diff --git a/docs/apm/images/service-maps-java.png b/docs/apm/images/service-maps-java.png
new file mode 100644
index 0000000000000..e1a42f4c76e12
Binary files /dev/null and b/docs/apm/images/service-maps-java.png differ
diff --git a/docs/apm/images/service-maps.png b/docs/apm/images/service-maps.png
new file mode 100644
index 0000000000000..454ae9bb720fb
Binary files /dev/null and b/docs/apm/images/service-maps.png differ
diff --git a/docs/apm/service-maps.asciidoc b/docs/apm/service-maps.asciidoc
new file mode 100644
index 0000000000000..e0d84f33b4dcb
--- /dev/null
+++ b/docs/apm/service-maps.asciidoc
@@ -0,0 +1,48 @@
+[[service-maps]]
+=== Service maps
+
+beta::[]
+
+A service map is a real-time diagram of the interactions occurring in your application’s architecture.
+It allows you to easily visualize data flow and high-level statistics, like average transaction duration,
+requests per minute, errors per minute, and metrics, allowing you to quickly assess the status of your services.
+
+Our beta offering creates two types of service maps:
+
+* Global: All services and connections are shown.
+* Service-specific: Selecting a specific service will highlight it's connections.
+
+[role="screenshot"]
+image::apm/images/service-maps.png[Example view of service maps in the APM app in Kibana]
+
+[float]
+[[visualize-your-architecture]]
+=== Visualize your architecture
+
+Select the **Service Map** tab to get started.
+By default, all services and connections are shown.
+Whether your onboarding a new engineer, or just trying to grasp the big picture,
+click around, zoom in and out, and begin to visualize how your services are connected.
+
+If there's a specific service that interests you, select that service to highlight its connections.
+Clicking **Focus map** will refocus the map on that specific service and lock the connection highlighting.
+From here, select **Service Details**, or click on the **Transaction** tab to jump to the Transaction overview.
+You can also use the tabs at the top of the page to easily jump to the **Errors** or **Metrics** overview.
+
+While it's not possible to query in service maps, it is possible to filter by environment.
+This can be useful if you have two or more services, in separate environments, but with the same name.
+Use the environment drop down to only see the data you're interested in, like `dev` or `production`.
+
+[role="screenshot"]
+image::apm/images/service-maps-java.png[Example view of service maps with Java highlighted in the APM app in Kibana]
+
+[float]
+[[service-maps-legend]]
+=== Legend
+
+Nodes appear on the map in one of two shapes:
+
+* **Circle**: Instrumented services. Interior icons are based on the language of the agent used.
+* **Diamond**: Databases, external, and messaging. Interior icons represent the generic type,
+with specific icons for known entities, like Elasticsearch.
+Type and subtype are based on `span.type`, and `span.subtype`.
diff --git a/docs/apm/using-the-apm-ui.asciidoc b/docs/apm/using-the-apm-ui.asciidoc
index 1361dc046e3b1..b1b7ed7307986 100644
--- a/docs/apm/using-the-apm-ui.asciidoc
+++ b/docs/apm/using-the-apm-ui.asciidoc
@@ -31,6 +31,8 @@ include::transactions.asciidoc[]
 
 include::spans.asciidoc[]
 
+include::service-maps.asciidoc[]
+
 include::errors.asciidoc[]
 
 include::metrics.asciidoc[]
diff --git a/src/legacy/core_plugins/region_map/public/region_map_visualization.js b/src/legacy/core_plugins/region_map/public/region_map_visualization.js
index 25641ea76809d..72f9d66e7d2bf 100644
--- a/src/legacy/core_plugins/region_map/public/region_map_visualization.js
+++ b/src/legacy/core_plugins/region_map/public/region_map_visualization.js
@@ -164,7 +164,8 @@ export function createRegionMapVisualization({ serviceSettings, $injector, uiSet
       }
 
       this._choroplethLayer.on('select', event => {
-        const rowIndex = this._chartData.rows.findIndex(row => row[0] === event);
+        const { rows, columns } = this._chartData;
+        const rowIndex = rows.findIndex(row => row[columns[0].id] === event);
         this._vis.API.events.filter({
           table: this._chartData,
           column: 0,
diff --git a/test/functional/apps/discover/_discover.js b/test/functional/apps/discover/_discover.js
index 850b2773b5025..4f357e2993b30 100644
--- a/test/functional/apps/discover/_discover.js
+++ b/test/functional/apps/discover/_discover.js
@@ -44,7 +44,6 @@ export default function({ getService, getPageObjects }) {
     });
 
     describe('query', function() {
-      this.tags(['skipFirefox']);
       const queryName1 = 'Query # 1';
 
       it('should show correct time range string by timepicker', async function() {
@@ -100,9 +99,10 @@ export default function({ getService, getPageObjects }) {
         const newDurationHours = await PageObjects.timePicker.getTimeDurationInHours();
         expect(Math.round(newDurationHours)).to.be(25);
         const rowData = await PageObjects.discover.getDocTableField(1);
+        log.debug(`The first timestamp value in doc table: ${rowData}`);
         expect(Date.parse(rowData)).to.be.within(
-          Date.parse('Sep 20, 2015 @ 22:00:00.000'),
-          Date.parse('Sep 20, 2015 @ 23:30:00.000')
+          Date.parse('Sep 20, 2015 @ 21:30:00.000'),
+          Date.parse('Sep 20, 2015 @ 23:00:00.000')
         );
       });
 
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index de4917ef2b1b3..f06baeb7a4167 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -43,42 +43,10 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
     appConfig: {};
     ensureCurrentUrl: boolean;
     shouldLoginIfPrompted: boolean;
-    shouldAcceptAlert: boolean;
     useActualUrl: boolean;
   }
 
   class CommonPage {
-    /**
-     * Navigates the browser window to provided URL
-     * @param url URL
-     * @param shouldAcceptAlert pass 'true' if browser alert should be accepted
-     */
-    private static async navigateToUrlAndHandleAlert(url: string, shouldAcceptAlert: boolean) {
-      log.debug('Navigate to: ' + url);
-      try {
-        await browser.get(url);
-      } catch (navigationError) {
-        log.debug('Error navigating to url');
-        const alert = await browser.getAlert();
-        if (alert && alert.accept) {
-          if (shouldAcceptAlert) {
-            log.debug('Should accept alert');
-            try {
-              await alert.accept();
-            } catch (alertException) {
-              log.debug('Error accepting alert');
-              throw alertException;
-            }
-          } else {
-            log.debug('Will not accept alert');
-            throw navigationError;
-          }
-        } else {
-          throw navigationError;
-        }
-      }
-    }
-
     /**
      * Returns Kibana host URL
      */
@@ -127,13 +95,7 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
     }
 
     private async navigate(navigateProps: NavigateProps) {
-      const {
-        appConfig,
-        ensureCurrentUrl,
-        shouldLoginIfPrompted,
-        shouldAcceptAlert,
-        useActualUrl,
-      } = navigateProps;
+      const { appConfig, ensureCurrentUrl, shouldLoginIfPrompted, useActualUrl } = navigateProps;
       const appUrl = getUrl.noAuth(config.get('servers.kibana'), appConfig);
 
       await retry.try(async () => {
@@ -141,7 +103,11 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
           log.debug(`navigateToActualUrl ${appUrl}`);
           await browser.get(appUrl);
         } else {
-          await CommonPage.navigateToUrlAndHandleAlert(appUrl, shouldAcceptAlert);
+          log.debug(`navigateToUrl ${appUrl}`);
+          await browser.get(appUrl);
+          // accept alert if it pops up
+          const alert = await browser.getAlert();
+          await alert?.accept();
         }
 
         const currentUrl = shouldLoginIfPrompted
@@ -167,7 +133,6 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
         basePath = '',
         ensureCurrentUrl = true,
         shouldLoginIfPrompted = true,
-        shouldAcceptAlert = true,
         useActualUrl = false,
       } = {}
     ) {
@@ -180,7 +145,6 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
         appConfig,
         ensureCurrentUrl,
         shouldLoginIfPrompted,
-        shouldAcceptAlert,
         useActualUrl,
       });
     }
@@ -200,7 +164,6 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
         basePath = '',
         ensureCurrentUrl = true,
         shouldLoginIfPrompted = true,
-        shouldAcceptAlert = true,
         useActualUrl = true,
       } = {}
     ) {
@@ -214,7 +177,6 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
         appConfig,
         ensureCurrentUrl,
         shouldLoginIfPrompted,
-        shouldAcceptAlert,
         useActualUrl,
       });
     }
@@ -228,18 +190,12 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
     async navigateToActualUrl(
       appName: string,
       hash?: string,
-      {
-        basePath = '',
-        ensureCurrentUrl = true,
-        shouldLoginIfPrompted = true,
-        shouldAcceptAlert = true,
-      } = {}
+      { basePath = '', ensureCurrentUrl = true, shouldLoginIfPrompted = true } = {}
     ) {
       await this.navigateToUrl(appName, hash, {
         basePath,
         ensureCurrentUrl,
         shouldLoginIfPrompted,
-        shouldAcceptAlert,
         useActualUrl: true,
       });
     }
@@ -252,7 +208,7 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
 
     async navigateToApp(
       appName: string,
-      { basePath = '', shouldLoginIfPrompted = true, shouldAcceptAlert = true, hash = '' } = {}
+      { basePath = '', shouldLoginIfPrompted = true, hash = '' } = {}
     ) {
       let appUrl: string;
       if (config.has(['apps', appName])) {
@@ -274,7 +230,11 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
       await retry.tryForTime(defaultTryTimeout * 2, async () => {
         let lastUrl = await retry.try(async () => {
           // since we're using hash URLs, always reload first to force re-render
-          await CommonPage.navigateToUrlAndHandleAlert(appUrl, shouldAcceptAlert);
+          log.debug('navigate to: ' + appUrl);
+          await browser.get(appUrl);
+          // accept alert if it pops up
+          const alert = await browser.getAlert();
+          await alert?.accept();
           await this.sleep(700);
           log.debug('returned from get, calling refresh');
           await browser.refresh();
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index 2377c32a80b5b..00bf87621864a 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -138,7 +138,7 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
 
       await browser
         .getActions()
-        .move({ x: 200, y: 20, origin: el._webElement })
+        .move({ x: 0, y: 20, origin: el._webElement })
         .click()
         .perform();
     }
@@ -147,8 +147,8 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
       const el = await elasticChart.getCanvas();
 
       await browser.dragAndDrop(
-        { location: el, offset: { x: 200, y: 20 } },
-        { location: el, offset: { x: 400, y: 30 } }
+        { location: el, offset: { x: -300, y: 20 } },
+        { location: el, offset: { x: -100, y: 30 } }
       );
     }
 
diff --git a/test/functional/services/remote/webdriver.ts b/test/functional/services/remote/webdriver.ts
index 382543822d8ac..3bf5b865aa7ba 100644
--- a/test/functional/services/remote/webdriver.ts
+++ b/test/functional/services/remote/webdriver.ts
@@ -107,9 +107,10 @@ async function attemptToCreateCommand(
           chromeOptions.push('headless', 'disable-gpu', 'remote-debugging-port=9222');
         }
         chromeCapabilities.set('goog:chromeOptions', {
-          w3c: false,
+          w3c: true,
           args: chromeOptions,
         });
+        chromeCapabilities.set('unexpectedAlertBehaviour', 'accept');
         chromeCapabilities.set('goog:loggingPrefs', { browser: 'ALL' });
 
         const session = await new Builder()
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx
index b1959e4d68aa4..30c772bf5f634 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx
@@ -90,6 +90,7 @@ function FormRow({
             <EuiFieldNumber
               placeholder={setting.placeholder}
               value={(amount as unknown) as number}
+              min={'min' in setting ? setting.min : 1}
               onChange={e =>
                 onChange(
                   setting.key,
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx
index 52befe37ffdae..bd00bcf600ffe 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx
@@ -3,14 +3,26 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React from 'react';
+import { EuiLink, EuiText } from '@elastic/eui';
 import Mustache from 'mustache';
+import React from 'react';
+import styled from 'styled-components';
 import { CustomLink } from '../../../../../../../../plugins/apm/common/custom_link/custom_link_types';
 import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
-import {
-  SectionLinks,
-  SectionLink
-} from '../../../../../../../../plugins/observability/public';
+import { px, truncate, units } from '../../../../style/variables';
+
+const LinkContainer = styled.li`
+  margin-top: ${px(units.half)};
+  &:first-of-type {
+    margin-top: 0;
+  }
+`;
+
+const TruncateText = styled(EuiText)`
+  font-weight: 500;
+  line-height: ${px(units.unit)};
+  ${truncate(px(units.unit * 25))}
+`;
 
 export const CustomLinkSection = ({
   customLinks,
@@ -19,7 +31,7 @@ export const CustomLinkSection = ({
   customLinks: CustomLink[];
   transaction: Transaction;
 }) => (
-  <SectionLinks>
+  <ul>
     {customLinks.map(link => {
       let href = link.url;
       try {
@@ -28,13 +40,12 @@ export const CustomLinkSection = ({
         // ignores any error that happens
       }
       return (
-        <SectionLink
-          key={link.id}
-          label={link.label}
-          href={href}
-          target="_blank"
-        />
+        <LinkContainer key={link.id}>
+          <EuiLink href={href} target="_blank">
+            <TruncateText size="s">{link.label}</TruncateText>
+          </EuiLink>
+        </LinkContainer>
       );
     })}
-  </SectionLinks>
+  </ul>
 );
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/demo_rows_types.ts b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/demo_rows_types.ts
new file mode 100644
index 0000000000000..e92dc79fba8c3
--- /dev/null
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/demo_rows_types.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum DemoRows {
+  CI = 'ci',
+  SHIRTS = 'shirts',
+}
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/get_demo_rows.ts b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/get_demo_rows.ts
index 02f8efcfde95d..58a2354b5cf38 100644
--- a/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/get_demo_rows.ts
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/get_demo_rows.ts
@@ -6,14 +6,10 @@
 
 import { cloneDeep } from 'lodash';
 import ci from './ci.json';
+import { DemoRows } from './demo_rows_types';
 import shirts from './shirts.json';
 import { getFunctionErrors } from '../../../../i18n';
 
-export enum DemoRows {
-  CI = 'ci',
-  SHIRTS = 'shirts',
-}
-
 export function getDemoRows(arg: string | null) {
   if (arg === DemoRows.CI) {
     return cloneDeep(ci);
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/index.ts b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/index.ts
index 826c49d328f21..5cebae5bb669f 100644
--- a/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/index.ts
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/functions/server/demodata/index.ts
@@ -8,7 +8,8 @@ import { sortBy } from 'lodash';
 import { ExpressionFunctionDefinition } from 'src/plugins/expressions';
 // @ts-ignore unconverted lib file
 import { queryDatatable } from '../../../../common/lib/datatable/query';
-import { DemoRows, getDemoRows } from './get_demo_rows';
+import { DemoRows } from './demo_rows_types';
+import { getDemoRows } from './get_demo_rows';
 import { Filter, Datatable, DatatableColumn, DatatableRow } from '../../../../types';
 import { getFunctionHelp } from '../../../../i18n';
 
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/templates/index.ts b/x-pack/legacy/plugins/canvas/canvas_plugin_src/templates/index.ts
index eba0b47f7dc13..88d2b904e6cb3 100644
--- a/x-pack/legacy/plugins/canvas/canvas_plugin_src/templates/index.ts
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/templates/index.ts
@@ -7,7 +7,7 @@ import { applyTemplateStrings } from '../../i18n/templates';
 
 import darkTemplate from './theme_dark.json';
 import lightTemplate from './theme_light.json';
-import pitchTemplate from './pitch_presentation.json';
+// import pitchTemplate from './pitch_presentation.json';
 import statusTemplate from './status_report.json';
 import summaryTemplate from './summary_report.json';
 
