/src/core/public/core_system.test.ts
+++ b/src/core/public/core_system.test.ts
@@ -46,6 +46,7 @@ const defaultCoreSystemParams = {
     csp: {
       warnLegacyBrowsers: true,
     },
+    version: 'version',
   } as any,
 };
 
@@ -91,12 +92,12 @@ describe('constructor', () => {
     });
   });
 
-  it('passes browserSupportsCsp to ChromeService', () => {
+  it('passes browserSupportsCsp and coreContext to ChromeService', () => {
     createCoreSystem();
-
     expect(ChromeServiceConstructor).toHaveBeenCalledTimes(1);
     expect(ChromeServiceConstructor).toHaveBeenCalledWith({
-      browserSupportsCsp: expect.any(Boolean),
+      browserSupportsCsp: true,
+      kibanaVersion: 'version',
     });
   });
 
diff --git a/src/core/public/core_system.ts b/src/core/public/core_system.ts
index f0ea1e62fc33f8..9a28bf45df9273 100644
--- a/src/core/public/core_system.ts
+++ b/src/core/public/core_system.ts
@@ -5,7 +5,6 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-
 import { CoreId } from '../server';
 import { PackageInfo, EnvironmentMode } from '../server/types';
 import { CoreSetup, CoreStart } from '.';
@@ -98,6 +97,7 @@ export class CoreSystem {
     this.injectedMetadata = new InjectedMetadataService({
       injectedMetadata,
     });
+    this.coreContext = { coreId: Symbol('core'), env: injectedMetadata.env };
 
     this.fatalErrors = new FatalErrorsService(rootDomElement, () => {
       // Stop Core before rendering any fatal errors into the DOM
@@ -109,14 +109,16 @@ export class CoreSystem {
     this.savedObjects = new SavedObjectsService();
     this.uiSettings = new UiSettingsService();
     this.overlay = new OverlayService();
-    this.chrome = new ChromeService({ browserSupportsCsp });
+    this.chrome = new ChromeService({
+      browserSupportsCsp,
+      kibanaVersion: injectedMetadata.version,
+    });
     this.docLinks = new DocLinksService();
     this.rendering = new RenderingService();
     this.application = new ApplicationService();
     this.integrations = new IntegrationsService();
     this.deprecations = new DeprecationsService();
 
-    this.coreContext = { coreId: Symbol('core'), env: injectedMetadata.env };
     this.plugins = new PluginsService(this.coreContext, injectedMetadata.uiPlugins);
     this.coreApp = new CoreApp(this.coreContext);
   }
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 8c52d09f821595..502b22a6f8e89c 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -204,6 +204,7 @@ export class DocLinksService {
         },
         search: {
           sessions: `${KIBANA_DOCS}search-sessions.html`,
+          sessionLimits: `${KIBANA_DOCS}search-sessions.html#_limitations`,
         },
         date: {
           dateMath: `${ELASTICSEARCH_DOCS}common-options.html#date-math`,
@@ -523,6 +524,7 @@ export interface DocLinksStart {
     };
     readonly search: {
       readonly sessions: string;
+      readonly sessionLimits: string;
     };
     readonly indexPatterns: {
       readonly introduction: string;
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 27569935bcc65f..ca95b253f9cdbb 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -585,6 +585,7 @@ export interface DocLinksStart {
         };
         readonly search: {
             readonly sessions: string;
+            readonly sessionLimits: string;
         };
         readonly indexPatterns: {
             readonly introduction: string;
@@ -1631,6 +1632,6 @@ export interface UserProvidedValues<T = any> {
 
 // Warnings were encountered during analysis:
 //
-// src/core/public/core_system.ts:166:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts
+// src/core/public/core_system.ts:168:21 - (ae-forgotten-export) The symbol "InternalApplicationStart" needs to be exported by the entry point index.d.ts
 
 ```
diff --git a/src/core/public/rendering/_base.scss b/src/core/public/rendering/_base.scss
index 4bd6afe90d3429..92ba28ff70887e 100644
--- a/src/core/public/rendering/_base.scss
+++ b/src/core/public/rendering/_base.scss
@@ -38,6 +38,7 @@
 @mixin kbnAffordForHeader($headerHeight) {
   @include euiHeaderAffordForFixed($headerHeight);
 
+  #securitySolutionStickyKQL,
   #app-fixed-viewport {
     top: $headerHeight;
   }
diff --git a/src/plugins/data/common/search/types.ts b/src/plugins/data/common/search/types.ts
index d1890ec97df4e1..c5cf3f9f09e6c7 100644
--- a/src/plugins/data/common/search/types.ts
+++ b/src/plugins/data/common/search/types.ts
@@ -65,6 +65,11 @@ export interface IKibanaSearchResponse<RawResponse = any> {
    */
   isPartial?: boolean;
 
+  /**
+   * Indicates whether the results returned are from the async-search index
+   */
+  isRestored?: boolean;
+
   /**
    * The raw response returned by the internal search method (usually the raw ES response)
    */
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 4d9c69b137a3e0..7a5f323e51459a 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -1351,6 +1351,7 @@ export interface IKibanaSearchRequest<Params = any> {
 export interface IKibanaSearchResponse<RawResponse = any> {
     id?: string;
     isPartial?: boolean;
+    isRestored?: boolean;
     isRunning?: boolean;
     loaded?: number;
     rawResponse: RawResponse;
diff --git a/src/plugins/data/public/search/errors/index.ts b/src/plugins/data/public/search/errors/index.ts
index 82c9e04b797983..fcdea8dec1c2eb 100644
--- a/src/plugins/data/public/search/errors/index.ts
+++ b/src/plugins/data/public/search/errors/index.ts
@@ -12,3 +12,4 @@ export * from './timeout_error';
 export * from './utils';
 export * from './types';
 export * from './http_error';
+export * from './search_session_incomplete_warning';
diff --git a/src/plugins/data/public/search/errors/search_session_incomplete_warning.tsx b/src/plugins/data/public/search/errors/search_session_incomplete_warning.tsx
new file mode 100644
index 00000000000000..c5c5c37f31cf87
--- /dev/null
+++ b/src/plugins/data/public/search/errors/search_session_incomplete_warning.tsx
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
+import { CoreStart } from 'kibana/public';
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+export const SearchSessionIncompleteWarning = (docLinks: CoreStart['docLinks']) => (
+  <>
+    <EuiSpacer size="s" />
+    It needs more time to fully render. You can wait here or come back to it later.
+    <EuiSpacer size="m" />
+    <EuiText textAlign="right">
+      <EuiLink
+        href={docLinks.links.search.sessionLimits}
+        color="warning"
+        target="_blank"
+        data-test-subj="searchSessionIncompleteWarning"
+        external
+      >
+        <FormattedMessage id="data.searchSession.warning.readDocs" defaultMessage="Read More" />
+      </EuiLink>
+    </EuiText>
+  </>
+);
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
index fe66d4b6e99370..155638250a2a4c 100644
--- a/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.test.ts
@@ -29,6 +29,12 @@ jest.mock('./utils', () => ({
   }),
 }));
 
+jest.mock('../errors/search_session_incomplete_warning', () => ({
+  SearchSessionIncompleteWarning: jest.fn(),
+}));
+
+import { SearchSessionIncompleteWarning } from '../errors/search_session_incomplete_warning';
+
 let searchInterceptor: SearchInterceptor;
 let mockCoreSetup: MockedKeys<CoreSetup>;
 let bfetchSetup: jest.Mocked<BfetchPublicSetup>;
@@ -508,6 +514,7 @@ describe('SearchInterceptor', () => {
               }
             : null
         );
+        sessionServiceMock.isRestore.mockReturnValue(!!opts?.isRestore);
         fetchMock.mockResolvedValue({ result: 200 });
       };
 
@@ -562,6 +569,92 @@ describe('SearchInterceptor', () => {
           (sessionService as jest.Mocked<ISessionService>).getSearchOptions
         ).toHaveBeenCalledWith(sessionId);
       });
+
+      test('should not show warning if a search is available during restore', async () => {
+        setup({
+          isRestore: true,
+          isStored: true,
+          sessionId: '123',
+        });
+
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: false,
+              isRunning: false,
+              isRestored: true,
+              id: 1,
+              rawResponse: {
+                took: 1,
+              },
+            },
+          },
+        ];
+        mockFetchImplementation(responses);
+
+        const response = searchInterceptor.search(
+          {},
+          {
+            sessionId: '123',
+          }
+        );
+        response.subscribe({ next, error, complete });
+
+        await timeTravel(10);
+
+        expect(SearchSessionIncompleteWarning).toBeCalledTimes(0);
+      });
+
+      test('should show warning once if a search is not available during restore', async () => {
+        setup({
+          isRestore: true,
+          isStored: true,
+          sessionId: '123',
+        });
+
+        const responses = [
+          {
+            time: 10,
+            value: {
+              isPartial: false,
+              isRunning: false,
+              isRestored: false,
+              id: 1,
+              rawResponse: {
+                took: 1,
+              },
+            },
+          },
+        ];
+        mockFetchImplementation(responses);
+
+        searchInterceptor
+          .search(
+            {},
+            {
+              sessionId: '123',
+            }
+          )
+          .subscribe({ next, error, complete });
+
+        await timeTravel(10);
+
+        expect(SearchSessionIncompleteWarning).toBeCalledTimes(1);
+
+        searchInterceptor
+          .search(
+            {},
+            {
+              sessionId: '123',
+            }
+          )
+          .subscribe({ next, error, complete });
+
+        await timeTravel(10);
+
+        expect(SearchSessionIncompleteWarning).toBeCalledTimes(1);
+      });
     });
 
     describe('Session tracking', () => {
diff --git a/src/plugins/data/public/search/search_interceptor/search_interceptor.ts b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
index 57b156a9b3c00a..e0e1df65101c7d 100644
--- a/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
+++ b/src/plugins/data/public/search/search_interceptor/search_interceptor.ts
@@ -43,6 +43,7 @@ import {
   PainlessError,
   SearchTimeoutError,
   TimeoutErrorMode,
+  SearchSessionIncompleteWarning,
 } from '../errors';
 import { toMountPoint } from '../../../../kibana_react/public';
 import { AbortError, KibanaServerError } from '../../../../kibana_utils/public';
@@ -82,6 +83,7 @@ export class SearchInterceptor {
    * @internal
    */
   private application!: CoreStart['application'];
+  private docLinks!: CoreStart['docLinks'];
   private batchedFetch!: BatchedFunc<
     { request: IKibanaSearchRequest; options: ISearchOptionsSerializable },
     IKibanaSearchResponse
@@ -95,6 +97,7 @@ export class SearchInterceptor {
 
     this.deps.startServices.then(([coreStart]) => {
       this.application = coreStart.application;
+      this.docLinks = coreStart.docLinks;
     });
 
     this.batchedFetch = deps.bfetch.batchedFunction({
@@ -345,6 +348,11 @@ export class SearchInterceptor {
               this.handleSearchError(e, searchOptions, searchAbortController.isTimeout())
             );
           }),
+          tap((response) => {
+            if (this.deps.session.isRestore() && response.isRestored === false) {
+              this.showRestoreWarning(this.deps.session.getSessionId());
+            }
+          }),
           finalize(() => {
             this.pendingCount$.next(this.pendingCount$.getValue() - 1);
             if (untrackSearch && this.deps.session.isCurrentSession(sessionId)) {
@@ -371,6 +379,25 @@ export class SearchInterceptor {
     }
   );
 
+  private showRestoreWarningToast = (sessionId?: string) => {
+    this.deps.toasts.addWarning(
+      {
+        title: 'Your search session is still running',
+        text: toMountPoint(SearchSessionIncompleteWarning(this.docLinks)),
+      },
+      {
+        toastLifeTimeMs: 60000,
+      }
+    );
+  };
+
+  private showRestoreWarning = memoize(
+    this.showRestoreWarningToast,
+    (_: SearchTimeoutError, sessionId: string) => {
+      return sessionId;
+    }
+  );
+
   /**
    * Show one error notification per session.
    * @internal
diff --git a/src/plugins/data/server/index.ts b/src/plugins/data/server/index.ts
index 0764f4f441e425..dd60951e6d2285 100644
--- a/src/plugins/data/server/index.ts
+++ b/src/plugins/data/server/index.ts
@@ -238,6 +238,7 @@ export {
   DataRequestHandlerContext,
   AsyncSearchResponse,
   AsyncSearchStatusResponse,
+  NoSearchIdInSessionError,
 } from './search';
 
 // Search namespace
diff --git a/src/plugins/data/server/search/errors/no_search_id_in_session.ts b/src/plugins/data/server/search/errors/no_search_id_in_session.ts
new file mode 100644
index 00000000000000..b291df1cee5ba7
--- /dev/null
+++ b/src/plugins/data/server/search/errors/no_search_id_in_session.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { KbnError } from '../../../../kibana_utils/common';
+
+export class NoSearchIdInSessionError extends KbnError {
+  constructor() {
+    super('No search ID in this session matching the given search request');
+  }
+}
diff --git a/src/plugins/data/server/search/index.ts b/src/plugins/data/server/search/index.ts
index 812f3171aef99f..b9affe96ea2ddd 100644
--- a/src/plugins/data/server/search/index.ts
+++ b/src/plugins/data/server/search/index.ts
@@ -13,3 +13,4 @@ export * from './strategies/eql_search';
 export { usageProvider, SearchUsage, searchUsageObserver } from './collectors';
 export * from './aggs';
 export * from './session';
+export * from './errors/no_search_id_in_session';
diff --git a/src/plugins/data/server/search/search_service.test.ts b/src/plugins/data/server/search/search_service.test.ts
index 52ee8e60a5b26a..314cb2c3acbf87 100644
--- a/src/plugins/data/server/search/search_service.test.ts
+++ b/src/plugins/data/server/search/search_service.test.ts
@@ -25,6 +25,7 @@ import {
   ISearchSessionService,
   ISearchStart,
   ISearchStrategy,
+  NoSearchIdInSessionError,
 } from '.';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { expressionsPluginMock } from '../../../expressions/public/mocks';
@@ -175,6 +176,22 @@ describe('Search service', () => {
         expect(request).toStrictEqual({ ...searchRequest, id: 'my_id' });
       });
 
+      it('searches even if id is not found in session during restore', async () => {
+        const searchRequest = { params: {} };
+        const options = { sessionId, isStored: true, isRestore: true };
+
+        mockSessionClient.getId = jest.fn().mockImplementation(() => {
+          throw new NoSearchIdInSessionError();
+        });
+
+        const res = await mockScopedClient.search(searchRequest, options).toPromise();
+
+        const [request, callOptions] = mockStrategy.search.mock.calls[0];
+        expect(callOptions).toBe(options);
+        expect(request).toStrictEqual({ ...searchRequest });
+        expect(res.isRestored).toBe(false);
+      });
+
       it('does not fail if `trackId` throws', async () => {
         const searchRequest = { params: {} };
         const options = { sessionId, isStored: false, isRestore: false };
diff --git a/src/plugins/data/server/search/search_service.ts b/src/plugins/data/server/search/search_service.ts
index a651d7b3bf105e..00dffefa5e3a6e 100644
--- a/src/plugins/data/server/search/search_service.ts
+++ b/src/plugins/data/server/search/search_service.ts
@@ -19,7 +19,7 @@ import {
   SharedGlobalConfig,
   StartServicesAccessor,
 } from 'src/core/server';
-import { first, switchMap, tap } from 'rxjs/operators';
+import { first, map, switchMap, tap, withLatestFrom } from 'rxjs/operators';
 import { BfetchServerSetup } from 'src/plugins/bfetch/server';
 import { ExpressionsServerSetup } from 'src/plugins/expressions/server';
 import type {
@@ -80,6 +80,7 @@ import { registerBsearchRoute } from './routes/bsearch';
 import { getKibanaContext } from './expressions/kibana_context';
 import { enhancedEsSearchStrategyProvider } from './strategies/ese_search';
 import { eqlSearchStrategyProvider } from './strategies/eql_search';
+import { NoSearchIdInSessionError } from './errors/no_search_id_in_session';
 
 type StrategyMap = Record<string, ISearchStrategy<any, any>>;
 
@@ -287,24 +288,48 @@ export class SearchService implements Plugin<ISearchSetup, ISearchStart> {
         options.strategy
       );
 
-      const getSearchRequest = async () =>
-        !options.sessionId || !options.isRestore || request.id
-          ? request
-          : {
+      const getSearchRequest = async () => {
+        if (!options.sessionId || !options.isRestore || request.id) {
+          return request;
+        } else {
+          try {
+            const id = await deps.searchSessionsClient.getId(request, options);
+            this.logger.debug(`Found search session id for request ${id}`);
+            return {
               ...request,
-              id: await deps.searchSessionsClient.getId(request, options),
+              id,
             };
+          } catch (e) {
+            if (e instanceof NoSearchIdInSessionError) {
+              this.logger.debug('Ignoring missing search ID');
+              return request;
+            } else {
+              throw e;
+            }
+          }
+        }
+      };
 
-      return from(getSearchRequest()).pipe(
+      const searchRequest$ = from(getSearchRequest());
+      const search$ = searchRequest$.pipe(
         switchMap((searchRequest) => strategy.search(searchRequest, options, deps)),
-        tap((response) => {
-          if (!options.sessionId || !response.id || options.isRestore) return;
+        withLatestFrom(searchRequest$),
+        tap(([response, requestWithId]) => {
+          if (!options.sessionId || !response.id || (options.isRestore && requestWithId.id)) return;
           // intentionally swallow tracking error, as it shouldn't fail the search
           deps.searchSessionsClient.trackId(request, response.id, options).catch((trackErr) => {
             this.logger.error(trackErr);
           });
+        }),
+        map(([response, requestWithId]) => {
+          return {
+            ...response,
+            isRestored: !!requestWithId.id,
+          };
         })
       );
+
+      return search$;
     } catch (e) {
       return throwError(e);
     }
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index c2b533bc42dc6f..768c44d3e3e950 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -1205,6 +1205,14 @@ export enum METRIC_TYPES {
     TOP_HITS = "top_hits"
 }
 
+// Warning: (ae-forgotten-export) The symbol "KbnError" needs to be exported by the entry point index.d.ts
+// Warning: (ae-missing-release-tag) "NoSearchIdInSessionError" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export class NoSearchIdInSessionError extends KbnError {
+    constructor();
+}
+
 // Warning: (ae-missing-release-tag) "OptionedParamType" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -1537,18 +1545,18 @@ export function usageProvider(core: CoreSetup_2): SearchUsage;
 // src/plugins/data/server/index.ts:101:26 - (ae-forgotten-export) The symbol "HistogramFormat" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:128:27 - (ae-forgotten-export) The symbol "isFilterable" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/index.ts:128:27 - (ae-forgotten-export) The symbol "isNestedField" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:244:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:244:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:246:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:247:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:256:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:257:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:258:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:262:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:263:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:267:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:270:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
-// src/plugins/data/server/index.ts:271:1 - (ae-forgotten-export) The symbol "calcAutoIntervalLessThan" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:245:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:245:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:247:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:248:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:257:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:258:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:259:1 - (ae-forgotten-export) The symbol "IpAddress" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:263:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:264:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:268:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:271:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/server/index.ts:272:1 - (ae-forgotten-export) The symbol "calcAutoIntervalLessThan" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/plugin.ts:81:74 - (ae-forgotten-export) The symbol "DataEnhancements" needs to be exported by the entry point index.d.ts
 // src/plugins/data/server/search/types.ts:115:5 - (ae-forgotten-export) The symbol "ISearchStartSearchSource" needs to be exported by the entry point index.d.ts
 
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.test.tsx b/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.test.tsx
new file mode 100644
index 00000000000000..8c32942740a768
--- /dev/null
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.test.tsx
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import React from 'react';
+import { EuiSelectable } from '@elastic/eui';
+import { ShallowWrapper } from 'enzyme';
+import { act } from 'react-dom/test-utils';
+import { shallowWithIntl } from '@kbn/test/jest';
+import { ChangeIndexPattern } from './change_indexpattern';
+import { indexPatternMock } from '../../../../../__mocks__/index_pattern';
+import { indexPatternWithTimefieldMock } from '../../../../../__mocks__/index_pattern_with_timefield';
+import { IndexPatternRef } from './types';
+
+function getProps() {
+  return {
+    indexPatternId: indexPatternMock.id,
+    indexPatternRefs: [
+      indexPatternMock as IndexPatternRef,
+      indexPatternWithTimefieldMock as IndexPatternRef,
+    ],
+    onChangeIndexPattern: jest.fn(),
+    trigger: {
+      label: indexPatternMock.title,
+      title: indexPatternMock.title,
+      'data-test-subj': 'indexPattern-switch-link',
+    },
+  };
+}
+
+function getIndexPatternPickerList(instance: ShallowWrapper) {
+  return instance.find(EuiSelectable).first();
+}
+
+function getIndexPatternPickerOptions(instance: ShallowWrapper) {
+  return getIndexPatternPickerList(instance).prop('options');
+}
+
+export function selectIndexPatternPickerOption(instance: ShallowWrapper, selectedLabel: string) {
+  const options: Array<{ label: string; checked?: 'on' | 'off' }> = getIndexPatternPickerOptions(
+    instance
+  ).map((option: { label: string }) =>
+    option.label === selectedLabel
+      ? { ...option, checked: 'on' }
+      : { ...option, checked: undefined }
+  );
+  return getIndexPatternPickerList(instance).prop('onChange')!(options);
+}
+
+describe('ChangeIndexPattern', () => {
+  test('switching index pattern to the same index pattern does not trigger onChangeIndexPattern', async () => {
+    const props = getProps();
+    const comp = shallowWithIntl(<ChangeIndexPattern {...props} />);
+    await act(async () => {
+      selectIndexPatternPickerOption(comp, indexPatternMock.title);
+    });
+    expect(props.onChangeIndexPattern).toHaveBeenCalledTimes(0);
+  });
+  test('switching index pattern to a different index pattern triggers onChangeIndexPattern', async () => {
+    const props = getProps();
+    const comp = shallowWithIntl(<ChangeIndexPattern {...props} />);
+    await act(async () => {
+      selectIndexPatternPickerOption(comp, indexPatternWithTimefieldMock.title);
+    });
+    expect(props.onChangeIndexPattern).toHaveBeenCalledTimes(1);
+    expect(props.onChangeIndexPattern).toHaveBeenCalledWith(indexPatternWithTimefieldMock.id);
+  });
+});
diff --git a/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.tsx b/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.tsx
index d5076e4daa9904..5f2f35e2419dd7 100644
--- a/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/sidebar/change_indexpattern.tsx
@@ -26,17 +26,17 @@ export type ChangeIndexPatternTriggerProps = EuiButtonProps & {
 // TODO: refactor to shared component with ../../../../../../../../x-pack/legacy/plugins/lens/public/indexpattern_plugin/change_indexpattern
 
 export function ChangeIndexPattern({
-  indexPatternRefs,
   indexPatternId,
+  indexPatternRefs,
   onChangeIndexPattern,
-  trigger,
   selectableProps,
+  trigger,
 }: {
-  trigger: ChangeIndexPatternTriggerProps;
+  indexPatternId?: string;
   indexPatternRefs: IndexPatternRef[];
   onChangeIndexPattern: (newId: string) => void;
-  indexPatternId?: string;
   selectableProps?: EuiSelectableProps<{ value: string }>;
+  trigger: ChangeIndexPatternTriggerProps;
 }) {
   const [isPopoverOpen, setPopoverIsOpen] = useState(false);
 
@@ -86,7 +86,9 @@ export function ChangeIndexPattern({
             const choice = (choices.find(({ checked }) => checked) as unknown) as {
               value: string;
             };
-            onChangeIndexPattern(choice.value);
+            if (choice.value !== indexPatternId) {
+              onChangeIndexPattern(choice.value);
+            }
             setPopoverIsOpen(false);
           }}
           searchProps={{
diff --git a/src/plugins/vis_default_editor/public/components/sidebar/controls.tsx b/src/plugins/vis_default_editor/public/components/sidebar/controls.tsx
index a24673a4c12455..e757b5fe8f61dd 100644
--- a/src/plugins/vis_default_editor/public/components/sidebar/controls.tsx
+++ b/src/plugins/vis_default_editor/public/components/sidebar/controls.tsx
@@ -7,7 +7,14 @@
  */
 
 import React, { useCallback, useState } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiButton, EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton,
+  EuiButtonEmpty,
+  EuiToolTip,
+  EuiIconTip,
+} from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import useDebounce from 'react-use/lib/useDebounce';
@@ -84,19 +91,32 @@ function DefaultEditorControls({
                 </EuiButton>
               </EuiToolTip>
             ) : (
-              <EuiButton
-                data-test-subj="visualizeEditorRenderButton"
-                disabled={!isDirty}
-                fill
-                iconType="play"
-                onClick={applyChanges}
-                size="s"
-              >
-                <FormattedMessage
-                  id="visDefaultEditor.sidebar.updateChartButtonLabel"
-                  defaultMessage="Update"
-                />