@@ -15,7 +15,7 @@ import summaryTemplate from './summary_report.json';
 export const templateSpecs = applyTemplateStrings([
   darkTemplate,
   lightTemplate,
-  pitchTemplate,
+  // pitchTemplate,
   statusTemplate,
   summaryTemplate,
 ]);
diff --git a/x-pack/legacy/plugins/canvas/i18n/functions/dict/demodata.ts b/x-pack/legacy/plugins/canvas/i18n/functions/dict/demodata.ts
index caedbfdec5be4..35a5b86f752dc 100644
--- a/x-pack/legacy/plugins/canvas/i18n/functions/dict/demodata.ts
+++ b/x-pack/legacy/plugins/canvas/i18n/functions/dict/demodata.ts
@@ -8,7 +8,7 @@ import { i18n } from '@kbn/i18n';
 import { demodata } from '../../../canvas_plugin_src/functions/server/demodata';
 import { FunctionHelp } from '../function_help';
 import { FunctionFactory } from '../../../types';
-import { DemoRows } from '../../../canvas_plugin_src/functions/server/demodata/get_demo_rows';
+import { DemoRows } from '../../../canvas_plugin_src/functions/server/demodata/demo_rows_types';
 
 export const help: FunctionHelp<FunctionFactory<typeof demodata>> = {
   help: i18n.translate('xpack.canvas.functions.demodataHelpText', {
diff --git a/x-pack/legacy/plugins/canvas/i18n/templates/template_strings.ts b/x-pack/legacy/plugins/canvas/i18n/templates/template_strings.ts
index 5ab6a908641de..d8e4d51706be9 100644
--- a/x-pack/legacy/plugins/canvas/i18n/templates/template_strings.ts
+++ b/x-pack/legacy/plugins/canvas/i18n/templates/template_strings.ts
@@ -37,14 +37,6 @@ export const getTemplateStrings = (): TemplateStringDict => ({
       defaultMessage: 'Light color themed presentation deck',
     }),
   },
-  Pitch: {
-    name: i18n.translate('xpack.canvas.templates.pitchName', {
-      defaultMessage: 'Pitch',
-    }),
-    help: i18n.translate('xpack.canvas.templates.pitchHelp', {
-      defaultMessage: 'Branded presentation with large photos',
-    }),
-  },
   Status: {
     name: i18n.translate('xpack.canvas.templates.statusName', {
       defaultMessage: 'Status',
@@ -62,3 +54,14 @@ export const getTemplateStrings = (): TemplateStringDict => ({
     }),
   },
 });
+
+export const getUnusedTemplateStrings = (): TemplateStringDict => ({
+  Pitch: {
+    name: i18n.translate('xpack.canvas.templates.pitchName', {
+      defaultMessage: 'Pitch',
+    }),
+    help: i18n.translate('xpack.canvas.templates.pitchHelp', {
+      defaultMessage: 'Branded presentation with large photos',
+    }),
+  },
+});
diff --git a/x-pack/legacy/plugins/monitoring/common/constants.ts b/x-pack/legacy/plugins/monitoring/common/constants.ts
index 9a4030f3eb214..3a4c7b71dcd03 100644
--- a/x-pack/legacy/plugins/monitoring/common/constants.ts
+++ b/x-pack/legacy/plugins/monitoring/common/constants.ts
@@ -239,11 +239,15 @@ export const ALERT_TYPE_PREFIX = 'monitoring_';
  * This is the alert type id for the license expiration alert
  */
 export const ALERT_TYPE_LICENSE_EXPIRATION = `${ALERT_TYPE_PREFIX}alert_type_license_expiration`;
+/**
+ * This is the alert type id for the cluster state alert
+ */
+export const ALERT_TYPE_CLUSTER_STATE = `${ALERT_TYPE_PREFIX}alert_type_cluster_state`;
 
 /**
  * A listing of all alert types
  */
-export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION];
+export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION, ALERT_TYPE_CLUSTER_STATE];
 
 /**
  * Matches the id for the built-in in email action type
@@ -254,7 +258,7 @@ export const ALERT_ACTION_TYPE_EMAIL = '.email';
 /**
  * The number of alerts that have been migrated
  */
-export const NUMBER_OF_MIGRATED_ALERTS = 1;
+export const NUMBER_OF_MIGRATED_ALERTS = 2;
 
 /**
  * The advanced settings config name for the email address
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js b/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
index 11fcef73a4b97..95c1af5549198 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/alerts.js
@@ -6,10 +6,15 @@
 
 import React from 'react';
 import chrome from '../../np_imports/ui/chrome';
-import { capitalize } from 'lodash';
+import { capitalize, get } from 'lodash';
 import { formatDateTimeLocal } from '../../../common/formatting';
 import { formatTimestampToDuration } from '../../../common';
-import { CALCULATE_DURATION_SINCE, EUI_SORT_DESCENDING } from '../../../common/constants';
+import {
+  CALCULATE_DURATION_SINCE,
+  EUI_SORT_DESCENDING,
+  ALERT_TYPE_LICENSE_EXPIRATION,
+  ALERT_TYPE_CLUSTER_STATE,
+} from '../../../common/constants';
 import { mapSeverity } from './map_severity';
 import { FormattedAlert } from 'plugins/monitoring/components/alerts/formatted_alert';
 import { EuiMonitoringTable } from 'plugins/monitoring/components/table';
@@ -21,6 +26,8 @@ const linkToCategories = {
   'elasticsearch/indices': 'Elasticsearch Indices',
   'kibana/instances': 'Kibana Instances',
   'logstash/instances': 'Logstash Nodes',
+  [ALERT_TYPE_LICENSE_EXPIRATION]: 'License expiration',
+  [ALERT_TYPE_CLUSTER_STATE]: 'Cluster state',
 };
 const getColumns = (kbnUrl, scope, timezone) => [
   {
@@ -94,19 +101,22 @@ const getColumns = (kbnUrl, scope, timezone) => [
     }),
     field: 'message',
     sortable: true,
-    render: (message, alert) => (
-      <FormattedAlert
-        prefix={alert.prefix}
-        suffix={alert.suffix}
-        message={message}
-        metadata={alert.metadata}
-        changeUrl={target => {
-          scope.$evalAsync(() => {
-            kbnUrl.changePath(target);
-          });
-        }}
-      />
-    ),
+    render: (_message, alert) => {
+      const message = get(alert, 'message.text', get(alert, 'message', ''));
+      return (
+        <FormattedAlert
+          prefix={alert.prefix}
+          suffix={alert.suffix}
+          message={message}
+          metadata={alert.metadata}
+          changeUrl={target => {
+            scope.$evalAsync(() => {
+              kbnUrl.changePath(target);
+            });
+          }}
+        />
+      );
+    },
   },
   {
     name: i18n.translate('xpack.monitoring.alerts.categoryColumnTitle', {
@@ -148,8 +158,8 @@ const getColumns = (kbnUrl, scope, timezone) => [
 export const Alerts = ({ alerts, angular, sorting, pagination, onTableChange }) => {
   const alertsFlattened = alerts.map(alert => ({
     ...alert,
-    status: alert.metadata.severity,
-    category: alert.metadata.link,
+    status: get(alert, 'metadata.severity', get(alert, 'severity', 0)),
+    category: get(alert, 'metadata.link', get(alert, 'type', null)),
   }));
 
   const injector = chrome.dangerouslyGetActiveInjector();
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
index 258a5b68db372..d3cf4b463a2cc 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.test.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { kfetch } from 'ui/kfetch';
 import { AlertsStatus, AlertsStatusProps } from './status';
-import { ALERT_TYPE_PREFIX } from '../../../common/constants';
+import { ALERT_TYPES } from '../../../common/constants';
 import { getSetupModeState } from '../../lib/setup_mode';
 import { mockUseEffects } from '../../jest.helpers';
 
@@ -63,11 +63,7 @@ describe('Status', () => {
 
   it('should render a success message if all alerts have been migrated and in setup mode', async () => {
     (kfetch as jest.Mock).mockReturnValue({
-      data: [
-        {
-          alertTypeId: ALERT_TYPE_PREFIX,
-        },
-      ],
+      data: ALERT_TYPES.map(type => ({ alertTypeId: type })),
     });
 
     (getSetupModeState as jest.Mock).mockReturnValue({
diff --git a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
index 072a98b123452..5f5329bf7fff8 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
+++ b/x-pack/legacy/plugins/monitoring/public/components/alerts/status.tsx
@@ -142,7 +142,7 @@ export const AlertsStatus: React.FC<AlertsStatusProps> = (props: AlertsStatusPro
       );
     }
 
-    const allMigrated = kibanaAlerts.length === NUMBER_OF_MIGRATED_ALERTS;
+    const allMigrated = kibanaAlerts.length >= NUMBER_OF_MIGRATED_ALERTS;
     if (allMigrated) {
       if (setupModeEnabled) {
         return (
diff --git a/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js b/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
index 8455fb8cf3088..d87ff98e79be0 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/cluster/overview/alerts_panel.js
@@ -6,14 +6,12 @@
 
 import React, { Fragment } from 'react';
 import moment from 'moment-timezone';
-import chrome from '../../../np_imports/ui/chrome';
 import { FormattedAlert } from 'plugins/monitoring/components/alerts/formatted_alert';
 import { mapSeverity } from 'plugins/monitoring/components/alerts/map_severity';
 import { formatTimestampToDuration } from '../../../../common/format_timestamp_to_duration';
 import {
   CALCULATE_DURATION_SINCE,
   KIBANA_ALERTING_ENABLED,
-  ALERT_TYPE_LICENSE_EXPIRATION,
   CALCULATE_DURATION_UNTIL,
 } from '../../../../common/constants';
 import { formatDateTimeLocal } from '../../../../common/formatting';
@@ -31,6 +29,37 @@ import {
   EuiLink,
 } from '@elastic/eui';
 
+function replaceTokens(alert) {
+  if (!alert.message.tokens) {
+    return alert.message.text;
+  }
+
+  let text = alert.message.text;
+
+  for (const token of alert.message.tokens) {
+    if (token.type === 'time') {
+      text = text.replace(
+        token.startToken,
+        token.isRelative
+          ? formatTimestampToDuration(alert.expirationTime, CALCULATE_DURATION_UNTIL)
+          : moment.tz(alert.expirationTime, moment.tz.guess()).format('LLL z')
+      );
+    } else if (token.type === 'link') {
+      const linkPart = new RegExp(`${token.startToken}(.+?)${token.endToken}`).exec(text);
+      // TODO: we assume this is at the end, which works for now but will not always work
+      const nonLinkText = text.replace(linkPart[0], '');
+      text = (
+        <Fragment>
+          {nonLinkText}
+          <EuiLink href={`#${token.url}`}>{linkPart[1]}</EuiLink>
+        </Fragment>
+      );
+    }
+  }
+
+  return text;
+}
+
 export function AlertsPanel({ alerts, changeUrl }) {
   const goToAlerts = () => changeUrl('/alerts');
 
@@ -58,9 +87,6 @@ export function AlertsPanel({ alerts, changeUrl }) {
       severityIcon.iconType = 'check';
     }
 
-    const injector = chrome.dangerouslyGetActiveInjector();
-    const timezone = injector.get('config').get('dateFormat:tz');
-
     return (
       <EuiCallOut
         key={`alert-item-${index}`}
@@ -83,7 +109,7 @@ export function AlertsPanel({ alerts, changeUrl }) {
               id="xpack.monitoring.cluster.overview.alertsPanel.lastCheckedTimeText"
               defaultMessage="Last checked {updateDateTime} (triggered {duration} ago)"
               values={{
-                updateDateTime: formatDateTimeLocal(item.update_timestamp, timezone),
+                updateDateTime: formatDateTimeLocal(item.update_timestamp),
                 duration: formatTimestampToDuration(item.timestamp, CALCULATE_DURATION_SINCE),
               }}
             />
@@ -96,14 +122,7 @@ export function AlertsPanel({ alerts, changeUrl }) {
   const alertsList = KIBANA_ALERTING_ENABLED
     ? alerts.map((alert, idx) => {
         const callOutProps = mapSeverity(alert.severity);
-        let message = alert.message
-          // scan message prefix and replace relative times
-          // \w: Matches any alphanumeric character from the basic Latin alphabet, including the underscore. Equivalent to [A-Za-z0-9_].
-          .replace(
-            '#relative',
-            formatTimestampToDuration(alert.expirationTime, CALCULATE_DURATION_UNTIL)
-          )
-          .replace('#absolute', moment.tz(alert.expirationTime, moment.tz.guess()).format('LLL z'));
+        const message = replaceTokens(alert);
 
         if (!alert.isFiring) {
           callOutProps.title = i18n.translate(
@@ -118,22 +137,30 @@ export function AlertsPanel({ alerts, changeUrl }) {
           );
           callOutProps.color = 'success';
           callOutProps.iconType = 'check';
-        } else {
-          if (alert.type === ALERT_TYPE_LICENSE_EXPIRATION) {
-            message = (
-              <Fragment>
-                {message}
-                &nbsp;
-                <EuiLink href="#license">Please update your license</EuiLink>
-              </Fragment>
-            );
-          }
         }
 
         return (
-          <EuiCallOut key={idx} {...callOutProps}>
-            <p>{message}</p>
-          </EuiCallOut>
+          <Fragment key={idx}>
+            <EuiCallOut {...callOutProps}>
+              <p>{message}</p>
+              <EuiText size="xs">
+                <p data-test-subj="alertMeta" className="monCallout--meta">
+                  <FormattedMessage
+                    id="xpack.monitoring.cluster.overview.alertsPanel.lastCheckedTimeText"
+                    defaultMessage="Last checked {updateDateTime} (triggered {duration} ago)"
+                    values={{
+                      updateDateTime: formatDateTimeLocal(alert.lastCheckedMS),
+                      duration: formatTimestampToDuration(
+                        alert.triggeredMS,
+                        CALCULATE_DURATION_SINCE
+                      ),
+                    }}
+                  />
+                </p>
+              </EuiText>
+            </EuiCallOut>
+            <EuiSpacer />
+          </Fragment>
         );
       })
     : alerts.map((item, index) => (
diff --git a/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js b/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
index 7c065a78a8af9..62cc985887e9f 100644
--- a/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
+++ b/x-pack/legacy/plugins/monitoring/public/views/alerts/index.js
@@ -18,25 +18,37 @@ import { Alerts } from '../../components/alerts';
 import { MonitoringViewBaseEuiTableController } from '../base_eui_table_controller';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiPage, EuiPageBody, EuiPageContent, EuiSpacer, EuiLink } from '@elastic/eui';
-import { CODE_PATH_ALERTS } from '../../../common/constants';
+import { CODE_PATH_ALERTS, KIBANA_ALERTING_ENABLED } from '../../../common/constants';
 
 function getPageData($injector) {
   const globalState = $injector.get('globalState');
   const $http = $injector.get('$http');
   const Private = $injector.get('Private');
-  const url = `../api/monitoring/v1/clusters/${globalState.cluster_uuid}/legacy_alerts`;
+  const url = KIBANA_ALERTING_ENABLED
+    ? `../api/monitoring/v1/alert_status`
+    : `../api/monitoring/v1/clusters/${globalState.cluster_uuid}/legacy_alerts`;
 
   const timeBounds = timefilter.getBounds();
+  const data = {
+    timeRange: {
+      min: timeBounds.min.toISOString(),
+      max: timeBounds.max.toISOString(),
+    },
+  };
+
+  if (!KIBANA_ALERTING_ENABLED) {
+    data.ccs = globalState.ccs;
+  }
 
   return $http
-    .post(url, {
-      ccs: globalState.ccs,
-      timeRange: {
-        min: timeBounds.min.toISOString(),
-        max: timeBounds.max.toISOString(),
-      },
+    .post(url, data)
+    .then(response => {
+      const result = get(response, 'data', []);
+      if (KIBANA_ALERTING_ENABLED) {
+        return result.alerts;
+      }
+      return result;
     })
-    .then(response => get(response, 'data', []))
     .catch(err => {
       const ajaxErrorHandlers = Private(ajaxErrorHandlersProvider);
       return ajaxErrorHandlers(err);
diff --git a/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts b/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts
index bc559c5ac4972..f89d21ef1aeb1 100644
--- a/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/types.ts
@@ -70,7 +70,7 @@ const MetaRule = t.intersection([
   }),
   t.partial({
     throttle: t.string,
-    kibanaSiemAppUrl: t.string,
+    kibana_siem_app_url: t.string,
   }),
 ]);
 
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
index efb601b6bd207..8d793f39afa99 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
@@ -515,7 +515,7 @@ describe('helpers', () => {
         actions: [],
         enabled: false,
         meta: {
-          kibanaSiemAppUrl: 'http://localhost:5601/app/siem',
+          kibana_siem_app_url: 'http://localhost:5601/app/siem',
         },
         throttle: 'no_actions',
       };
@@ -533,7 +533,7 @@ describe('helpers', () => {
         actions: [],
         enabled: false,
         meta: {
-          kibanaSiemAppUrl: mockStepData.kibanaSiemAppUrl,
+          kibana_siem_app_url: mockStepData.kibanaSiemAppUrl,
         },
         throttle: 'no_actions',
       };
@@ -566,7 +566,7 @@ describe('helpers', () => {
         ],
         enabled: false,
         meta: {
-          kibanaSiemAppUrl: mockStepData.kibanaSiemAppUrl,
+          kibana_siem_app_url: mockStepData.kibanaSiemAppUrl,
         },
         throttle: 'rule',
       };
@@ -599,7 +599,7 @@ describe('helpers', () => {
         ],
         enabled: false,
         meta: {
-          kibanaSiemAppUrl: mockStepData.kibanaSiemAppUrl,
+          kibana_siem_app_url: mockStepData.kibanaSiemAppUrl,
         },
         throttle: mockStepData.throttle,
       };
@@ -631,7 +631,7 @@ describe('helpers', () => {
         ],
         enabled: false,
         meta: {
-          kibanaSiemAppUrl: mockStepData.kibanaSiemAppUrl,
+          kibana_siem_app_url: mockStepData.kibanaSiemAppUrl,
         },
         throttle: 'no_actions',
       };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
index 151e3a9bdf4d6..7ad116c313361 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
@@ -155,7 +155,7 @@ export const formatActionsStepData = (actionsStepData: ActionsStepRule): Actions
     enabled,
     throttle: actions.length ? throttle : NOTIFICATION_THROTTLE_NO_ACTIONS,
     meta: {
-      kibanaSiemAppUrl,
+      kibana_siem_app_url: kibanaSiemAppUrl,
     },
   };
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
index db1f2298b5ea7..58a1b0fd3133e 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
@@ -64,7 +64,7 @@ export const getActionsStepsData = (
     actions: actions?.map(transformRuleToAlertAction),
     isNew: false,
     throttle,
-    kibanaSiemAppUrl: meta?.kibanaSiemAppUrl,
+    kibanaSiemAppUrl: meta?.kibana_siem_app_url,
     enabled,
   };
 };
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts
index 189c596a77125..c6923283bec16 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts
@@ -41,6 +41,7 @@ describe('buildSignalsSearchQuery', () => {
                   '@timestamp': {
                     gt: from,
                     lte: to,
+                    format: 'epoch_millis',
                   },
                 },
               },
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts
index b973d4c5f4e98..be0943c014225 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts
@@ -32,6 +32,7 @@ export const buildSignalsSearchQuery = ({ ruleId, index, from, to }: BuildSignal
               '@timestamp': {
                 gt: from,
                 lte: to,
+                format: 'epoch_millis',
               },
             },
           },
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
index 546488caa5ee7..ced81098c9f8e 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
@@ -53,7 +53,7 @@ export const rulesNotificationAlertType = ({
       from: fromInMs,
       to: toInMs,
       index: ruleParams.outputIndex,
-      ruleId: ruleParams.ruleId!,
+      ruleId: ruleParams.ruleId,
       callCluster: services.callCluster,
     });
 
@@ -61,14 +61,14 @@ export const rulesNotificationAlertType = ({
       from: fromInMs,
       to: toInMs,
       id: ruleAlertSavedObject.id,
-      kibanaSiemAppUrl: ruleAlertParams.meta?.kibanaSiemAppUrl as string,
+      kibanaSiemAppUrl: ruleAlertParams.meta?.kibana_siem_app_url,
     });
 
     logger.info(
       `Found ${signalsCount} signals using signal rule name: "${ruleParams.name}", id: "${params.ruleAlertId}", rule_id: "${ruleParams.ruleId}" in "${ruleParams.outputIndex}" index`
     );
 
-    if (signalsCount) {
+    if (signalsCount !== 0) {
       const alertInstance = services.alertInstanceFactory(alertId);
       scheduleNotificationActions({ alertInstance, signalsCount, resultsLink, ruleParams });
     }
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts
index 749b892ef506f..9f145af79ca90 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts
@@ -8,7 +8,7 @@ import { mapKeys, snakeCase } from 'lodash/fp';
 import { AlertInstance } from '../../../../../../../plugins/alerting/server';
 import { RuleTypeParams } from '../types';
 
-type NotificationRuleTypeParams = RuleTypeParams & {
+export type NotificationRuleTypeParams = RuleTypeParams & {
   name: string;
   id: string;
 };
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts
index 5dc7e7fc30b7f..c91c4490e8eba 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts
@@ -10,7 +10,7 @@ export const getNotificationResultsLink = ({
   from,
   to,
 }: {
-  kibanaSiemAppUrl: string;
+  kibanaSiemAppUrl?: string;
   id: string;
   from?: string;
   to?: string;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
index 85255594ee480..8c0fceb7a5f29 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_bulk_route.ts
@@ -121,15 +121,15 @@ export const patchRulesBulkRoute = (router: IRouter) => {
               anomalyThreshold,
               machineLearningJobId,
             });
-            if (rule != null) {
+            if (rule != null && rule.enabled != null && rule.name != null) {
               const ruleActions = await updateRulesNotifications({
                 ruleAlertId: rule.id,
                 alertsClient,
                 savedObjectsClient,
-                enabled: rule.enabled!,
+                enabled: rule.enabled,
                 actions,
                 throttle,
-                name: rule.name!,
+                name: rule.name,
               });
               const ruleStatuses = await savedObjectsClient.find<
                 IRuleSavedAttributesSavedObjectAttributes
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts
index f553ccd2c6f81..9c5000d70e5fe 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/patch_rules_route.ts
@@ -117,15 +117,15 @@ export const patchRulesRoute = (router: IRouter) => {
           anomalyThreshold,
           machineLearningJobId,
         });
-        if (rule != null) {
+        if (rule != null && rule.enabled != null && rule.name != null) {
           const ruleActions = await updateRulesNotifications({
             ruleAlertId: rule.id,
             alertsClient,
             savedObjectsClient,
-            enabled: rule.enabled!,
+            enabled: rule.enabled,
             actions,
             throttle,
-            name: rule.name!,
+            name: rule.name,
           });
           const ruleStatuses = await savedObjectsClient.find<
             IRuleSavedAttributesSavedObjectAttributes
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
index 8d7360bae8eb9..e4015ad8bafa4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
@@ -309,7 +309,7 @@ export const validateLicenseForRuleType = ({
 }: {
   license: ILicense;
   ruleType: RuleType;
-}) => {
+}): void => {
   if (isMlRule(ruleType) && !license.hasAtLeast(MINIMUM_ML_LICENSE)) {
     const message = i18n.translate('xpack.siem.licensing.unsupportedMachineLearningMessage', {
       defaultMessage:
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/create_rule_actions_saved_object.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/create_rule_actions_saved_object.ts
index 23c99b36cb4a7..97cfc1d2d9ea7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/create_rule_actions_saved_object.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/create_rule_actions_saved_object.ts
@@ -14,7 +14,7 @@ interface CreateRuleActionsSavedObject {
   ruleAlertId: string;
   savedObjectsClient: AlertServices['savedObjectsClient'];
   actions: RuleAlertAction[] | undefined;
-  throttle: string | undefined;
+  throttle: string | null | undefined;
 }
 
 export const createRuleActionsSavedObject = async ({
@@ -22,7 +22,12 @@ export const createRuleActionsSavedObject = async ({
   savedObjectsClient,
   actions = [],
   throttle,
-}: CreateRuleActionsSavedObject) => {
+}: CreateRuleActionsSavedObject): Promise<{
+  id: string;
+  actions: RuleAlertAction[];
+  alertThrottle: string | null;
+  ruleThrottle: string;
+}> => {
   const ruleActionsSavedObject = await savedObjectsClient.create<
     IRuleActionsAttributesSavedObjectAttributes
   >(ruleActionsSavedObjectType, {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/delete_rule_actions_saved_object.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/delete_rule_actions_saved_object.ts
index 4e8781dd45692..864281da5bafd 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/delete_rule_actions_saved_object.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/delete_rule_actions_saved_object.ts
@@ -16,7 +16,7 @@ interface DeleteRuleActionsSavedObject {
 export const deleteRuleActionsSavedObject = async ({
   ruleAlertId,
   savedObjectsClient,
-}: DeleteRuleActionsSavedObject) => {
+}: DeleteRuleActionsSavedObject): Promise<{} | null> => {
   const ruleActions = await getRuleActionsSavedObject({ ruleAlertId, savedObjectsClient });
 
   if (!ruleActions) return null;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/get_rule_actions_saved_object.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/get_rule_actions_saved_object.ts
index 3ae9090526d69..61b544db5a18a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/get_rule_actions_saved_object.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/get_rule_actions_saved_object.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
 import { AlertServices } from '../../../../../../../plugins/alerting/server';
 import { ruleActionsSavedObjectType } from './saved_object_mappings';
 import { IRuleActionsAttributesSavedObjectAttributes } from './types';
@@ -17,7 +18,12 @@ interface GetRuleActionsSavedObject {
 export const getRuleActionsSavedObject = async ({
   ruleAlertId,
   savedObjectsClient,
-}: GetRuleActionsSavedObject) => {
+}: GetRuleActionsSavedObject): Promise<{
+  id: string;
+  actions: RuleAlertAction[];
+  alertThrottle: string | null;
+  ruleThrottle: string;
+} | null> => {
   const { saved_objects } = await savedObjectsClient.find<
     IRuleActionsAttributesSavedObjectAttributes
   >({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_or_create_rule_actions_saved_object.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_or_create_rule_actions_saved_object.ts
index 3856f75255262..adc87150f89a7 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_or_create_rule_actions_saved_object.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_or_create_rule_actions_saved_object.ts
@@ -15,7 +15,7 @@ interface UpdateOrCreateRuleActionsSavedObject {
   ruleAlertId: string;
   savedObjectsClient: AlertServices['savedObjectsClient'];
   actions: RuleAlertAction[] | undefined;
-  throttle: string | undefined;
+  throttle: string | null | undefined;
 }
 
 export const updateOrCreateRuleActionsSavedObject = async ({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_rule_actions_saved_object.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_rule_actions_saved_object.ts
index 56bce3c8b67a3..a15005110c56b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_rule_actions_saved_object.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/update_rule_actions_saved_object.ts
@@ -15,7 +15,7 @@ interface DeleteRuleActionsSavedObject {
   ruleAlertId: string;
   savedObjectsClient: AlertServices['savedObjectsClient'];
   actions: RuleAlertAction[] | undefined;
-  throttle: string | undefined;
+  throttle: string | null | undefined;
 }
 
 export const updateRuleActionsSavedObject = async ({
@@ -23,7 +23,12 @@ export const updateRuleActionsSavedObject = async ({
   savedObjectsClient,
   actions,
   throttle,
-}: DeleteRuleActionsSavedObject) => {
+}: DeleteRuleActionsSavedObject): Promise<{
+  ruleThrottle: string;
+  alertThrottle: string | null;
+  actions: RuleAlertAction[];
+  id: string;
+} | null> => {
   const ruleActions = await getRuleActionsSavedObject({ ruleAlertId, savedObjectsClient });
 
   if (!ruleActions) return null;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/utils.ts
index 3c297ed848555..554c2b4a3dd90 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/utils.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rule_actions/utils.ts
@@ -5,16 +5,27 @@
  */
 
 import { SavedObjectsUpdateResponse } from 'kibana/server';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
 import { IRuleActionsAttributesSavedObjectAttributes } from './types';
 
-export const getThrottleOptions = (throttle = 'no_actions') => ({
-  ruleThrottle: throttle,
-  alertThrottle: ['no_actions', 'rule'].includes(throttle) ? null : throttle,
+export const getThrottleOptions = (
+  throttle: string | undefined | null = 'no_actions'
+): {
+  ruleThrottle: string;
+  alertThrottle: string | null;
+} => ({
+  ruleThrottle: throttle ?? 'no_actions',
+  alertThrottle: ['no_actions', 'rule'].includes(throttle ?? 'no_actions') ? null : throttle,
 });
 
 export const getRuleActionsFromSavedObject = (
   savedObject: SavedObjectsUpdateResponse<IRuleActionsAttributesSavedObjectAttributes>
-) => ({
+): {
+  id: string;
+  actions: RuleAlertAction[];
+  alertThrottle: string | null;
+  ruleThrottle: string;
+} => ({
   id: savedObject.id,
   actions: savedObject.attributes.actions || [],
   alertThrottle: savedObject.attributes.alertThrottle || null,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rule_actions.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rule_actions.ts
index ac10143c1d8d0..e6ee1e6a29764 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rule_actions.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rule_actions.ts
@@ -4,7 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertsClient, AlertServices } from '../../../../../../../plugins/alerting/server';
+import {
+  AlertsClient,
+  AlertServices,
+  PartialAlert,
+} from '../../../../../../../plugins/alerting/server';
 import { getRuleActionsSavedObject } from '../rule_actions/get_rule_actions_saved_object';
 import { readRules } from './read_rules';
 import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
@@ -19,7 +23,7 @@ export const updateRuleActions = async ({
   alertsClient,
   savedObjectsClient,
   ruleAlertId,
-}: UpdateRuleActions) => {
+}: UpdateRuleActions): Promise<PartialAlert | null> => {
   const rule = await readRules({ alertsClient, id: ruleAlertId });
   if (rule == null) {
     return null;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts
index f70c591243a76..bb66a5ee1342f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules_notifications.ts
@@ -9,13 +9,14 @@ import { AlertsClient, AlertServices } from '../../../../../../../plugins/alerti
 import { updateOrCreateRuleActionsSavedObject } from '../rule_actions/update_or_create_rule_actions_saved_object';
 import { updateNotifications } from '../notifications/update_notifications';
 import { updateRuleActions } from './update_rule_actions';
+import { RuleActions } from '../rule_actions/types';
 
 interface UpdateRulesNotifications {
   alertsClient: AlertsClient;
   savedObjectsClient: AlertServices['savedObjectsClient'];
   ruleAlertId: string;
   actions: RuleAlertAction[] | undefined;
-  throttle: string | undefined;
+  throttle: string | null | undefined;
   enabled: boolean;
   name: string;
 }
@@ -28,7 +29,7 @@ export const updateRulesNotifications = async ({
   enabled,
   name,
   throttle,
-}: UpdateRulesNotifications) => {
+}: UpdateRulesNotifications): Promise<RuleActions> => {
   const ruleActions = await updateOrCreateRuleActionsSavedObject({
     savedObjectsClient,
     ruleAlertId,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
index 11d31f1805440..3d6f443ce60d6 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
@@ -47,7 +47,7 @@ const getPayload = (
     interval: ruleAlert.schedule.interval,
     name: ruleAlert.name,
     tags: ruleAlert.tags,
-    throttle: ruleAlert.throttle!,
+    throttle: ruleAlert.throttle,
     scrollSize: 10,
     scrollLock: '0',
   },
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 417fcbbe42a56..faac4a547fc17 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -24,7 +24,10 @@ import { signalParamsSchema } from './signal_params_schema';
 import { siemRuleActionGroups } from './siem_rule_action_groups';
 import { findMlSignals } from './find_ml_signals';
 import { bulkCreateMlSignals } from './bulk_create_ml_signals';
-import { scheduleNotificationActions } from '../notifications/schedule_notification_actions';
+import {
+  scheduleNotificationActions,
+  NotificationRuleTypeParams,
+} from '../notifications/schedule_notification_actions';
 import { ruleStatusServiceFactory } from './rule_status_service';
 import { buildRuleMessageFactory } from './rule_messages';
 import { ruleStatusSavedObjectsClientFactory } from './rule_status_saved_objects_client';
@@ -246,7 +249,7 @@ export const signalRulesAlertType = ({
 
         if (result.success) {
           if (actions.length) {
-            const notificationRuleParams = {
+            const notificationRuleParams: NotificationRuleTypeParams = {
               ...ruleParams,
               name,
               id: savedObject.id,
@@ -259,7 +262,7 @@ export const signalRulesAlertType = ({
               from: fromInMs,
               to: toInMs,
               id: savedObject.id,
-              kibanaSiemAppUrl: meta?.kibanaSiemAppUrl as string,
+              kibanaSiemAppUrl: meta?.kibana_siem_app_url,
             });
 
             logger.info(
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
index 543e8bf0619b0..d4469351de544 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
@@ -162,5 +162,5 @@ export interface AlertAttributes {
 }
 
 export interface RuleAlertAttributes extends AlertAttributes {
-  params: RuleAlertParams;
+  params: Omit<RuleAlertParams, 'ruleId'> & { ruleId: string };
 }
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
index efa0a92cc573b..d3fa98fd73d3a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
@@ -29,6 +29,11 @@ export interface ThreatParams {
 // We don't have the input types defined through io-ts just yet but as we being introducing types from there we will more and more remove
 // types and share them between input and output schema but have an input Rule Schema and an output Rule Schema.
 