-              </EuiButton>
+              <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
+                <EuiFlexItem grow={false}>
+                  <EuiIconTip
+                    content={i18n.translate('visDefaultEditor.sidebar.updateInfoTooltip', {
+                      defaultMessage: 'CTRL + Enter is a shortcut for Update.',
+                    })}
+                    type="keyboardShortcut"
+                    color="subdued"
+                  />
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiButton
+                    data-test-subj="visualizeEditorRenderButton"
+                    disabled={!isDirty}
+                    fill
+                    iconType="play"
+                    onClick={applyChanges}
+                    size="s"
+                  >
+                    <FormattedMessage
+                      id="visDefaultEditor.sidebar.updateChartButtonLabel"
+                      defaultMessage="Update"
+                    />
+                  </EuiButton>
+                </EuiFlexItem>
+              </EuiFlexGroup>
             )}
           </EuiFlexItem>
         </EuiFlexGroup>
diff --git a/src/plugins/vis_type_timeseries/public/application/components/aggs/field_select.tsx b/src/plugins/vis_type_timeseries/public/application/components/aggs/field_select.tsx
index 7d42eb3f40ac57..610b4a91cfd14b 100644
--- a/src/plugins/vis_type_timeseries/public/application/components/aggs/field_select.tsx
+++ b/src/plugins/vis_type_timeseries/public/application/components/aggs/field_select.tsx
@@ -128,7 +128,7 @@ export function FieldSelect({
       selectedOptions = [{ label: value!, id: 'INVALID_FIELD' }];
     }
   } else {
-    if (value && !selectedOptions.length) {
+    if (value && fields[fieldsSelector] && !selectedOptions.length) {
       onChange([]);
     }
   }
diff --git a/test/functional/apps/discover/_data_grid_doc_navigation.ts b/test/functional/apps/discover/_data_grid_doc_navigation.ts
index e3e8a20b693f85..cf5532aa6d7625 100644
--- a/test/functional/apps/discover/_data_grid_doc_navigation.ts
+++ b/test/functional/apps/discover/_data_grid_doc_navigation.ts
@@ -41,8 +41,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await rowActions[0].click();
       });
 
-      const hasDocHit = await testSubjects.exists('doc-hit');
-      expect(hasDocHit).to.be(true);
+      await retry.waitFor('hit loaded', async () => {
+        const hasDocHit = await testSubjects.exists('doc-hit');
+        return !!hasDocHit;
+      });
     });
 
     // no longer relevant as null field won't be returned in the Fields API response
diff --git a/test/functional/apps/discover/_discover.ts b/test/functional/apps/discover/_discover.ts
index dce6bfba9cd99c..c68db8cbd797bd 100644
--- a/test/functional/apps/discover/_discover.ts
+++ b/test/functional/apps/discover/_discover.ts
@@ -181,8 +181,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
-    // FLAKY: https://github.com/elastic/kibana/issues/89550
-    describe.skip('query #2, which has an empty time range', () => {
+    describe('query #2, which has an empty time range', () => {
       const fromTime = 'Jun 11, 1999 @ 09:22:11.000';
       const toTime = 'Jun 12, 1999 @ 11:21:04.000';
 
@@ -193,8 +192,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
 
       it('should show "no results"', async () => {
-        const isVisible = await PageObjects.discover.hasNoResults();
-        expect(isVisible).to.be(true);
+        await retry.waitFor('no results screen is displayed', async function () {
+          const isVisible = await PageObjects.discover.hasNoResults();
+          return isVisible === true;
+        });
       });
 
       it('should suggest a new time range is picked', async () => {
diff --git a/test/functional/apps/discover/_doc_navigation.ts b/test/functional/apps/discover/_doc_navigation.ts
index 771dac4d40a64f..8d156cb305586b 100644
--- a/test/functional/apps/discover/_doc_navigation.ts
+++ b/test/functional/apps/discover/_doc_navigation.ts
@@ -51,8 +51,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await rowActions[1].click();
       });
 
-      const hasDocHit = await testSubjects.exists('doc-hit');
-      expect(hasDocHit).to.be(true);
+      await retry.waitFor('hit loaded', async () => {
+        const hasDocHit = await testSubjects.exists('doc-hit');
+        return !!hasDocHit;
+      });
     });
 
     // no longer relevant as null field won't be returned in the Fields API response
diff --git a/x-pack/plugins/cases/public/components/panel/index.tsx b/x-pack/plugins/cases/public/components/panel/index.tsx
index 652d22409cb0c3..802fd4c7f44a60 100644
--- a/x-pack/plugins/cases/public/components/panel/index.tsx
+++ b/x-pack/plugins/cases/public/components/panel/index.tsx
@@ -25,7 +25,7 @@ import { EuiPanel } from '@elastic/eui';
  * Ref: https://www.styled-components.com/docs/faqs#why-am-i-getting-html-attribute-warnings
  * Ref: https://reactjs.org/blog/2017/09/08/dom-attributes-in-react-16.html
  */
-export const Panel = styled(({ loading, ...props }) => <EuiPanel {...props} />)`
+export const Panel = styled(({ loading, ...props }) => <EuiPanel {...props} hasBorder />)`
   position: relative;
   ${({ loading }) =>
     loading &&
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/status.test.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/status.test.tsx
index 86f5564a17d528..59da0f0f4d17e5 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/status.test.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/status.test.tsx
@@ -27,6 +27,7 @@ describe('Background Search Session management status labels', () => {
       id: 'wtywp9u2802hahgp-gsla',
       restoreUrl: '/app/great-app-url/#45',
       reloadUrl: '/app/great-app-url/#45',
+      numSearches: 1,
       appId: 'security',
       status: SearchSessionStatus.IN_PROGRESS,
       created: '2020-12-02T00:19:32Z',
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
index 42ff270ed44a06..6dfe3a5153670b 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/table/table.test.tsx
@@ -70,6 +70,7 @@ describe('Background Search Session Management Table', () => {
               status: SearchSessionStatus.IN_PROGRESS,
               created: '2020-12-02T00:19:32Z',
               expires: '2020-12-07T00:19:32Z',
+              idMapping: {},
             },
           },
         ],
@@ -95,10 +96,12 @@ describe('Background Search Session Management Table', () => {
         );
       });
 
-      expect(table.find('thead th').map((node) => node.text())).toMatchInlineSnapshot(`
+      expect(table.find('thead th .euiTableCellContent__text').map((node) => node.text()))
+        .toMatchInlineSnapshot(`
         Array [
           "App",
           "Name",
+          "# Searches",
           "Status",
           "Created",
           "Expiration",
@@ -130,6 +133,7 @@ describe('Background Search Session Management Table', () => {
         Array [
           "App",
           "Namevery background search ",
+          "# Searches0",
           "StatusExpired",
           "Created2 Dec, 2020, 00:19:32",
           "Expiration--",
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.test.ts b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.test.ts
index 3857b08ad0a3ae..cc79f8002a98c4 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.test.ts
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.test.ts
@@ -52,6 +52,7 @@ describe('Search Sessions Management API', () => {
                 status: 'complete',
                 initialState: {},
                 restoreState: {},
+                idMapping: [],
               },
             },
           ],
@@ -78,6 +79,7 @@ describe('Search Sessions Management API', () => {
             "id": "hello-pizza-123",
             "initialState": Object {},
             "name": "Veggie",
+            "numSearches": 0,
             "reloadUrl": "hello-cool-undefined-url",
             "restoreState": Object {},
             "restoreUrl": "hello-cool-undefined-url",
@@ -100,6 +102,7 @@ describe('Search Sessions Management API', () => {
                 expires: moment().subtract(3, 'days'),
                 initialState: {},
                 restoreState: {},
+                idMapping: {},
               },
             },
           ],
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.ts b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.ts
index 3710dfa16e76b8..0369dc4a839b51 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.ts
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/api.ts
@@ -90,6 +90,7 @@ const mapToUISession = (urls: UrlGeneratorsStart, config: SessionsConfigSchema)
     urlGeneratorId,
     initialState,
     restoreState,
+    idMapping,
   } = savedObject.attributes;
 
   const status = getUIStatus(savedObject.attributes);
@@ -113,6 +114,7 @@ const mapToUISession = (urls: UrlGeneratorsStart, config: SessionsConfigSchema)
     reloadUrl,
     initialState,
     restoreState,
+    numSearches: Object.keys(idMapping).length,
   };
 };
 
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
index 4b68e0c9e2afd0..fc4e67360ea4aa 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.test.tsx
@@ -70,6 +70,7 @@ describe('Search Sessions Management table column factory', () => {
       reloadUrl: '/app/great-app-url',
       restoreUrl: '/app/great-app-url/#42',
       appId: 'discovery',
+      numSearches: 3,
       status: SearchSessionStatus.IN_PROGRESS,
       created: '2020-12-02T00:19:32Z',
       expires: '2020-12-07T00:19:32Z',
@@ -95,6 +96,12 @@ describe('Search Sessions Management table column factory', () => {
           "sortable": true,
           "width": "20%",
         },
+        Object {
+          "field": "numSearches",
+          "name": "# Searches",
+          "render": [Function],
+          "sortable": true,
+        },
         Object {
           "field": "status",
           "name": "Status",
@@ -146,10 +153,29 @@ describe('Search Sessions Management table column factory', () => {
     });
   });
 
+  // Num of searches column
+  describe('num of searches', () => {
+    test('renders', () => {
+      const [, , numOfSearches] = getColumns(
+        mockCoreStart,
+        mockPluginsSetup,
+        api,
+        mockConfig,
+        tz,
+        handleAction
+      ) as Array<EuiTableFieldDataColumnType<UISession>>;
+
+      const numOfSearchesLine = mount(
+        numOfSearches.render!(mockSession.numSearches, mockSession) as ReactElement
+      );
+      expect(numOfSearchesLine.text()).toMatchInlineSnapshot(`"3"`);
+    });
+  });
+
   // Status column
   describe('status', () => {
     test('render in_progress', () => {
-      const [, , status] = getColumns(
+      const [, , , status] = getColumns(
         mockCoreStart,
         mockPluginsSetup,
         api,
@@ -165,7 +191,7 @@ describe('Search Sessions Management table column factory', () => {
     });
 
     test('error handling', () => {
-      const [, , status] = getColumns(
+      const [, , , status] = getColumns(
         mockCoreStart,
         mockPluginsSetup,
         api,
@@ -188,7 +214,7 @@ describe('Search Sessions Management table column factory', () => {
     test('render using Browser timezone', () => {
       tz = 'Browser';
 
-      const [, , , createdDateCol] = getColumns(
+      const [, , , , createdDateCol] = getColumns(
         mockCoreStart,
         mockPluginsSetup,
         api,
@@ -205,7 +231,7 @@ describe('Search Sessions Management table column factory', () => {
     test('render using AK timezone', () => {
       tz = 'US/Alaska';
 
-      const [, , , createdDateCol] = getColumns(
+      const [, , , , createdDateCol] = getColumns(
         mockCoreStart,
         mockPluginsSetup,
         api,
@@ -220,7 +246,7 @@ describe('Search Sessions Management table column factory', () => {
     });
 
     test('error handling', () => {
-      const [, , , createdDateCol] = getColumns(
+      const [, , , , createdDateCol] = getColumns(
         mockCoreStart,
         mockPluginsSetup,
         api,
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
index 1805ef52b85f1d..d8d2fa0aeac59c 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/lib/get_columns.tsx
@@ -120,6 +120,20 @@ export const getColumns = (
       },
     },
 
+    // # Searches
+    {
+      field: 'numSearches',
+      name: i18n.translate('xpack.data.mgmt.searchSessions.table.numSearches', {
+        defaultMessage: '# Searches',
+      }),
+      sortable: true,
+      render: (numSearches: UISession['numSearches'], session) => (
+        <TableText color="subdued" data-test-subj="sessionManagementNumSearchesCol">
+          {numSearches}
+        </TableText>
+      ),
+    },
+
     // Session status
     {
       field: 'status',
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/types.ts b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/types.ts
index d0d5ee9fb17dd3..6a8ace8dbdc79a 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/types.ts
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/types.ts
@@ -34,6 +34,7 @@ export interface UISession {
   created: string;
   expires: string | null;
   status: UISearchSessionState;
+  numSearches: number;
   actions?: ACTION[];
   reloadUrl: string;
   restoreUrl: string;
diff --git a/x-pack/plugins/data_enhanced/server/search/session/session_service.ts b/x-pack/plugins/data_enhanced/server/search/session/session_service.ts
index 138f42549a0944..81a12f607935d2 100644
--- a/x-pack/plugins/data_enhanced/server/search/session/session_service.ts
+++ b/x-pack/plugins/data_enhanced/server/search/session/session_service.ts
@@ -24,7 +24,11 @@ import {
   ENHANCED_ES_SEARCH_STRATEGY,
   SEARCH_SESSION_TYPE,
 } from '../../../../../../src/plugins/data/common';
-import { esKuery, ISearchSessionService } from '../../../../../../src/plugins/data/server';
+import {
+  esKuery,
+  ISearchSessionService,
+  NoSearchIdInSessionError,
+} from '../../../../../../src/plugins/data/server';
 import { AuthenticatedUser, SecurityPluginSetup } from '../../../../security/server';
 import {
   TaskManagerSetupContract,
@@ -436,7 +440,7 @@ export class SearchSessionService
     const requestHash = createRequestHash(searchRequest.params);
     if (!session.attributes.idMapping.hasOwnProperty(requestHash)) {
       this.logger.error(`getId | ${sessionId} | ${requestHash} not found`);
-      throw new Error('No search ID in this session matching the given search request');
+      throw new NoSearchIdInSessionError();
     }
     this.logger.debug(`getId | ${sessionId} | ${requestHash}`);
 
diff --git a/x-pack/plugins/fleet/server/services/hosts_utils.test.ts b/x-pack/plugins/fleet/common/services/hosts_utils.test.ts
similarity index 100%
rename from x-pack/plugins/fleet/server/services/hosts_utils.test.ts
rename to x-pack/plugins/fleet/common/services/hosts_utils.test.ts
diff --git a/x-pack/plugins/fleet/server/services/hosts_utils.ts b/x-pack/plugins/fleet/common/services/hosts_utils.ts
similarity index 100%
rename from x-pack/plugins/fleet/server/services/hosts_utils.ts
rename to x-pack/plugins/fleet/common/services/hosts_utils.ts
diff --git a/x-pack/plugins/fleet/common/services/index.ts b/x-pack/plugins/fleet/common/services/index.ts
index 86361ae1633995..a6f4cd319b9701 100644
--- a/x-pack/plugins/fleet/common/services/index.ts
+++ b/x-pack/plugins/fleet/common/services/index.ts
@@ -30,3 +30,5 @@ export {
   validationHasErrors,
   countValidationErrors,
 } from './validate_package_policy';
+
+export { normalizeHostsForAgents } from './hosts_utils';
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
index 995423ea91f968..9e8d200344b01d 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/detail/settings/settings.tsx
@@ -233,7 +233,7 @@ export const SettingsPage: React.FC<Props> = memo(({ packageInfo }: Props) => {
                   <EuiText color="subdued">
                     <FormattedMessage
                       id="xpack.fleet.integrations.settings.packageUninstallNoteDescription.packageUninstallUninstallableNoteDetail"
-                      defaultMessage="{strongNote} The {title} integration is installed by default and cannot be removed."
+                      defaultMessage="{strongNote} The {title} integration is a system integration and cannot be removed."
                       values={{
                         title,
                         strongNote: <NoteLabel />,
diff --git a/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx b/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
index d748e655bd5062..9bc1bc977b7861 100644
--- a/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
+++ b/x-pack/plugins/fleet/public/components/settings_flyout/index.tsx
@@ -38,7 +38,7 @@ import {
   useGetOutputs,
   sendPutOutput,
 } from '../../hooks';
-import { isDiffPathProtocol } from '../../../common';
+import { isDiffPathProtocol, normalizeHostsForAgents } from '../../../common';
 
 import { SettingsConfirmModal } from './confirm_modal';
 import type { SettingsConfirmModalProps } from './confirm_modal';
@@ -53,8 +53,20 @@ interface Props {
   onClose: () => void;
 }
 
-function isSameArrayValue(arrayA: string[] = [], arrayB: string[] = []) {
-  return arrayA.length === arrayB.length && arrayA.every((val, index) => val === arrayB[index]);
+function normalizeHosts(hostsInput: string[]) {
+  return hostsInput.map((host) => {
+    try {
+      return normalizeHostsForAgents(host);
+    } catch (err) {
+      return host;
+    }
+  });
+}
+
+function isSameArrayValueWithNormalizedHosts(arrayA: string[] = [], arrayB: string[] = []) {
+  const hostsA = normalizeHosts(arrayA);
+  const hostsB = normalizeHosts(arrayB);
+  return hostsA.length === hostsB.length && hostsA.every((val, index) => val === hostsB[index]);
 }
 
 function useSettingsForm(outputId: string | undefined, onSuccess: () => void) {
@@ -234,8 +246,11 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
       return false;
     }
     return (
-      !isSameArrayValue(settings.fleet_server_hosts, inputs.fleetServerHosts.value) ||
-      !isSameArrayValue(output.hosts, inputs.elasticsearchUrl.value) ||
+      !isSameArrayValueWithNormalizedHosts(
+        settings.fleet_server_hosts,
+        inputs.fleetServerHosts.value
+      ) ||
+      !isSameArrayValueWithNormalizedHosts(output.hosts, inputs.elasticsearchUrl.value) ||
       (output.config_yaml || '') !== inputs.additionalYamlConfig.value
     );
   }, [settings, inputs, output]);
@@ -246,32 +261,37 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
     }
 
     const tmpChanges: SettingsConfirmModalProps['changes'] = [];
-    if (!isSameArrayValue(output.hosts, inputs.elasticsearchUrl.value)) {
+    if (!isSameArrayValueWithNormalizedHosts(output.hosts, inputs.elasticsearchUrl.value)) {
       tmpChanges.push(
         {
           type: 'elasticsearch',
           direction: 'removed',
-          urls: output.hosts || [],
+          urls: normalizeHosts(output.hosts || []),
         },
         {
           type: 'elasticsearch',
           direction: 'added',
-          urls: inputs.elasticsearchUrl.value,
+          urls: normalizeHosts(inputs.elasticsearchUrl.value),
         }
       );
     }
 
-    if (!isSameArrayValue(settings.fleet_server_hosts, inputs.fleetServerHosts.value)) {
+    if (
+      !isSameArrayValueWithNormalizedHosts(
+        settings.fleet_server_hosts,
+        inputs.fleetServerHosts.value
+      )
+    ) {
       tmpChanges.push(
         {
           type: 'fleet_server',
           direction: 'removed',
-          urls: settings.fleet_server_hosts,
+          urls: normalizeHosts(settings.fleet_server_hosts || []),
         },
         {
           type: 'fleet_server',
           direction: 'added',
-          urls: inputs.fleetServerHosts.value,
+          urls: normalizeHosts(inputs.fleetServerHosts.value),
         }
       );
     }
@@ -300,7 +320,7 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
           helpText={
             <FormattedMessage
               id="xpack.fleet.settings.fleetServerHostsHelpTect"
-              defaultMessage="Specify the URLs that your agents will use to connect to a Fleet Server. If multiple URLs exist, Fleet shows the first provided URL for enrollment purposes. Refer to the {link}."
+              defaultMessage="Specify the URLs that your agents will use to connect to a Fleet Server. If multiple URLs exist, Fleet shows the first provided URL for enrollment purposes. Fleet Server uses port 8220 by default. Refer to the {link}."
               values={{
                 link: (
                   <EuiLink
@@ -327,7 +347,8 @@ export const SettingFlyout: React.FunctionComponent<Props> = ({ onClose }) => {
             defaultMessage: 'Elasticsearch hosts',
           })}
           helpText={i18n.translate('xpack.fleet.settings.elasticsearchUrlsHelpTect', {
-            defaultMessage: 'Specify the Elasticsearch URLs where agents send data.',
+            defaultMessage:
+              'Specify the Elasticsearch URLs where agents send data. Elasticsearch uses port 9200 by default.',
           })}
         />
       </EuiPanel>
diff --git a/x-pack/plugins/fleet/server/services/output.ts b/x-pack/plugins/fleet/server/services/output.ts
index 0c7b086f78fdf8..8c6bc7eca04010 100644
--- a/x-pack/plugins/fleet/server/services/output.ts
+++ b/x-pack/plugins/fleet/server/services/output.ts
@@ -9,10 +9,9 @@ import type { SavedObjectsClientContract } from 'src/core/server';
 
 import type { NewOutput, Output, OutputSOAttributes } from '../types';
 import { DEFAULT_OUTPUT, OUTPUT_SAVED_OBJECT_TYPE } from '../constants';
-import { decodeCloudId } from '../../common';
+import { decodeCloudId, normalizeHostsForAgents } from '../../common';
 
 import { appContextService } from './app_context';
-import { normalizeHostsForAgents } from './hosts_utils';
 
 const SAVED_OBJECT_TYPE = OUTPUT_SAVED_OBJECT_TYPE;
 
diff --git a/x-pack/plugins/fleet/server/services/settings.ts b/x-pack/plugins/fleet/server/services/settings.ts
index 226fbb29467c2f..26d581f32d9a23 100644
--- a/x-pack/plugins/fleet/server/services/settings.ts
+++ b/x-pack/plugins/fleet/server/services/settings.ts
@@ -8,11 +8,14 @@
 import Boom from '@hapi/boom';
 import type { SavedObjectsClientContract } from 'kibana/server';
 
-import { decodeCloudId, GLOBAL_SETTINGS_SAVED_OBJECT_TYPE } from '../../common';
+import {
+  decodeCloudId,
+  GLOBAL_SETTINGS_SAVED_OBJECT_TYPE,
+  normalizeHostsForAgents,
+} from '../../common';
 import type { SettingsSOAttributes, Settings, BaseSettings } from '../../common';
 
 import { appContextService } from './app_context';
-import { normalizeHostsForAgents } from './hosts_utils';
 
 export async function getSettings(soClient: SavedObjectsClientContract): Promise<Settings> {
   const res = await soClient.find<SettingsSOAttributes>({
diff --git a/x-pack/plugins/lists/public/exceptions/hooks/use_exception_lists.test.ts b/x-pack/plugins/lists/public/exceptions/hooks/use_exception_lists.test.ts
index bdcb4224eed9c5..4987de321c556c 100644
--- a/x-pack/plugins/lists/public/exceptions/hooks/use_exception_lists.test.ts
+++ b/x-pack/plugins/lists/public/exceptions/hooks/use_exception_lists.test.ts
@@ -48,6 +48,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
@@ -83,6 +84,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
@@ -122,6 +124,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: true,
         })
       );
@@ -132,7 +135,7 @@ describe('useExceptionLists', () => {
 
       expect(spyOnfetchExceptionLists).toHaveBeenCalledWith({
         filters:
-          '(exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)',
+          '(exception-list.attributes.list_id: endpoint_trusted_apps* OR exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)',
         http: mockKibanaHttpService,
         namespaceTypes: 'single,agnostic',
         pagination: { page: 1, perPage: 20 },
@@ -157,6 +160,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
@@ -167,7 +171,79 @@ describe('useExceptionLists', () => {
 
       expect(spyOnfetchExceptionLists).toHaveBeenCalledWith({
         filters:
-          '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)',
+          '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)',
+        http: mockKibanaHttpService,
+        namespaceTypes: 'single,agnostic',
+        pagination: { page: 1, perPage: 20 },
+        signal: new AbortController().signal,
+      });
+    });
+  });
+
+  test('fetches event filters lists if "showEventFilters" is true', async () => {
+    const spyOnfetchExceptionLists = jest.spyOn(api, 'fetchExceptionLists');
+
+    await act(async () => {
+      const { waitForNextUpdate } = renderHook<UseExceptionListsProps, ReturnExceptionLists>(() =>
+        useExceptionLists({
+          errorMessage: 'Uh oh',
+          filterOptions: {},
+          http: mockKibanaHttpService,
+          namespaceTypes: ['single', 'agnostic'],
+          notifications: mockKibanaNotificationsService,
+          pagination: {
+            page: 1,
+            perPage: 20,
+            total: 0,
+          },
+          showEventFilters: true,
+          showTrustedApps: false,
+        })
+      );
+      // NOTE: First `waitForNextUpdate` is initialization
+      // Second call applies the params
+      await waitForNextUpdate();
+      await waitForNextUpdate();
+
+      expect(spyOnfetchExceptionLists).toHaveBeenCalledWith({
+        filters:
+          '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (exception-list.attributes.list_id: endpoint_event_filters* OR exception-list-agnostic.attributes.list_id: endpoint_event_filters*)',
+        http: mockKibanaHttpService,
+        namespaceTypes: 'single,agnostic',
+        pagination: { page: 1, perPage: 20 },
+        signal: new AbortController().signal,
+      });
+    });
+  });
+
+  test('does not fetch event filters lists if "showEventFilters" is false', async () => {
+    const spyOnfetchExceptionLists = jest.spyOn(api, 'fetchExceptionLists');
+
+    await act(async () => {
+      const { waitForNextUpdate } = renderHook<UseExceptionListsProps, ReturnExceptionLists>(() =>
+        useExceptionLists({
+          errorMessage: 'Uh oh',
+          filterOptions: {},
+          http: mockKibanaHttpService,
+          namespaceTypes: ['single', 'agnostic'],
+          notifications: mockKibanaNotificationsService,
+          pagination: {
+            page: 1,
+            perPage: 20,
+            total: 0,
+          },
+          showEventFilters: false,
+          showTrustedApps: false,
+        })
+      );
+      // NOTE: First `waitForNextUpdate` is initialization
+      // Second call applies the params
+      await waitForNextUpdate();
+      await waitForNextUpdate();
+
+      expect(spyOnfetchExceptionLists).toHaveBeenCalledWith({
+        filters:
+          '(not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)',
         http: mockKibanaHttpService,
         namespaceTypes: 'single,agnostic',
         pagination: { page: 1, perPage: 20 },
@@ -195,6 +271,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
@@ -205,7 +282,7 @@ describe('useExceptionLists', () => {
 
       expect(spyOnfetchExceptionLists).toHaveBeenCalledWith({
         filters:
-          '(exception-list.attributes.created_by:Moi OR exception-list-agnostic.attributes.created_by:Moi) AND (exception-list.attributes.name.text:Sample Endpoint OR exception-list-agnostic.attributes.name.text:Sample Endpoint) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*)',
+          '(exception-list.attributes.created_by:Moi OR exception-list-agnostic.attributes.created_by:Moi) AND (exception-list.attributes.name.text:Sample Endpoint OR exception-list-agnostic.attributes.name.text:Sample Endpoint) AND (not exception-list.attributes.list_id: endpoint_trusted_apps* AND not exception-list-agnostic.attributes.list_id: endpoint_trusted_apps*) AND (not exception-list.attributes.list_id: endpoint_event_filters* AND not exception-list-agnostic.attributes.list_id: endpoint_event_filters*)',
         http: mockKibanaHttpService,
         namespaceTypes: 'single,agnostic',
         pagination: { page: 1, perPage: 20 },
@@ -228,6 +305,7 @@ describe('useExceptionLists', () => {
           namespaceTypes,
           notifications,
           pagination,
+          showEventFilters,
           showTrustedApps,
         }) =>
           useExceptionLists({
@@ -237,6 +315,7 @@ describe('useExceptionLists', () => {
             namespaceTypes,
             notifications,
             pagination,
+            showEventFilters,
             showTrustedApps,
           }),
         {
@@ -251,6 +330,7 @@ describe('useExceptionLists', () => {
               perPage: 20,
               total: 0,
             },
+            showEventFilters: false,
             showTrustedApps: false,
           },
         }
@@ -271,6 +351,7 @@ describe('useExceptionLists', () => {
           perPage: 20,
           total: 0,
         },
+        showEventFilters: false,
         showTrustedApps: false,
       });
       // NOTE: Only need one call here because hook already initilaized
@@ -298,6 +379,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
@@ -336,6 +418,7 @@ describe('useExceptionLists', () => {
             perPage: 20,
             total: 0,
           },
+          showEventFilters: false,
           showTrustedApps: false,
         })
       );
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index 37a8e8063c4ed1..fa065e701184e9 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -58,15 +58,14 @@ export const KBN_IS_CENTROID_FEATURE = '__kbn_is_centroid_feature__';
 
 export const MVT_TOKEN_PARAM_NAME = 'token';
 
-const MAP_BASE_URL = `/${MAPS_APP_PATH}/${MAP_PATH}`;
 export function getNewMapPath() {
-  return MAP_BASE_URL;
+  return `/${MAPS_APP_PATH}/${MAP_PATH}`;
 }
-export function getExistingMapPath(id: string) {
-  return `${MAP_BASE_URL}/${id}`;
+export function getFullPath(id: string | undefined) {
+  return `/${MAPS_APP_PATH}${getEditPath(id)}`;
 }
-export function getEditPath(id: string) {
-  return `/${MAP_PATH}/${id}`;
+export function getEditPath(id: string | undefined) {
+  return id ? `/${MAP_PATH}/${id}` : `/${MAP_PATH}`;
 }
 
 export enum LAYER_TYPE {
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_circle.ts b/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_circle.ts
index f0df797582bef7..998329a78bfbbd 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_circle.ts
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_circle.ts
@@ -11,7 +11,11 @@
 import turfDistance from '@turf/distance';
 // @ts-expect-error
 import turfCircle from '@turf/circle';
-import { Position } from 'geojson';
+import { Feature, GeoJSON, Position } from 'geojson';
+
+const DRAW_CIRCLE_RADIUS = 'draw-circle-radius';
+
+export const DRAW_CIRCLE_RADIUS_MB_FILTER = ['==', 'meta', DRAW_CIRCLE_RADIUS];
 
 export interface DrawCircleProperties {
   center: Position;
@@ -22,10 +26,12 @@ type DrawCircleState = {
   circle: {
     properties: Omit<DrawCircleProperties, 'center'> & {
       center: Position | null;
+      edge: Position | null;
+      radiusKm: number;
     };
     id: string | number;
     incomingCoords: (coords: unknown[]) => void;
-    toGeoJSON: () => unknown;
+    toGeoJSON: () => GeoJSON;
   };
 };
 
@@ -43,6 +49,7 @@ export const DrawCircle = {
       type: 'Feature',
       properties: {
         center: null,
+        edge: null,
         radiusKm: 0,
       },
       geometry: {
@@ -96,6 +103,7 @@ export const DrawCircle = {
     }
 
     const mouseLocation = [e.lngLat.lng, e.lngLat.lat];
+    state.circle.properties.edge = mouseLocation;
     state.circle.properties.radiusKm = turfDistance(state.circle.properties.center, mouseLocation);
     const newCircleFeature = turfCircle(
       state.circle.properties.center,
@@ -124,15 +132,53 @@ export const DrawCircle = {
       this.changeMode('simple_select', {}, { silent: true });
     }
   },
-  toDisplayFeatures(
-    state: DrawCircleState,
-    geojson: { properties: { active: string } },
-    display: (geojson: unknown) => unknown
-  ) {
-    if (state.circle.properties.center) {
-      geojson.properties.active = 'true';
-      return display(geojson);
+  toDisplayFeatures(state: DrawCircleState, geojson: Feature, display: (geojson: Feature) => void) {
+    if (!state.circle.properties.center || !state.circle.properties.edge) {
+      return null;
+    }
+
+    geojson.properties!.active = 'true';
+
+    let radiusLabel = '';
+    if (state.circle.properties.radiusKm <= 1) {
+      radiusLabel = `${Math.round(state.circle.properties.radiusKm * 1000)} m`;
+    } else if (state.circle.properties.radiusKm <= 10) {
+      radiusLabel = `${state.circle.properties.radiusKm.toFixed(1)} km`;
+    } else {
+      radiusLabel = `${Math.round(state.circle.properties.radiusKm)} km`;
     }
+
+    // display radius label, requires custom 'symbol' style with DRAW_CIRCLE_RADIUS_MB_FILTER filter
+    display({
+      type: 'Feature',
+      properties: {
+        meta: DRAW_CIRCLE_RADIUS,
+        parent: state.circle.id,
+        radiusLabel,
+        active: 'false',
+      },
+      geometry: {
+        type: 'Point',
+        coordinates: state.circle.properties.edge,
+      },
+    });
+
+    // display line from center vertex to edge
+    display({
+      type: 'Feature',
+      properties: {
+        meta: 'draw-circle-radius-line',
+        parent: state.circle.id,
+        active: 'true',
+      },
+      geometry: {
+        type: 'LineString',
+        coordinates: [state.circle.properties.center, state.circle.properties.edge],
+      },
+    });
+
+    // display circle
+    display(geojson);
   },
   onTrash(state: DrawCircleState) {
     // @ts-ignore
diff --git a/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_control.tsx b/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_control.tsx
index 879bd85dd6019d..5d9cb59bbe522f 100644
--- a/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_control.tsx
+++ b/x-pack/plugins/maps/public/connected_components/mb_map/draw_control/draw_control.tsx
@@ -14,9 +14,11 @@ import DrawRectangle from 'mapbox-gl-draw-rectangle-mode';
 import type { Map as MbMap } from '@kbn/mapbox-gl';
 import { Feature } from 'geojson';
 import { DRAW_SHAPE } from '../../../../common/constants';
-import { DrawCircle } from './draw_circle';
+import { DrawCircle, DRAW_CIRCLE_RADIUS_MB_FILTER } from './draw_circle';
 import { DrawTooltip } from './draw_tooltip';
 
+const GL_DRAW_RADIUS_LABEL_LAYER_ID = 'gl-draw-radius-label';
+
 const mbModeEquivalencies = new Map<string, DRAW_SHAPE>([
   ['simple_select', DRAW_SHAPE.SIMPLE_SELECT],
   ['draw_rectangle', DRAW_SHAPE.BOUNDS],
@@ -94,6 +96,7 @@ export class DrawControl extends Component<Props> {
     this.props.mbMap.getCanvas().style.cursor = '';
     this.props.mbMap.off('draw.modechange', this._onModeChange);
     this.props.mbMap.off('draw.create', this._onDraw);
+    this.props.mbMap.removeLayer(GL_DRAW_RADIUS_LABEL_LAYER_ID);
     this.props.mbMap.removeControl(this._mbDrawControl);
     this._mbDrawControlAdded = false;
   }
@@ -105,6 +108,25 @@ export class DrawControl extends Component<Props> {
 
     if (!this._mbDrawControlAdded) {
       this.props.mbMap.addControl(this._mbDrawControl);
+      this.props.mbMap.addLayer({
+        id: GL_DRAW_RADIUS_LABEL_LAYER_ID,
+        type: 'symbol',
+        source: 'mapbox-gl-draw-hot',
+        filter: DRAW_CIRCLE_RADIUS_MB_FILTER,
+        layout: {
+          'text-anchor': 'right',
+          'text-field': '{radiusLabel}',
+          'text-size': 16,
+          'text-offset': [-1, 0],
+          'text-ignore-placement': true,
+          'text-allow-overlap': true,
+        },
+        paint: {
+          'text-color': '#fbb03b',
+          'text-halo-color': 'rgba(255, 255, 255, 1)',
+          'text-halo-width': 2,
+        },
+      });
       this._mbDrawControlAdded = true;
       this.props.mbMap.getCanvas().style.cursor = 'crosshair';
       this.props.mbMap.on('draw.modechange', this._onModeChange);
diff --git a/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx b/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx
index 5a477754683e68..509cece671dd6d 100644
--- a/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx
+++ b/x-pack/plugins/maps/public/embeddable/map_embeddable.tsx
@@ -54,9 +54,9 @@ import {
 } from '../selectors/map_selectors';
 import {
   APP_ID,
-  getExistingMapPath,
+  getEditPath,
+  getFullPath,
   MAP_SAVED_OBJECT_TYPE,
-  MAP_PATH,
   RawValue,
 } from '../../common/constants';
 import { RenderToolTipContent } from '../classes/tooltips/tooltip_property';
@@ -180,13 +180,13 @@ export class MapEmbeddable
       : '';
     const input = this.getInput();
     const title = input.hidePanelTitles ? '' : input.title || savedMapTitle;
-    const savedObjectId = (input as MapByReferenceInput).savedObjectId;
+    const savedObjectId = 'savedObjectId' in input ? input.savedObjectId : undefined;
     this.updateOutput({
       ...this.getOutput(),
       defaultTitle: savedMapTitle,
       title,
-      editPath: `/${MAP_PATH}/${savedObjectId}`,
-      editUrl: getHttp().basePath.prepend(getExistingMapPath(savedObjectId)),
+      editPath: getEditPath(savedObjectId),
+      editUrl: getHttp().basePath.prepend(getFullPath(savedObjectId)),
       indexPatterns: await this._getIndexPatterns(),
     });
   }
diff --git a/x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx b/x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx
index 0dfff5a2c221ed..92459ed28ab91e 100644
--- a/x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx
+++ b/x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx
@@ -44,7 +44,7 @@ import { getTopNavConfig } from '../top_nav_config';
 import { MapQuery } from '../../../../common/descriptor_types';
 import { goToSpecifiedPath } from '../../../render_app';
 import { MapSavedObjectAttributes } from '../../../../common/map_saved_object_type';
-import { getExistingMapPath, APP_ID } from '../../../../common/constants';
+import { getFullPath, APP_ID } from '../../../../common/constants';
 import {
   getInitialQuery,
   getInitialRefreshConfig,
@@ -356,7 +356,7 @@ export class MapApp extends React.Component<Props, State> {
     const savedObjectId = this.props.savedMap.getSavedObjectId();
     if (savedObjectId) {
       getCoreChrome().recentlyAccessed.add(
-        getExistingMapPath(savedObjectId),
+        getFullPath(savedObjectId),
         this.props.savedMap.getTitle(),
         savedObjectId
       );
diff --git a/x-pack/plugins/maps/public/routes/map_page/url_state/app_sync.ts b/x-pack/plugins/maps/public/routes/map_page/url_state/app_sync.ts
index 268e5fa600b464..f05836dff2bd98 100644
--- a/x-pack/plugins/maps/public/routes/map_page/url_state/app_sync.ts
+++ b/x-pack/plugins/maps/public/routes/map_page/url_state/app_sync.ts
@@ -60,7 +60,9 @@ export function startAppStateSyncing(appStateManager: AppStateManager) {
   stateContainer.set(initialAppState);
 
   // set current url to whatever is in app state container
-  kbnUrlStateStorage.set('_a', initialAppState);
+  kbnUrlStateStorage.set('_a', initialAppState, {
+    replace: true,
+  });
 
   // finally start syncing state containers with url
   startSyncingAppStateWithUrl();
diff --git a/x-pack/plugins/maps/server/plugin.ts b/x-pack/plugins/maps/server/plugin.ts
index c7532979320378..b8676559a4e2b1 100644
--- a/x-pack/plugins/maps/server/plugin.ts
+++ b/x-pack/plugins/maps/server/plugin.ts
@@ -22,7 +22,7 @@ import { getFlightsSavedObjects } from './sample_data/flights_saved_objects.js';
 // @ts-ignore
 import { getWebLogsSavedObjects } from './sample_data/web_logs_saved_objects.js';
 import { registerMapsUsageCollector } from './maps_telemetry/collectors/register';
-import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE, getExistingMapPath } from '../common/constants';
+import { APP_ID, APP_ICON, MAP_SAVED_OBJECT_TYPE, getFullPath } from '../common/constants';
 import { mapSavedObjects, mapsTelemetrySavedObjects } from './saved_objects';
 import { MapsXPackConfig } from '../config';
 // @ts-ignore
@@ -77,7 +77,7 @@ export class MapsPlugin implements Plugin {
 
       home.sampleData.addAppLinksToSampleDataset('ecommerce', [
         {
-          path: getExistingMapPath('2c9c1f60-1909-11e9-919b-ffe5949a18d2'),
+          path: getFullPath('2c9c1f60-1909-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
@@ -99,7 +99,7 @@ export class MapsPlugin implements Plugin {
 
       home.sampleData.addAppLinksToSampleDataset('flights', [
         {
-          path: getExistingMapPath('5dd88580-1906-11e9-919b-ffe5949a18d2'),
+          path: getFullPath('5dd88580-1906-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
@@ -120,7 +120,7 @@ export class MapsPlugin implements Plugin {
       home.sampleData.addSavedObjectsToSampleDataset('logs', getWebLogsSavedObjects());
       home.sampleData.addAppLinksToSampleDataset('logs', [
         {
-          path: getExistingMapPath('de71f4f0-1902-11e9-919b-ffe5949a18d2'),
+          path: getFullPath('de71f4f0-1902-11e9-919b-ffe5949a18d2'),
           label: sampleDataLinkLabel,
           icon: APP_ICON,
         },
diff --git a/x-pack/plugins/maps/server/saved_objects/map.ts b/x-pack/plugins/maps/server/saved_objects/map.ts
index 78f70e27b2b7bf..24effd651a31b0 100644
--- a/x-pack/plugins/maps/server/saved_objects/map.ts
+++ b/x-pack/plugins/maps/server/saved_objects/map.ts
@@ -6,7 +6,7 @@
  */
 
 import { SavedObjectsType } from 'src/core/server';
-import { APP_ICON, getExistingMapPath } from '../../common/constants';
+import { APP_ICON, getFullPath } from '../../common/constants';
 // @ts-ignore
 import { savedObjectMigrations } from './saved_object_migrations';
 
@@ -34,7 +34,7 @@ export const mapSavedObjects: SavedObjectsType = {
     },
     getInAppUrl(obj) {
       return {
-        path: getExistingMapPath(obj.id),
+        path: getFullPath(obj.id),
         uiCapabilitiesPath: 'maps.show',
       };
     },
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index e65ff1afcc9c33..d112630facbc6f 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -44,7 +44,8 @@ export const DEFAULT_INTERVAL_VALUE = 300000; // ms
 export const DEFAULT_TIMEPICKER_QUICK_RANGES = 'timepicker:quickRanges';
 export const DEFAULT_TRANSFORMS = 'securitySolution:transforms';
 export const SCROLLING_DISABLED_CLASS_NAME = 'scrolling-disabled';
-export const GLOBAL_HEADER_HEIGHT = 98; // px
+export const GLOBAL_HEADER_HEIGHT = 96; // px
+export const GLOBAL_HEADER_HEIGHT_WITH_GLOBAL_BANNER = 128; // px
 export const FILTERS_GLOBAL_HEIGHT = 109; // px
 export const FULL_SCREEN_TOGGLED_CLASS_NAME = 'fullScreenToggled';
 export const NO_ALERT_INDEX = 'no-alert-index-049FC71A-4C2C-446F-9901-37XMC5024C51';
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
index f1ee0d39f545f5..bf5c281a43e39e 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
@@ -129,7 +129,13 @@ describe('Alerts detection rules', () => {
   });
 
   it('Auto refreshes rules', () => {
-    cy.clock(Date.now());
+    /**
+     * Ran into the error: timer created with setInterval() but cleared with cancelAnimationFrame()
+     * There are no cancelAnimationFrames in the codebase that are used to clear a setInterval so
+     * explicitly set the below overrides. see https://docs.cypress.io/api/commands/clock#Function-names
+     */
+
+    cy.clock(Date.now(), ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', 'Date']);
 
     goToManageAlertsDetectionRules();
     waitForRulesTableToBeLoaded();
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/data_providers.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/data_providers.spec.ts
index d42632a66eb260..a0e7e77f89b679 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/data_providers.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/data_providers.spec.ts
@@ -12,6 +12,7 @@ import {
   TIMELINE_DATA_PROVIDERS_ACTION_MENU,
   IS_DRAGGING_DATA_PROVIDERS,
   TIMELINE_FLYOUT_HEADER,
+  TIMELINE_BOTTOM_BAR_CONTAINER,
 } from '../../screens/timeline';
 import { HOSTS_NAMES_DRAGGABLE } from '../../screens/hosts/all_hosts';
 
@@ -46,7 +47,7 @@ describe('timeline data providers', () => {
   it('renders the data provider of a host dragged from the All Hosts widget on the hosts page', () => {
     dragAndDropFirstHostToTimeline();
     openTimelineUsingToggle();
-    cy.get(TIMELINE_DROPPED_DATA_PROVIDERS)
+    cy.get(`${TIMELINE_BOTTOM_BAR_CONTAINER} ${TIMELINE_DROPPED_DATA_PROVIDERS}`)
       .first()
       .invoke('text')
       .then((dataProviderText) => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/pagination.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/pagination.spec.ts
index 568fb90568fb33..8b65f99eb04b87 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/pagination.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/pagination.spec.ts
@@ -6,6 +6,7 @@
  */
 
 import {
+  TIMELINE_BOTTOM_BAR_CONTAINER,
   TIMELINE_EVENT,
   TIMELINE_EVENTS_COUNT_NEXT_PAGE,
   TIMELINE_EVENTS_COUNT_PER_PAGE,
@@ -50,10 +51,10 @@ describe('Pagination', () => {
 
   it('should be able to go to next / previous page', () => {
     cy.intercept('POST', '/internal/bsearch').as('refetch');
-    cy.get(TIMELINE_EVENTS_COUNT_NEXT_PAGE).first().click();
+    cy.get(`${TIMELINE_BOTTOM_BAR_CONTAINER} ${TIMELINE_EVENTS_COUNT_NEXT_PAGE}`).first().click();
     cy.wait('@refetch').its('response.statusCode').should('eq', 200);
 
-    cy.get(TIMELINE_EVENTS_COUNT_PREV_PAGE).first().click();
+    cy.get(`${TIMELINE_BOTTOM_BAR_CONTAINER} ${TIMELINE_EVENTS_COUNT_PREV_PAGE}`).first().click();
     cy.wait('@refetch').its('response.statusCode').should('eq', 200);
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/screens/timeline.ts b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
index 0a9e5b44feb1f6..25cd2357fe02bc 100644
--- a/x-pack/plugins/security_solution/cypress/screens/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/timeline.ts
@@ -143,6 +143,8 @@ export const TIMELINE_CORRELATION_TAB = '[data-test-subj="timelineTabs-eql"]';
 
 export const IS_DRAGGING_DATA_PROVIDERS = '.is-dragging';
 
+export const TIMELINE_BOTTOM_BAR_CONTAINER = '[data-test-subj="timeline-bottom-bar-container"]';
+
 export const TIMELINE_DATA_PROVIDERS = '[data-test-subj="dataProviders"]';
 
 export const TIMELINE_DATA_PROVIDERS_ACTION_MENU = '[data-test-subj="providerActions"]';
diff --git a/x-pack/plugins/security_solution/public/app/404.tsx b/x-pack/plugins/security_solution/public/app/404.tsx
index c21f7a4d4d5782..2634ffd47bff1d 100644
--- a/x-pack/plugins/security_solution/public/app/404.tsx
+++ b/x-pack/plugins/security_solution/public/app/404.tsx
@@ -8,15 +8,15 @@
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import { WrapperPage } from '../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../common/components/page_wrapper';
 
 export const NotFoundPage = React.memo(() => (
-  <WrapperPage>
+  <SecuritySolutionPageWrapper>
     <FormattedMessage
       id="xpack.securitySolution.pages.fourohfour.noContentFoundDescription"
       defaultMessage="No content found"
     />
-  </WrapperPage>
+  </SecuritySolutionPageWrapper>
 ));
 
 NotFoundPage.displayName = 'NotFoundPage';
diff --git a/x-pack/plugins/security_solution/public/app/app.tsx b/x-pack/plugins/security_solution/public/app/app.tsx
index 2dc7f632c84829..c223570c77201c 100644
--- a/x-pack/plugins/security_solution/public/app/app.tsx
+++ b/x-pack/plugins/security_solution/public/app/app.tsx
@@ -11,7 +11,7 @@ import { Store, Action } from 'redux';
 import { Provider as ReduxStoreProvider } from 'react-redux';
 
 import { EuiErrorBoundary } from '@elastic/eui';
-import { AppLeaveHandler } from '../../../../../src/core/public';
+import { AppLeaveHandler, AppMountParameters } from '../../../../../src/core/public';
 
 import { ManageUserInfo } from '../detections/components/user_info';
 import { DEFAULT_DARK_MODE, APP_NAME } from '../../common/constants';
@@ -30,10 +30,17 @@ interface StartAppComponent {
   children: React.ReactNode;
   history: History;
   onAppLeave: (handler: AppLeaveHandler) => void;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
   store: Store<State, Action>;
 }
 
-const StartAppComponent: FC<StartAppComponent> = ({ children, history, onAppLeave, store }) => {
+const StartAppComponent: FC<StartAppComponent> = ({
+  children,
+  history,
+  setHeaderActionMenu,
+  onAppLeave,
+  store,
+}) => {
   const { i18n } = useKibana().services;
   const [darkMode] = useUiSetting$<boolean>(DEFAULT_DARK_MODE);
 
@@ -46,7 +53,11 @@ const StartAppComponent: FC<StartAppComponent> = ({ children, history, onAppLeav
               <MlCapabilitiesProvider>
                 <UserPrivilegesProvider>
                   <ManageUserInfo>
-                    <PageRouter history={history} onAppLeave={onAppLeave}>
+                    <PageRouter
+                      history={history}
+                      onAppLeave={onAppLeave}
+                      setHeaderActionMenu={setHeaderActionMenu}
+                    >
                       {children}
                     </PageRouter>
                   </ManageUserInfo>
@@ -69,6 +80,7 @@ interface SecurityAppComponentProps {
   history: History;
   onAppLeave: (handler: AppLeaveHandler) => void;
   services: StartServices;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
   store: Store<State, Action>;
 }
 
@@ -77,6 +89,7 @@ const SecurityAppComponent: React.FC<SecurityAppComponentProps> = ({
   history,
   onAppLeave,
   services,
+  setHeaderActionMenu,
   store,
 }) => (
   <KibanaContextProvider
@@ -85,7 +98,12 @@ const SecurityAppComponent: React.FC<SecurityAppComponentProps> = ({
       ...services,
     }}
   >
-    <StartApp history={history} onAppLeave={onAppLeave} store={store}>
+    <StartApp
+      history={history}
+      onAppLeave={onAppLeave}
+      setHeaderActionMenu={setHeaderActionMenu}
+      store={store}
+    >
       {children}
     </StartApp>
   </KibanaContextProvider>
diff --git a/x-pack/plugins/security_solution/public/app/home/global_header/index.tsx b/x-pack/plugins/security_solution/public/app/home/global_header/index.tsx
new file mode 100644
index 00000000000000..98ff11423ce01c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/app/home/global_header/index.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import {
+  EuiHeaderSection,
+  EuiHeaderLinks,
+  EuiHeaderLink,
+  EuiHeaderSectionItem,
+} from '@elastic/eui';
+import React, { useEffect, useMemo } from 'react';
+import { createPortalNode, OutPortal, InPortal } from 'react-reverse-portal';
+import { i18n } from '@kbn/i18n';
+
+import { AppMountParameters } from '../../../../../../../src/core/public';
+import { toMountPoint } from '../../../../../../../src/plugins/kibana_react/public';
+import { MlPopover } from '../../../common/components/ml_popover/ml_popover';
+import { useKibana } from '../../../common/lib/kibana';
+import { ADD_DATA_PATH, APP_DETECTIONS_PATH } from '../../../../common/constants';
+
+const BUTTON_ADD_DATA = i18n.translate('xpack.securitySolution.globalHeader.buttonAddData', {
+  defaultMessage: 'Add data',
+});
+
+/**
+ * This component uses the reverse portal to add the Add Data and ML job settings buttons on the
+ * right hand side of the Kibana global header
+ */
+export const GlobalHeader = React.memo(
+  ({ setHeaderActionMenu }: { setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'] }) => {
+    const portalNode = useMemo(() => createPortalNode(), []);
+    const { http } = useKibana().services;
+
+    useEffect(() => {
+      let unmount = () => {};
+
+      setHeaderActionMenu((element) => {
+        const mount = toMountPoint(<OutPortal node={portalNode} />);
+        unmount = mount(element);
+        return unmount;
+      });
+
+      return () => {
+        portalNode.unmount();
+        unmount();
+      };
+    }, [portalNode, setHeaderActionMenu]);
+
+    return (
+      <InPortal node={portalNode}>
+        <EuiHeaderSection side="right">
+          {window.location.pathname.includes(APP_DETECTIONS_PATH) && (
+            <EuiHeaderSectionItem>
+              <MlPopover />
+            </EuiHeaderSectionItem>
+          )}
+          <EuiHeaderSectionItem>
+            <EuiHeaderLinks>
+              <EuiHeaderLink
+                color="primary"
+                data-test-subj="add-data"
+                href={http.basePath.prepend(ADD_DATA_PATH)}
+                iconType="indexOpen"
+              >
+                {BUTTON_ADD_DATA}
+              </EuiHeaderLink>
+            </EuiHeaderLinks>
+          </EuiHeaderSectionItem>
+        </EuiHeaderSection>
+      </InPortal>
+    );
+  }
+);
+GlobalHeader.displayName = 'GlobalHeader';
diff --git a/x-pack/plugins/security_solution/public/app/home/home_navigations.tsx b/x-pack/plugins/security_solution/public/app/home/home_navigations.tsx
index 7ebcc967538366..8358e2f9377b82 100644
--- a/x-pack/plugins/security_solution/public/app/home/home_navigations.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/home_navigations.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import * as i18n from './translations';
+import * as i18n from '../translations';
 import { SecurityPageName } from '../types';
 import { SiemNavTab } from '../../common/components/navigation/types';
 import {
diff --git a/x-pack/plugins/security_solution/public/app/home/index.tsx b/x-pack/plugins/security_solution/public/app/home/index.tsx
index 1b0ddcfb9ae7d2..9a57ab3fc3a738 100644
--- a/x-pack/plugins/security_solution/public/app/home/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/index.tsx
@@ -5,57 +5,35 @@
  * 2.0.