+export interface Meta {
+  [key: string]: {} | string | undefined | null;
+  kibana_siem_app_url?: string | undefined;
+}
+
 export interface RuleAlertParams {
   actions: RuleAlertAction[];
   anomalyThreshold: number | undefined;
@@ -51,7 +56,7 @@ export interface RuleAlertParams {
   query: string | undefined | null;
   references: string[];
   savedId?: string | undefined | null;
-  meta: Record<string, {} | string> | undefined | null;
+  meta: Meta | undefined | null;
   severity: string;
   tags: string[];
   to: string;
@@ -60,7 +65,7 @@ export interface RuleAlertParams {
   threat: ThreatParams[] | undefined | null;
   type: RuleType;
   version: number;
-  throttle: string;
+  throttle: string | undefined | null;
   lists: ListsDefaultArraySchema | null | undefined;
 }
 
diff --git a/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts b/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts
index 447e529c9c199..d6520ae150539 100644
--- a/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts
@@ -10,7 +10,8 @@ interface AmountAndUnit {
 }
 
 export function amountAndUnitToObject(value: string): AmountAndUnit {
-  const [, amount = '', unit = ''] = value.match(/(\d+)?(\w+)?/) || [];
+  // matches any postive and negative number and its unit.
+  const [, amount = '', unit = ''] = value.match(/(^-?\d+)?(\w+)?/) || [];
   return { amount, unit };
 }
 
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts
index a83ee9262cad6..98d0cb5f028c3 100644
--- a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts
@@ -10,24 +10,56 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { durationRt } from './duration_rt';
+import { durationRt, getDurationRt } from './duration_rt';
 import { isRight } from 'fp-ts/lib/Either';
 
 describe('durationRt', () => {
   describe('it should not accept', () => {
-    [undefined, null, '', 0, 'foo', true, false, '100', 's', 'm', '0h'].map(
+    [
+      undefined,
+      null,
+      '',
+      0,
+      'foo',
+      true,
+      false,
+      '100',
+      's',
+      'm',
+      '0ms',
+      '-1ms'
+    ].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(durationRt.decode(input))).toBe(false);
+      });
+    });
+  });
+
+  describe('it should accept', () => {
+    ['1000ms', '2s', '3m', '1s'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(durationRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
+
+describe('getDurationRt', () => {
+  const customDurationRt = getDurationRt({ min: -1 });
+  describe('it should not accept', () => {
+    [undefined, null, '', 0, 'foo', true, false, '100', 's', 'm', '-2ms'].map(
       input => {
         it(`${JSON.stringify(input)}`, () => {
-          expect(isRight(durationRt.decode(input))).toBe(false);
+          expect(isRight(customDurationRt.decode(input))).toBe(false);
         });
       }
     );
   });
 
-  describe('It should accept', () => {
-    ['1000ms', '2s', '3m'].map(input => {
+  describe('it should accept', () => {
+    ['1000ms', '2s', '3m', '1s', '-1s', '0ms'].map(input => {
       it(`${JSON.stringify(input)}`, () => {
-        expect(isRight(durationRt.decode(input))).toBe(true);
+        expect(isRight(customDurationRt.decode(input))).toBe(true);
       });
     });
   });
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts
index 383fd69be9a78..b691276854fb0 100644
--- a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts
@@ -10,24 +10,28 @@ import { amountAndUnitToObject } from '../amount_and_unit';
 
 export const DURATION_UNITS = ['ms', 's', 'm'];
 
-export const durationRt = new t.Type<string, string, unknown>(
-  'durationRt',
-  t.string.is,
-  (input, context) => {
-    return either.chain(t.string.validate(input, context), inputAsString => {
-      const { amount, unit } = amountAndUnitToObject(inputAsString);
-      const amountAsInt = parseInt(amount, 10);
-      const isValidUnit = DURATION_UNITS.includes(unit);
-      const isValid = amountAsInt > 0 && isValidUnit;
+export function getDurationRt({ min }: { min: number }) {
+  return new t.Type<string, string, unknown>(
+    'durationRt',
+    t.string.is,
+    (input, context) => {
+      return either.chain(t.string.validate(input, context), inputAsString => {
+        const { amount, unit } = amountAndUnitToObject(inputAsString);
+        const amountAsInt = parseInt(amount, 10);
+        const isValidUnit = DURATION_UNITS.includes(unit);
+        const isValid = amountAsInt >= min && isValidUnit;
 
-      return isValid
-        ? t.success(inputAsString)
-        : t.failure(
-            input,
-            context,
-            `Must have numeric amount and a valid unit (${DURATION_UNITS})`
-          );
-    });
-  },
-  t.identity
-);
+        return isValid
+          ? t.success(inputAsString)
+          : t.failure(
+              input,
+              context,
+              `Must have numeric amount and a valid unit (${DURATION_UNITS})`
+            );
+      });
+    },
+    t.identity
+  );
+}
+
+export const durationRt = getDurationRt({ min: 1 });
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
index 4b74b07fc8e27..bc435179762a2 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
@@ -118,6 +118,7 @@ Array [
   },
   Object {
     "key": "span_frames_min_duration",
+    "min": -1,
     "type": "duration",
     "units": Array [
       "ms",
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
index 152db37a1bff3..f1d11c5c70c2b 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
@@ -8,6 +8,7 @@ import { i18n } from '@kbn/i18n';
 import { getIntegerRt } from '../runtime_types/integer_rt';
 import { captureBodyRt } from '../runtime_types/capture_body_rt';
 import { RawSettingDefinition } from './types';
+import { getDurationRt } from '../runtime_types/duration_rt';
 
 /*
  * Settings added here will show up in the UI and will be validated on the client and server
@@ -143,6 +144,7 @@ export const generalSettings: RawSettingDefinition[] = [
   {
     key: 'span_frames_min_duration',
     type: 'duration',
+    validation: getDurationRt({ min: -1 }),
     defaultValue: '5ms',
     label: i18n.translate('xpack.apm.agentConfig.spanFramesMinDuration.label', {
       defaultMessage: 'Span frames minimum duration'
@@ -154,7 +156,8 @@ export const generalSettings: RawSettingDefinition[] = [
           'In its default settings, the APM agent will collect a stack trace with every recorded span.\nWhile this is very helpful to find the exact place in your code that causes the span, collecting this stack trace does have some overhead. \nWhen setting this option to a negative value, like `-1ms`, stack traces will be collected for all spans. Setting it to a positive value, e.g. `5ms`, will limit stack trace collection to spans with durations equal to or longer than the given value, e.g. 5 milliseconds.\n\nTo disable stack trace collection for spans completely, set the value to `0ms`.'
       }
     ),
-    excludeAgents: ['js-base', 'rum-js', 'nodejs']
+    excludeAgents: ['js-base', 'rum-js', 'nodejs'],
+    min: -1
   },
 
   // STACK_TRACE_LIMIT
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts
index 6b584fc7e2048..282ced346dda0 100644
--- a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts
@@ -91,6 +91,7 @@ interface BytesSetting extends BaseSetting {
 interface DurationSetting extends BaseSetting {
   type: 'duration';
   units?: string[];
+  min?: number;
 }
 
 export type RawSettingDefinition =
diff --git a/x-pack/plugins/endpoint/common/generate_data.ts b/x-pack/plugins/endpoint/common/generate_data.ts
index 0ec105129b7ac..7c24bd9d77148 100644
--- a/x-pack/plugins/endpoint/common/generate_data.ts
+++ b/x-pack/plugins/endpoint/common/generate_data.ts
@@ -7,6 +7,11 @@
 import uuid from 'uuid';
 import seedrandom from 'seedrandom';
 import { AlertEvent, EndpointEvent, HostMetadata, OSFields, HostFields } from './types';
+// FIXME: move types/model to top-level
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { PolicyData } from '../public/applications/endpoint/types';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { generatePolicy } from '../public/applications/endpoint/models/policy';
 
 export type Event = AlertEvent | EndpointEvent;
 
@@ -452,6 +457,39 @@ export class EndpointDocGenerator {
     }
   }
 
+  /**
+   * Generates an Ingest `datasource` that includes the Endpoint Policy data
+   */
+  public generatePolicyDatasource(): PolicyData {
+    return {
+      id: this.seededUUIDv4(),
+      name: 'Endpoint Policy',
+      description: 'Policy to protect the worlds data',
+      config_id: this.seededUUIDv4(),
+      enabled: true,
+      output_id: '',
+      inputs: [
+        {
+          type: 'endpoint',
+          enabled: true,
+          streams: [],
+          config: {
+            policy: {
+              value: generatePolicy(),
+            },
+          },
+        },
+      ],
+      namespace: 'default',
+      package: {
+        name: 'endpoint',
+        title: 'Elastic Endpoint',
+        version: '1.0.0',
+      },
+      revision: 1,
+    };
+  }
+
   private randomN(n: number): number {
     return Math.floor(this.random() * n);
   }
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
index fa9055e0d9bbd..89a6302351a54 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
@@ -7,13 +7,9 @@
 import * as React from 'react';
 import ReactDOM from 'react-dom';
 import { CoreStart, AppMountParameters, ScopedHistory } from 'kibana/public';
-import { I18nProvider, FormattedMessage } from '@kbn/i18n/react';
-import { Route, Switch, Router } from 'react-router-dom';
-import { Provider } from 'react-redux';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { Route, Switch } from 'react-router-dom';
 import { Store } from 'redux';
-import { useObservable } from 'react-use';
-import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
-import { RouteCapture } from './view/route_capture';
 import { EndpointPluginStartDependencies } from '../../plugin';
 import { appStoreFactory } from './store';
 import { AlertIndex } from './view/alerts';
@@ -21,7 +17,7 @@ import { HostList } from './view/hosts';
 import { PolicyList } from './view/policy';
 import { PolicyDetails } from './view/policy';
 import { HeaderNavigation } from './components/header_nav';
-import { EuiThemeProvider } from '../../../../../legacy/common/eui_styled_components';
+import { AppRootProvider } from './view/app_root_provider';
 
 /**
  * This module will be loaded asynchronously to reduce the bundle size of your plugin's main bundle.
@@ -49,54 +45,31 @@ interface RouterProps {
 }
 
 const AppRoot: React.FunctionComponent<RouterProps> = React.memo(
-  ({
-    history,
-    store,
-    coreStart: { http, notifications, uiSettings, application },
-    depsStart: { data },
-  }) => {
-    const isDarkMode = useObservable<boolean>(uiSettings.get$('theme:darkMode'));
-
+  ({ history, store, coreStart, depsStart }) => {
     return (
-      <Provider store={store}>
-        <I18nProvider>
-          <KibanaContextProvider services={{ http, notifications, application, data }}>
-            <EuiThemeProvider darkMode={isDarkMode}>
-              <Router history={history}>
-                <RouteCapture>
-                  <HeaderNavigation />
-                  <Switch>
-                    <Route
-                      exact
-                      path="/"
-                      render={() => (
-                        <h1 data-test-subj="welcomeTitle">
-                          <FormattedMessage
-                            id="xpack.endpoint.welcomeTitle"
-                            defaultMessage="Hello World"
-                          />
-                        </h1>
-                      )}
-                    />
-                    <Route path="/hosts" component={HostList} />
-                    <Route path="/alerts" component={AlertIndex} />
-                    <Route path="/policy" exact component={PolicyList} />
-                    <Route path="/policy/:id" exact component={PolicyDetails} />
-                    <Route
-                      render={() => (
-                        <FormattedMessage
-                          id="xpack.endpoint.notFound"
-                          defaultMessage="Page Not Found"
-                        />
-                      )}
-                    />
-                  </Switch>
-                </RouteCapture>
-              </Router>
-            </EuiThemeProvider>
-          </KibanaContextProvider>
-        </I18nProvider>
-      </Provider>
+      <AppRootProvider store={store} history={history} coreStart={coreStart} depsStart={depsStart}>
+        <HeaderNavigation />
+        <Switch>
+          <Route
+            exact
+            path="/"
+            render={() => (
+              <h1 data-test-subj="welcomeTitle">
+                <FormattedMessage id="xpack.endpoint.welcomeTitle" defaultMessage="Hello World" />
+              </h1>
+            )}
+          />
+          <Route path="/hosts" component={HostList} />
+          <Route path="/alerts" component={AlertIndex} />
+          <Route path="/policy" exact component={PolicyList} />
+          <Route path="/policy/:id" exact component={PolicyDetails} />
+          <Route
+            render={() => (
+              <FormattedMessage id="xpack.endpoint.notFound" defaultMessage="Page Not Found" />
+            )}
+          />
+        </Switch>
+      </AppRootProvider>
     );
   }
 );
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/mocks/app_context_render.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/app_context_render.tsx
new file mode 100644
index 0000000000000..af34205e2310f
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/app_context_render.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { createMemoryHistory } from 'history';
+import { render as reactRender, RenderOptions, RenderResult } from '@testing-library/react';
+import { appStoreFactory } from '../store';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
+import { EndpointPluginStartDependencies } from '../../../plugin';
+import { depsStartMock } from './dependencies_start_mock';
+import { AppRootProvider } from '../view/app_root_provider';
+
+type UiRender = (ui: React.ReactElement, options?: RenderOptions) => RenderResult;
+
+/**
+ * Mocked app root context renderer
+ */
+interface AppContextTestRender {
+  store: ReturnType<typeof appStoreFactory>;
+  history: ReturnType<typeof createMemoryHistory>;
+  coreStart: ReturnType<typeof coreMock.createStart>;
+  depsStart: EndpointPluginStartDependencies;
+  /**
+   * A wrapper around `AppRootContext` component. Uses the mocked modules as input to the
+   * `AppRootContext`
+   */
+  AppWrapper: React.FC<any>;
+  /**
+   * Renders the given UI within the created `AppWrapper` providing the given UI a mocked
+   * endpoint runtime context environment
+   */
+  render: UiRender;
+}
+
+/**
+ * Creates a mocked endpoint app context custom renderer that can be used to render
+ * component that depend upon the application's surrounding context providers.
+ * Factory also returns the content that was used to create the custom renderer, allowing
+ * for further customization.
+ */
+export const createAppRootMockRenderer = (): AppContextTestRender => {
+  const history = createMemoryHistory<never>();
+  const coreStart = coreMock.createStart({ basePath: '/mock' });
+  const depsStart = depsStartMock();
+  const store = appStoreFactory({ coreStart, depsStart });
+  const AppWrapper: React.FunctionComponent<{ children: React.ReactElement }> = ({ children }) => (
+    <AppRootProvider store={store} history={history} coreStart={coreStart} depsStart={depsStart}>
+      {children}
+    </AppRootProvider>
+  );
+  const render: UiRender = (ui, options) => {
+    // @ts-ignore
+    return reactRender(ui, {
+      wrapper: AppWrapper,
+      ...options,
+    });
+  };
+
+  return {
+    store,
+    history,
+    coreStart,
+    depsStart,
+    AppWrapper,
+    render,
+  };
+};
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/mocks.ts b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/dependencies_start_mock.ts
similarity index 96%
rename from x-pack/plugins/endpoint/public/applications/endpoint/mocks.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/mocks/dependencies_start_mock.ts
index e1a90b4a416dc..00cf0bca57e66 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/mocks.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/dependencies_start_mock.ts
@@ -7,7 +7,7 @@
 import {
   dataPluginMock,
   Start as DataPublicStartMock,
-} from '../../../../../../src/plugins/data/public/mocks';
+} from '../../../../../../../src/plugins/data/public/mocks';
 
 type DataMock = Omit<DataPublicStartMock, 'indexPatterns' | 'query'> & {
   indexPatterns: Omit<DataPublicStartMock['indexPatterns'], 'getFieldsForWildcard'> & {
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/mocks/index.ts b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/index.ts
new file mode 100644
index 0000000000000..65e78f27943ba
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/mocks/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './dependencies_start_mock';
+export * from './app_context_render';
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
index af9b49cea18ad..fb3e26157ef32 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
@@ -74,8 +74,12 @@ export const policyDetailsReducer: Reducer<PolicyDetailsState, AppAction> = (
       ...state,
       location: action.payload,
     };
+    const isCurrentlyOnDetailsPage = isOnPolicyDetailsPage(newState);
+    const wasPreviouslyOnDetailsPage = isOnPolicyDetailsPage(state);
 
-    if (isOnPolicyDetailsPage(newState)) {
+    // Did user just enter the Detail page? if so, then set the loading indicator and return new state
+    if (isCurrentlyOnDetailsPage && !wasPreviouslyOnDetailsPage) {
+      newState.isLoading = true;
       return newState;
     }
     return {
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/app_root_provider.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/app_root_provider.tsx
new file mode 100644
index 0000000000000..ca27831ee90b5
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/app_root_provider.tsx
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo, ReactNode, useMemo } from 'react';
+import { Provider } from 'react-redux';
+import { I18nProvider } from '@kbn/i18n/react';
+import { Router } from 'react-router-dom';
+import { History } from 'history';
+import { CoreStart } from 'kibana/public';
+import { useObservable } from 'react-use';
+import { EuiThemeProvider } from '../../../../../../legacy/common/eui_styled_components';
+import { KibanaContextProvider } from '../../../../../../../src/plugins/kibana_react/public';
+import { appStoreFactory } from '../store';
+import { RouteCapture } from './route_capture';
+import { EndpointPluginStartDependencies } from '../../../plugin';
+
+/**
+ * Provides the context for rendering the endpoint app
+ */
+export const AppRootProvider = memo<{
+  store: ReturnType<typeof appStoreFactory>;
+  history: History;
+  coreStart: CoreStart;
+  depsStart: EndpointPluginStartDependencies;
+  children: ReactNode | ReactNode[];
+}>(
+  ({
+    store,
+    history,
+    coreStart: { http, notifications, uiSettings, application },
+    depsStart: { data },
+    children,
+  }) => {
+    const isDarkMode = useObservable<boolean>(uiSettings.get$('theme:darkMode'));
+    const services = useMemo(() => ({ http, notifications, application, data }), [
+      application,
+      data,
+      http,
+      notifications,
+    ]);
+    return (
+      <Provider store={store}>
+        <I18nProvider>
+          <KibanaContextProvider services={services}>
+            <EuiThemeProvider darkMode={isDarkMode}>
+              <Router history={history}>
+                <RouteCapture>{children}</RouteCapture>
+              </Router>
+            </EuiThemeProvider>
+          </KibanaContextProvider>
+        </I18nProvider>
+      </Provider>
+    );
+  }
+);
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/agents_summary.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/agents_summary.tsx
index d0751cf9fb886..a3e30eb891db4 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/agents_summary.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/agents_summary.tsx
@@ -61,7 +61,7 @@ export const AgentsSummary = memo<AgentsSummaryProps>(props => {
   }, []);
 
   return (
-    <EuiFlexGroup gutterSize="xl">
+    <EuiFlexGroup gutterSize="xl" data-test-subj="policyAgentsSummary">
       {stats.map(({ key, title, health }) => {
         return (
           <EuiFlexItem grow={false} key={key}>
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.test.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.test.tsx
new file mode 100644
index 0000000000000..2ecc2b117bf01
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.test.tsx
@@ -0,0 +1,239 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+import { createAppRootMockRenderer } from '../../mocks';
+import { PolicyDetails } from './policy_details';
+import { EndpointDocGenerator } from '../../../../../common/generate_data';
+
+describe('Policy Details', () => {
+  type FindReactWrapperResponse = ReturnType<ReturnType<typeof render>['find']>;
+
+  const sleep = (ms = 100) => new Promise(wakeup => setTimeout(wakeup, ms));
+  const generator = new EndpointDocGenerator();
+  const { history, AppWrapper, coreStart } = createAppRootMockRenderer();
+  const http = coreStart.http;
+  const render = (ui: Parameters<typeof mount>[0]) => mount(ui, { wrappingComponent: AppWrapper });
+  let policyDatasource: ReturnType<typeof generator.generatePolicyDatasource>;
+  let policyView: ReturnType<typeof render>;
+
+  beforeEach(() => jest.clearAllMocks());
+
+  afterEach(() => {
+    if (policyView) {
+      policyView.unmount();
+    }
+  });
+
+  describe('when displayed with invalid id', () => {
+    beforeEach(() => {
+      http.get.mockReturnValue(Promise.reject(new Error('policy not found')));
+      history.push('/policy/1');
+      policyView = render(<PolicyDetails />);
+    });
+
+    it('should show loader followed by error message', () => {
+      expect(policyView.find('EuiLoadingSpinner').length).toBe(1);
+      policyView.update();
+      const callout = policyView.find('EuiCallOut');
+      expect(callout).toHaveLength(1);
+      expect(callout.prop('color')).toEqual('danger');
+      expect(callout.text()).toEqual('policy not found');
+    });
+  });
+  describe('when displayed with valid id', () => {
+    let asyncActions: Promise<unknown> = Promise.resolve();
+
+    beforeEach(() => {
+      policyDatasource = generator.generatePolicyDatasource();
+      policyDatasource.id = '1';
+
+      http.get.mockImplementation((...args) => {
+        const [path] = args;
+        if (typeof path === 'string') {
+          // GET datasouce
+          if (path === '/api/ingest_manager/datasources/1') {
+            asyncActions = asyncActions.then<unknown>(async (): Promise<unknown> => await sleep());
+            return Promise.resolve({
+              item: policyDatasource,
+              success: true,
+            });
+          }
+
+          // GET Agent status for agent config
+          if (path === '/api/ingest_manager/fleet/agent-status') {
+            asyncActions = asyncActions.then(async () => await sleep());
+            return Promise.resolve({
+              results: { events: 0, total: 5, online: 3, error: 1, offline: 1 },
+              success: true,
+            });
+          }
+        }
+
+        return Promise.reject(new Error('unknown API call!'));
+      });
+      history.push('/policy/1');
+      policyView = render(<PolicyDetails />);
+    });
+
+    it('should display back to list button and policy title', () => {
+      policyView.update();
+      const pageHeaderLeft = policyView.find(
+        'EuiPageHeaderSection[data-test-subj="pageViewHeaderLeft"]'
+      );
+
+      const backToListButton = pageHeaderLeft.find('EuiButtonEmpty');
+      expect(backToListButton.prop('iconType')).toBe('arrowLeft');
+      expect(backToListButton.prop('href')).toBe('/mock/app/endpoint/policy');
+      expect(backToListButton.text()).toBe('Back to policy list');
+
+      const pageTitle = pageHeaderLeft.find('[data-test-subj="pageViewHeaderLeftTitle"]');
+      expect(pageTitle).toHaveLength(1);
+      expect(pageTitle.text()).toEqual(policyDatasource.name);
+    });
+    it('should navigate to list if back to link is clicked', async () => {
+      policyView.update();
+      const backToListButton = policyView.find(
+        'EuiPageHeaderSection[data-test-subj="pageViewHeaderLeft"] EuiButtonEmpty'
+      );
+      expect(history.location.pathname).toEqual('/policy/1');
+      backToListButton.simulate('click');
+      expect(history.location.pathname).toEqual('/policy');
+    });
+    it('should display agent stats', async () => {
+      await asyncActions;
+      policyView.update();
+      const headerRight = policyView.find(
+        'EuiPageHeaderSection[data-test-subj="pageViewHeaderRight"]'
+      );
+      const agentsSummary = headerRight.find('EuiFlexGroup[data-test-subj="policyAgentsSummary"]');
+      expect(agentsSummary).toHaveLength(1);
+      expect(agentsSummary.text()).toBe('Hosts5Online3Offline1Error1');
+    });
+    it('should display cancel button', async () => {
+      await asyncActions;
+      policyView.update();
+      const cancelbutton = policyView.find(
+        'EuiButtonEmpty[data-test-subj="policyDetailsCancelButton"]'
+      );
+      expect(cancelbutton).toHaveLength(1);
+      expect(cancelbutton.text()).toEqual('Cancel');
+    });
+    it('should redirect to policy list when cancel button is clicked', async () => {
+      await asyncActions;
+      policyView.update();
+      const cancelbutton = policyView.find(
+        'EuiButtonEmpty[data-test-subj="policyDetailsCancelButton"]'
+      );
+      expect(history.location.pathname).toEqual('/policy/1');
+      cancelbutton.simulate('click');
+      expect(history.location.pathname).toEqual('/policy');
+    });
+    it('should display save button', async () => {
+      await asyncActions;
+      policyView.update();
+      const saveButton = policyView.find('EuiButton[data-test-subj="policyDetailsSaveButton"]');
+      expect(saveButton).toHaveLength(1);
+      expect(saveButton.text()).toEqual('Save');
+    });
+    describe('when the save button is clicked', () => {
+      let saveButton: FindReactWrapperResponse;
+      let confirmModal: FindReactWrapperResponse;
+      let modalCancelButton: FindReactWrapperResponse;
+      let modalConfirmButton: FindReactWrapperResponse;
+
+      beforeEach(async () => {
+        await asyncActions;
+        policyView.update();
+        saveButton = policyView.find('EuiButton[data-test-subj="policyDetailsSaveButton"]');
+        saveButton.simulate('click');
+        policyView.update();
+        confirmModal = policyView.find(
+          'EuiConfirmModal[data-test-subj="policyDetailsConfirmModal"]'
+        );
+        modalCancelButton = confirmModal.find('button[data-test-subj="confirmModalCancelButton"]');
+        modalConfirmButton = confirmModal.find(
+          'button[data-test-subj="confirmModalConfirmButton"]'
+        );
+        http.put.mockImplementation((...args) => {
+          asyncActions = asyncActions.then(async () => await sleep());
+          const [path] = args;
+          if (typeof path === 'string') {
+            if (path === '/api/ingest_manager/datasources/1') {
+              return Promise.resolve({
+                item: policyDatasource,
+                success: true,
+              });
+            }
+          }
+
+          return Promise.reject(new Error('unknown PUT path!'));
+        });
+      });
+
+      it('should show a modal confirmation', () => {
+        expect(confirmModal).toHaveLength(1);
+        expect(confirmModal.find('div[data-test-subj="confirmModalTitleText"]').text()).toEqual(
+          'Save and deploy changes'
+        );
+        expect(modalCancelButton.text()).toEqual('Cancel');
+        expect(modalConfirmButton.text()).toEqual('Save and deploy changes');
+      });
+      it('should show info callout if policy is in use', () => {
+        const warningCallout = confirmModal.find(
+          'EuiCallOut[data-test-subj="policyDetailsWarningCallout"]'
+        );
+        expect(warningCallout).toHaveLength(1);
+        expect(warningCallout.text()).toEqual(
+          'This action will update 5 hostsSaving these changes will apply the updates to all active endpoints assigned to this policy'
+        );
+      });
+      it('should close dialog if cancel button is clicked', () => {
+        modalCancelButton.simulate('click');
+        expect(
+          policyView.find('EuiConfirmModal[data-test-subj="policyDetailsConfirmModal"]')
+        ).toHaveLength(0);
+      });
+      it('should update policy and show success notification when confirm button is clicked', async () => {
+        modalConfirmButton.simulate('click');
+        policyView.update();
+        // Modal should be closed
+        expect(
+          policyView.find('EuiConfirmModal[data-test-subj="policyDetailsConfirmModal"]')
+        ).toHaveLength(0);
+
+        // API should be called
+        await asyncActions;
+        expect(http.put.mock.calls[0][0]).toEqual(`/api/ingest_manager/datasources/1`);
+        policyView.update();
+
+        // Toast notification should be shown
+        const toastAddMock = coreStart.notifications.toasts.add.mock;
+        expect(toastAddMock.calls).toHaveLength(1);
+        expect(toastAddMock.calls[0][0]).toMatchObject({
+          color: 'success',
+          iconType: 'check',
+        });
+      });
+      it('should show an error notification toast if update fails', async () => {
+        policyDatasource.id = 'invalid';
+        modalConfirmButton.simulate('click');
+
+        await asyncActions;
+        policyView.update();
+
+        // Toast notification should be shown
+        const toastAddMock = coreStart.notifications.toasts.add.mock;
+        expect(toastAddMock.calls).toHaveLength(1);
+        expect(toastAddMock.calls[0][0]).toMatchObject({
+          color: 'danger',
+          iconType: 'alert',
+        });
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.tsx
index 2dba301bf4537..bc56e5e6f6329 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_details.tsx
@@ -149,7 +149,10 @@ export const PolicyDetails = React.memo(() => {
         <VerticalDivider spacing="l" />
       </EuiFlexItem>
       <EuiFlexItem grow={false}>
-        <EuiButtonEmpty onClick={handleBackToListOnClick}>
+        <EuiButtonEmpty
+          onClick={handleBackToListOnClick}
+          data-test-subj="policyDetailsCancelButton"
+        >
           <FormattedMessage id="xpack.endpoint.policy.details.cancel" defaultMessage="Cancel" />
         </EuiButtonEmpty>
       </EuiFlexItem>
@@ -157,6 +160,7 @@ export const PolicyDetails = React.memo(() => {
         <EuiButton
           fill={true}
           iconType="save"
+          data-test-subj="policyDetailsSaveButton"
           // FIXME: need to disable if User has no write permissions to ingest - see: https://github.com/elastic/endpoint-app-team/issues/296
           onClick={handleSaveOnClick}
           isLoading={isPolicyLoading}
@@ -216,6 +220,7 @@ const ConfirmUpdate = React.memo<{
   return (
     <EuiOverlayMask>
       <EuiConfirmModal
+        data-test-subj="policyDetailsConfirmModal"
         title={i18n.translate('xpack.endpoint.policy.details.updateConfirm.title', {
           defaultMessage: 'Save and deploy changes',
         })}
@@ -237,6 +242,7 @@ const ConfirmUpdate = React.memo<{
         {hostCount > 0 && (
           <>
             <EuiCallOut
+              data-test-subj="policyDetailsWarningCallout"
               title={i18n.translate('xpack.endpoint.policy.details.updateConfirm.warningTitle', {
                 defaultMessage:
                   'This action will update {hostCount, plural, one {# host} other {# hosts}}',
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx
index cd3ba43c3607c..0903787dd05c4 100644
--- a/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx
@@ -17,6 +17,11 @@ import {
 import { IFieldType } from 'src/plugins/data/public';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
+import {
+  MetricExpressionParams,
+  Comparator,
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../server/lib/alerting/metric_threshold/types';
 import { euiStyled } from '../../../../../observability/public';
 import {
   WhenExpression,
@@ -36,16 +41,6 @@ import { MetricsExplorerSeries } from '../../../../common/http_api/metrics_explo
 import { useSource } from '../../../containers/source';
 import { MetricsExplorerGroupBy } from '../../metrics_explorer/group_by';
 
-export interface MetricExpression {
-  aggType?: string;
-  metric?: string;
-  comparator?: Comparator;
-  threshold?: number[];
-  timeSize?: number;
-  timeUnit?: TimeUnit;
-  indexPattern?: string;
-}
-
 interface AlertContextMeta {
   currentOptions?: Partial<MetricsExplorerOptions>;
   series?: MetricsExplorerSeries;
@@ -57,14 +52,35 @@ interface Props {
     criteria: MetricExpression[];
     groupBy?: string;
     filterQuery?: string;
+    sourceId?: string;
   };
   alertsContext: AlertsContextValue<AlertContextMeta>;
   setAlertParams(key: string, value: any): void;
   setAlertProperty(key: string, value: any): void;
 }
 
-type Comparator = '>' | '>=' | 'between' | '<' | '<=';
 type TimeUnit = 's' | 'm' | 'h' | 'd';
+type MetricExpression = Omit<MetricExpressionParams, 'metric'> & {
+  metric?: string;
+};
+
+enum AGGREGATION_TYPES {
+  COUNT = 'count',
+  AVERAGE = 'avg',
+  SUM = 'sum',
+  MIN = 'min',
+  MAX = 'max',
+  RATE = 'rate',
+  CARDINALITY = 'cardinality',
+}
+
+const defaultExpression = {
+  aggType: AGGREGATION_TYPES.AVERAGE,
+  comparator: Comparator.GT,
+  threshold: [],
+  timeSize: 1,
+  timeUnit: 'm',
+} as MetricExpression;
 
 export const Expressions: React.FC<Props> = props => {
   const { setAlertParams, alertParams, errors, alertsContext } = props;
@@ -87,18 +103,6 @@ export const Expressions: React.FC<Props> = props => {
     }
   }, [alertsContext.metadata]);
 
-  const defaultExpression = useMemo<MetricExpression>(
-    () => ({
-      aggType: AGGREGATION_TYPES.AVERAGE,
-      comparator: '>',
-      threshold: [],
-      timeSize: 1,
-      timeUnit: 'm',
-      indexPattern: source?.configuration.metricAlias,
-    }),
-    [source]
-  );
-
   const updateParams = useCallback(
     (id, e: MetricExpression) => {
       const exp = alertParams.criteria ? alertParams.criteria.slice() : [];
@@ -112,7 +116,7 @@ export const Expressions: React.FC<Props> = props => {
     const exp = alertParams.criteria.slice();
     exp.push(defaultExpression);
     setAlertParams('criteria', exp);
-  }, [setAlertParams, alertParams.criteria, defaultExpression]);
+  }, [setAlertParams, alertParams.criteria]);
 
   const removeExpression = useCallback(
     (id: number) => {
@@ -179,11 +183,10 @@ export const Expressions: React.FC<Props> = props => {
           'criteria',
           md.currentOptions.metrics.map(metric => ({
             metric: metric.field,
-            comparator: '>',
+            comparator: Comparator.GT,
             threshold: [],
             timeSize,
             timeUnit,
-            indexPattern: source?.configuration.metricAlias,
             aggType: metric.aggregation,
           }))
         );
@@ -201,6 +204,7 @@ export const Expressions: React.FC<Props> = props => {
 
         setAlertParams('groupBy', md.currentOptions.groupBy);
       }
+      setAlertParams('sourceId', source?.id);
     }
   }, [alertsContext.metadata, defaultExpression, source]); // eslint-disable-line react-hooks/exhaustive-deps
 
@@ -325,17 +329,22 @@ const StyledExpression = euiStyled.div`
 
 export const ExpressionRow: React.FC<ExpressionRowProps> = props => {
   const { setAlertParams, expression, errors, expressionId, remove, fields, canDelete } = props;
-  const { aggType = AGGREGATION_TYPES.MAX, metric, comparator = '>', threshold = [] } = expression;
+  const {
+    aggType = AGGREGATION_TYPES.MAX,
+    metric,
+    comparator = Comparator.GT,
+    threshold = [],
+  } = expression;
 
   const updateAggType = useCallback(
     (at: string) => {
-      setAlertParams(expressionId, { ...expression, aggType: at });
+      setAlertParams(expressionId, { ...expression, aggType: at as MetricExpression['aggType'] });
     },
     [expressionId, expression, setAlertParams]
   );
 
   const updateMetric = useCallback(
-    (m?: string) => {
+    (m?: MetricExpression['metric']) => {
       setAlertParams(expressionId, { ...expression, metric: m });
     },
     [expressionId, expression, setAlertParams]
@@ -384,7 +393,7 @@ export const ExpressionRow: React.FC<ExpressionRowProps> = props => {
             )}
             <StyledExpression>
               <ThresholdExpression
-                thresholdComparator={comparator || '>'}
+                thresholdComparator={comparator || Comparator.GT}
                 threshold={threshold}
                 onChangeSelectedThresholdComparator={updateComparator}
                 onChangeSelectedThreshold={updateThreshold}
@@ -411,16 +420,6 @@ export const ExpressionRow: React.FC<ExpressionRowProps> = props => {
   );
 };
 