  */
 
-import React, { useEffect, useRef, useState } from 'react';
-import styled from 'styled-components';
+import React, { useRef } from 'react';
 
-import { TimelineId } from '../../../common/types/timeline';
 import { DragDropContextWrapper } from '../../common/components/drag_and_drop/drag_drop_context_wrapper';
-import { Flyout } from '../../timelines/components/flyout';
+import { AppLeaveHandler, AppMountParameters } from '../../../../../../src/core/public';
 import { SecuritySolutionAppWrapper } from '../../common/components/page';
-import { HeaderGlobal } from '../../common/components/header_global';
 import { HelpMenu } from '../../common/components/help_menu';
-import { AutoSaveWarningMsg } from '../../timelines/components/timeline/auto_save_warning';
 import { UseUrlState } from '../../common/components/url_state';
-import { useShowTimeline } from '../../common/utils/timeline/use_show_timeline';
 import { navTabs } from './home_navigations';
 import { useInitSourcerer, useSourcererScope } from '../../common/containers/sourcerer';
 import { useKibana } from '../../common/lib/kibana';
 import { DETECTIONS_SUB_PLUGIN_ID } from '../../../common/constants';
 import { SourcererScopeName } from '../../common/store/sourcerer/model';
 import { useUpgradeEndpointPackage } from '../../common/hooks/endpoint/upgrade';
-import { useThrottledResizeObserver } from '../../common/components/utils';
-import { AppLeaveHandler } from '../../../../../../src/core/public';
-
-const Main = styled.main.attrs<{ paddingTop: number }>(({ paddingTop }) => ({
-  style: {
-    paddingTop: `${paddingTop}px`,
-  },
-}))<{ paddingTop: number }>`
-  overflow: auto;
-  display: flex;
-  flex-direction: column;
-  flex: 1 1 auto;
-`;
-
-Main.displayName = 'Main';
+import { GlobalHeader } from './global_header';
+import { SecuritySolutionTemplateWrapper } from './template_wrapper';
 
 interface HomePageProps {
   children: React.ReactNode;
   onAppLeave: (handler: AppLeaveHandler) => void;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
 }
 
-const HomePageComponent: React.FC<HomePageProps> = ({ children, onAppLeave }) => {
-  const { application, overlays } = useKibana().services;
+const HomePageComponent: React.FC<HomePageProps> = ({
+  children,
+  onAppLeave,
+  setHeaderActionMenu,
+}) => {
+  const { application } = useKibana().services;
   const subPluginId = useRef<string>('');
-  const { ref, height = 0 } = useThrottledResizeObserver(300);
-  const banners$ = overlays.banners.get$();
-  const [headerFixed, setHeaderFixed] = useState<boolean>(true);
-  const mainPaddingTop = headerFixed ? height : 0;
-
-  useEffect(() => {
-    const subscription = banners$.subscribe((banners) => setHeaderFixed(!banners.length));
-    return () => subscription.unsubscribe();
-  }, [banners$]); // Only un/re-subscribe if the Observable changes
 
   application.currentAppId$.subscribe((appId) => {
     subPluginId.current = appId ?? '';
@@ -66,13 +44,13 @@ const HomePageComponent: React.FC<HomePageProps> = ({ children, onAppLeave }) =>
       ? SourcererScopeName.detections
       : SourcererScopeName.default
   );
-  const [showTimeline] = useShowTimeline();
 
-  const { browserFields, indexPattern, indicesExist } = useSourcererScope(
+  const { browserFields, indexPattern } = useSourcererScope(
     subPluginId.current === DETECTIONS_SUB_PLUGIN_ID
       ? SourcererScopeName.detections
       : SourcererScopeName.default
   );
+
   // side effect: this will attempt to upgrade the endpoint package if it is not up to date
   // this will run when a user navigates to the Security Solution app and when they navigate between
   // tabs in the app. This is useful for keeping the endpoint package as up to date as possible until
@@ -81,23 +59,14 @@ const HomePageComponent: React.FC<HomePageProps> = ({ children, onAppLeave }) =>
   useUpgradeEndpointPackage();
 
   return (
-    <SecuritySolutionAppWrapper>
-      <HeaderGlobal ref={ref} isFixed={headerFixed} />
-
-      <Main paddingTop={mainPaddingTop} data-test-subj="pageContainer">
-        <DragDropContextWrapper browserFields={browserFields}>
-          <UseUrlState indexPattern={indexPattern} navTabs={navTabs} />
-          {indicesExist && showTimeline && (
-            <>
-              <AutoSaveWarningMsg />
-              <Flyout timelineId={TimelineId.active} onAppLeave={onAppLeave} />
-            </>
-          )}
-
+    <SecuritySolutionAppWrapper className="kbnAppWrapper">
+      <GlobalHeader setHeaderActionMenu={setHeaderActionMenu} />
+      <DragDropContextWrapper browserFields={browserFields}>
+        <UseUrlState indexPattern={indexPattern} navTabs={navTabs} />
+        <SecuritySolutionTemplateWrapper onAppLeave={onAppLeave}>
           {children}
-        </DragDropContextWrapper>
-      </Main>
-
+        </SecuritySolutionTemplateWrapper>
+      </DragDropContextWrapper>
       <HelpMenu />
     </SecuritySolutionAppWrapper>
   );
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx
new file mode 100644
index 00000000000000..08ebbeaee55d44
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable react/display-name */
+
+import React, { useRef } from 'react';
+import { KibanaPageTemplateProps } from '../../../../../../../../src/plugins/kibana_react/public';
+import { AppLeaveHandler } from '../../../../../../../../src/core/public';
+import { useKibana } from '../../../../common/lib/kibana';
+import { useShowTimeline } from '../../../../common/utils/timeline/use_show_timeline';
+import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { DETECTIONS_SUB_PLUGIN_ID } from '../../../../../common/constants';
+import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
+import { TimelineId } from '../../../../../common/types/timeline';
+import { AutoSaveWarningMsg } from '../../../../timelines/components/timeline/auto_save_warning';
+import { Flyout } from '../../../../timelines/components/flyout';
+
+export const BOTTOM_BAR_CLASSNAME = 'timeline-bottom-bar';
+
+export const SecuritySolutionBottomBar = React.memo(
+  ({ onAppLeave }: { onAppLeave: (handler: AppLeaveHandler) => void }) => {
+    const subPluginId = useRef<string>('');
+    const { application } = useKibana().services;
+    application.currentAppId$.subscribe((appId) => {
+      subPluginId.current = appId ?? '';
+    });
+
+    const [showTimeline] = useShowTimeline();
+
+    const { indicesExist } = useSourcererScope(
+      subPluginId.current === DETECTIONS_SUB_PLUGIN_ID
+        ? SourcererScopeName.detections
+        : SourcererScopeName.default
+    );
+
+    return indicesExist && showTimeline ? (
+      <>
+        <AutoSaveWarningMsg />
+        <Flyout timelineId={TimelineId.active} onAppLeave={onAppLeave} />
+      </>
+    ) : null;
+  }
+);
+
+export const SecuritySolutionBottomBarProps: KibanaPageTemplateProps['bottomBarProps'] = {
+  className: BOTTOM_BAR_CLASSNAME,
+  'data-test-subj': 'timeline-bottom-bar-container',
+  position: 'fixed',
+  usePortal: false,
+};
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
new file mode 100644
index 00000000000000..3e3c91133eab61
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+import styled from 'styled-components';
+import { OutPortal } from 'react-reverse-portal';
+import { useGlobalHeaderPortal } from '../../../../common/hooks/use_global_header_portal';
+
+const StyledStickyWrapper = styled.div`
+  position: sticky;
+  z-index: ${(props) => props.theme.eui.euiZLevel2};
+  // TOP location is declared in src/public/rendering/_base.scss to keep in line with Kibana Chrome
+`;
+
+export const GlobalKQLHeader = React.memo(() => {
+  const { globalKQLHeaderPortalNode } = useGlobalHeaderPortal();
+
+  return (
+    <StyledStickyWrapper id="securitySolutionStickyKQL">
+      <OutPortal node={globalKQLHeaderPortalNode} />
+    </StyledStickyWrapper>
+  );
+});
+
+GlobalKQLHeader.displayName = 'GlobalKQLHeader';
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx
new file mode 100644
index 00000000000000..02fd07151f111a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/index.tsx
@@ -0,0 +1,96 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo } from 'react';
+import styled from 'styled-components';
+import { EuiPanel } from '@elastic/eui';
+import { IS_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
+import { AppLeaveHandler } from '../../../../../../../src/core/public';
+import { KibanaPageTemplate } from '../../../../../../../src/plugins/kibana_react/public';
+import { useSecuritySolutionNavigation } from '../../../common/components/navigation/use_security_solution_navigation';
+import { TimelineId } from '../../../../common/types/timeline';
+import { getTimelineShowStatusByIdSelector } from '../../../timelines/components/flyout/selectors';
+import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
+import { GlobalKQLHeader } from './global_kql_header';
+import {
+  BOTTOM_BAR_CLASSNAME,
+  SecuritySolutionBottomBar,
+  SecuritySolutionBottomBarProps,
+} from './bottom_bar';
+import { useShowTimeline } from '../../../common/utils/timeline/use_show_timeline';
+import { gutterTimeline } from '../../../common/lib/helpers';
+
+/* eslint-disable react/display-name */
+
+/**
+ * Need to apply the styles via a className to effect the containing bottom bar
+ * rather than applying them to the timeline bar directly
+ */
+const StyledKibanaPageTemplate = styled(KibanaPageTemplate)<{
+  $isShowingTimelineOverlay?: boolean;
+  $isTimelineBottomBarVisible?: boolean;
+}>`
+  .${BOTTOM_BAR_CLASSNAME} {
+    animation: 'none !important'; // disable the default bottom bar slide animation
+    background: ${({ theme }) =>
+      theme.eui.euiColorEmptyShade}; // Override bottom bar black background
+    color: inherit; // Necessary to override the bottom bar 'white text'
+    transform: ${(
+      { $isShowingTimelineOverlay } // Since the bottom bar wraps the whole overlay now, need to override any transforms when it is open
+    ) => ($isShowingTimelineOverlay ? 'none' : 'translateY(calc(100% - 50px))')};
+    z-index: ${({ theme }) => theme.eui.euiZLevel8};
+
+    .${IS_DRAGGING_CLASS_NAME} & {
+      // When a drag is in process the bottom flyout should slide up to allow a drop
+      transform: none;
+    }
+  }
+
+  // If the bottom bar is visible add padding to the navigation
+  ${({ $isTimelineBottomBarVisible }) =>
+    $isTimelineBottomBarVisible &&
+    `
+    @media (min-width: 768px) {
+      .kbnPageTemplateSolutionNav {
+        padding-bottom: ${gutterTimeline};
+      }
+    }
+  `}
+`;
+
+interface SecuritySolutionPageWrapperProps {
+  onAppLeave: (handler: AppLeaveHandler) => void;
+}
+
+export const SecuritySolutionTemplateWrapper: React.FC<SecuritySolutionPageWrapperProps> = React.memo(
+  ({ children, onAppLeave }) => {
+    const solutionNav = useSecuritySolutionNavigation();
+    const [isTimelineBottomBarVisible] = useShowTimeline();
+    const getTimelineShowStatus = useMemo(() => getTimelineShowStatusByIdSelector(), []);
+    const { show: isShowingTimelineOverlay } = useDeepEqualSelector((state) =>
+      getTimelineShowStatus(state, TimelineId.active)
+    );
+
+    return (
+      <StyledKibanaPageTemplate
+        $isTimelineBottomBarVisible={isTimelineBottomBarVisible}
+        $isShowingTimelineOverlay={isShowingTimelineOverlay}
+        bottomBarProps={SecuritySolutionBottomBarProps}
+        bottomBar={<SecuritySolutionBottomBar onAppLeave={onAppLeave} />}
+        paddingSize="none"
+        solutionNav={solutionNav}
+        restrictWidth={false}
+        template="default"
+      >
+        <GlobalKQLHeader />
+        <EuiPanel className="securityPageWrapper" data-test-subj="pageContainer" hasShadow={false}>
+          {children}
+        </EuiPanel>
+      </StyledKibanaPageTemplate>
+    );
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/app/index.tsx b/x-pack/plugins/security_solution/public/app/index.tsx
index 1e304c26869602..194f119e35478e 100644
--- a/x-pack/plugins/security_solution/public/app/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/index.tsx
@@ -15,12 +15,19 @@ export const renderApp = ({
   element,
   history,
   onAppLeave,
+  setHeaderActionMenu,
   services,
   store,
   SubPluginRoutes,
 }: RenderAppProps): (() => void) => {
   render(
-    <SecurityApp history={history} onAppLeave={onAppLeave} services={services} store={store}>
+    <SecurityApp
+      history={history}
+      onAppLeave={onAppLeave}
+      services={services}
+      setHeaderActionMenu={setHeaderActionMenu}
+      store={store}
+    >
       <SubPluginRoutes />
     </SecurityApp>,
     element
diff --git a/x-pack/plugins/security_solution/public/app/routes.tsx b/x-pack/plugins/security_solution/public/app/routes.tsx
index 6454653af5214d..a9a94a69982863 100644
--- a/x-pack/plugins/security_solution/public/app/routes.tsx
+++ b/x-pack/plugins/security_solution/public/app/routes.tsx
@@ -10,7 +10,7 @@ import React, { FC, memo, useEffect } from 'react';
 import { Route, Router, Switch } from 'react-router-dom';
 import { useDispatch } from 'react-redux';
 
-import { AppLeaveHandler } from '../../../../../src/core/public';
+import { AppLeaveHandler, AppMountParameters } from '../../../../../src/core/public';
 import { ManageRoutesSpy } from '../common/utils/route/manage_spy_routes';
 import { RouteCapture } from '../common/components/endpoint/route_capture';
 import { AppAction } from '../common/store/actions';
@@ -21,9 +21,15 @@ interface RouterProps {
   children: React.ReactNode;
   history: History;
   onAppLeave: (handler: AppLeaveHandler) => void;
+  setHeaderActionMenu: AppMountParameters['setHeaderActionMenu'];
 }
 
-const PageRouterComponent: FC<RouterProps> = ({ children, history, onAppLeave }) => {
+const PageRouterComponent: FC<RouterProps> = ({
+  children,
+  history,
+  onAppLeave,
+  setHeaderActionMenu,
+}) => {
   const dispatch = useDispatch<(action: AppAction) => void>();
   useEffect(() => {
     return () => {
@@ -42,7 +48,9 @@ const PageRouterComponent: FC<RouterProps> = ({ children, history, onAppLeave })
         <RouteCapture>
           <Switch>
             <Route path="/">
-              <HomePage onAppLeave={onAppLeave}>{children}</HomePage>
+              <HomePage onAppLeave={onAppLeave} setHeaderActionMenu={setHeaderActionMenu}>
+                {children}
+              </HomePage>
             </Route>
             <Route>
               <NotFoundPage />
diff --git a/x-pack/plugins/security_solution/public/app/home/translations.ts b/x-pack/plugins/security_solution/public/app/translations.ts
similarity index 100%
rename from x-pack/plugins/security_solution/public/app/home/translations.ts
rename to x-pack/plugins/security_solution/public/app/translations.ts
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 91fb45de04320b..dfd53ae5cc0b07 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -38,7 +38,7 @@ export const Create = React.memo(() => {
   );
 
   return (
-    <EuiPanel>
+    <EuiPanel hasBorder>
       {cases.getCreateCase({
         onCancel: handleSetIsCancel,
         onSuccess,
diff --git a/x-pack/plugins/security_solution/public/cases/pages/case.tsx b/x-pack/plugins/security_solution/public/cases/pages/case.tsx
index 647647afbe0a4a..ad0176bda6905c 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/case.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/case.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGetUserCasesPermissions } from '../../common/lib/kibana';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { AllCases } from '../components/all_cases';
@@ -20,9 +20,9 @@ export const CasesPage = React.memo(() => {
 
   return userPermissions == null || userPermissions?.read ? (
     <>
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <AllCases userCanCrud={userPermissions?.crud ?? false} />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
       <SpyRoute pageName={SecurityPageName.case} />
     </>
   ) : (
diff --git a/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx b/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
index a086409e55df52..f6bb27b7b7104f 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/case_details.tsx
@@ -10,7 +10,7 @@ import { useParams } from 'react-router-dom';
 
 import { SecurityPageName } from '../../app/types';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGetUrlSearch } from '../../common/components/navigation/use_get_url_search';
 import { useGetUserCasesPermissions, useKibana } from '../../common/lib/kibana';
 import { getCaseUrl } from '../../common/components/link_to';
@@ -37,13 +37,13 @@ export const CaseDetailsPage = React.memo(() => {
 
   return caseId != null ? (
     <>
-      <WrapperPage noPadding>
+      <SecuritySolutionPageWrapper noPadding>
         <CaseView
           caseId={caseId}
           subCaseId={subCaseId}
           userCanCrud={userPermissions?.crud ?? false}
         />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
       <SpyRoute pageName={SecurityPageName.case} />
     </>
   ) : null;
diff --git a/x-pack/plugins/security_solution/public/cases/pages/configure_cases.tsx b/x-pack/plugins/security_solution/public/cases/pages/configure_cases.tsx
index c942065e45278d..d3f235a5da7dc1 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/configure_cases.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/configure_cases.tsx
@@ -11,7 +11,7 @@ import styled from 'styled-components';
 import { SecurityPageName } from '../../app/types';
 import { getCaseUrl } from '../../common/components/link_to';
 import { useGetUrlSearch } from '../../common/components/navigation/use_get_url_search';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGetUserCasesPermissions, useKibana } from '../../common/lib/kibana';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { navTabs } from '../../app/home/home_navigations';
@@ -51,7 +51,7 @@ const ConfigureCasesPageComponent: React.FC = () => {
 
   return (
     <>
-      <WrapperPage noPadding>
+      <SecuritySolutionPageWrapper noPadding>
         <SectionWrapper>
           <HeaderWrapper>
             <CaseHeaderPage title={i18n.CONFIGURE_CASES_PAGE_TITLE} backOptions={backOptions} />
@@ -63,7 +63,7 @@ const ConfigureCasesPageComponent: React.FC = () => {
             owner: [APP_ID],
           })}
         </WhitePageWrapper>
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
       <SpyRoute pageName={SecurityPageName.case} />
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/cases/pages/create_case.tsx b/x-pack/plugins/security_solution/public/cases/pages/create_case.tsx
index 3c5197f19eff12..6c88c4afb63955 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/create_case.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/create_case.tsx
@@ -10,7 +10,7 @@ import React, { useEffect, useMemo } from 'react';
 import { SecurityPageName } from '../../app/types';
 import { getCaseUrl } from '../../common/components/link_to';
 import { useGetUrlSearch } from '../../common/components/navigation/use_get_url_search';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGetUserCasesPermissions, useKibana } from '../../common/lib/kibana';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { navTabs } from '../../app/home/home_navigations';
@@ -45,10 +45,10 @@ export const CreateCasePage = React.memo(() => {
 
   return (
     <>
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <CaseHeaderPage backOptions={backOptions} title={i18n.CREATE_TITLE} />
         <Create />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
       <SpyRoute pageName={SecurityPageName.case} />
     </>
   );
diff --git a/x-pack/plugins/security_solution/public/common/components/callouts/callout_switcher.tsx b/x-pack/plugins/security_solution/public/common/components/callouts/callout_switcher.tsx
index e700bb97e9893b..43f10604d8582e 100644
--- a/x-pack/plugins/security_solution/public/common/components/callouts/callout_switcher.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/callouts/callout_switcher.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { FC, memo } from 'react';
+import { EuiSpacer } from '@elastic/eui';
 
 import { CallOutMessage } from './callout_types';
 import { CallOut } from './callout';
@@ -21,7 +22,12 @@ const CallOutSwitcherComponent: FC<CallOutSwitcherProps> = ({ namespace, conditi
   const { isVisible, dismiss } = useCallOutStorage([message], namespace);
 
   const shouldRender = condition && isVisible(message);
-  return shouldRender ? <CallOut message={message} onDismiss={dismiss} /> : null;
+  return shouldRender ? (
+    <>
+      <CallOut message={message} onDismiss={dismiss} />
+      <EuiSpacer size="l" />
+    </>
+  ) : null;
 };
 
 export const CallOutSwitcher = memo(CallOutSwitcherComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index 8326cdaaaf9952..5dadd740ae3bca 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -286,6 +286,7 @@ const EventsViewerComponent: React.FC<Props> = ({
     <StyledEuiPanel
       data-test-subj="events-viewer-panel"
       $isFullScreen={globalFullScreen && id !== TimelineId.active}
+      hasBorder
     >
       {canQueryTimeline ? (
         <EventDetailsWidthProvider>
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index c0a75bdd3edd2e..32aa716d4bce3e 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -27,10 +27,8 @@ import { useKibana } from '../../lib/kibana';
 import { defaultControlColumn } from '../../../timelines/components/timeline/body/control_columns';
 import { EventsViewer } from './events_viewer';
 
-const DEFAULT_EVENTS_VIEWER_HEIGHT = 652;
-
 const FullScreenContainer = styled.div<{ $isFullScreen: boolean }>`
-  height: ${({ $isFullScreen }) => ($isFullScreen ? '100%' : `${DEFAULT_EVENTS_VIEWER_HEIGHT}px`)};
+  height: ${({ $isFullScreen }) => ($isFullScreen ? '100%' : undefined)};
   flex: 1 1 auto;
   display: flex;
   width: 100%;
diff --git a/x-pack/plugins/security_solution/public/common/components/filters_global/__snapshots__/filters_global.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/filters_global/__snapshots__/filters_global.test.tsx.snap
index 994e98d8619a18..51326d54a61611 100644
--- a/x-pack/plugins/security_solution/public/common/components/filters_global/__snapshots__/filters_global.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/filters_global/__snapshots__/filters_global.test.tsx.snap
@@ -4,17 +4,19 @@ exports[`rendering renders correctly 1`] = `
 <InPortal
   node={<div />}
 >
-  <FiltersGlobalContainer
-    data-test-subj="filters-global-container"
-    show={true}
+  <EuiPanel
+    borderRadius="none"
+    color="subdued"
+    paddingSize="s"
   >
-    <Wrapper
-      className="siemFiltersGlobal"
+    <FiltersGlobalContainer
+      data-test-subj="filters-global-container"
+      show={true}
     >
       <p>
         Additional filters here.