-enum AGGREGATION_TYPES {
-  COUNT = 'count',
-  AVERAGE = 'avg',
-  SUM = 'sum',
-  MIN = 'min',
-  MAX = 'max',
-  RATE = 'rate',
-  CARDINALITY = 'cardinality',
-}
-
 export const aggregationType: { [key: string]: any } = {
   avg: {
     text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.avg', {
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx
index 0f5b07f8c0e13..55365c3d4c2ba 100644
--- a/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx
@@ -6,15 +6,14 @@
 
 import { i18n } from '@kbn/i18n';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-
-import { MetricExpression } from './expression';
+import { MetricExpressionParams } from '../../../../server/lib/alerting/metric_threshold/types';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { ValidationResult } from '../../../../../triggers_actions_ui/public/types';
 
 export function validateMetricThreshold({
   criteria,
 }: {
-  criteria: MetricExpression[];
+  criteria: MetricExpressionParams[];
 }): ValidationResult {
   const validationResult = { errors: {} };
   const errors: {
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index 09f1702349542..38cd0cec145f9 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -16,7 +16,8 @@ const executor = createMetricThresholdExecutor('test') as (opts: {
 const alertInstances = new Map();
 
 const services = {
-  callCluster(_: string, { body }: any) {
+  callCluster(_: string, { body, index }: any) {
+    if (index === 'alternatebeat-*') return mocks.changedSourceIdResponse;
     const metric = body.query.bool.filter[1]?.exists.field;
     if (body.aggs.groupings) {
       if (body.aggs.groupings.composite.after) {
@@ -55,6 +56,13 @@ const services = {
       },
     };
   },
+  savedObjectsClient: {
+    get(_: string, sourceId: string) {
+      if (sourceId === 'alternate')
+        return { id: 'alternate', attributes: { metricAlias: 'alternatebeat-*' } };
+      return { id: 'default', attributes: { metricAlias: 'metricbeat-*' } };
+    },
+  },
 };
 
 const baseCriterion = {
@@ -62,15 +70,15 @@ const baseCriterion = {
   metric: 'test.metric.1',
   timeSize: 1,
   timeUnit: 'm',
-  indexPattern: 'metricbeat-*',
 };
 describe('The metric threshold alert type', () => {
   describe('querying the entire infrastructure', () => {
     const instanceID = 'test-*';
-    const execute = (comparator: Comparator, threshold: number[]) =>
+    const execute = (comparator: Comparator, threshold: number[], sourceId: string = 'default') =>
       executor({
         services,
         params: {
+          sourceId,
           criteria: [
             {
               ...baseCriterion,
@@ -134,6 +142,14 @@ describe('The metric threshold alert type', () => {
       expect(mostRecentAction.action.thresholdOf.condition0).toStrictEqual([0.75]);
       expect(mostRecentAction.action.metricOf.condition0).toBe('test.metric.1');
     });
+    test('fetches the index pattern dynamically', async () => {
+      await execute(Comparator.LT, [17], 'alternate');
+      expect(alertInstances.get(instanceID).mostRecentAction.id).toBe(FIRED_ACTIONS.id);
+      expect(alertInstances.get(instanceID).state.alertState).toBe(AlertStates.ALERT);
+      await execute(Comparator.LT, [1.5], 'alternate');
+      expect(alertInstances.get(instanceID).mostRecentAction).toBe(undefined);
+      expect(alertInstances.get(instanceID).state.alertState).toBe(AlertStates.OK);
+    });
   });
 
   describe('querying with a groupBy parameter', () => {
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 60bba61b75ef1..c5ea65f7a4d1a 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -5,6 +5,8 @@
  */
 import { mapValues } from 'lodash';
 import { i18n } from '@kbn/i18n';
+import { convertSavedObjectToSavedSourceConfiguration } from '../../sources/sources';
+import { infraSourceConfigurationSavedObjectType } from '../../sources/saved_object_mappings';
 import { InfraDatabaseSearchResponse } from '../../adapters/framework/adapter_types';
 import { createAfterKeyHandler } from '../../../utils/create_afterkey_handler';
 import { getAllCompositeData } from '../../../utils/get_all_composite_data';
@@ -15,6 +17,7 @@ import { getIntervalInSeconds } from '../../../utils/get_interval_in_seconds';
 import { getDateHistogramOffset } from '../../snapshot/query_helpers';
 
 const TOTAL_BUCKETS = 5;
+const DEFAULT_INDEX_PATTERN = 'metricbeat-*';
 
 interface Aggregation {
   aggregatedIntervals: {
@@ -165,18 +168,42 @@ export const getElasticsearchMetricQuery = (
   };
 };
 
+const getIndexPattern: (
+  services: AlertServices,
+  sourceId?: string
+) => Promise<string> = async function({ savedObjectsClient }, sourceId = 'default') {
+  try {
+    const sourceConfiguration = await savedObjectsClient.get(
+      infraSourceConfigurationSavedObjectType,
+      sourceId
+    );
+    const { metricAlias } = convertSavedObjectToSavedSourceConfiguration(
+      sourceConfiguration
+    ).configuration;
+    return metricAlias || DEFAULT_INDEX_PATTERN;
+  } catch (e) {
+    if (e.output.statusCode === 404) {
+      return DEFAULT_INDEX_PATTERN;
+    } else {
+      throw e;
+    }
+  }
+};
+
 const getMetric: (
   services: AlertServices,
   params: MetricExpressionParams,
+  index: string,
   groupBy: string | undefined,
   filterQuery: string | undefined
 ) => Promise<Record<string, number>> = async function(
-  { callCluster },
+  { savedObjectsClient, callCluster },
   params,
+  index,
   groupBy,
   filterQuery
 ) {
-  const { indexPattern, aggType } = params;
+  const { aggType } = params;
   const searchBody = getElasticsearchMetricQuery(params, groupBy, filterQuery);
 
   try {
@@ -189,7 +216,7 @@ const getMetric: (
         response => response.aggregations?.groupings?.after_key
       );
       const compositeBuckets = (await getAllCompositeData(
-        body => callCluster('search', { body, index: indexPattern }),
+        body => callCluster('search', { body, index }),
         searchBody,
         bucketSelector,
         afterKeyHandler
@@ -204,7 +231,7 @@ const getMetric: (
     }
     const result = await callCluster('search', {
       body: searchBody,
-      index: indexPattern,
+      index,
     });
     return { '*': getCurrentValueFromAggregations(result.aggregations, aggType) };
   } catch (e) {
@@ -236,16 +263,18 @@ const mapToConditionsLookup = (
 
 export const createMetricThresholdExecutor = (alertUUID: string) =>
   async function({ services, params }: AlertExecutorOptions) {
-    const { criteria, groupBy, filterQuery } = params as {
+    const { criteria, groupBy, filterQuery, sourceId } = params as {
       criteria: MetricExpressionParams[];
       groupBy: string | undefined;
       filterQuery: string | undefined;
+      sourceId?: string;
     };
 
     const alertResults = await Promise.all(
       criteria.map(criterion =>
         (async () => {
-          const currentValues = await getMetric(services, criterion, groupBy, filterQuery);
+          const index = await getIndexPattern(services, sourceId);
+          const currentValues = await getMetric(services, criterion, index, groupBy, filterQuery);
           const { threshold, comparator } = criterion;
           const comparisonFunction = comparatorMap[comparator];
           return mapValues(currentValues, value => ({
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
index 2ab3a3322661d..8808219cabaa7 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
@@ -29,7 +29,6 @@ export async function registerMetricThresholdAlertType(alertingPlugin: PluginSet
     ]),
     timeUnit: schema.string(),
     timeSize: schema.number(),
-    indexPattern: schema.string(),
   };
 
   const nonCountCriterion = schema.object({
@@ -89,6 +88,7 @@ export async function registerMetricThresholdAlertType(alertingPlugin: PluginSet
         criteria: schema.arrayOf(schema.oneOf([countCriterion, nonCountCriterion])),
         groupBy: schema.maybe(schema.string()),
         filterQuery: schema.maybe(schema.string()),
+        sourceId: schema.string(),
       }),
     },
     defaultActionGroupId: FIRED_ACTIONS.id,
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
index e87ffcfb2b912..66e0a363c8983 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/test_mocks.ts
@@ -26,6 +26,17 @@ const bucketsB = [
   },
 ];
 
+const bucketsC = [
+  {
+    doc_count: 2,
+    aggregatedValue: { value: 0.5 },
+  },
+  {
+    doc_count: 3,
+    aggregatedValue: { value: 16.0 },
+  },
+];
+
 export const basicMetricResponse = {
   aggregations: {
     aggregatedIntervals: {
@@ -108,3 +119,11 @@ export const compositeEndResponse = {
   aggregations: {},
   hits: { total: { value: 0 } },
 };
+
+export const changedSourceIdResponse = {
+  aggregations: {
+    aggregatedIntervals: {
+      buckets: bucketsC,
+    },
+  },
+};
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
index 557a071ec9175..abed691f109c0 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
@@ -28,7 +28,7 @@ export type TimeUnit = 's' | 'm' | 'h' | 'd';
 interface BaseMetricExpressionParams {
   timeSize: number;
   timeUnit: TimeUnit;
-  indexPattern: string;
+  sourceId?: string;
   threshold: number[];
   comparator: Comparator;
 }
diff --git a/x-pack/plugins/infra/server/lib/sources/sources.ts b/x-pack/plugins/infra/server/lib/sources/sources.ts
index 5b9207a88e6e4..c7ff6c9638204 100644
--- a/x-pack/plugins/infra/server/lib/sources/sources.ts
+++ b/x-pack/plugins/infra/server/lib/sources/sources.ts
@@ -231,7 +231,7 @@ const mergeSourceConfiguration = (
     first
   );
 
-const convertSavedObjectToSavedSourceConfiguration = (savedObject: unknown) =>
+export const convertSavedObjectToSavedSourceConfiguration = (savedObject: unknown) =>
   pipe(
     SourceConfigurationSavedObjectRuntimeType.decode(savedObject),
     map(savedSourceConfiguration => ({
diff --git a/x-pack/plugins/monitoring/common/constants.ts b/x-pack/plugins/monitoring/common/constants.ts
index 9a4030f3eb214..3a4c7b71dcd03 100644
--- a/x-pack/plugins/monitoring/common/constants.ts
+++ b/x-pack/plugins/monitoring/common/constants.ts
@@ -239,11 +239,15 @@ export const ALERT_TYPE_PREFIX = 'monitoring_';
  * This is the alert type id for the license expiration alert
  */
 export const ALERT_TYPE_LICENSE_EXPIRATION = `${ALERT_TYPE_PREFIX}alert_type_license_expiration`;
+/**
+ * This is the alert type id for the cluster state alert
+ */
+export const ALERT_TYPE_CLUSTER_STATE = `${ALERT_TYPE_PREFIX}alert_type_cluster_state`;
 
 /**
  * A listing of all alert types
  */
-export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION];
+export const ALERT_TYPES = [ALERT_TYPE_LICENSE_EXPIRATION, ALERT_TYPE_CLUSTER_STATE];
 
 /**
  * Matches the id for the built-in in email action type
@@ -254,7 +258,7 @@ export const ALERT_ACTION_TYPE_EMAIL = '.email';
 /**
  * The number of alerts that have been migrated
  */
-export const NUMBER_OF_MIGRATED_ALERTS = 1;
+export const NUMBER_OF_MIGRATED_ALERTS = 2;
 
 /**
  * The advanced settings config name for the email address
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts b/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts
new file mode 100644
index 0000000000000..6a9ca88437347
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_state.test.ts
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Logger } from 'src/core/server';
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import { getClusterState } from './cluster_state';
+import { AlertServices } from '../../../alerting/server';
+import { ALERT_TYPE_CLUSTER_STATE } from '../../common/constants';
+import { AlertCommonParams, AlertCommonState, AlertClusterStatePerClusterState } from './types';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+import { executeActions } from '../lib/alerts/cluster_state.lib';
+import { AlertClusterStateState } from './enums';
+
+jest.mock('../lib/alerts/cluster_state.lib', () => ({
+  executeActions: jest.fn(),
+  getUiMessage: jest.fn(),
+}));
+
+jest.mock('../lib/alerts/get_prepared_alert', () => ({
+  getPreparedAlert: jest.fn(() => {
+    return {
+      emailAddress: 'foo@foo.com',
+    };
+  }),
+}));
+
+interface MockServices {
+  callCluster: jest.Mock;
+  alertInstanceFactory: jest.Mock;
+  savedObjectsClient: jest.Mock;
+}
+
+describe('getClusterState', () => {
+  const services: MockServices | AlertServices = {
+    callCluster: jest.fn(),
+    alertInstanceFactory: jest.fn(),
+    savedObjectsClient: savedObjectsClientMock.create(),
+  };
+
+  const params: AlertCommonParams = {
+    dateFormat: 'YYYY',
+    timezone: 'UTC',
+  };
+
+  const emailAddress = 'foo@foo.com';
+  const clusterUuid = 'kdksdfj434';
+  const clusterName = 'monitoring_test';
+  const cluster = { clusterUuid, clusterName };
+
+  async function setupAlert(
+    previousState: AlertClusterStateState,
+    newState: AlertClusterStateState
+  ): Promise<AlertCommonState> {
+    const logger: Logger = {
+      warn: jest.fn(),
+      log: jest.fn(),
+      debug: jest.fn(),
+      trace: jest.fn(),
+      error: jest.fn(),
+      fatal: jest.fn(),
+      info: jest.fn(),
+      get: jest.fn(),
+    };
+    const getLogger = (): Logger => logger;
+    const ccrEnabled = false;
+    (getPreparedAlert as jest.Mock).mockImplementation(() => ({
+      emailAddress,
+      data: [
+        {
+          state: newState,
+          clusterUuid,
+        },
+      ],
+      clusters: [cluster],
+    }));
+
+    const alert = getClusterState(null as any, null as any, getLogger, ccrEnabled);
+    const state: AlertCommonState = {
+      [clusterUuid]: {
+        state: previousState,
+        ui: {
+          isFiring: false,
+          severity: 0,
+          message: null,
+          resolvedMS: 0,
+          lastCheckedMS: 0,
+          triggeredMS: 0,
+        },
+      } as AlertClusterStatePerClusterState,
+    };
+
+    return (await alert.executor({ services, params, state } as any)) as AlertCommonState;
+  }
+
+  afterEach(() => {
+    (executeActions as jest.Mock).mockClear();
+  });
+
+  it('should configure the alert properly', () => {
+    const alert = getClusterState(null as any, null as any, jest.fn(), false);
+    expect(alert.id).toBe(ALERT_TYPE_CLUSTER_STATE);
+    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
+  });
+
+  it('should alert if green -> yellow', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Yellow);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Yellow,
+      emailAddress
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Yellow);
+    expect(clusterResult.ui.isFiring).toBe(true);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should alert if yellow -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Yellow, AlertClusterStateState.Green);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Green,
+      emailAddress,
+      true
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBeGreaterThan(0);
+  });
+
+  it('should alert if green -> red', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Red);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Red,
+      emailAddress
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Red);
+    expect(clusterResult.ui.isFiring).toBe(true);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should alert if red -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Red, AlertClusterStateState.Green);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      AlertClusterStateState.Green,
+      emailAddress,
+      true
+    );
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBeGreaterThan(0);
+  });
+
+  it('should not alert if red -> yellow', async () => {
+    const result = await setupAlert(AlertClusterStateState.Red, AlertClusterStateState.Yellow);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Red);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should not alert if yellow -> red', async () => {
+    const result = await setupAlert(AlertClusterStateState.Yellow, AlertClusterStateState.Red);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Yellow);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+
+  it('should not alert if green -> green', async () => {
+    const result = await setupAlert(AlertClusterStateState.Green, AlertClusterStateState.Green);
+    expect(executeActions).not.toHaveBeenCalled();
+    const clusterResult = result[clusterUuid] as AlertClusterStatePerClusterState;
+    expect(clusterResult.state).toBe(AlertClusterStateState.Green);
+    expect(clusterResult.ui.resolvedMS).toBe(0);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/alerts/cluster_state.ts b/x-pack/plugins/monitoring/server/alerts/cluster_state.ts
new file mode 100644
index 0000000000000..9a5805b8af7ce
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/cluster_state.ts
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment-timezone';
+import { i18n } from '@kbn/i18n';
+import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'src/core/server';
+import { ALERT_TYPE_CLUSTER_STATE } from '../../common/constants';
+import { AlertType } from '../../../alerting/server';
+import { executeActions, getUiMessage } from '../lib/alerts/cluster_state.lib';
+import {
+  AlertCommonExecutorOptions,
+  AlertCommonState,
+  AlertClusterStatePerClusterState,
+  AlertCommonCluster,
+} from './types';
+import { AlertClusterStateState } from './enums';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+import { fetchClusterState } from '../lib/alerts/fetch_cluster_state';
+
+export const getClusterState = (
+  getUiSettingsService: () => Promise<UiSettingsServiceStart>,
+  monitoringCluster: ICustomClusterClient,
+  getLogger: (...scopes: string[]) => Logger,
+  ccsEnabled: boolean
+): AlertType => {
+  const logger = getLogger(ALERT_TYPE_CLUSTER_STATE);
+  return {
+    id: ALERT_TYPE_CLUSTER_STATE,
+    name: 'Monitoring Alert - Cluster Status',
+    actionGroups: [
+      {
+        id: 'default',
+        name: i18n.translate('xpack.monitoring.alerts.clusterState.actionGroups.default', {
+          defaultMessage: 'Default',
+        }),
+      },
+    ],
+    defaultActionGroupId: 'default',
+    async executor({
+      services,
+      params,
+      state,
+    }: AlertCommonExecutorOptions): Promise<AlertCommonState> {
+      logger.debug(
+        `Firing alert with params: ${JSON.stringify(params)} and state: ${JSON.stringify(state)}`
+      );
+
+      const preparedAlert = await getPreparedAlert(
+        ALERT_TYPE_CLUSTER_STATE,
+        getUiSettingsService,
+        monitoringCluster,
+        logger,
+        ccsEnabled,
+        services,
+        fetchClusterState
+      );
+
+      if (!preparedAlert) {
+        return state;
+      }
+
+      const { emailAddress, data: states, clusters } = preparedAlert;
+
+      const result: AlertCommonState = { ...state };
+      const defaultAlertState: AlertClusterStatePerClusterState = {
+        state: AlertClusterStateState.Green,
+        ui: {
+          isFiring: false,
+          message: null,
+          severity: 0,
+          resolvedMS: 0,
+          triggeredMS: 0,
+          lastCheckedMS: 0,
+        },
+      };
+
+      for (const clusterState of states) {
+        const alertState: AlertClusterStatePerClusterState =
+          (state[clusterState.clusterUuid] as AlertClusterStatePerClusterState) ||
+          defaultAlertState;
+        const cluster = clusters.find(
+          (c: AlertCommonCluster) => c.clusterUuid === clusterState.clusterUuid
+        );
+        if (!cluster) {
+          logger.warn(`Unable to find cluster for clusterUuid='${clusterState.clusterUuid}'`);
+          continue;
+        }
+        const isNonGreen = clusterState.state !== AlertClusterStateState.Green;
+        const severity = clusterState.state === AlertClusterStateState.Red ? 2100 : 1100;
+
+        const ui = alertState.ui;
+        let triggered = ui.triggeredMS;
+        let resolved = ui.resolvedMS;
+        let message = ui.message || {};
+        let lastState = alertState.state;
+        const instance = services.alertInstanceFactory(ALERT_TYPE_CLUSTER_STATE);
+
+        if (isNonGreen) {
+          if (lastState === AlertClusterStateState.Green) {
+            logger.debug(`Cluster state changed from green to ${clusterState.state}`);
+            executeActions(instance, cluster, clusterState.state, emailAddress);
+            lastState = clusterState.state;
+            triggered = moment().valueOf();
+          }
+          message = getUiMessage(clusterState.state);
+          resolved = 0;
+        } else if (!isNonGreen && lastState !== AlertClusterStateState.Green) {
+          logger.debug(`Cluster state changed from ${lastState} to green`);
+          executeActions(instance, cluster, clusterState.state, emailAddress, true);
+          lastState = clusterState.state;
+          message = getUiMessage(clusterState.state, true);
+          resolved = moment().valueOf();
+        }
+
+        result[clusterState.clusterUuid] = {
+          state: lastState,
+          ui: {
+            message,
+            isFiring: isNonGreen,
+            severity,
+            resolvedMS: resolved,
+            triggeredMS: triggered,
+            lastCheckedMS: moment().valueOf(),
+          },
+        } as AlertClusterStatePerClusterState;
+      }
+
+      return result;
+    },
+  };
+};
diff --git a/x-pack/plugins/monitoring/server/alerts/enums.ts b/x-pack/plugins/monitoring/server/alerts/enums.ts
new file mode 100644
index 0000000000000..ccff588743af1
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/alerts/enums.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export enum AlertClusterStateState {
+  Green = 'green',
+  Red = 'red',
+  Yellow = 'yellow',
+}
+
+export enum AlertCommonPerClusterMessageTokenType {
+  Time = 'time',
+  Link = 'link',
+}
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
index 0773af6e7f070..92047e300bc1f 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration.test.ts
@@ -6,42 +6,31 @@
 
 import moment from 'moment-timezone';
 import { getLicenseExpiration } from './license_expiration';
-import {
-  ALERT_TYPE_LICENSE_EXPIRATION,
-  MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS,
-} from '../../common/constants';
+import { ALERT_TYPE_LICENSE_EXPIRATION } from '../../common/constants';
 import { Logger } from 'src/core/server';
-import { AlertServices, AlertInstance } from '../../../alerting/server';
+import { AlertServices } from '../../../alerting/server';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import {
-  AlertState,
-  AlertClusterState,
-  AlertParams,
-  LicenseExpirationAlertExecutorOptions,
+  AlertCommonParams,
+  AlertCommonState,
+  AlertLicensePerClusterState,
+  AlertLicense,
 } from './types';
-import { SavedObject, SavedObjectAttributes } from 'src/core/server';
-import { SavedObjectsClientContract } from 'src/core/server';
-
-function fillLicense(license: any, clusterUuid?: string) {
-  return {
-    hits: {
-      hits: [
-        {
-          _source: {
-            license,
-            cluster_uuid: clusterUuid,
-          },
-        },
-      ],
-    },
-  };
-}
-
-const clusterUuid = 'a4545jhjb';
-const params: AlertParams = {
-  dateFormat: 'YYYY',
-  timezone: 'UTC',
-};
+import { executeActions } from '../lib/alerts/license_expiration.lib';
+import { PreparedAlert, getPreparedAlert } from '../lib/alerts/get_prepared_alert';
+
+jest.mock('../lib/alerts/license_expiration.lib', () => ({
+  executeActions: jest.fn(),
+  getUiMessage: jest.fn(),
+}));
+
+jest.mock('../lib/alerts/get_prepared_alert', () => ({
+  getPreparedAlert: jest.fn(() => {
+    return {
+      emailAddress: 'foo@foo.com',
+    };
+  }),
+}));
 
 interface MockServices {
   callCluster: jest.Mock;
@@ -49,428 +38,169 @@ interface MockServices {
   savedObjectsClient: jest.Mock;
 }
 
-const alertExecutorOptions: LicenseExpirationAlertExecutorOptions = {
-  alertId: '',
-  startedAt: new Date(),
-  services: {
-    callCluster: (path: string, opts: any) => new Promise(resolve => resolve()),
-    alertInstanceFactory: (id: string) => new AlertInstance(),
-    savedObjectsClient: {} as jest.Mocked<SavedObjectsClientContract>,
-  },
-  params: {},
-  state: {},
-  spaceId: '',
-  name: '',
-  tags: [],
-  previousStartedAt: null,
-  createdBy: null,
-  updatedBy: null,
-};
-
 describe('getLicenseExpiration', () => {
-  const emailAddress = 'foo@foo.com';
-  const getUiSettingsService: any = () => ({
-    asScopedToClient: (): any => ({
-      get: () => new Promise(resolve => resolve(emailAddress)),
-    }),
-  });
-  const monitoringCluster: any = null;
-  const logger: Logger = {
-    warn: jest.fn(),
-    log: jest.fn(),
-    debug: jest.fn(),
-    trace: jest.fn(),
-    error: jest.fn(),
-    fatal: jest.fn(),
-    info: jest.fn(),
-    get: jest.fn(),
+  const services: MockServices | AlertServices = {
+    callCluster: jest.fn(),
+    alertInstanceFactory: jest.fn(),
+    savedObjectsClient: savedObjectsClientMock.create(),
   };
-  const getLogger = (): Logger => logger;
-  const ccrEnabled = false;
 
-  afterEach(() => {
-    (logger.warn as jest.Mock).mockClear();
-  });
-
-  it('should have the right id and actionGroups', () => {
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-    expect(alert.id).toBe(ALERT_TYPE_LICENSE_EXPIRATION);
-    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
-  });
+  const params: AlertCommonParams = {
+    dateFormat: 'YYYY',
+    timezone: 'UTC',
+  };
 
-  it('should return the state if no license is provided', async () => {
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
+  const emailAddress = 'foo@foo.com';
+  const clusterUuid = 'kdksdfj434';
+  const clusterName = 'monitoring_test';
+  const dateFormat = 'YYYY-MM-DD';
+  const cluster = { clusterUuid, clusterName };
+  const defaultUiState = {
+    isFiring: false,
+    severity: 0,
+    message: null,
+    resolvedMS: 0,
+    lastCheckedMS: 0,
+    triggeredMS: 0,
+  };
 
-    const services: MockServices | AlertServices = {
-      callCluster: jest.fn(),
-      alertInstanceFactory: jest.fn(),
-      savedObjectsClient: savedObjectsClientMock.create(),
+  async function setupAlert(
+    license: AlertLicense | null,
+    expiredCheckDateMS: number,
+    preparedAlertResponse: PreparedAlert | null | undefined = undefined
+  ): Promise<AlertCommonState> {
+    const logger: Logger = {
+      warn: jest.fn(),
+      log: jest.fn(),
+      debug: jest.fn(),
+      trace: jest.fn(),
+      error: jest.fn(),
+      fatal: jest.fn(),
+      info: jest.fn(),
+      get: jest.fn(),
     };
-    const state = { foo: 1 };
-
-    const result = await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    });
-
-    expect(result).toEqual(state);
-  });
+    const getLogger = (): Logger => logger;
+    const ccrEnabled = false;
+    (getPreparedAlert as jest.Mock).mockImplementation(() => {
+      if (preparedAlertResponse !== undefined) {
+        return preparedAlertResponse;
+      }
 
-  it('should log a warning if no email is provided', async () => {
-    const customGetUiSettingsService: any = () => ({
-      asScopedToClient: () => ({
-        get: () => null,
-      }),
+      return {
+        emailAddress,
+        data: [license],
+        clusters: [cluster],
+        dateFormat,
+      };
     });
-    const alert = getLicenseExpiration(
-      customGetUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
 
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense({
-                  status: 'good',
-                  type: 'basic',
-                  expiry_date_in_millis: moment()
-                    .add(7, 'days')
-                    .valueOf(),
-                })
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory: jest.fn(),
-      savedObjectsClient: savedObjectsClientMock.create(),
+    const alert = getLicenseExpiration(null as any, null as any, getLogger, ccrEnabled);
+    const state: AlertCommonState = {
+      [clusterUuid]: {
+        expiredCheckDateMS,
+        ui: { ...defaultUiState },
+      } as AlertLicensePerClusterState,
     };
 
-    const state = {};
+    return (await alert.executor({ services, params, state } as any)) as AlertCommonState;
+  }
 
-    await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    });
-
-    expect((logger.warn as jest.Mock).mock.calls.length).toBe(1);
-    expect(logger.warn).toHaveBeenCalledWith(
-      `Unable to send email for ${ALERT_TYPE_LICENSE_EXPIRATION} because there is no email configured.`
-    );
+  afterEach(() => {
+    (executeActions as jest.Mock).mockClear();
+    (getPreparedAlert as jest.Mock).mockClear();
   });
 
-  it('should fire actions if going to expire', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
+  it('should have the right id and actionGroups', () => {
+    const alert = getLicenseExpiration(null as any, null as any, jest.fn(), false);
+    expect(alert.id).toBe(ALERT_TYPE_LICENSE_EXPIRATION);
+    expect(alert.actionGroups).toEqual([{ id: 'default', name: 'Default' }]);
+  });
 
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
+  it('should return the state if no license is provided', async () => {
+    const result = await setupAlert(null, 0, null);
+    expect(result[clusterUuid].ui).toEqual(defaultUiState);
+  });
 
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'gold',
-                    expiry_date_in_millis: moment()
-                      .add(7, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+  it('should fire actions if going to expire', async () => {
+    const expiryDateMS = moment()
+      .add(7, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'gold',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
-
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS > 0).toBe(true);
-    expect(scheduleActions.mock.calls.length).toBe(1);
-    expect(scheduleActions.mock.calls[0][1].subject).toBe(
-      'NEW X-Pack Monitoring: License Expiration'
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress
     );
-    expect(scheduleActions.mock.calls[0][1].to).toBe(emailAddress);
   });
 
   it('should fire actions if the user fixed their license', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'gold',
-                    expiry_date_in_millis: moment()
-                      .add(120, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
-    };
-
-    const state: AlertState = {
-      [clusterUuid]: {
-        expiredCheckDateMS: moment()
-          .subtract(1, 'day')
-          .valueOf(),
-        ui: { isFiring: true, severity: 0, message: null, resolvedMS: 0, expirationTime: 0 },
-      },
+    const expiryDateMS = moment()
+      .add(365, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'gold',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
+    const result = await setupAlert(license, 100);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS).toBe(0);
-    expect(scheduleActions.mock.calls.length).toBe(1);
-    expect(scheduleActions.mock.calls[0][1].subject).toBe(
-      'RESOLVED X-Pack Monitoring: License Expiration'
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress,
+      true
     );
-    expect(scheduleActions.mock.calls[0][1].to).toBe(emailAddress);
   });
 
   it('should not fire actions for trial license that expire in more than 14 days', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'trial',
-                    expiry_date_in_millis: moment()
-                      .add(15, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+    const expiryDateMS = moment()
+      .add(20, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'trial',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
-    expect(newState.expiredCheckDateMS).toBe(undefined);
-    expect(scheduleActions).not.toHaveBeenCalled();
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
+    expect(newState.expiredCheckDateMS).toBe(0);
+    expect(executeActions).not.toHaveBeenCalled();
   });
 
   it('should fire actions for trial license that in 14 days or less', async () => {
-    const scheduleActions = jest.fn();
-    const alertInstanceFactory = jest.fn(
-      (id: string): AlertInstance => {
-        const instance = new AlertInstance();
-        instance.scheduleActions = scheduleActions;
-        return instance;
-      }
-    );
-    const alert = getLicenseExpiration(
-      getUiSettingsService,
-      monitoringCluster,
-      getLogger,
-      ccrEnabled
-    );
-
-    const savedObjectsClient = savedObjectsClientMock.create();
-    savedObjectsClient.get.mockReturnValue(
-      new Promise(resolve => {
-        const savedObject: SavedObject<SavedObjectAttributes> = {
-          id: '',
-          type: '',
-          references: [],
-          attributes: {
-            [MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS]: emailAddress,
-          },
-        };
-        resolve(savedObject);
-      })
-    );
-    const services = {
-      callCluster: jest.fn(
-        (method: string, { filterPath }): Promise<any> => {
-          return new Promise(resolve => {
-            if (filterPath.includes('hits.hits._source.license.*')) {
-              resolve(
-                fillLicense(
-                  {
-                    status: 'active',
-                    type: 'trial',
-                    expiry_date_in_millis: moment()
-                      .add(13, 'days')
-                      .valueOf(),
-                  },
-                  clusterUuid
-                )
-              );
-            }
-            resolve({});
-          });
-        }
-      ),
-      alertInstanceFactory,
-      savedObjectsClient,
+    const expiryDateMS = moment()
+      .add(7, 'days')
+      .valueOf();
+    const license = {
+      status: 'active',
+      type: 'trial',
+      expiryDateMS,
+      clusterUuid,
     };
-
-    const state = {};
-    const result: AlertState = (await alert.executor({
-      ...alertExecutorOptions,
-      services,
-      params,
-      state,
-    })) as AlertState;
-
-    const newState: AlertClusterState = result[clusterUuid] as AlertClusterState;
+    const result = await setupAlert(license, 0);
+    const newState = result[clusterUuid] as AlertLicensePerClusterState;
     expect(newState.expiredCheckDateMS > 0).toBe(true);
-    expect(scheduleActions.mock.calls.length).toBe(1);
+    expect(executeActions).toHaveBeenCalledWith(
+      undefined,
+      cluster,
+      moment.utc(expiryDateMS),
+      dateFormat,
+      emailAddress
+    );
   });
 });
diff --git a/x-pack/plugins/monitoring/server/alerts/license_expiration.ts b/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
index 93397ff3641ae..2e5356150086b 100644
--- a/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
+++ b/x-pack/plugins/monitoring/server/alerts/license_expiration.ts
@@ -5,24 +5,20 @@
  */
 
 import moment from 'moment-timezone';
-import { get } from 'lodash';
 import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'src/core/server';
 import { i18n } from '@kbn/i18n';
-import { ALERT_TYPE_LICENSE_EXPIRATION, INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
+import { ALERT_TYPE_LICENSE_EXPIRATION } from '../../common/constants';
 import { AlertType } from '../../../../plugins/alerting/server';
 import { fetchLicenses } from '../lib/alerts/fetch_licenses';
-import { fetchDefaultEmailAddress } from '../lib/alerts/fetch_default_email_address';
-import { fetchClusters } from '../lib/alerts/fetch_clusters';
-import { fetchAvailableCcs } from '../lib/alerts/fetch_available_ccs';
 import {
-  AlertLicense,
-  AlertState,
-  AlertClusterState,
-  AlertClusterUiState,
-  LicenseExpirationAlertExecutorOptions,
+  AlertCommonState,
+  AlertLicensePerClusterState,
+  AlertCommonExecutorOptions,
+  AlertCommonCluster,
+  AlertLicensePerClusterUiState,
 } from './types';
-import { getCcsIndexPattern } from '../lib/alerts/get_ccs_index_pattern';
 import { executeActions, getUiMessage } from '../lib/alerts/license_expiration.lib';
+import { getPreparedAlert } from '../lib/alerts/get_prepared_alert';
 
 const EXPIRES_DAYS = [60, 30, 14, 7];
 