       </p>
-    </Wrapper>
-  </FiltersGlobalContainer>
+    </FiltersGlobalContainer>
+  </EuiPanel>
 </InPortal>
 `;
diff --git a/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx b/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
index c6b5b6ccde5cd1..79c08e50451f78 100644
--- a/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/filters_global/filters_global.tsx
@@ -8,18 +8,9 @@
 import React from 'react';
 import styled from 'styled-components';
 import { InPortal } from 'react-reverse-portal';
-
+import { EuiPanel } from '@elastic/eui';
 import { useGlobalHeaderPortal } from '../../hooks/use_global_header_portal';
 
-const Wrapper = styled.aside`
-  position: relative;
-  z-index: ${({ theme }) => theme.eui.euiZNavigation};
-  background: ${({ theme }) => theme.eui.euiColorEmptyShade};
-  border-bottom: ${({ theme }) => theme.eui.euiBorderThin};
-  padding: ${({ theme }) => theme.eui.paddingSizes.m} ${({ theme }) => theme.eui.paddingSizes.l};
-`;
-Wrapper.displayName = 'Wrapper';
-
 const FiltersGlobalContainer = styled.header<{ show: boolean }>`
   display: ${({ show }) => (show ? 'block' : 'none')};
 `;
@@ -32,13 +23,15 @@ export interface FiltersGlobalProps {
 }
 
 export const FiltersGlobal = React.memo<FiltersGlobalProps>(({ children, show = true }) => {
-  const { globalHeaderPortalNode } = useGlobalHeaderPortal();
+  const { globalKQLHeaderPortalNode } = useGlobalHeaderPortal();
 
   return (
-    <InPortal node={globalHeaderPortalNode}>
-      <FiltersGlobalContainer data-test-subj="filters-global-container" show={show}>
-        <Wrapper className="siemFiltersGlobal">{children}</Wrapper>
-      </FiltersGlobalContainer>
+    <InPortal node={globalKQLHeaderPortalNode}>
+      <EuiPanel borderRadius="none" color="subdued" paddingSize="s">
+        <FiltersGlobalContainer data-test-subj="filters-global-container" show={show}>
+          {children}
+        </FiltersGlobalContainer>
+      </EuiPanel>
     </InPortal>
   );
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/header_global/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/header_global/index.test.tsx
deleted file mode 100644
index 96a7eacb7fb08c..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/header_global/index.test.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { mount } from 'enzyme';
-
-import { useGetUserCasesPermissions } from '../../../common/lib/kibana';
-import { TestProviders } from '../../../common/mock';
-import { HeaderGlobal } from '.';
-
-jest.mock('../../../common/lib/kibana');
-
-describe('HeaderGlobal', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  it('does not display the cases tab when the user does not have read permissions', () => {
-    (useGetUserCasesPermissions as jest.Mock).mockReturnValue({
-      crud: false,
-      read: false,
-    });
-
-    const wrapper = mount(
-      <TestProviders>
-        <HeaderGlobal />
-      </TestProviders>
-    );
-
-    expect(wrapper.find(`[data-test-subj="navigation-case"]`).exists()).toBeFalsy();
-  });
-
-  it('displays the cases tab when the user has read permissions', () => {
-    (useGetUserCasesPermissions as jest.Mock).mockReturnValue({
-      crud: true,
-      read: true,
-    });
-
-    const wrapper = mount(
-      <TestProviders>
-        <HeaderGlobal />
-      </TestProviders>
-    );
-
-    expect(wrapper.find(`[data-test-subj="navigation-case"]`).exists()).toBeTruthy();
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx b/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx
deleted file mode 100644
index e91905183aab10..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/header_global/index.tsx
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem, EuiIcon } from '@elastic/eui';
-import { pickBy } from 'lodash/fp';
-import React, { forwardRef, useCallback, useMemo } from 'react';
-import styled from 'styled-components';
-import { OutPortal } from 'react-reverse-portal';
-
-import { navTabs } from '../../../app/home/home_navigations';
-import { useGlobalFullScreen, useTimelineFullScreen } from '../../containers/use_full_screen';
-import { SecurityPageName } from '../../../app/types';
-import { getAppOverviewUrl } from '../link_to';
-import { MlPopover } from '../ml_popover/ml_popover';
-import { SiemNavigation } from '../navigation';
-import * as i18n from './translations';
-import { useGetUrlSearch } from '../navigation/use_get_url_search';
-import { useGetUserCasesPermissions, useKibana } from '../../lib/kibana';
-import { APP_ID, ADD_DATA_PATH, APP_DETECTIONS_PATH } from '../../../../common/constants';
-import { useGlobalHeaderPortal } from '../../hooks/use_global_header_portal';
-import { LinkAnchor } from '../links';
-
-const Wrapper = styled.header<{ $isFixed: boolean }>`
-  ${({ theme, $isFixed }) => `
-    background: ${theme.eui.euiColorEmptyShade};
-    border-bottom: ${theme.eui.euiBorderThin};
-    width: 100%;
-    z-index: ${theme.eui.euiZNavigation};
-    position: ${$isFixed ? 'fixed' : 'relative'};
-  `}
-`;
-Wrapper.displayName = 'Wrapper';
-
-const WrapperContent = styled.div<{ $globalFullScreen: boolean }>`
-  display: ${({ $globalFullScreen }) => ($globalFullScreen ? 'none' : 'block')};
-  padding-top: ${({ $globalFullScreen, theme }) =>
-    $globalFullScreen ? theme.eui.paddingSizes.s : theme.eui.paddingSizes.m};
-`;
-
-WrapperContent.displayName = 'WrapperContent';
-
-const FlexItem = styled(EuiFlexItem)`
-  min-width: 0;
-`;
-FlexItem.displayName = 'FlexItem';
-
-const FlexGroup = styled(EuiFlexGroup)<{ $hasSibling: boolean }>`
-  ${({ $hasSibling, theme }) => `
-    border-bottom: ${theme.eui.euiBorderThin};
-    margin-bottom: 1px;
-    padding-bottom: 4px;
-    padding-left: ${theme.eui.paddingSizes.l};
-    padding-right: ${theme.eui.paddingSizes.l};
-    ${$hasSibling ? `border-bottom: ${theme.eui.euiBorderThin};` : 'border-bottom-width: 0px;'}
-  `}
-`;
-FlexGroup.displayName = 'FlexGroup';
-
-interface HeaderGlobalProps {
-  hideDetectionEngine?: boolean;
-  isFixed?: boolean;
-}
-
-export const HeaderGlobal = React.memo(
-  forwardRef<HTMLDivElement, HeaderGlobalProps>(
-    ({ hideDetectionEngine = false, isFixed = true }, ref) => {
-      const { globalHeaderPortalNode } = useGlobalHeaderPortal();
-      const { globalFullScreen } = useGlobalFullScreen();
-      const { timelineFullScreen } = useTimelineFullScreen();
-      const search = useGetUrlSearch(navTabs.overview);
-      const { application, http } = useKibana().services;
-      const { navigateToApp, getUrlForApp } = application;
-      const overviewPath = useMemo(
-        () => getUrlForApp(APP_ID, { path: SecurityPageName.overview }),
-        [getUrlForApp]
-      );
-      const overviewHref = useMemo(() => getAppOverviewUrl(overviewPath, search), [
-        overviewPath,
-        search,
-      ]);
-
-      const basePath = http.basePath.get();
-      const goToOverview = useCallback(
-        (ev) => {
-          ev.preventDefault();
-          navigateToApp(`${APP_ID}:${SecurityPageName.overview}`, { path: search });
-        },
-        [navigateToApp, search]
-      );
-
-      const hasCasesReadPermissions = useGetUserCasesPermissions()?.read;
-
-      // build a list of tabs to exclude
-      const tabsToExclude = new Set<string>([
-        ...(hideDetectionEngine ? [SecurityPageName.detections] : []),
-        ...(!hasCasesReadPermissions ? [SecurityPageName.case] : []),
-      ]);
-
-      // include the tab if it is not in the set of excluded ones
-      const tabsToDisplay = pickBy((_, key) => !tabsToExclude.has(key), navTabs);
-
-      return (
-        <Wrapper ref={ref} $isFixed={isFixed}>
-          <WrapperContent $globalFullScreen={globalFullScreen ?? timelineFullScreen}>
-            <FlexGroup
-              alignItems="center"
-              $hasSibling={globalHeaderPortalNode.hasChildNodes()}
-              justifyContent="spaceBetween"
-              wrap
-            >
-              <FlexItem>
-                <EuiFlexGroup alignItems="center" responsive={false}>
-                  <FlexItem grow={false}>
-                    <LinkAnchor onClick={goToOverview} href={overviewHref}>
-                      <EuiIcon aria-label={i18n.SECURITY_SOLUTION} type="logoSecurity" size="l" />
-                    </LinkAnchor>
-                  </FlexItem>
-
-                  <FlexItem component="nav">
-                    <SiemNavigation display="condensed" navTabs={tabsToDisplay} />
-                  </FlexItem>
-                </EuiFlexGroup>
-              </FlexItem>
-              <FlexItem grow={false}>
-                <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false} wrap>
-                  {window.location.pathname.includes(APP_DETECTIONS_PATH) && (
-                    <FlexItem grow={false}>
-                      <MlPopover />
-                    </FlexItem>
-                  )}
-
-                  <FlexItem grow={false}>
-                    <EuiButtonEmpty
-                      data-test-subj="add-data"
-                      href={`${basePath}${ADD_DATA_PATH}`}
-                      iconType="plusInCircle"
-                    >
-                      {i18n.BUTTON_ADD_DATA}
-                    </EuiButtonEmpty>
-                  </FlexItem>
-                </EuiFlexGroup>
-              </FlexItem>
-            </FlexGroup>
-          </WrapperContent>
-          <OutPortal node={globalHeaderPortalNode} />
-        </Wrapper>
-      );
-    }
-  )
-);
-HeaderGlobal.displayName = 'HeaderGlobal';
diff --git a/x-pack/plugins/security_solution/public/common/components/header_global/translations.ts b/x-pack/plugins/security_solution/public/common/components/header_global/translations.ts
deleted file mode 100644
index a2a22dfe31eb96..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/header_global/translations.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const SECURITY_SOLUTION = i18n.translate(
-  'xpack.securitySolution.headerGlobal.securitySolution',
-  {
-    defaultMessage: 'Security solution',
-  }
-);
-
-export const BUTTON_ADD_DATA = i18n.translate('xpack.securitySolution.headerGlobal.buttonAddData', {
-  defaultMessage: 'Add data',
-});
diff --git a/x-pack/plugins/security_solution/public/common/components/header_page/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/header_page/__snapshots__/index.test.tsx.snap
index 84c8971e3d352f..9cb9f28612b155 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_page/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/header_page/__snapshots__/index.test.tsx.snap
@@ -1,14 +1,12 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
 exports[`HeaderPage it renders 1`] = `
-<Header
-  border={true}
->
-  <EuiFlexGroup
+<Fragment>
+  <EuiPageHeader
     alignItems="center"
-    justifyContent="spaceBetween"
+    bottomBorder={true}
   >
-    <FlexItem>
+    <EuiPageHeaderSection>
       <Memo(TitleComponent)
         badgeOptions={
           Object {
@@ -27,18 +25,20 @@ exports[`HeaderPage it renders 1`] = `
         data-test-subj="header-page-subtitle-2"
         items="Test subtitle 2"
       />
-    </FlexItem>
-    <FlexItem
+    </EuiPageHeaderSection>
+    <EuiPageHeaderSection
       data-test-subj="header-page-supplements"
-      grow={false}
     >
       <p>
         Test supplement
       </p>
-    </FlexItem>
-  </EuiFlexGroup>
-  <Sourcerer
-    scope="default"
+    </EuiPageHeaderSection>
+    <Sourcerer
+      scope="default"
+    />
+  </EuiPageHeader>
+  <EuiSpacer
+    size="l"
   />
-</Header>
+</Fragment>
 `;
diff --git a/x-pack/plugins/security_solution/public/common/components/header_page/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/header_page/index.test.tsx
index 78bac02585b9f5..8a1748de582c43 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_page/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/header_page/index.test.tsx
@@ -57,7 +57,7 @@ describe('HeaderPage', () => {
       </TestProviders>
     );
 
-    expect(wrapper.find('.siemHeaderPage__linkBack').first().exists()).toBe(true);
+    expect(wrapper.find('.securitySolutionHeaderPage__linkBack').first().exists()).toBe(true);
   });
 
   test('it DOES NOT render the back link when not provided', () => {
@@ -67,7 +67,7 @@ describe('HeaderPage', () => {
       </TestProviders>
     );
 
-    expect(wrapper.find('.siemHeaderPage__linkBack').first().exists()).toBe(false);
+    expect(wrapper.find('.securitySolutionHeaderPage__linkBack').first().exists()).toBe(false);
   });
 
   test('it renders the first subtitle when provided', () => {
@@ -134,27 +134,21 @@ describe('HeaderPage', () => {
     expect(wrapper.find('[data-test-subj="header-page-supplements"]').first().exists()).toBe(false);
   });
 
-  test('it applies border styles when border is true', () => {
-    const wrapper = mount(
-      <TestProviders>
-        <HeaderPage border title="Test title" />
-      </TestProviders>
-    );
-    const siemHeaderPage = wrapper.find('.siemHeaderPage').first();
-
-    expect(siemHeaderPage).toHaveStyleRule('border-bottom', euiDarkVars.euiBorderThin);
-    expect(siemHeaderPage).toHaveStyleRule('padding-bottom', euiDarkVars.paddingSizes.l);
-  });
-
   test('it DOES NOT apply border styles when border is false', () => {
     const wrapper = mount(
       <TestProviders>
         <HeaderPage title="Test title" />
       </TestProviders>
     );
-    const siemHeaderPage = wrapper.find('.siemHeaderPage').first();
+    const securitySolutionHeaderPage = wrapper.find('.securitySolutionHeaderPage').first();
 
-    expect(siemHeaderPage).not.toHaveStyleRule('border-bottom', euiDarkVars.euiBorderThin);
-    expect(siemHeaderPage).not.toHaveStyleRule('padding-bottom', euiDarkVars.paddingSizes.l);
+    expect(securitySolutionHeaderPage).not.toHaveStyleRule(
+      'border-bottom',
+      euiDarkVars.euiBorderThin
+    );
+    expect(securitySolutionHeaderPage).not.toHaveStyleRule(
+      'padding-bottom',
+      euiDarkVars.paddingSizes.l
+    );
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/header_page/index.tsx b/x-pack/plugins/security_solution/public/common/components/header_page/index.tsx
index d01869bb6999b0..1c87d70c0c7cb1 100644
--- a/x-pack/plugins/security_solution/public/common/components/header_page/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/header_page/index.tsx
@@ -5,7 +5,13 @@
  * 2.0.
  */
 
-import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiProgress } from '@elastic/eui';
+import {
+  EuiBadge,
+  EuiProgress,
+  EuiPageHeader,
+  EuiPageHeaderSection,
+  EuiSpacer,
+} from '@elastic/eui';
 import React, { useCallback } from 'react';
 import { useHistory } from 'react-router-dom';
 import styled, { css } from 'styled-components';
@@ -25,36 +31,16 @@ interface HeaderProps {
 }
 
 const Header = styled.header.attrs({
-  className: 'siemHeaderPage',
+  className: 'securitySolutionHeaderPage',
 })<HeaderProps>`
   ${({ border, theme }) => css`
     margin-bottom: ${theme.eui.euiSizeL};
-
-    ${border &&
-    css`
-      border-bottom: ${theme.eui.euiBorderThin};
-      padding-bottom: ${theme.eui.paddingSizes.l};
-      .euiProgress {
-        top: ${theme.eui.paddingSizes.l};
-      }
-    `}
   `}
 `;
 Header.displayName = 'Header';
 
-const FlexItem = styled(EuiFlexItem)`
-  ${({ theme }) => css`
-    display: block;
-
-    @media only screen and (min-width: ${theme.eui.euiBreakpoints.m}) {
-      max-width: 50%;
-    }
-  `}
-`;
-FlexItem.displayName = 'FlexItem';
-
 const LinkBack = styled.div.attrs({
-  className: 'siemHeaderPage__linkBack',
+  className: 'securitySolutionHeaderPage__linkBack',
 })`
   ${({ theme }) => css`
     font-size: ${theme.eui.euiFontSizeXS};
@@ -117,9 +103,9 @@ const HeaderPageComponent: React.FC<HeaderPageProps> = ({
     [backOptions, history]
   );
   return (
-    <Header border={border} {...rest}>
-      <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
-        <FlexItem>
+    <>
+      <EuiPageHeader alignItems="center" bottomBorder={border}>
+        <EuiPageHeaderSection>
           {backOptions && (
             <LinkBack>
               <LinkIcon
@@ -146,16 +132,18 @@ const HeaderPageComponent: React.FC<HeaderPageProps> = ({
           {subtitle && <Subtitle data-test-subj="header-page-subtitle" items={subtitle} />}
           {subtitle2 && <Subtitle data-test-subj="header-page-subtitle-2" items={subtitle2} />}
           {border && isLoading && <EuiProgress size="xs" color="accent" />}
-        </FlexItem>
+        </EuiPageHeaderSection>
 
         {children && (
-          <FlexItem data-test-subj="header-page-supplements" grow={false}>
+          <EuiPageHeaderSection data-test-subj="header-page-supplements">
             {children}
-          </FlexItem>
+          </EuiPageHeaderSection>
         )}
-      </EuiFlexGroup>
-      {!hideSourcerer && <Sourcerer scope={SourcererScopeName.default} />}
-    </Header>
+        {!hideSourcerer && <Sourcerer scope={SourcererScopeName.default} />}
+      </EuiPageHeader>
+      {/* Manually add a 'padding-bottom' to header */}
+      <EuiSpacer size="l" />
+    </>
   );
 };
 
diff --git a/x-pack/plugins/security_solution/public/common/components/item_details_card/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/item_details_card/__snapshots__/index.test.tsx.snap
index c7841f6d6bbcc2..f0fd8427140df2 100644
--- a/x-pack/plugins/security_solution/public/common/components/item_details_card/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/item_details_card/__snapshots__/index.test.tsx.snap
@@ -14,6 +14,7 @@ exports[`item_details_card ItemDetailsAction should render correctly 1`] = `
 
 exports[`item_details_card ItemDetailsCard should render correctly with actions 1`] = `
 <EuiPanel
+  hasBorder={true}
   paddingSize="none"
 >
   <EuiFlexGroup
@@ -115,6 +116,7 @@ exports[`item_details_card ItemDetailsCard should render correctly with actions
 
 exports[`item_details_card ItemDetailsCard should render correctly with no actions 1`] = `
 <EuiPanel
+  hasBorder={true}
   paddingSize="none"
 >
   <EuiFlexGroup
diff --git a/x-pack/plugins/security_solution/public/common/components/item_details_card/index.tsx b/x-pack/plugins/security_solution/public/common/components/item_details_card/index.tsx
index 47fe9dc175ce63..ea53777e590758 100644
--- a/x-pack/plugins/security_solution/public/common/components/item_details_card/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/item_details_card/index.tsx
@@ -112,7 +112,7 @@ export const ItemDetailsCard = memo<ItemDetailsCardProps>(
     );
 
     return (
-      <EuiPanel paddingSize="none" data-test-subj={dataTestSubj} className={className}>
+      <EuiPanel paddingSize="none" data-test-subj={dataTestSubj} className={className} hasBorder>
         <EuiFlexGroup direction="row">
           <SummarySection grow={2}>
             <EuiDescriptionList compressed type="column">
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
index 561805217e8a14..cc6ac5355f90b8 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
@@ -5,7 +5,13 @@
  * 2.0.
  */
 
-import { EuiButtonEmpty, EuiCallOut, EuiPopover, EuiPopoverTitle, EuiSpacer } from '@elastic/eui';
+import {
+  EuiHeaderSectionItemButton,
+  EuiCallOut,
+  EuiPopover,
+  EuiPopoverTitle,
+  EuiSpacer,
+} from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import moment from 'moment';
 import React, { Dispatch, useCallback, useReducer, useState } from 'react';
@@ -115,14 +121,19 @@ export const MlPopover = React.memo(() => {
         anchorPosition="downRight"
         id="integrations-popover"
         button={
-          <EuiButtonEmpty
+          <EuiHeaderSectionItemButton
+            aria-expanded={isPopoverOpen}
+            aria-haspopup="true"
+            aria-label={i18n.ML_JOB_SETTINGS}
+            color="primary"
             data-test-subj="integrations-button"
             iconType="arrowDown"
             iconSide="right"
             onClick={() => setIsPopoverOpen(!isPopoverOpen)}
+            textProps={{ style: { fontSize: '1rem' } }}
           >
             {i18n.ML_JOB_SETTINGS}
-          </EuiButtonEmpty>
+          </EuiHeaderSectionItemButton>
         }
         isOpen={isPopoverOpen}
         closePopover={() => setIsPopoverOpen(!isPopoverOpen)}
@@ -138,7 +149,11 @@ export const MlPopover = React.memo(() => {
         anchorPosition="downRight"
         id="integrations-popover"
         button={
-          <EuiButtonEmpty
+          <EuiHeaderSectionItemButton
+            aria-expanded={isPopoverOpen}
+            aria-haspopup="true"
+            aria-label={i18n.ML_JOB_SETTINGS}
+            color="primary"
             data-test-subj="integrations-button"
             iconType="arrowDown"
             iconSide="right"
@@ -146,9 +161,10 @@ export const MlPopover = React.memo(() => {
               setIsPopoverOpen(!isPopoverOpen);
               dispatch({ type: 'refresh' });
             }}
+            textProps={{ style: { fontSize: '1rem' } }}
           >
             {i18n.ML_JOB_SETTINGS}
-          </EuiButtonEmpty>
+          </EuiHeaderSectionItemButton>
         }
         isOpen={isPopoverOpen}
         closePopover={() => setIsPopoverOpen(!isPopoverOpen)}
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
index 27db326dddec5c..c75b38e03acb46 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/index.test.tsx
@@ -9,12 +9,12 @@ import { mount } from 'enzyme';
 import React from 'react';
 
 import { CONSTANTS } from '../url_state/constants';
-import { SiemNavigationComponent } from './';
+import { TabNavigationComponent } from './';
 import { setBreadcrumbs } from './breadcrumbs';
 import { navTabs } from '../../../app/home/home_navigations';
 import { HostsTableType } from '../../../hosts/store/model';
 import { RouteSpyState } from '../../utils/route/types';
-import { SiemNavigationProps, SiemNavigationComponentProps } from './types';
+import { TabNavigationComponentProps, SecuritySolutionTabNavigationProps } from './types';
 import { TimelineTabs } from '../../../../common/types/timeline';
 
 jest.mock('react-router-dom', () => {
@@ -48,7 +48,9 @@ jest.mock('../../lib/kibana', () => {
 jest.mock('../link_to');
 
 describe('SIEM Navigation', () => {
-  const mockProps: SiemNavigationComponentProps & SiemNavigationProps & RouteSpyState = {
+  const mockProps: TabNavigationComponentProps &
+    SecuritySolutionTabNavigationProps &
+    RouteSpyState = {
     pageName: 'hosts',
     pathName: '/',
     detailName: undefined,
@@ -89,7 +91,7 @@ describe('SIEM Navigation', () => {
       },
     },
   };
-  const wrapper = mount(<SiemNavigationComponent {...mockProps} />);
+  const wrapper = mount(<TabNavigationComponent {...mockProps} />);
   test('it calls setBreadcrumbs with correct path on mount', () => {
     expect(setBreadcrumbs).toHaveBeenNthCalledWith(
       1,
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/index.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/index.tsx
index 7ea0b26ae8b3b8..233b4b2cb1d029 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/index.tsx
@@ -16,75 +16,93 @@ import { useRouteSpy } from '../../utils/route/use_route_spy';
 import { makeMapStateToProps } from '../url_state/helpers';
 import { setBreadcrumbs } from './breadcrumbs';
 import { TabNavigation } from './tab_navigation';
-import { SiemNavigationProps, SiemNavigationComponentProps } from './types';
+import { TabNavigationComponentProps, SecuritySolutionTabNavigationProps } from './types';
 
-export const SiemNavigationComponent: React.FC<
-  SiemNavigationComponentProps & SiemNavigationProps & RouteSpyState
-> = ({
-  detailName,
-  display,
-  navTabs,
-  pageName,
-  pathName,
-  search,
-  tabName,
-  urlState,
-  flowTarget,
-  state,
-}) => {
-  const {
-    chrome,
-    application: { getUrlForApp },
-  } = useKibana().services;
+/**
+ * @description - This component handels all of the tab navigation seen within a Security Soluton application page, not the Security Solution primary side navigation
+ * For the primary side nav see './use_security_solution_navigation'
+ */
+export const TabNavigationComponent: React.FC<
+  RouteSpyState & SecuritySolutionTabNavigationProps & TabNavigationComponentProps
+> = React.memo(
+  ({
+    detailName,
+    display,
+    flowTarget,
+    navTabs,
+    pageName,
+    pathName,
+    search,
+    state,
+    tabName,
+    urlState,
+  }) => {
+    const {
+      chrome,
+      application: { getUrlForApp },
+    } = useKibana().services;
 
-  useEffect(() => {
-    if (pathName || pageName) {
-      setBreadcrumbs(
-        {
-          detailName,
-          filters: urlState.filters,
-          flowTarget,
-          navTabs,
-          pageName,
-          pathName,
-          query: urlState.query,
-          savedQuery: urlState.savedQuery,
-          search,
-          sourcerer: urlState.sourcerer,
-          state,
-          tabName,
-          timeline: urlState.timeline,
-          timerange: urlState.timerange,
-        },
-        chrome,
-        getUrlForApp
-      );
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [chrome, pageName, pathName, search, navTabs, urlState, state]);
+    useEffect(() => {
+      if (pathName || pageName) {
+        setBreadcrumbs(
+          {
+            detailName,
+            filters: urlState.filters,
+            flowTarget,
+            navTabs,
+            pageName,
+            pathName,
+            query: urlState.query,
+            savedQuery: urlState.savedQuery,
+            search,
+            sourcerer: urlState.sourcerer,
+            state,
+            tabName,
+            timeline: urlState.timeline,
+            timerange: urlState.timerange,
+          },
+          chrome,
+          getUrlForApp
+        );
+      }
+    }, [
+      chrome,
+      pageName,
+      pathName,
+      search,
+      navTabs,
+      urlState,
+      state,
+      detailName,
+      flowTarget,
+      tabName,
+      getUrlForApp,
+    ]);
 
-  return (
-    <TabNavigation
-      query={urlState.query}
-      display={display}
-      filters={urlState.filters}
-      navTabs={navTabs}
-      pageName={pageName}
-      pathName={pathName}
-      sourcerer={urlState.sourcerer}
-      savedQuery={urlState.savedQuery}
-      tabName={tabName}
-      timeline={urlState.timeline}
-      timerange={urlState.timerange}
-    />
-  );
-};
+    return (
+      <TabNavigation
+        query={urlState.query}
+        display={display}
+        filters={urlState.filters}
+        navTabs={navTabs}
+        pageName={pageName}
+        pathName={pathName}
+        sourcerer={urlState.sourcerer}
+        savedQuery={urlState.savedQuery}
+        tabName={tabName}
+        timeline={urlState.timeline}
+        timerange={urlState.timerange}
+      />
+    );
+  }
+);
+TabNavigationComponent.displayName = 'TabNavigationComponent';
 
-export const SiemNavigationRedux = compose<
-  React.ComponentClass<SiemNavigationProps & RouteSpyState>
+export const SecuritySolutionTabNavigationRedux = compose<
+  React.ComponentClass<SecuritySolutionTabNavigationProps & RouteSpyState>
 >(connect(makeMapStateToProps))(
   React.memo(
-    SiemNavigationComponent,
+    TabNavigationComponent,
     (prevProps, nextProps) =>
       prevProps.pathName === nextProps.pathName &&
       prevProps.search === nextProps.search &&
@@ -94,16 +112,16 @@ export const SiemNavigationRedux = compose<
   )
 );
 
-const SiemNavigationContainer: React.FC<SiemNavigationProps> = (props) => {
-  const [routeProps] = useRouteSpy();
-  const stateNavReduxProps: RouteSpyState & SiemNavigationProps = {
-    ...routeProps,
-    ...props,
-  };
-
-  return <SiemNavigationRedux {...stateNavReduxProps} />;
-};
+export const SecuritySolutionTabNavigation: React.FC<SecuritySolutionTabNavigationProps> = React.memo(
+  (props) => {
+    const [routeProps] = useRouteSpy();
+    const stateNavReduxProps: RouteSpyState & SecuritySolutionTabNavigationProps = {
+      ...routeProps,
+      ...props,
+    };
 
-export const SiemNavigation = React.memo(SiemNavigationContainer, (prevProps, nextProps) =>
-  deepEqual(prevProps.navTabs, nextProps.navTabs)
+    return <SecuritySolutionTabNavigationRedux {...stateNavReduxProps} />;
+  },
+  (prevProps, nextProps) => deepEqual(prevProps.navTabs, nextProps.navTabs)
 );
+SecuritySolutionTabNavigation.displayName = 'SecuritySolutionTabNavigation';
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
index 4253d08d1ed197..53565d79e6948a 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
@@ -7,17 +7,17 @@
 
 import { UrlInputsModel } from '../../../store/inputs/model';
 import { CONSTANTS } from '../../url_state/constants';
-import { HostsTableType } from '../../../../hosts/store/model';
 import { SourcererScopePatterns } from '../../../store/sourcerer/model';
 import { TimelineUrl } from '../../../../timelines/store/timeline/model';
 import { Filter, Query } from '../../../../../../../../src/plugins/data/public';
 
-import { SiemNavigationProps } from '../types';
+import { SecuritySolutionTabNavigationProps } from '../types';
+import { SiemRouteType } from '../../../utils/route/types';
 
-export interface TabNavigationProps extends SiemNavigationProps {
+export interface TabNavigationProps extends SecuritySolutionTabNavigationProps {
   pathName: string;
   pageName: string;
-  tabName: HostsTableType | undefined;
+  tabName: SiemRouteType | undefined;
   [CONSTANTS.appQuery]?: Query;
   [CONSTANTS.filters]?: Filter[];
   [CONSTANTS.savedQuery]?: string;
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/types.ts b/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
index 9700afcb8cd59e..1c317700b1d150 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/types.ts
@@ -5,31 +5,20 @@
  * 2.0.
  */
 
-import { Filter, Query } from '../../../../../../../src/plugins/data/public';
-import { HostsTableType } from '../../../hosts/store/model';
-import { UrlInputsModel } from '../../store/inputs/model';
-import { TimelineUrl } from '../../../timelines/store/timeline/model';
-import { CONSTANTS, UrlStateType } from '../url_state/constants';
+import { UrlStateType } from '../url_state/constants';
 import { SecurityPageName } from '../../../app/types';
-import { SourcererScopePatterns } from '../../store/sourcerer/model';
+import { UrlState } from '../url_state/types';
+import { SiemRouteType } from '../../utils/route/types';
 
-export interface SiemNavigationProps {
+export interface SecuritySolutionTabNavigationProps {
   display?: 'default' | 'condensed';
   navTabs: Record<string, NavTab>;
 }
-
-export interface SiemNavigationComponentProps {
-  pathName: string;
+export interface TabNavigationComponentProps {
   pageName: string;
-  tabName: HostsTableType | undefined;
-  urlState: {
-    [CONSTANTS.appQuery]?: Query;
-    [CONSTANTS.filters]?: Filter[];
-    [CONSTANTS.savedQuery]?: string;
-    [CONSTANTS.sourcerer]: SourcererScopePatterns;
-    [CONSTANTS.timerange]: UrlInputsModel;
-    [CONSTANTS.timeline]: TimelineUrl;
-  };
+  tabName: SiemRouteType | undefined;
+  urlState: UrlState;
+  pathName: string;
 }
 
 export type SearchNavTab = NavTab | { urlKey: UrlStateType; isDetailPage: boolean };
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx
new file mode 100644
index 00000000000000..48d3cfb5abcc14
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx
@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { renderHook } from '@testing-library/react-hooks';
+import { KibanaPageTemplateProps } from '../../../../../../../../src/plugins/kibana_react/public';
+import { useGetUserCasesPermissions, useKibana } from '../../../lib/kibana';
+import { SecurityPageName } from '../../../../app/types';
+import { useSecuritySolutionNavigation } from '.';
+import { CONSTANTS } from '../../url_state/constants';
+import { TimelineTabs } from '../../../../../common/types/timeline';
+import { useDeepEqualSelector } from '../../../hooks/use_selector';
+import { UrlInputsModel } from '../../../store/inputs/model';
+import { useRouteSpy } from '../../../utils/route/use_route_spy';
+
+jest.mock('../../../lib/kibana');
+jest.mock('../../../hooks/use_selector');
+jest.mock('../../../utils/route/use_route_spy');
+
+describe('useSecuritySolutionNavigation', () => {
+  const mockUrlState = {
+    [CONSTANTS.appQuery]: { query: 'host.name:"security-solution-es"', language: 'kuery' },
+    [CONSTANTS.savedQuery]: '',
+    [CONSTANTS.sourcerer]: {},
+    [CONSTANTS.timeline]: {
+      activeTab: TimelineTabs.query,
+      id: '',
+      isOpen: false,
+      graphEventId: '',
+    },
+    [CONSTANTS.timerange]: {
+      global: {
+        [CONSTANTS.timerange]: {
+          from: '2020-07-07T08:20:18.966Z',
+          fromStr: 'now-24h',
+          kind: 'relative',
+          to: '2020-07-08T08:20:18.966Z',
+          toStr: 'now',
+        },
+        linkTo: ['timeline'],
+      },
+      timeline: {
+        [CONSTANTS.timerange]: {
+          from: '2020-07-07T08:20:18.966Z',
+          fromStr: 'now-24h',
+          kind: 'relative',
+          to: '2020-07-08T08:20:18.966Z',
+          toStr: 'now',
+        },
+        linkTo: ['global'],
+      },
+    } as UrlInputsModel,
+  };
+
+  const mockRouteSpy = [
+    {
+      detailName: '',
+      flowTarget: '',
+      pathName: '',
+      search: '',
+      state: '',
+      tabName: '',
+      pageName: SecurityPageName.hosts,
+    },
+  ];
+
+  beforeEach(() => {
+    (useDeepEqualSelector as jest.Mock).mockReturnValue({ urlState: mockUrlState });
+    (useRouteSpy as jest.Mock).mockReturnValue(mockRouteSpy);
+    (useKibana as jest.Mock).mockReturnValue({
+      services: {
+        application: {
+          navigateToApp: jest.fn(),
+          getUrlForApp: (appId: string, options?: { path?: string; absolute?: boolean }) =>
+            `${appId}${options?.path ?? ''}`,
+        },
+        chrome: {
+          setBreadcrumbs: jest.fn(),
+        },
+      },
+    });
+  });
+
+  it('should create navigation config', async () => {
+    const { result } = renderHook<{}, KibanaPageTemplateProps['solutionNav']>(() =>
+      useSecuritySolutionNavigation()
+    );
+
+    expect(result.current).toMatchInlineSnapshot(`
+      Object {
+        "icon": "logoSecurity",
+        "items": Array [
+          Object {
+            "id": "securitySolution",
+            "items": Array [
+              Object {
+                "data-href": "securitySolution:overview?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "data-test-subj": "navigation-overview",
+                "disabled": false,
+                "href": "securitySolution:overview?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "id": "overview",
+                "isSelected": false,
+                "name": "Overview",
+                "onClick": [Function],
+              },
+              Object {
+                "data-href": "securitySolution:detections?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "data-test-subj": "navigation-detections",
+                "disabled": false,
+                "href": "securitySolution:detections?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "id": "detections",
+                "isSelected": false,
+                "name": "Detections",
+                "onClick": [Function],
+              },
+              Object {
+                "data-href": "securitySolution:hosts?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "data-test-subj": "navigation-hosts",
+                "disabled": false,
+                "href": "securitySolution:hosts?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "id": "hosts",
+                "isSelected": true,
+                "name": "Hosts",
+                "onClick": [Function],
+              },
+              Object {
+                "data-href": "securitySolution:network?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "data-test-subj": "navigation-network",
+                "disabled": false,
+                "href": "securitySolution:network?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "id": "network",
+                "isSelected": false,
+                "name": "Network",
+                "onClick": [Function],
+              },
+              Object {
+                "data-href": "securitySolution:timelines?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "data-test-subj": "navigation-timelines",
+                "disabled": false,
+                "href": "securitySolution:timelines?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+                "id": "timelines",
+                "isSelected": false,
+                "name": "Timelines",
+                "onClick": [Function],
+              },
+              Object {
+                "data-href": "securitySolution:administration",
+                "data-test-subj": "navigation-administration",
+                "disabled": false,
+                "href": "securitySolution:administration",
+                "id": "administration",
+                "isSelected": false,
+                "name": "Administration",
+                "onClick": [Function],
+              },
+            ],
+            "name": "",
+          },
+        ],
+        "name": "Security",
+      }
+    `);
+  });
+
+  describe('Permission gated routes', () => {
+    describe('cases', () => {
+      it('should display the cases navigation item when the user has read permissions', () => {
+        (useGetUserCasesPermissions as jest.Mock).mockReturnValue({
+          crud: true,
+          read: true,
+        });
+
+        const { result } = renderHook<{}, KibanaPageTemplateProps['solutionNav']>(() =>
+          useSecuritySolutionNavigation()
+        );
+
+        const caseNavItem = result.current?.items[0].items?.find(
+          (item) => item['data-test-subj'] === 'navigation-case'
+        );
+        expect(caseNavItem).toMatchInlineSnapshot(`
+          Object {
+            "data-href": "securitySolution:case?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+            "data-test-subj": "navigation-case",
+            "disabled": false,
+            "href": "securitySolution:case?query=(language:kuery,query:'host.name:%22security-solution-es%22')&sourcerer=()&timerange=(global:(linkTo:!(timeline),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)),timeline:(linkTo:!(global),timerange:(from:'2020-07-07T08:20:18.966Z',fromStr:now-24h,kind:relative,to:'2020-07-08T08:20:18.966Z',toStr:now)))",
+            "id": "case",
+            "isSelected": false,
+            "name": "Cases",
+            "onClick": [Function],
+          }
+        `);
+      });
+
+      it('should not display the cases navigation item when the user does not have read permissions', () => {
+        (useGetUserCasesPermissions as jest.Mock).mockReturnValue({
+          crud: false,
+          read: false,
+        });
+
+        const { result } = renderHook<{}, KibanaPageTemplateProps['solutionNav']>(() =>
+          useSecuritySolutionNavigation()
+        );
+
+        const caseNavItem = result.current?.items[0].items?.find(
+          (item) => item['data-test-subj'] === 'navigation-case'
+        );
+        expect(caseNavItem).toBeFalsy();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.tsx
new file mode 100644
index 00000000000000..f2aee86912dd7a
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/index.tsx
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useEffect } from 'react';
+import { pickBy } from 'lodash/fp';
+import { usePrimaryNavigation } from './use_primary_navigation';
+import { useGetUserCasesPermissions, useKibana } from '../../../lib/kibana';
+import { setBreadcrumbs } from '../breadcrumbs';
+import { makeMapStateToProps } from '../../url_state/helpers';
+import { useRouteSpy } from '../../../utils/route/use_route_spy';
+import { navTabs } from '../../../../app/home/home_navigations';
+import { useDeepEqualSelector } from '../../../hooks/use_selector';
+import { SecurityPageName } from '../../../../../common/constants';
+
+/**
+ * @description - This hook provides the structure necessary by the KibanaPageTemplate for rendering the primary security_solution side navigation.
+ * TODO: Consolidate & re-use the logic in the hooks in this directory that are replicated from the tab_navigation to maintain breadcrumbs, telemetry, etc...
+ */
+export const useSecuritySolutionNavigation = () => {
+  const [routeProps] = useRouteSpy();
+  const urlMapState = makeMapStateToProps();
+  const { urlState } = useDeepEqualSelector(urlMapState);
+  const {
+    chrome,
+    application: { getUrlForApp },
+  } = useKibana().services;
+
+  const { detailName, flowTarget, pageName, pathName, search, state, tabName } = routeProps;
+
+  useEffect(() => {
+    if (pathName || pageName) {
+      setBreadcrumbs(
+        {
+          detailName,
+          filters: urlState.filters,
+          flowTarget,
+          navTabs,
+          pageName,
+          pathName,
+          query: urlState.query,
+          savedQuery: urlState.savedQuery,
+          search,
+          sourcerer: urlState.sourcerer,
+          state,
+          tabName,
+          timeline: urlState.timeline,
+          timerange: urlState.timerange,
+        },
+        chrome,
+        getUrlForApp
+      );
+    }
+  }, [
+    chrome,
+    pageName,
+    pathName,
+    search,
+    urlState,
+    state,
+    detailName,
+    flowTarget,
+    tabName,
+    getUrlForApp,
+  ]);
+
+  const hasCasesReadPermissions = useGetUserCasesPermissions()?.read;
+
+  // build a list of tabs to exclude
+  const tabsToExclude = new Set<string>([
+    ...(!hasCasesReadPermissions ? [SecurityPageName.case] : []),
+  ]);
+
+  // include the tab if it is not in the set of excluded ones
+  const tabsToDisplay = pickBy((_, key) => !tabsToExclude.has(key), navTabs);
+
+  return usePrimaryNavigation({
+    query: urlState.query,
+    filters: urlState.filters,
+    navTabs: tabsToDisplay,
+    pageName,
+    sourcerer: urlState.sourcerer,
+    savedQuery: urlState.savedQuery,
+    timeline: urlState.timeline,
+    timerange: urlState.timerange,
+  });
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/types.ts b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/types.ts
new file mode 100644
index 00000000000000..f639b8a37f0da4
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/types.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TabNavigationProps } from '../tab_navigation/types';
+
+export type PrimaryNavigationItemsProps = Omit<
+  TabNavigationProps,
+  'pathName' | 'pageName' | 'tabName'
+> & { selectedTabId: string };
+
+export type PrimaryNavigationProps = Omit<TabNavigationProps, 'pathName' | 'tabName'>;
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx
new file mode 100644
index 00000000000000..42ca7f4c65460e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_navigation_items.tsx
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { APP_ID } from '../../../../../common/constants';
+import { track, METRIC_TYPE, TELEMETRY_EVENT } from '../../../lib/telemetry';
+import { getSearch } from '../helpers';
+import { PrimaryNavigationItemsProps } from './types';
+import { useKibana } from '../../../lib/kibana';
+
+export const usePrimaryNavigationItems = ({
+  filters,
+  navTabs,
+  query,
+  savedQuery,
+  selectedTabId,
+  sourcerer,
+  timeline,
+  timerange,
+}: PrimaryNavigationItemsProps) => {
+  const { navigateToApp, getUrlForApp } = useKibana().services.application;
+
+  const navItems = Object.values(navTabs).map((tab) => {
+    const { id, name, disabled } = tab;
+    const isSelected = selectedTabId === id;
+    const urlSearch = getSearch(tab, {
+      filters,
+      query,
+      savedQuery,
+      sourcerer,
+      timeline,
+      timerange,
+    });
+
+    const handleClick = (ev: React.MouseEvent) => {
+      ev.preventDefault();
+      navigateToApp(`${APP_ID}:${id}`, { path: urlSearch });
+      track(METRIC_TYPE.CLICK, `${TELEMETRY_EVENT.TAB_CLICKED}${id}`);
+    };
+
+    const appHref = getUrlForApp(`${APP_ID}:${id}`, { path: urlSearch });
+
+    return {
+      'data-href': appHref,
+      'data-test-subj': `navigation-${id}`,
+      disabled,
+      href: appHref,
+      id,
+      isSelected,
+      name,
+      onClick: handleClick,
+    };
+  });
+
+  return [
+    {
+      id: APP_ID, // TODO: When separating into sub-sections (detect, explore, investigate). Those names can also serve as the section id
+      items: navItems,
+      name: '',
+    },
+  ];
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_primary_navigation.tsx b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_primary_navigation.tsx
new file mode 100644
index 00000000000000..390f44b48b0b17
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/use_security_solution_navigation/use_primary_navigation.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getOr } from 'lodash/fp';
+import { useEffect, useState, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+
+import { PrimaryNavigationProps } from './types';
+import { usePrimaryNavigationItems } from './use_navigation_items';
+import { KibanaPageTemplateProps } from '../../../../../../../../src/plugins/kibana_react/public';
+
+const translatedNavTitle = i18n.translate('xpack.securitySolution.navigation.mainLabel', {
+  defaultMessage: 'Security',
+});
+
+export const usePrimaryNavigation = ({
+  filters,
+  query,
+  navTabs,
+  pageName,
+  savedQuery,
+  sourcerer,
+  timeline,
+  timerange,
+}: PrimaryNavigationProps): KibanaPageTemplateProps['solutionNav'] => {
+  const mapLocationToTab = useCallback(
+    (): string =>
+      getOr(
+        '',
+        'id',
+        Object.values(navTabs).find((item) => pageName === item.id && item.pageId == null)
+      ),
+    [pageName, navTabs]
+  );
+
+  const [selectedTabId, setSelectedTabId] = useState(mapLocationToTab());
+
+  useEffect(() => {
+    const currentTabSelected = mapLocationToTab();
+
+    if (currentTabSelected !== selectedTabId) {
+      setSelectedTabId(currentTabSelected);
+    }
+
+    // we do need navTabs in case the selectedTabId appears after initial load (ex. checking permissions for anomalies)
+  }, [pageName, navTabs, mapLocationToTab, selectedTabId]);
+
+  const navItems = usePrimaryNavigationItems({
+    filters,
+    navTabs,
+    query,
+    savedQuery,
+    selectedTabId,
+    sourcerer,
+    timeline,
+    timerange,
+  });
+
+  return {
+    name: translatedNavTitle,
+    icon: 'logoSecurity',
+    items: navItems,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/components/page/index.tsx b/x-pack/plugins/security_solution/public/common/components/page/index.tsx
index 30b89086fb99cb..051c1bd8ae5cb8 100644
--- a/x-pack/plugins/security_solution/public/common/components/page/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/page/index.tsx
@@ -5,14 +5,10 @@
  * 2.0.
  */
 
-import { EuiBadge, EuiDescriptionList, EuiFlexGroup, EuiIcon, EuiPage } from '@elastic/eui';
+import { EuiBadge, EuiDescriptionList, EuiFlexGroup, EuiIcon } from '@elastic/eui';
 import styled, { createGlobalStyle } from 'styled-components';
 
-import {
-  GLOBAL_HEADER_HEIGHT,
-  FULL_SCREEN_TOGGLED_CLASS_NAME,
-  SCROLLING_DISABLED_CLASS_NAME,
-} from '../../../../common/constants';
+import { FULL_SCREEN_TOGGLED_CLASS_NAME } from '../../../../common/constants';
 
 export const SecuritySolutionAppWrapper = styled.div`
   display: flex;
@@ -27,25 +23,6 @@ SecuritySolutionAppWrapper.displayName = 'SecuritySolutionAppWrapper';
   and `EuiPopover`, `EuiToolTip` global styles
 */
 export const AppGlobalStyle = createGlobalStyle<{ theme: { eui: { euiColorPrimary: string } } }>`
-  // fixes double scrollbar on views with EventsTable
-  #kibana-body {
-    overflow: hidden;
-  }
-
-  div.kbnAppWrapper {
-    background-color: rgba(0,0,0,0);
-  }
-
-  div.application {
-    background-color: rgba(0,0,0,0);
-
-    // Security App wrapper
-    > div {
-      display: flex;
-      flex: 1 1 auto;
-    }
-  }
-
   .euiPopover__panel.euiPopover__panel-isOpen {
     z-index: 9900 !important;
     min-width: 24px;
@@ -82,10 +59,6 @@ export const AppGlobalStyle = createGlobalStyle<{ theme: { eui: { euiColorPrimar
     ${({ theme }) => `background-color: ${theme.eui.euiColorPrimary} !important`};
   }
 
-  .${SCROLLING_DISABLED_CLASS_NAME} ${SecuritySolutionAppWrapper} {
-    max-height: calc(100vh - ${GLOBAL_HEADER_HEIGHT}px);
-  }
-
   /*
      EuiScreenReaderOnly has a default 1px height and width. These extra pixels
      were adding additional height to every table row in the alerts table on the
@@ -122,96 +95,6 @@ export const DescriptionListStyled = styled(EuiDescriptionList)`
 
 DescriptionListStyled.displayName = 'DescriptionListStyled';
 
-export const PageContainer = styled.div`
-  display: flex;
-  flex-direction: column;
-  align-items: stretch;
-  background-color: ${(props) => props.theme.eui.euiColorEmptyShade};
-  height: 100%;
-  padding: 1rem;
-  overflow: hidden;
-  margin: 0px;
-`;
-
-PageContainer.displayName = 'PageContainer';
-
-export const PageContent = styled.div`
-  flex: 1 1 auto;
-  height: 100%;
-  position: relative;
-  overflow-y: hidden;
-  background-color: ${(props) => props.theme.eui.euiColorEmptyShade};
-  margin-top: 62px;
-`;
-
-PageContent.displayName = 'PageContent';
-
-export const FlexPage = styled(EuiPage)`
-  flex: 1 0 0;
-`;
-
-FlexPage.displayName = 'FlexPage';
-
-export const PageHeader = styled.div`
-  background-color: ${(props) => props.theme.eui.euiColorEmptyShade};
-  display: flex;
-  user-select: none;
-  padding: 1rem 1rem 0rem 1rem;
-  width: 100vw;
-  position: fixed;
-`;
-
-PageHeader.displayName = 'PageHeader';
-
-export const FooterContainer = styled.div`
-  flex: 0;
-  bottom: 0;
-  color: #666;
-  left: 0;
-  position: fixed;
-  text-align: left;
-  user-select: none;
-  width: 100%;
-  background-color: #f5f7fa;
-  padding: 16px;
-  border-top: 1px solid #d3dae6;
-`;
-
-FooterContainer.displayName = 'FooterContainer';
-
-export const PaneScrollContainer = styled.div`
-  height: 100%;
-  overflow-y: scroll;
-  > div:last-child {
-    margin-bottom: 3rem;
-  }
-`;
-
-PaneScrollContainer.displayName = 'PaneScrollContainer';
-
-export const Pane = styled.div`
-  height: 100%;
-  overflow: hidden;
-  user-select: none;
-`;
-
-Pane.displayName = 'Pane';
-
-export const PaneHeader = styled.div`
-  display: flex;
-`;
-
-PaneHeader.displayName = 'PaneHeader';
-
-export const Pane1FlexContent = styled.div`
-  display: flex;
-  flex-direction: row;
-  flex-wrap: wrap;
-  height: 100%;
-`;
-
-Pane1FlexContent.displayName = 'Pane1FlexContent';
-
 export const CountBadge = (styled(EuiBadge)`
   margin-left: 5px;
 ` as unknown) as typeof EuiBadge;
diff --git a/x-pack/plugins/security_solution/public/common/components/page_wrapper/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/page_wrapper/__snapshots__/index.test.tsx.snap
new file mode 100644
index 00000000000000..5da587f23693b8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/page_wrapper/__snapshots__/index.test.tsx.snap
@@ -0,0 +1,9 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`SecuritySolutionPageWrapper it renders 1`] = `
+<Memo(SecuritySolutionPageWrapperComponent)>
+  <p>
+    Test page
+  </p>
+</Memo(SecuritySolutionPageWrapperComponent)>
+`;
diff --git a/x-pack/plugins/security_solution/public/common/components/wrapper_page/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/page_wrapper/index.test.tsx
similarity index 65%
rename from x-pack/plugins/security_solution/public/common/components/wrapper_page/index.test.tsx
rename to x-pack/plugins/security_solution/public/common/components/page_wrapper/index.test.tsx
index 3ec1e44205dd3f..f6ebf2a90abb4f 100644
--- a/x-pack/plugins/security_solution/public/common/components/wrapper_page/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/page_wrapper/index.test.tsx
@@ -9,18 +9,18 @@ import { shallow } from 'enzyme';
 import React from 'react';
 
 import { TestProviders } from '../../mock';
-import { WrapperPage } from './index';
+import { SecuritySolutionPageWrapper } from './index';
 
-describe('WrapperPage', () => {
+describe('SecuritySolutionPageWrapper', () => {
   test('it renders', () => {
     const wrapper = shallow(
       <TestProviders>
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <p>{'Test page'}</p>
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       </TestProviders>
     );
 
-    expect(wrapper.find('Memo(WrapperPageComponent)')).toMatchSnapshot();
+    expect(wrapper.find('Memo(SecuritySolutionPageWrapperComponent)')).toMatchSnapshot();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/wrapper_page/index.tsx b/x-pack/plugins/security_solution/public/common/components/page_wrapper/index.tsx
similarity index 68%
rename from x-pack/plugins/security_solution/public/common/components/wrapper_page/index.tsx
rename to x-pack/plugins/security_solution/public/common/components/page_wrapper/index.tsx
index a3eb76a2728bf8..82e0ded264b061 100644
--- a/x-pack/plugins/security_solution/public/common/components/wrapper_page/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/page_wrapper/index.tsx
@@ -15,30 +15,26 @@ import { gutterTimeline } from '../../lib/helpers';
 import { AppGlobalStyle } from '../page/index';
 
 const Wrapper = styled.div`
-  padding: ${(props) => `${props.theme.eui.paddingSizes.l}`};
-
-  &.siemWrapperPage--fullHeight {
+  &.securitySolutionWrapper--fullHeight {
     height: 100%;
     display: flex;
     flex-direction: column;
     flex: 1 1 auto;
   }
-
-  &.siemWrapperPage--noPadding {
+  &.securitySolutionWrapper--noPadding {
     padding: 0;
     display: flex;
     flex-direction: column;
     flex: 1 1 auto;
   }
-
-  &.siemWrapperPage--withTimeline {
+  &.securitySolutionWrapper--withTimeline {
     padding-bottom: ${gutterTimeline};
   }
 `;
 
 Wrapper.displayName = 'Wrapper';
 
-interface WrapperPageProps {
+interface SecuritySolutionPageWrapperProps {
   children: React.ReactNode;
   restrictWidth?: boolean | number | string;
   style?: Record<string, string>;
@@ -46,24 +42,19 @@ interface WrapperPageProps {
   noTimeline?: boolean;
 }
 
-const WrapperPageComponent: React.FC<WrapperPageProps & CommonProps> = ({
-  children,
-  className,
-  style,
-  noPadding,
-  noTimeline,
-  ...otherProps
-}) => {
+const SecuritySolutionPageWrapperComponent: React.FC<
+  SecuritySolutionPageWrapperProps & CommonProps
+> = ({ children, className, style, noPadding, noTimeline, ...otherProps }) => {
   const { globalFullScreen, setGlobalFullScreen } = useGlobalFullScreen();
   useEffect(() => {
     setGlobalFullScreen(false); // exit full screen mode on page load
   }, [setGlobalFullScreen]);
 
   const classes = classNames(className, {
-    siemWrapperPage: true,
-    'siemWrapperPage--noPadding': noPadding,
-    'siemWrapperPage--withTimeline': !noTimeline,
-    'siemWrapperPage--fullHeight': globalFullScreen,
+    securitySolutionWrapper: true,
+    'securitySolutionWrapper--noPadding': noPadding,
+    'securitySolutionWrapper--withTimeline': !noTimeline,
+    'securitySolutionWrapper--fullHeight': globalFullScreen,
   });
 
   return (
@@ -74,4 +65,4 @@ const WrapperPageComponent: React.FC<WrapperPageProps & CommonProps> = ({
   );
 };
 
-export const WrapperPage = React.memo(WrapperPageComponent);
+export const SecuritySolutionPageWrapper = React.memo(SecuritySolutionPageWrapperComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/panel/index.tsx b/x-pack/plugins/security_solution/public/common/components/panel/index.tsx
index 652d22409cb0c3..802fd4c7f44a60 100644
--- a/x-pack/plugins/security_solution/public/common/components/panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/panel/index.tsx
@@ -25,7 +25,7 @@ import { EuiPanel } from '@elastic/eui';
  * Ref: https://www.styled-components.com/docs/faqs#why-am-i-getting-html-attribute-warnings
  * Ref: https://reactjs.org/blog/2017/09/08/dom-attributes-in-react-16.html
  */
-export const Panel = styled(({ loading, ...props }) => <EuiPanel {...props} />)`
+export const Panel = styled(({ loading, ...props }) => <EuiPanel {...props} hasBorder />)`
   position: relative;
   ${({ loading }) =>
     loading &&
diff --git a/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx b/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
index 5b4a8f67aa3617..2d8d55a5c943f3 100644
--- a/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/stat_items/index.tsx
@@ -222,7 +222,7 @@ export const StatItemsComponent = React.memo<StatItemsProps>(
     return (
       <FlexItem grow={grow} data-test-subj={`stat-${statKey}`}>
         <InspectButtonContainer>
-          <EuiPanel>
+          <EuiPanel hasBorder>
             <EuiFlexGroup gutterSize={'none'}>
               <EuiFlexItem>
                 <EuiTitle size="xxxs">
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
index a2d5076031328c..8a7c6bcb4a9b52 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
@@ -29,7 +29,6 @@ import { SecurityPageName } from '../../../../common/constants';
 export const dispatchSetInitialStateFromUrl = (
   dispatch: Dispatch
 ): DispatchSetInitialStateFromUrl => ({
-  detailName,
   filterManager,
   indexPattern,
   pageName,
diff --git a/x-pack/plugins/security_solution/public/common/components/wrapper_page/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/wrapper_page/__snapshots__/index.test.tsx.snap
deleted file mode 100644
index 89ed2f45a6bf1f..00000000000000
--- a/x-pack/plugins/security_solution/public/common/components/wrapper_page/__snapshots__/index.test.tsx.snap
+++ /dev/null
@@ -1,9 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`WrapperPage it renders 1`] = `
-<Memo(WrapperPageComponent)>
-  <p>
-    Test page
-  </p>
-</Memo(WrapperPageComponent)>
-`;
diff --git a/x-pack/plugins/security_solution/public/common/hooks/use_global_header_portal.tsx b/x-pack/plugins/security_solution/public/common/hooks/use_global_header_portal.tsx
index 5b5877a4c2dedc..8e8d73ff12849e 100644
--- a/x-pack/plugins/security_solution/public/common/hooks/use_global_header_portal.tsx
+++ b/x-pack/plugins/security_solution/public/common/hooks/use_global_header_portal.tsx
@@ -11,10 +11,10 @@ import { createPortalNode } from 'react-reverse-portal';
 /**
  * A singleton portal for rendering content in the global header
  */
-const globalHeaderPortalNodeSingleton = createPortalNode();
+const globalKQLHeaderPortalNodeSingleton = createPortalNode();
 
 export const useGlobalHeaderPortal = () => {
-  const [globalHeaderPortalNode] = useState(globalHeaderPortalNodeSingleton);
+  const [globalKQLHeaderPortalNode] = useState(globalKQLHeaderPortalNodeSingleton);
 
-  return { globalHeaderPortalNode };
+  return { globalKQLHeaderPortalNode };
 };
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
index 91b5a106844054..d766104e356ebb 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_histogram_panel/index.tsx
@@ -298,7 +298,7 @@ export const AlertsHistogramPanel = memo<AlertsHistogramPanelProps>(
 
     return (
       <InspectButtonContainer data-test-subj="alerts-histogram-panel" show={!isInitialLoading}>
-        <StyledEuiPanel height={panelHeight}>
+        <StyledEuiPanel height={panelHeight} hasBorder>
           <HeaderSection
             id={uniqueQueryId}
             title={titleText}
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index a27368cc61c3a8..7980160fea76cd 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -358,7 +358,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
 
   if (loading || indexPatternsLoading || isEmpty(selectedPatterns)) {
     return (
-      <EuiPanel>
+      <EuiPanel hasBorder>
         <HeaderSection title="" />
         <EuiLoadingContent data-test-subj="loading-alerts-panel" />
       </EuiPanel>
diff --git a/x-pack/plugins/security_solution/public/detections/components/callouts/need_admin_for_update_callout/index.tsx b/x-pack/plugins/security_solution/public/detections/components/callouts/need_admin_for_update_callout/index.tsx
index fd0be8e0021933..3b41c9280998b3 100644
--- a/x-pack/plugins/security_solution/public/detections/components/callouts/need_admin_for_update_callout/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/callouts/need_admin_for_update_callout/index.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { memo } from 'react';
+import { EuiSpacer } from '@elastic/eui';
 import { CallOutMessage, CallOutPersistentSwitcher } from '../../../../common/components/callouts';
 import { useUserData } from '../../user_info';
 
@@ -33,20 +34,22 @@ const needAdminForUpdateRulesMessage: CallOutMessage = {
  * hasIndexManage is also true, then the user should be performing the update on the page which is
  * why we do not show it for that condition.
  */
-const NeedAdminForUpdateCallOutComponent = (): JSX.Element => {
+const NeedAdminForUpdateCallOutComponent = (): JSX.Element | null => {
   const [{ signalIndexMappingOutdated, hasIndexManage }] = useUserData();
 
   const signalIndexMappingIsOutdated =
     signalIndexMappingOutdated != null && signalIndexMappingOutdated;
 
   const userDoesntHaveIndexManage = hasIndexManage != null && !hasIndexManage;
-
-  return (
-    <CallOutPersistentSwitcher
-      condition={signalIndexMappingIsOutdated && userDoesntHaveIndexManage}
-      message={needAdminForUpdateRulesMessage}
-    />
-  );
+  const shouldShowCallout = signalIndexMappingIsOutdated && userDoesntHaveIndexManage;
+
+  // Passing shouldShowCallout to the condition param will end up with an unecessary spacer being rendered
+  return shouldShowCallout ? (
+    <>
+      <CallOutPersistentSwitcher condition={true} message={needAdminForUpdateRulesMessage} />
+      <EuiSpacer size="l" />
+    </>
+  ) : null;
 };
 
 export const NeedAdminForUpdateRulesCallOut = memo(NeedAdminForUpdateCallOutComponent);
diff --git a/x-pack/plugins/security_solution/public/detections/components/callouts/no_api_integration_callout/index.tsx b/x-pack/plugins/security_solution/public/detections/components/callouts/no_api_integration_callout/index.tsx
index f21c66380f30aa..7b483930db5053 100644
--- a/x-pack/plugins/security_solution/public/detections/components/callouts/no_api_integration_callout/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/callouts/no_api_integration_callout/index.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { EuiCallOut, EuiButton } from '@elastic/eui';
+import { EuiCallOut, EuiButton, EuiSpacer } from '@elastic/eui';
 import React, { memo, useCallback, useState } from 'react';
 
 import * as i18n from './translations';
@@ -15,12 +15,15 @@ const NoApiIntegrationKeyCallOutComponent = () => {
   const handleCallOut = useCallback(() => setShowCallOut(false), [setShowCallOut]);
 
   return showCallOut ? (
-    <EuiCallOut title={i18n.NO_API_INTEGRATION_KEY_CALLOUT_TITLE} color="danger" iconType="alert">
-      <p>{i18n.NO_API_INTEGRATION_KEY_CALLOUT_MSG}</p>
-      <EuiButton color="danger" onClick={handleCallOut}>
-        {i18n.DISMISS_CALLOUT}
-      </EuiButton>
-    </EuiCallOut>
+    <>
+      <EuiCallOut title={i18n.NO_API_INTEGRATION_KEY_CALLOUT_TITLE} color="danger" iconType="alert">
+        <p>{i18n.NO_API_INTEGRATION_KEY_CALLOUT_MSG}</p>
+        <EuiButton color="danger" onClick={handleCallOut}>
+          {i18n.DISMISS_CALLOUT}
+        </EuiButton>
+      </EuiCallOut>
+      <EuiSpacer size="l" />
+    </>
   ) : null;
 };
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.tsx
index a09afa3ca21642..c1078e1ba77e7c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule_details/index.tsx
@@ -82,7 +82,7 @@ const StepAboutRuleToggleDetailsComponent: React.FC<StepPanelProps> = ({
   );
 
   return (
-    <MyPanel>
+    <MyPanel hasBorder>
       {loading && (
         <>
           <EuiProgress size="xs" color="accent" position="absolute" />
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_panel/index.tsx
index f9e6031d826caf..ac9a153ad76bff 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_panel/index.tsx
@@ -24,7 +24,7 @@ const MyPanel = styled(EuiPanel)`
 MyPanel.displayName = 'MyPanel';
 
 const StepPanelComponent: React.FC<StepPanelProps> = ({ children, loading, title }) => (
-  <MyPanel>
+  <MyPanel hasBorder>
     {loading && <EuiProgress size="xs" color="accent" position="absolute" />}
     <HeaderSection title={title} />
     {children}
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
index dbad1c57fda77d..3d81735122e731 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.tsx
@@ -216,7 +216,7 @@ export const ValueListsModalComponent: React.FC<ValueListsModalProps> = ({
         <EuiModalBody>
           <ValueListsForm onSuccess={handleUploadSuccess} onError={handleUploadError} />
           <EuiSpacer />
-          <EuiPanel>
+          <EuiPanel hasBorder>
             <EuiText size="s">
               <h2>{i18n.TABLE_TITLE}</h2>
             </EuiText>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index 1c31dfd3b89078..0c12d8256d66d2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -22,7 +22,7 @@ import { UpdateDateRange } from '../../../common/components/charts/common';
 import { FiltersGlobal } from '../../../common/components/filters_global';
 import { getRulesUrl } from '../../../common/components/link_to/redirect_to_detection_engine';
 import { SiemSearchBar } from '../../../common/components/search_bar';
-import { WrapperPage } from '../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../common/components/page_wrapper';
 import { inputsSelectors } from '../../../common/store/inputs';
 import { setAbsoluteRangeDatePicker } from '../../../common/store/inputs/actions';
 import { SpyRoute } from '../../../common/utils/route/spy_routes';
@@ -197,22 +197,22 @@ const DetectionEnginePageComponent = () => {
 
   if (isUserAuthenticated != null && !isUserAuthenticated && !loading) {
     return (
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
         <DetectionEngineUserUnauthenticated />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
     );
   }
 
   if (!loading && (isSignalIndexExists === false || needsListsConfiguration)) {
     return (
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
         <DetectionEngineNoIndex
           needsSignalsIndex={isSignalIndexExists === false}
           needsListsIndex={needsListsConfiguration}
         />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
     );
   }
 
@@ -228,7 +228,7 @@ const DetectionEnginePageComponent = () => {
             <SiemSearchBar id="global" indexPattern={indexPattern} />
           </FiltersGlobal>
 
-          <WrapperPage noPadding={globalFullScreen}>
+          <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
             <Display show={!globalFullScreen}>
               <DetectionEngineHeaderPage
                 subtitle={
@@ -280,13 +280,13 @@ const DetectionEnginePageComponent = () => {
               onShowOnlyThreatIndicatorAlertsChanged={onShowOnlyThreatIndicatorAlertsCallback}
               to={to}
             />
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </StyledFullHeightContainer>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
       <SpyRoute pageName={SecurityPageName.detections} />
     </>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
index 35404f4486bc3e..f38bde4839f18b 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/all/exceptions/exceptions_table.tsx
@@ -77,6 +77,7 @@ export const ExceptionListsTable = React.memo<ExceptionListsTableProps>(
       namespaceTypes: ['single', 'agnostic'],
       notifications,
       showTrustedApps: false,
+      showEventFilters: false,
     });
     const [loadingTableInfo, exceptionListsWithRuleRefs, exceptionsListsRef] = useAllExceptionLists(
       {
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
index 90247d19e05039..23edf785a7f3a2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
@@ -26,7 +26,7 @@ import {
   getRuleDetailsUrl,
   getRulesUrl,
 } from '../../../../../common/components/link_to/redirect_to_detection_engine';
-import { WrapperPage } from '../../../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../../../common/components/page_wrapper';
 import { displaySuccessToast, useStateToaster } from '../../../../../common/components/toasters';
 import { SpyRoute } from '../../../../../common/utils/route/spy_routes';
 import { useUserData } from '../../../../components/user_info';
@@ -287,7 +287,7 @@ const CreateRulePageComponent: React.FC = () => {
 
   return (
     <>
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <EuiFlexGroup direction="row" justifyContent="spaceAround">
           <MaxWidthEuiFlexItem>
             <DetectionEngineHeaderPage
@@ -296,11 +296,10 @@ const CreateRulePageComponent: React.FC = () => {
                 text: i18n.BACK_TO_RULES,
                 pageId: SecurityPageName.detections,
               }}
-              border
               isLoading={isLoading || loading}
               title={i18n.PAGE_TITLE}
             />
-            <MyEuiPanel zindex={4}>
+            <MyEuiPanel zindex={4} hasBorder>
               <StepDefineRuleAccordion
                 initialIsOpen={true}
                 id={RuleStep.defineRule}
@@ -334,7 +333,7 @@ const CreateRulePageComponent: React.FC = () => {
               </StepDefineRuleAccordion>
             </MyEuiPanel>
             <EuiSpacer size="l" />
-            <MyEuiPanel zindex={3}>
+            <MyEuiPanel hasBorder zindex={3}>
               <EuiAccordion
                 initialIsOpen={false}
                 id={RuleStep.aboutRule}
@@ -369,7 +368,7 @@ const CreateRulePageComponent: React.FC = () => {
               </EuiAccordion>
             </MyEuiPanel>
             <EuiSpacer size="l" />
-            <MyEuiPanel zindex={2}>
+            <MyEuiPanel hasBorder zindex={2}>
               <EuiAccordion
                 initialIsOpen={false}
                 id={RuleStep.scheduleRule}
@@ -402,7 +401,7 @@ const CreateRulePageComponent: React.FC = () => {
               </EuiAccordion>
             </MyEuiPanel>
             <EuiSpacer size="l" />
-            <MyEuiPanel zindex={1}>
+            <MyEuiPanel hasBorder zindex={1}>
               <EuiAccordion
                 initialIsOpen={false}
                 id={RuleStep.ruleActions}
@@ -436,7 +435,7 @@ const CreateRulePageComponent: React.FC = () => {
             </MyEuiPanel>
           </MaxWidthEuiFlexItem>
         </EuiFlexGroup>
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
 
       <SpyRoute pageName={SecurityPageName.detections} />
     </>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/failure_history.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/failure_history.tsx
index 417e1c989ce9b4..2fedd6160af2c6 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/failure_history.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/failure_history.tsx
@@ -29,7 +29,7 @@ const FailureHistoryComponent: React.FC<FailureHistoryProps> = ({ id }) => {
   const [loading, ruleStatus] = useRuleStatus(id);
   if (loading) {
     return (
-      <EuiPanel>
+      <EuiPanel hasBorder>
         <HeaderSection title={i18n.LAST_FIVE_ERRORS} />
         <EuiLoadingContent />
       </EuiPanel>
@@ -60,7 +60,7 @@ const FailureHistoryComponent: React.FC<FailureHistoryProps> = ({ id }) => {
     },
   ];
   return (
-    <EuiPanel>
+    <EuiPanel hasBorder>
       <HeaderSection title={i18n.LAST_FIVE_ERRORS} />
       <EuiBasicTable
         columns={columns}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index 51a6d9606376a5..b4f1af41a06064 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -49,7 +49,7 @@ import {
   getDetectionEngineUrl,
 } from '../../../../../common/components/link_to/redirect_to_detection_engine';
 import { SiemSearchBar } from '../../../../../common/components/search_bar';
-import { WrapperPage } from '../../../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../../../common/components/page_wrapper';
 import { Rule, useRuleStatus, RuleInfoStatus } from '../../../../containers/detection_engine/rules';
 import { useListsConfig } from '../../../../containers/detection_engine/lists/use_lists_config';
 import { SpyRoute } from '../../../../../common/utils/route/spy_routes';
@@ -563,7 +563,7 @@ const RuleDetailsPageComponent = () => {
             <SiemSearchBar id="global" indexPattern={indexPattern} />
           </FiltersGlobal>
 
-          <WrapperPage noPadding={globalFullScreen}>
+          <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
             <Display show={!globalFullScreen}>
               <DetectionEngineHeaderPage
                 backOptions={{
@@ -728,14 +728,14 @@ const RuleDetailsPageComponent = () => {
               />
             )}
             {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </StyledFullHeightContainer>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
 
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
 
       <SpyRoute pageName={SecurityPageName.detections} state={{ ruleName: rule?.name }} />
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
index 2d751459eb12fd..41710a822e5394 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/edit/index.tsx
@@ -21,7 +21,7 @@ import { useParams, useHistory } from 'react-router-dom';
 import { UpdateRulesSchema } from '../../../../../../common/detection_engine/schemas/request';
 import { useRule, useUpdateRule } from '../../../../containers/detection_engine/rules';
 import { useListsConfig } from '../../../../containers/detection_engine/lists/use_lists_config';
-import { WrapperPage } from '../../../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../../../common/components/page_wrapper';
 import {
   getRuleDetailsUrl,
   getDetectionEngineUrl,
@@ -335,7 +335,7 @@ const EditRulePageComponent: FC = () => {
 
   return (
     <>
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <EuiFlexGroup direction="row" justifyContent="spaceAround">
           <MaxWidthEuiFlexItem>
             <DetectionEngineHeaderPage
@@ -410,7 +410,7 @@ const EditRulePageComponent: FC = () => {
             </EuiFlexGroup>
           </MaxWidthEuiFlexItem>
         </EuiFlexGroup>
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
 
       <SpyRoute pageName={SecurityPageName.detections} state={{ ruleName: rule?.name }} />
     </>
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
index 8bacb10444a7d0..29fd8e2e8b247c 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/index.tsx
@@ -16,7 +16,7 @@ import {
   getCreateRuleUrl,
 } from '../../../../common/components/link_to/redirect_to_detection_engine';
 import { DetectionEngineHeaderPage } from '../../../components/detection_engine_header_page';
-import { WrapperPage } from '../../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../../common/components/page_wrapper';
 import { SpyRoute } from '../../../../common/utils/route/spy_routes';
 
 import { useUserData } from '../../../components/user_info';
@@ -182,7 +182,7 @@ const RulesPageComponent: React.FC = () => {
         subtitle={i18n.INITIAL_PROMPT_TEXT}
         title={i18n.IMPORT_RULE}
       />
-      <WrapperPage>
+      <SecuritySolutionPageWrapper>
         <DetectionEngineHeaderPage
           backOptions={{
             href: getDetectionEngineUrl(),
@@ -258,7 +258,7 @@ const RulesPageComponent: React.FC = () => {
           rulesNotUpdated={rulesNotUpdated}
           setRefreshRulesData={handleSetRefreshRulesData}
         />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
 
       <SpyRoute pageName={SecurityPageName.detections} />
     </>
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
index d88e4f048f917a..22edd2c19d6bd2 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
@@ -21,11 +21,11 @@ import { hostToCriteria } from '../../../common/components/ml/criteria/host_to_c
 import { hasMlUserPermissions } from '../../../../common/machine_learning/has_ml_user_permissions';
 import { useMlCapabilities } from '../../../common/components/ml/hooks/use_ml_capabilities';
 import { scoreIntervalToDateTime } from '../../../common/components/ml/score/score_interval_to_datetime';
-import { SiemNavigation } from '../../../common/components/navigation';
+import { SecuritySolutionTabNavigation } from '../../../common/components/navigation';
 import { HostsDetailsKpiComponent } from '../../components/kpi_hosts';
 import { HostOverview } from '../../../overview/components/host_overview';
 import { SiemSearchBar } from '../../../common/components/search_bar';
-import { WrapperPage } from '../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../common/components/page_wrapper';
 import { useGlobalTime } from '../../../common/containers/use_global_time';
 import { useKibana } from '../../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
@@ -123,7 +123,7 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
             <SiemSearchBar indexPattern={indexPattern} id="global" />
           </FiltersGlobal>
 
-          <WrapperPage noPadding={globalFullScreen}>
+          <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
             <Display show={!globalFullScreen}>
               <HeaderPage
                 border
@@ -184,7 +184,7 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
 
               <EuiSpacer />
 
-              <SiemNavigation
+              <SecuritySolutionTabNavigation
                 navTabs={navTabsHostDetails(detailName, hasMlUserPermissions(capabilities))}
               />
 
@@ -207,14 +207,14 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
               indexPattern={indexPattern}
               setAbsoluteRangeDatePicker={setAbsoluteRangeDatePicker}
             />
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <HeaderPage border title={detailName} />
 
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
 
       <SpyRoute pageName={SecurityPageName.hosts} />
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index f1eab38c56db0a..d05b091381cca7 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -18,7 +18,7 @@ import {
   kibanaObservable,
   createSecuritySolutionStorageMock,
 } from '../../common/mock';
-import { SiemNavigation } from '../../common/components/navigation';
+import { SecuritySolutionTabNavigation } from '../../common/components/navigation';
 import { inputsActions } from '../../common/store/inputs';
 import { State, createStore } from '../../common/store';
 import { Hosts } from './hosts';
@@ -102,7 +102,7 @@ describe('Hosts - rendering', () => {
         </Router>
       </TestProviders>
     );
-    expect(wrapper.find(SiemNavigation).exists()).toBe(true);
+    expect(wrapper.find(SecuritySolutionTabNavigation).exists()).toBe(true);
   });
 
   test('it should add the new filters after init', async () => {
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
index ce0385b532fd5a..7d31d291e75f17 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
@@ -19,10 +19,10 @@ import { FiltersGlobal } from '../../common/components/filters_global';
 import { HeaderPage } from '../../common/components/header_page';
 import { LastEventTime } from '../../common/components/last_event_time';
 import { hasMlUserPermissions } from '../../../common/machine_learning/has_ml_user_permissions';
-import { SiemNavigation } from '../../common/components/navigation';
+import { SecuritySolutionTabNavigation } from '../../common/components/navigation';
 import { HostsKpiComponent } from '../components/kpi_hosts';
 import { SiemSearchBar } from '../../common/components/search_bar';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGlobalFullScreen } from '../../common/containers/use_full_screen';
 import { useGlobalTime } from '../../common/containers/use_global_time';
 import { TimelineId } from '../../../common/types/timeline';
@@ -164,10 +164,9 @@ const HostsComponent = () => {
             <SiemSearchBar indexPattern={indexPattern} id="global" />
           </FiltersGlobal>
 
-          <WrapperPage noPadding={globalFullScreen}>
+          <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
             <Display show={!globalFullScreen}>
               <HeaderPage
-                border
                 subtitle={
                   <LastEventTime
                     docValueFields={docValueFields}
@@ -190,7 +189,9 @@ const HostsComponent = () => {
 
               <EuiSpacer />
 
-              <SiemNavigation navTabs={navTabsHosts(hasMlUserPermissions(capabilities))} />
+              <SecuritySolutionTabNavigation
+                navTabs={navTabsHosts(hasMlUserPermissions(capabilities))}
+              />
 
               <EuiSpacer />
             </Display>
@@ -207,14 +208,14 @@ const HostsComponent = () => {
               from={from}
               type={hostsModel.HostsType.page}
             />
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </StyledFullHeightContainer>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <HeaderPage border title={i18n.PAGE_TITLE} />
 
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
 
       <SpyRoute pageName={SecurityPageName.hosts} />
diff --git a/x-pack/plugins/security_solution/public/management/common/breadcrumbs.ts b/x-pack/plugins/security_solution/public/management/common/breadcrumbs.ts
index 76acff7847671f..3bcbd81621588b 100644
--- a/x-pack/plugins/security_solution/public/management/common/breadcrumbs.ts
+++ b/x-pack/plugins/security_solution/public/management/common/breadcrumbs.ts
@@ -11,7 +11,7 @@ import { AdministrationSubTab } from '../types';
 import { ENDPOINTS_TAB, EVENT_FILTERS_TAB, POLICIES_TAB, TRUSTED_APPS_TAB } from './translations';
 import { AdministrationRouteSpyState } from '../../common/utils/route/types';
 import { GetUrlForApp } from '../../common/components/navigation/types';
-import { ADMINISTRATION } from '../../app/home/translations';
+import { ADMINISTRATION } from '../../app/translations';
 import { APP_ID, SecurityPageName } from '../../../common/constants';
 
 const TabNameMappedToI18nKey: Record<AdministrationSubTab, string> = {
diff --git a/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx b/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
index 72a6de2a2de8d1..021c900824f8df 100644
--- a/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
@@ -9,9 +9,9 @@ import React, { FC, memo } from 'react';
 import { EuiPanel, EuiSpacer, CommonProps } from '@elastic/eui';
 import styled from 'styled-components';
 import { SecurityPageName } from '../../../common/constants';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { HeaderPage } from '../../common/components/header_page';
-import { SiemNavigation } from '../../common/components/navigation';
+import { SecuritySolutionTabNavigation } from '../../common/components/navigation';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { AdministrationSubTab } from '../types';
 import {
@@ -46,7 +46,7 @@ export const AdministrationListPage: FC<AdministrationListPageProps & CommonProp
     const badgeOptions = !beta ? undefined : { beta: true, text: BETA_BADGE_LABEL };
 
     return (
-      <WrapperPage noTimeline {...otherProps}>
+      <SecuritySolutionPageWrapper noTimeline {...otherProps}>
         <HeaderPage
           hideSourcerer={true}
           title={title}
@@ -57,7 +57,7 @@ export const AdministrationListPage: FC<AdministrationListPageProps & CommonProp
           {actions}
         </HeaderPage>
 
-        <SiemNavigation
+        <SecuritySolutionTabNavigation
           navTabs={{
             [AdministrationSubTab.endpoints]: {
               name: ENDPOINTS_TAB,
@@ -88,10 +88,10 @@ export const AdministrationListPage: FC<AdministrationListPageProps & CommonProp
 
         <EuiSpacer />
 
-        <EuiPanelStyled>{children}</EuiPanelStyled>
+        <EuiPanelStyled hasBorder>{children}</EuiPanelStyled>
 
         <SpyRoute pageName={SecurityPageName.administration} />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
index 204c3a86ce3e69..e9cdd16554f33b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
@@ -42,7 +42,7 @@ import { useFormatUrl } from '../../../../common/components/link_to';
 import { useNavigateToAppEventHandler } from '../../../../common/hooks/endpoint/use_navigate_to_app_event_handler';
 import { MANAGEMENT_APP_ID } from '../../../common/constants';
 import { PolicyDetailsRouteState } from '../../../../../common/endpoint/types';
-import { WrapperPage } from '../../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../../common/components/page_wrapper';
 import { HeaderPage } from '../../../../common/components/header_page';
 import { PolicyDetailsForm } from './policy_details_form';
 
@@ -51,7 +51,7 @@ const PolicyDetailsHeader = styled.div`
   padding: ${(props) => props.theme.eui.paddingSizes.xl} 0;
   background-color: #fafbfd;
   border-bottom: 1px solid #d3dae6;
-  .siemHeaderPage {
+  .securitySolutionHeaderPage {
     max-width: ${maxFormWidth};
     margin: 0 auto;
   }
@@ -159,7 +159,7 @@ export const PolicyDetails = React.memo(() => {
   // Else, if we have an error, then show error on the page.
   if (!policyItem) {
     return (
-      <WrapperPage noTimeline>
+      <SecuritySolutionPageWrapper noTimeline>
         {isPolicyLoading ? (
           <EuiLoadingSpinner size="xl" />
         ) : policyApiError ? (
@@ -168,7 +168,7 @@ export const PolicyDetails = React.memo(() => {
           </EuiCallOut>
         ) : null}
         <SpyRoute pageName={SecurityPageName.administration} />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
     );
   }
 
@@ -190,7 +190,7 @@ export const PolicyDetails = React.memo(() => {
           onConfirm={handleSaveConfirmation}
         />
       )}
-      <WrapperPage
+      <SecuritySolutionPageWrapper
         noTimeline
         data-test-subj="policyDetailsPage"
         noPadding
@@ -221,7 +221,7 @@ export const PolicyDetails = React.memo(() => {
           <PolicyDetailsForm />
         </PolicyDetailsFormDiv>
         <EuiSpacer size="xxl" />
-      </WrapperPage>
+      </SecuritySolutionPageWrapper>
       <EuiBottomBar paddingSize="s">
         <EuiFlexGroup justifyContent="flexEnd" gutterSize="s">
           <EuiFlexItem grow={false}>
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/__snapshots__/index.test.tsx.snap
index e984ea5bb1711f..51b60c8ff292be 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_grid/__snapshots__/index.test.tsx.snap
@@ -427,7 +427,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
           class="body-content undefined"
         >
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -722,7 +722,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -1017,7 +1017,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -1312,7 +1312,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -1607,7 +1607,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -1902,7 +1902,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -2197,7 +2197,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -2492,7 +2492,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -2787,7 +2787,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -3082,7 +3082,7 @@ exports[`TrustedAppsGrid renders correctly when loaded data 1`] = `
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -3685,7 +3685,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
           class="body-content undefined"
         >
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -3980,7 +3980,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -4275,7 +4275,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -4570,7 +4570,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -4865,7 +4865,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -5160,7 +5160,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -5455,7 +5455,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -5750,7 +5750,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -6045,7 +6045,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -6340,7 +6340,7 @@ exports[`TrustedAppsGrid renders correctly when loading data for the second time
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -6900,7 +6900,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
           class="body-content undefined"
         >
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -7195,7 +7195,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -7490,7 +7490,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -7785,7 +7785,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -8080,7 +8080,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -8375,7 +8375,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -8670,7 +8670,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -8965,7 +8965,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -9260,7 +9260,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
@@ -9555,7 +9555,7 @@ exports[`TrustedAppsGrid renders correctly when new page and page size set (not
             </div>
           </div>
           <div
-            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow trusted-app"
+            class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder trusted-app"
           >
             <div
               class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow euiFlexGroup--responsive"
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_list/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_list/__snapshots__/index.test.tsx.snap
index 543ca9695fce21..9a5137271b408b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_list/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_apps_list/__snapshots__/index.test.tsx.snap
@@ -774,7 +774,7 @@ exports[`TrustedAppsList renders correctly when item details expanded 1`] = `
                 class="euiTableCellContent euiTableCellContent--overflowingContent"
               >
                 <div
-                  class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow"
+                  class="euiPanel euiPanel--borderRadiusMedium euiPanel--plain euiPanel--hasShadow euiPanel--hasBorder"
                   data-test-subj="trustedAppCard"
                 >
                   <div
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embeddable.test.tsx.snap b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embeddable.test.tsx.snap
index b03670b2b1cd4c..8835a3ac390f35 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embeddable.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embeddable.test.tsx.snap
@@ -5,6 +5,7 @@ exports[`Embeddable it renders 1`] = `
   className="siemEmbeddable"
 >
   <Panel
+    hasBorder={true}
     paddingSize="none"
   >
     <p>
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embeddable.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embeddable.tsx
index 82b5b8a3e7b3db..3087dbe4ad6edc 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embeddable.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embeddable.tsx
@@ -20,7 +20,9 @@ export interface EmbeddableProps {
 
 export const Embeddable = React.memo<EmbeddableProps>(({ children }) => (
   <section className="siemEmbeddable">
-    <Panel paddingSize="none">{children}</Panel>
+    <Panel paddingSize="none" hasBorder>
+      {children}
+    </Panel>
   </section>
 ));
 Embeddable.displayName = 'Embeddable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
index 4cccb536c08bbd..02be5f78261c1d 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
@@ -28,7 +28,7 @@ import { manageQuery } from '../../../common/components/page/manage_query';
 import { FlowTargetSelectConnected } from '../../components/flow_target_select_connected';
 import { IpOverview } from '../../components/details';
 import { SiemSearchBar } from '../../../common/components/search_bar';
-import { WrapperPage } from '../../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../../common/components/page_wrapper';
 import { useNetworkDetails } from '../../containers/details';
 import { useKibana } from '../../../common/lib/kibana';
 import { decodeIpv6 } from '../../../common/lib/helpers';
@@ -128,7 +128,7 @@ const NetworkDetailsComponent: React.FC = () => {
             <SiemSearchBar indexPattern={indexPattern} id="global" />
           </FiltersGlobal>
 
-          <WrapperPage>
+          <SecuritySolutionPageWrapper>
             <HeaderPage
               border
               data-test-subj="network-details-headline"
@@ -289,14 +289,14 @@ const NetworkDetailsComponent: React.FC = () => {
               hideHistogramIfEmpty={true}
               AnomaliesTableComponent={AnomaliesNetworkTable}
             />
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <HeaderPage border title={ip} />
 
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
 
       <SpyRoute pageName={SecurityPageName.network} />
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.tsx b/x-pack/plugins/security_solution/public/network/pages/network.tsx
index dbfb250095ee26..13c04a5e5ec5b7 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.tsx
@@ -20,11 +20,11 @@ import { EmbeddedMap } from '../components/embeddables/embedded_map';
 import { FiltersGlobal } from '../../common/components/filters_global';
 import { HeaderPage } from '../../common/components/header_page';
 import { LastEventTime } from '../../common/components/last_event_time';
-import { SiemNavigation } from '../../common/components/navigation';
+import { SecuritySolutionTabNavigation } from '../../common/components/navigation';
 
 import { NetworkKpiComponent } from '../components/kpi_network';
 import { SiemSearchBar } from '../../common/components/search_bar';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGlobalFullScreen } from '../../common/containers/use_full_screen';
 import { useGlobalTime } from '../../common/containers/use_global_time';
 import { LastEventIndexKey } from '../../../common/search_strategy';
@@ -155,10 +155,9 @@ const NetworkComponent = React.memo<NetworkComponentProps>(
               <SiemSearchBar indexPattern={indexPattern} id="global" />
             </FiltersGlobal>
 
-            <WrapperPage noPadding={globalFullScreen}>
+            <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
               <Display show={!globalFullScreen}>
                 <HeaderPage
-                  border
                   subtitle={
                     <LastEventTime
                       docValueFields={docValueFields}
@@ -195,7 +194,7 @@ const NetworkComponent = React.memo<NetworkComponentProps>(
                   <Display show={!globalFullScreen}>
                     <EuiSpacer />
 
-                    <SiemNavigation navTabs={navTabsNetwork(hasMlUserPermissions)} />
+                    <SecuritySolutionTabNavigation navTabs={navTabsNetwork(hasMlUserPermissions)} />
 
                     <EuiSpacer />
                   </Display>
@@ -217,13 +216,13 @@ const NetworkComponent = React.memo<NetworkComponentProps>(
               ) : (
                 <NetworkRoutesLoading />
               )}
-            </WrapperPage>
+            </SecuritySolutionPageWrapper>
           </StyledFullHeightContainer>
         ) : (
-          <WrapperPage>
+          <SecuritySolutionPageWrapper>
             <HeaderPage border title={i18n.PAGE_TITLE} />
             <OverviewEmpty />
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         )}
 
         <SpyRoute pageName={SecurityPageName.network} />
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
index 70f44a0008cbc4..f11b849f5df6b4 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.tsx
@@ -115,7 +115,7 @@ const OverviewHostComponent: React.FC<OverviewHostProps> = ({
   return (
     <EuiFlexItem>
       <InspectButtonContainer>
-        <EuiPanel>
+        <EuiPanel hasBorder>
           <HeaderSection id={OverviewHostQueryId} subtitle={subtitle} title={title}>
             <>{hostPageButton}</>
           </HeaderSection>
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
index 107a47f6cc1324..39fb6ff08ee539 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.tsx
@@ -120,7 +120,7 @@ const OverviewNetworkComponent: React.FC<OverviewNetworkProps> = ({
   return (
     <EuiFlexItem>
       <InspectButtonContainer>
-        <EuiPanel data-test-subj="overview-network-query">
+        <EuiPanel hasBorder data-test-subj="overview-network-query">
           <>
             <HeaderSection id={OverviewNetworkQueryId} subtitle={subtitle} title={title}>
               {networkPageButton}
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
index 4270d8ec164b30..2cf998e5e133a4 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
@@ -12,7 +12,7 @@ import styled from 'styled-components';
 import { AlertsByCategory } from '../components/alerts_by_category';
 import { FiltersGlobal } from '../../common/components/filters_global';
 import { SiemSearchBar } from '../../common/components/search_bar';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useGlobalTime } from '../../common/containers/use_global_time';
 import { useFetchIndex } from '../../common/containers/source';
 
@@ -37,6 +37,10 @@ const SidebarFlexItem = styled(EuiFlexItem)`
   margin-right: 24px;
 `;
 
+const StyledSecuritySolutionPageWrapper = styled(SecuritySolutionPageWrapper)`
+  overflow-x: auto;
+`;
+
 const OverviewComponent = () => {
   const getGlobalFiltersQuerySelector = useMemo(
     () => inputsSelectors.globalFiltersQuerySelector(),
@@ -73,7 +77,7 @@ const OverviewComponent = () => {
             <SiemSearchBar id="global" indexPattern={indexPattern} />
           </FiltersGlobal>
 
-          <WrapperPage>
+          <StyledSecuritySolutionPageWrapper>
             {!dismissMessage && !metadataIndexExists && isIngestEnabled && (
               <>
                 <EndpointNotice onDismiss={dismissEndpointNotice} />
@@ -139,7 +143,7 @@ const OverviewComponent = () => {
                 </EuiFlexGroup>
               </EuiFlexItem>
             </EuiFlexGroup>
-          </WrapperPage>
+          </StyledSecuritySolutionPageWrapper>
         </>
       ) : (
         <OverviewEmpty />
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index 5a44faa58414a1..32e6748f38141c 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -61,7 +61,7 @@ import {
   DETECTION_ENGINE,
   CASE,
   ADMINISTRATION,
-} from './app/home/translations';
+} from './app/translations';
 import {
   IndexFieldsStrategyRequest,
   IndexFieldsStrategyResponse,
diff --git a/x-pack/plugins/security_solution/public/resolver/view/graph_controls.tsx b/x-pack/plugins/security_solution/public/resolver/view/graph_controls.tsx
index 45f7e6950b0069..1f520a18470536 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/graph_controls.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/graph_controls.tsx
@@ -207,7 +207,7 @@ export const GraphControls = React.memo(
           />
         </StyledGraphControlsColumn>
         <StyledGraphControlsColumn>
-          <EuiPanel className="panning-controls" paddingSize="none" hasShadow>
+          <EuiPanel className="panning-controls" paddingSize="none" hasBorder>
             <div className="panning-controls-top">
               <button
                 className="north-button"
@@ -265,7 +265,7 @@ export const GraphControls = React.memo(
               </button>
             </div>
           </EuiPanel>
-          <EuiPanel className="zoom-controls" paddingSize="none" hasShadow>
+          <EuiPanel className="zoom-controls" paddingSize="none" hasBorder>
             <button
               title={i18n.translate('xpack.securitySolution.resolver.graphControls.zoomIn', {
                 defaultMessage: 'Zoom In',
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
index c587c454604e8e..6fde15b85a2fc9 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/event_detail.tsx
@@ -60,7 +60,7 @@ export const EventDetail = memo(function EventDetail({
   const event = useSelector(selectors.currentRelatedEventData);
 
   return isLoading ? (
-    <StyledPanel>
+    <StyledPanel hasBorder>
       <PanelLoading />
     </StyledPanel>
   ) : event ? (
@@ -71,7 +71,7 @@ export const EventDetail = memo(function EventDetail({
       eventType={eventType}
     />
   ) : (
-    <StyledPanel>
+    <StyledPanel hasBorder>
       <PanelContentError translatedErrorMessage={eventDetailRequestError} />
     </StyledPanel>
   );
@@ -105,7 +105,7 @@ const EventDetailContents = memo(function ({
   const nodeName = processEvent ? eventModel.processNameSafeVersion(processEvent) : null;
 
   return (
-    <StyledPanel data-test-subj="resolver:panel:event-detail">
+    <StyledPanel hasBorder data-test-subj="resolver:panel:event-detail">
       <EventDetailBreadcrumbs
         nodeID={nodeID}
         nodeName={nodeName}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/node_detail.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_detail.tsx
index ed3507d8f4bc33..a3f1b1fccb5de3 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/node_detail.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_detail.tsx
@@ -48,15 +48,15 @@ export const NodeDetail = memo(function ({ nodeID }: { nodeID: string }) {
   const nodeStatus = useSelector((state: ResolverState) => selectors.nodeDataStatus(state)(nodeID));
 
   return nodeStatus === 'loading' ? (
-    <StyledPanel>
+    <StyledPanel hasBorder>
       <PanelLoading />
     </StyledPanel>
   ) : processEvent ? (
-    <StyledPanel data-test-subj="resolver:panel:node-detail">
+    <StyledPanel hasBorder data-test-subj="resolver:panel:node-detail">
       <NodeDetailView nodeID={nodeID} processEvent={processEvent} />
     </StyledPanel>
   ) : (
-    <StyledPanel>
+    <StyledPanel hasBorder>
       <PanelContentError translatedErrorMessage={nodeDetailError} />
     </StyledPanel>
   );
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
index 951d2ff9fdc430..e7cd37506134f3 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events.tsx
@@ -30,13 +30,13 @@ export function NodeEvents({ nodeID }: { nodeID: string }) {
 
   if (processEvent === undefined || nodeStats === undefined) {
     return (
-      <StyledPanel>
+      <StyledPanel hasBorder>
         <PanelLoading />
       </StyledPanel>
     );
   } else {
     return (
-      <StyledPanel>
+      <StyledPanel hasBorder>
         <NodeEventsBreadcrumbs
           nodeName={event.processNameSafeVersion(processEvent)}
           nodeID={nodeID}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
index aff78e4b5965b3..09437c662ead9b 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_events_of_type.tsx
@@ -50,11 +50,11 @@ export const NodeEventsInCategory = memo(function ({
   return (
     <>
       {isLoading ? (
-        <StyledPanel>
+        <StyledPanel hasBorder>
           <PanelLoading />
         </StyledPanel>
       ) : (
-        <StyledPanel data-test-subj="resolver:panel:events-in-category">
+        <StyledPanel hasBorder data-test-subj="resolver:panel:events-in-category">
           {hasError || !node ? (
             <EuiCallOut
               title={i18n.translate(
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
index f3a85635eb9a87..682304b5395b1b 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/node_list.tsx
@@ -124,7 +124,7 @@ export const NodeList = memo(() => {
   const showWarning = children === true || ancestors === true || generations === true;
   const rowProps = useMemo(() => ({ 'data-test-subj': 'resolver:node-list:item' }), []);
   return (
-    <StyledPanel>
+    <StyledPanel hasBorder>
       <Breadcrumbs breadcrumbs={breadcrumbs} />
       {showWarning && <LimitWarning numberDisplayed={numberOfProcesses} />}
       <EuiSpacer size="l" />
diff --git a/x-pack/plugins/security_solution/public/resolver/view/styles.tsx b/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
index 851e8a2fcf10e8..44522441e6e994 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/styles.tsx
@@ -95,6 +95,11 @@ export const StyledMapContainer = styled.div<{ backgroundColor: string }>`
     justify-content: center;
     flex-grow: 1;
   }
+  /**
+  * Set to force base-height necessary for resolver to show up in timeline.
+  * Was previously set in events_viewer.tsx, but more appropriate here
+   */
+  min-height: 652px;
   /**
    * The placeholder components use absolute positioning.
    */
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/bottom_bar/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/bottom_bar/index.tsx
index feaf7b7513bc1f..32d36006fffd5c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/bottom_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/bottom_bar/index.tsx
@@ -6,60 +6,19 @@
  */
 
 import { EuiPanel } from '@elastic/eui';
-import { rgba } from 'polished';
 import React from 'react';
 import styled from 'styled-components';
 
-import { IS_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
 import { DataProvider } from '../../timeline/data_providers/data_provider';
 import { flattenIntoAndGroups } from '../../timeline/data_providers/helpers';
 import { DataProviders } from '../../timeline/data_providers';
-import { FLYOUT_BUTTON_BAR_CLASS_NAME, FLYOUT_BUTTON_CLASS_NAME } from '../../timeline/helpers';
+import { FLYOUT_BUTTON_BAR_CLASS_NAME } from '../../timeline/helpers';
 import { FlyoutHeaderPanel } from '../header';
 import { TimelineTabs } from '../../../../../common/types/timeline';
 
 export const getBadgeCount = (dataProviders: DataProvider[]): number =>
   flattenIntoAndGroups(dataProviders).reduce((total, group) => total + group.length, 0);
 
-const SHOW_HIDE_GLOBAL_TRANSLATE_Y = 50; // px
-const SHOW_HIDE_TIMELINE_TRANSLATE_Y = 0; // px
-
-const Container = styled.div.attrs<{ $isGlobal: boolean }>(({ $isGlobal = true }) => ({
-  style: {
-    transform: $isGlobal
-      ? `translateY(calc(100% - ${SHOW_HIDE_GLOBAL_TRANSLATE_Y}px))`
-      : `translateY(calc(100% - ${SHOW_HIDE_TIMELINE_TRANSLATE_Y}px))`,
-  },
-}))<{ $isGlobal: boolean }>`
-  position: fixed;
-  left: 0;
-  bottom: 0;
-  user-select: none;
-  width: 100%;
-  z-index: ${({ theme }) => theme.eui.euiZLevel8 + 1};
-
-  .${IS_DRAGGING_CLASS_NAME} & {
-    transform: none !important;
-  }
-
-  .${FLYOUT_BUTTON_CLASS_NAME} {
-    background: ${({ theme }) => rgba(theme.eui.euiPageBackgroundColor, 1)};
-    border-radius: 4px 4px 0 0;
-    box-shadow: none;
-    height: 46px;
-  }
-
-  .${IS_DRAGGING_CLASS_NAME} & .${FLYOUT_BUTTON_CLASS_NAME} {
-    color: ${({ theme }) => theme.eui.euiColorSuccess};
-    background: ${({ theme }) => rgba(theme.eui.euiColorSuccess, 0.2)} !important;
-    border: 1px solid ${({ theme }) => theme.eui.euiColorSuccess};
-    border-bottom: none;
-    text-decoration: none;
-  }
-`;
-
-Container.displayName = 'Container';
-
 const DataProvidersPanel = styled(EuiPanel)`
   border-radius: 0;
   padding: 0 4px 0 4px;
@@ -76,18 +35,14 @@ interface FlyoutBottomBarProps {
 export const FlyoutBottomBar = React.memo<FlyoutBottomBarProps>(
   ({ activeTab, showDataproviders, timelineId }) => {
     return (
-      <Container
-        className={FLYOUT_BUTTON_BAR_CLASS_NAME}
-        $isGlobal={showDataproviders}
-        data-test-subj="flyoutBottomBar"
-      >
+      <div className={FLYOUT_BUTTON_BAR_CLASS_NAME} data-test-subj="flyoutBottomBar">
         {showDataproviders && <FlyoutHeaderPanel timelineId={timelineId} />}
         {(showDataproviders || (!showDataproviders && activeTab !== TimelineTabs.query)) && (
           <DataProvidersPanel paddingSize="none">
             <DataProviders timelineId={timelineId} data-test-subj="dataProviders-bottomBar" />
           </DataProvidersPanel>
         )}
-      </Container>
+      </div>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
index 922e40d6d860e4..1eafa51058bdd6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/open_timeline.tsx
@@ -194,7 +194,7 @@ export const OpenTimeline = React.memo<OpenTimelineProps>(
           title={i18n.IMPORT_TIMELINE}
         />
 
-        <EuiPanel className={OPEN_TIMELINE_CLASS_NAME}>
+        <EuiPanel className={OPEN_TIMELINE_CLASS_NAME} hasBorder>
           {!!timelineFilter && timelineFilter}
           <SearchRow
             data-test-subj="search-row"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/providers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/providers.tsx
index d144a67c275091..5b982e4e831f72 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/providers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/providers.tsx
@@ -26,7 +26,6 @@ import {
   getTimelineProviderDraggableId,
   getTimelineProviderDroppableId,
 } from '../../../../common/components/drag_and_drop/helpers';
-
 import { DataProvider, DataProviderType, DataProvidersAnd, IS_OPERATOR } from './data_provider';
 import { EMPTY_GROUP, flattenIntoAndGroups } from './helpers';
 import { ProviderItemBadge } from './provider_item_badge';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
index 0c584a2d62efee..3514766b334a08 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/styles.tsx
@@ -8,9 +8,9 @@
 import { EuiLoadingSpinner } from '@elastic/eui';
 import { rgba } from 'polished';
 import styled, { createGlobalStyle } from 'styled-components';
+import { IS_TIMELINE_FIELD_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
 
 import { TimelineEventsType } from '../../../../common/types/timeline';
-import { IS_TIMELINE_FIELD_DRAGGING_CLASS_NAME } from '../../../common/components/drag_and_drop/helpers';
 
 import { ACTIONS_COLUMN_ARIA_COL_INDEX } from './helpers';
 import { EVENTS_TABLE_ARIA_LABEL } from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
index fe8650da7a0903..5d2e45b638d59a 100644
--- a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
@@ -12,7 +12,7 @@ import { useParams } from 'react-router-dom';
 
 import { TimelineId, TimelineType } from '../../../common/types/timeline';
 import { HeaderPage } from '../../common/components/header_page';
-import { WrapperPage } from '../../common/components/wrapper_page';
+import { SecuritySolutionPageWrapper } from '../../common/components/page_wrapper';
 import { useKibana } from '../../common/lib/kibana';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { OverviewEmpty } from '../../overview/components/overview_empty';
@@ -45,8 +45,8 @@ export const TimelinesPageComponent: React.FC = () => {
     <>
       {indicesExist ? (
         <>
-          <WrapperPage>
-            <HeaderPage border hideSourcerer={true} title={i18n.PAGE_TITLE}>
+          <SecuritySolutionPageWrapper>
+            <HeaderPage hideSourcerer={true} title={i18n.PAGE_TITLE}>
               <EuiFlexGroup gutterSize="s" alignItems="center">
                 <EuiFlexItem>
                   {capabilitiesCanUserCRUD && (
@@ -89,13 +89,13 @@ export const TimelinesPageComponent: React.FC = () => {
                 data-test-subj="stateful-open-timeline"
               />
             </TimelinesContainer>
-          </WrapperPage>
+          </SecuritySolutionPageWrapper>
         </>
       ) : (
-        <WrapperPage>
+        <SecuritySolutionPageWrapper>
           <HeaderPage hideSourcerer={true} border title={i18n.PAGE_TITLE} />
           <OverviewEmpty />
-        </WrapperPage>
+        </SecuritySolutionPageWrapper>
       )}
 
       <SpyRoute pageName={SecurityPageName.timelines} />
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 271916b3971f5d..75bf27f9617139 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -20445,8 +20445,6 @@
     "xpack.securitySolution.header.editableTitle.cancel": "キャンセル",
     "xpack.securitySolution.header.editableTitle.editButtonAria": "クリックすると {title} を編集できます",
     "xpack.securitySolution.header.editableTitle.save": "保存",
-    "xpack.securitySolution.headerGlobal.buttonAddData": "データの追加",
-    "xpack.securitySolution.headerGlobal.securitySolution": "セキュリティソリューション",
     "xpack.securitySolution.headerPage.pageSubtitle": "前回のイベント：{beat}",
     "xpack.securitySolution.hooks.useAddToTimeline.addedFieldMessage": "{fieldOrValue}をタイムラインに追加しました",
     "xpack.securitySolution.hooks.useAddToTimeline.template.addedFieldMessage": "{fieldOrValue}をタイムラインテンプレートに追加しました",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 945e25fcf962ed..d3f5b9c4bce8b9 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -20754,8 +20754,6 @@
     "xpack.securitySolution.header.editableTitle.cancel": "取消",
     "xpack.securitySolution.header.editableTitle.editButtonAria": "通过单击，可以编辑 {title}",
     "xpack.securitySolution.header.editableTitle.save": "保存",
-    "xpack.securitySolution.headerGlobal.buttonAddData": "添加数据",
-    "xpack.securitySolution.headerGlobal.securitySolution": "安全解决方案",
     "xpack.securitySolution.headerPage.pageSubtitle": "上一事件：{beat}",
     "xpack.securitySolution.hooks.useAddToTimeline.addedFieldMessage": "已将 {fieldOrValue} 添加到时间线",
     "xpack.securitySolution.hooks.useAddToTimeline.template.addedFieldMessage": "已将 {fieldOrValue} 添加到时间线模板",
diff --git a/x-pack/test/api_integration/apis/search/session.ts b/x-pack/test/api_integration/apis/search/session.ts
index d47199a0f1c1e2..06be7c6759bc05 100644
--- a/x-pack/test/api_integration/apis/search/session.ts
+++ b/x-pack/test/api_integration/apis/search/session.ts
@@ -403,7 +403,12 @@ export default function ({ getService }: FtrProviderContext) {
       const { id: id1 } = searchRes1.body;
 
       // it might take the session a moment to be created
-      await new Promise((resolve) => setTimeout(resolve, 2500));
+      await retry.waitFor('search session created', async () => {
+        const response = await supertest
+          .get(`/internal/session/${sessionId}`)
+          .set('kbn-xsrf', 'foo');
+        return response.body.statusCode === undefined;
+      });
 
       const getSessionFirstTime = await supertest
         .get(`/internal/session/${sessionId}`)