@@ -32,14 +28,6 @@ export const getLicenseExpiration = (
   getLogger: (...scopes: string[]) => Logger,
   ccsEnabled: boolean
 ): AlertType => {
-  async function getCallCluster(services: any): Promise<any> {
-    if (!monitoringCluster) {
-      return services.callCluster;
-    }
-
-    return monitoringCluster.callAsInternalUser;
-  }
-
   const logger = getLogger(ALERT_TYPE_LICENSE_EXPIRATION);
   return {
     id: ALERT_TYPE_LICENSE_EXPIRATION,
@@ -53,54 +41,50 @@ export const getLicenseExpiration = (
       },
     ],
     defaultActionGroupId: 'default',
-    async executor({
-      services,
-      params,
-      state,
-    }: LicenseExpirationAlertExecutorOptions): Promise<any> {
+    async executor({ services, params, state }: AlertCommonExecutorOptions): Promise<any> {
       logger.debug(
         `Firing alert with params: ${JSON.stringify(params)} and state: ${JSON.stringify(state)}`
       );
 
-      const callCluster = await getCallCluster(services);
-
-      // Support CCS use cases by querying to find available remote clusters
-      // and then adding those to the index pattern we are searching against
-      let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
-      if (ccsEnabled) {
-        const availableCcs = await fetchAvailableCcs(callCluster);
-        if (availableCcs.length > 0) {
-          esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
-        }
-      }
-
-      const clusters = await fetchClusters(callCluster, esIndexPattern);
+      const preparedAlert = await getPreparedAlert(
+        ALERT_TYPE_LICENSE_EXPIRATION,
+        getUiSettingsService,
+        monitoringCluster,
+        logger,
+        ccsEnabled,
+        services,
+        fetchLicenses
+      );
 
-      // Fetch licensing information from cluster_stats documents
-      const licenses: AlertLicense[] = await fetchLicenses(callCluster, clusters, esIndexPattern);
-      if (licenses.length === 0) {
-        logger.warn(`No license found for ${ALERT_TYPE_LICENSE_EXPIRATION}.`);
+      if (!preparedAlert) {
         return state;
       }
 
-      const uiSettings = (await getUiSettingsService()).asScopedToClient(
-        services.savedObjectsClient
-      );
-      const dateFormat: string = await uiSettings.get<string>('dateFormat');
-      const timezone: string = await uiSettings.get<string>('dateFormat:tz');
-      const emailAddress = await fetchDefaultEmailAddress(uiSettings);
-      if (!emailAddress) {
-        // TODO: we can do more here
-        logger.warn(
-          `Unable to send email for ${ALERT_TYPE_LICENSE_EXPIRATION} because there is no email configured.`
-        );
-        return;
-      }
+      const { emailAddress, data: licenses, clusters, dateFormat } = preparedAlert;
 
-      const result: AlertState = { ...state };
+      const result: AlertCommonState = { ...state };
+      const defaultAlertState: AlertLicensePerClusterState = {
+        expiredCheckDateMS: 0,
+        ui: {
+          isFiring: false,
+          message: null,
+          severity: 0,
+          resolvedMS: 0,
+          lastCheckedMS: 0,
+          triggeredMS: 0,
+        },
+      };
 
       for (const license of licenses) {
-        const licenseState: AlertClusterState = state[license.clusterUuid] || {};
+        const alertState: AlertLicensePerClusterState =
+          (state[license.clusterUuid] as AlertLicensePerClusterState) || defaultAlertState;
+        const cluster = clusters.find(
+          (c: AlertCommonCluster) => c.clusterUuid === license.clusterUuid
+        );
+        if (!cluster) {
+          logger.warn(`Unable to find cluster for clusterUuid='${license.clusterUuid}'`);
+          continue;
+        }
         const $expiry = moment.utc(license.expiryDateMS);
         let isExpired = false;
         let severity = 0;
@@ -123,31 +107,26 @@ export const getLicenseExpiration = (
           }
         }
 
-        const ui: AlertClusterUiState = get<AlertClusterUiState>(licenseState, 'ui', {
-          isFiring: false,
-          message: null,
-          severity: 0,
-          resolvedMS: 0,
-          expirationTime: 0,
-        });
+        const ui = alertState.ui;
+        let triggered = ui.triggeredMS;
         let resolved = ui.resolvedMS;
         let message = ui.message;
-        let expiredCheckDate = licenseState.expiredCheckDateMS;
+        let expiredCheckDate = alertState.expiredCheckDateMS;
         const instance = services.alertInstanceFactory(ALERT_TYPE_LICENSE_EXPIRATION);
 
         if (isExpired) {
-          if (!licenseState.expiredCheckDateMS) {
+          if (!alertState.expiredCheckDateMS) {
             logger.debug(`License will expire soon, sending email`);
-            executeActions(instance, license, $expiry, dateFormat, emailAddress);
-            expiredCheckDate = moment().valueOf();
+            executeActions(instance, cluster, $expiry, dateFormat, emailAddress);
+            expiredCheckDate = triggered = moment().valueOf();
           }
-          message = getUiMessage(license, timezone);
+          message = getUiMessage();
           resolved = 0;
-        } else if (!isExpired && licenseState.expiredCheckDateMS) {
+        } else if (!isExpired && alertState.expiredCheckDateMS) {
           logger.debug(`License expiration has been resolved, sending email`);
-          executeActions(instance, license, $expiry, dateFormat, emailAddress, true);
+          executeActions(instance, cluster, $expiry, dateFormat, emailAddress, true);
           expiredCheckDate = 0;
-          message = getUiMessage(license, timezone, true);
+          message = getUiMessage(true);
           resolved = moment().valueOf();
         }
 
@@ -159,8 +138,10 @@ export const getLicenseExpiration = (
             isFiring: expiredCheckDate > 0,
             severity,
             resolvedMS: resolved,
-          },
-        };
+            triggeredMS: triggered,
+            lastCheckedMS: moment().valueOf(),
+          } as AlertLicensePerClusterUiState,
+        } as AlertLicensePerClusterState;
       }
 
       return result;
diff --git a/x-pack/plugins/monitoring/server/alerts/types.d.ts b/x-pack/plugins/monitoring/server/alerts/types.d.ts
index ff47d6f2ad4dc..b689d008b51a7 100644
--- a/x-pack/plugins/monitoring/server/alerts/types.d.ts
+++ b/x-pack/plugins/monitoring/server/alerts/types.d.ts
@@ -5,41 +5,79 @@
  */
 import { Moment } from 'moment';
 import { AlertExecutorOptions } from '../../../alerting/server';
+import { AlertClusterStateState, AlertCommonPerClusterMessageTokenType } from './enums';
 
 export interface AlertLicense {
   status: string;
   type: string;
   expiryDateMS: number;
   clusterUuid: string;
-  clusterName: string;
 }
 
-export interface AlertState {
-  [clusterUuid: string]: AlertClusterState;
+export interface AlertClusterState {
+  state: AlertClusterStateState;
+  clusterUuid: string;
+}
+
+export interface AlertCommonState {
+  [clusterUuid: string]: AlertCommonPerClusterState;
 }
 
-export interface AlertClusterState {
-  expiredCheckDateMS: number | Moment;
-  ui: AlertClusterUiState;
+export interface AlertCommonPerClusterState {
+  ui: AlertCommonPerClusterUiState;
 }
 
-export interface AlertClusterUiState {
+export interface AlertClusterStatePerClusterState extends AlertCommonPerClusterState {
+  state: AlertClusterStateState;
+}
+
+export interface AlertLicensePerClusterState extends AlertCommonPerClusterState {
+  expiredCheckDateMS: number;
+}
+
+export interface AlertCommonPerClusterUiState {
   isFiring: boolean;
   severity: number;
-  message: string | null;
+  message: AlertCommonPerClusterMessage | null;
   resolvedMS: number;
+  lastCheckedMS: number;
+  triggeredMS: number;
+}
+
+export interface AlertCommonPerClusterMessage {
+  text: string; // Do this. #link this is a link #link
+  tokens?: AlertCommonPerClusterMessageToken[];
+}
+
+export interface AlertCommonPerClusterMessageToken {
+  startToken: string;
+  endToken?: string;
+  type: AlertCommonPerClusterMessageTokenType;
+}
+
+export interface AlertCommonPerClusterMessageLinkToken extends AlertCommonPerClusterMessageToken {
+  url?: string;
+}
+
+export interface AlertCommonPerClusterMessageTimeToken extends AlertCommonPerClusterMessageToken {
+  isRelative: boolean;
+  isAbsolute: boolean;
+}
+
+export interface AlertLicensePerClusterUiState extends AlertCommonPerClusterUiState {
   expirationTime: number;
 }
 
-export interface AlertCluster {
+export interface AlertCommonCluster {
   clusterUuid: string;
+  clusterName: string;
 }
 
-export interface LicenseExpirationAlertExecutorOptions extends AlertExecutorOptions {
-  state: AlertState;
+export interface AlertCommonExecutorOptions extends AlertExecutorOptions {
+  state: AlertCommonState;
 }
 
-export interface AlertParams {
+export interface AlertCommonParams {
   dateFormat: string;
   timezone: string;
 }
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts
new file mode 100644
index 0000000000000..81e375734cc50
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.test.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { executeActions, getUiMessage } from './cluster_state.lib';
+import { AlertClusterStateState } from '../../alerts/enums';
+import { AlertCommonPerClusterMessageLinkToken } from '../../alerts/types';
+
+describe('clusterState lib', () => {
+  describe('executeActions', () => {
+    const clusterName = 'clusterA';
+    const instance: any = { scheduleActions: jest.fn() };
+    const license: any = { clusterName };
+    const status = AlertClusterStateState.Green;
+    const emailAddress = 'test@test.com';
+
+    beforeEach(() => {
+      instance.scheduleActions.mockClear();
+    });
+
+    it('should schedule actions when firing', () => {
+      executeActions(instance, license, status, emailAddress, false);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'NEW X-Pack Monitoring: Cluster Status',
+        message: `Allocate missing replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+
+    it('should have a different message for red state', () => {
+      executeActions(instance, license, AlertClusterStateState.Red, emailAddress, false);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'NEW X-Pack Monitoring: Cluster Status',
+        message: `Allocate missing primary and replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+
+    it('should schedule actions when resolved', () => {
+      executeActions(instance, license, status, emailAddress, true);
+      expect(instance.scheduleActions).toHaveBeenCalledWith('default', {
+        subject: 'RESOLVED X-Pack Monitoring: Cluster Status',
+        message: `This cluster alert has been resolved: Allocate missing replica shards for cluster '${clusterName}'`,
+        to: emailAddress,
+      });
+    });
+  });
+
+  describe('getUiMessage', () => {
+    it('should return a message when firing', () => {
+      const message = getUiMessage(AlertClusterStateState.Red, false);
+      expect(message.text).toBe(
+        `Elasticsearch cluster status is red. #start_linkAllocate missing primary and replica shards#end_link`
+      );
+      expect(message.tokens && message.tokens.length).toBe(1);
+      expect(message.tokens && message.tokens[0].startToken).toBe('#start_link');
+      expect(message.tokens && message.tokens[0].endToken).toBe('#end_link');
+      expect(
+        message.tokens && (message.tokens[0] as AlertCommonPerClusterMessageLinkToken).url
+      ).toBe('elasticsearch/indices');
+    });
+
+    it('should return a message when resolved', () => {
+      const message = getUiMessage(AlertClusterStateState.Green, true);
+      expect(message.text).toBe(`Elasticsearch cluster status is green.`);
+      expect(message.tokens).not.toBeDefined();
+    });
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts
new file mode 100644
index 0000000000000..ae66d603507ca
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/cluster_state.lib.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+import { AlertInstance } from '../../../../alerting/server';
+import {
+  AlertCommonCluster,
+  AlertCommonPerClusterMessage,
+  AlertCommonPerClusterMessageLinkToken,
+} from '../../alerts/types';
+import { AlertClusterStateState, AlertCommonPerClusterMessageTokenType } from '../../alerts/enums';
+
+const RESOLVED_SUBJECT = i18n.translate('xpack.monitoring.alerts.clusterStatus.resolvedSubject', {
+  defaultMessage: 'RESOLVED X-Pack Monitoring: Cluster Status',
+});
+
+const NEW_SUBJECT = i18n.translate('xpack.monitoring.alerts.clusterStatus.newSubject', {
+  defaultMessage: 'NEW X-Pack Monitoring: Cluster Status',
+});
+
+const RED_STATUS_MESSAGE = i18n.translate('xpack.monitoring.alerts.clusterStatus.redMessage', {
+  defaultMessage: 'Allocate missing primary and replica shards',
+});
+
+const YELLOW_STATUS_MESSAGE = i18n.translate(
+  'xpack.monitoring.alerts.clusterStatus.yellowMessage',
+  {
+    defaultMessage: 'Allocate missing replica shards',
+  }
+);
+
+export function executeActions(
+  instance: AlertInstance,
+  cluster: AlertCommonCluster,
+  status: AlertClusterStateState,
+  emailAddress: string,
+  resolved: boolean = false
+) {
+  const message =
+    status === AlertClusterStateState.Red ? RED_STATUS_MESSAGE : YELLOW_STATUS_MESSAGE;
+  if (resolved) {
+    instance.scheduleActions('default', {
+      subject: RESOLVED_SUBJECT,
+      message: `This cluster alert has been resolved: ${message} for cluster '${cluster.clusterName}'`,
+      to: emailAddress,
+    });
+  } else {
+    instance.scheduleActions('default', {
+      subject: NEW_SUBJECT,
+      message: `${message} for cluster '${cluster.clusterName}'`,
+      to: emailAddress,
+    });
+  }
+}
+
+export function getUiMessage(
+  status: AlertClusterStateState,
+  resolved: boolean = false
+): AlertCommonPerClusterMessage {
+  if (resolved) {
+    return {
+      text: i18n.translate('xpack.monitoring.alerts.clusterStatus.ui.resolvedMessage', {
+        defaultMessage: `Elasticsearch cluster status is green.`,
+      }),
+    };
+  }
+  const message =
+    status === AlertClusterStateState.Red ? RED_STATUS_MESSAGE : YELLOW_STATUS_MESSAGE;
+  return {
+    text: i18n.translate('xpack.monitoring.alerts.clusterStatus.ui.firingMessage', {
+      defaultMessage: `Elasticsearch cluster status is {status}. #start_link{message}#end_link`,
+      values: {
+        status,
+        message,
+      },
+    }),
+    tokens: [
+      {
+        startToken: '#start_link',
+        endToken: '#end_link',
+        type: AlertCommonPerClusterMessageTokenType.Link,
+        url: 'elasticsearch/indices',
+      } as AlertCommonPerClusterMessageLinkToken,
+    ],
+  };
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts
new file mode 100644
index 0000000000000..642ae3c39a027
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fetchClusterState } from './fetch_cluster_state';
+
+describe('fetchClusterState', () => {
+  it('should return the cluster state', async () => {
+    const status = 'green';
+    const clusterUuid = 'sdfdsaj34434';
+    const callCluster = jest.fn(() => ({
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_state: {
+                status,
+              },
+              cluster_uuid: clusterUuid,
+            },
+          },
+        ],
+      },
+    }));
+
+    const clusters = [{ clusterUuid, clusterName: 'foo' }];
+    const index = '.monitoring-es-*';
+
+    const state = await fetchClusterState(callCluster, clusters, index);
+    expect(state).toEqual([
+      {
+        state: status,
+        clusterUuid,
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts
new file mode 100644
index 0000000000000..66ea30d5f2e96
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_cluster_state.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { get } from 'lodash';
+import { AlertCommonCluster, AlertClusterState } from '../../alerts/types';
+
+export async function fetchClusterState(
+  callCluster: any,
+  clusters: AlertCommonCluster[],
+  index: string
+): Promise<AlertClusterState[]> {
+  const params = {
+    index,
+    filterPath: ['hits.hits._source.cluster_state.status', 'hits.hits._source.cluster_uuid'],
+    body: {
+      size: 1,
+      sort: [{ timestamp: { order: 'desc' } }],
+      query: {
+        bool: {
+          filter: [
+            {
+              terms: {
+                cluster_uuid: clusters.map(cluster => cluster.clusterUuid),
+              },
+            },
+            {
+              term: {
+                type: 'cluster_stats',
+              },
+            },
+            {
+              range: {
+                timestamp: {
+                  gte: 'now-2m',
+                },
+              },
+            },
+          ],
+        },
+      },
+    },
+  };
+
+  const response = await callCluster('search', params);
+  return get<any>(response, 'hits.hits', []).map((hit: any) => {
+    return {
+      state: get(hit, '_source.cluster_state.status'),
+      clusterUuid: get(hit, '_source.cluster_uuid'),
+    };
+  });
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
index 78eb9773df15f..7a9b61f37707b 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.test.ts
@@ -6,21 +6,51 @@
 import { fetchClusters } from './fetch_clusters';
 
 describe('fetchClusters', () => {
+  const clusterUuid = '1sdfds734';
+  const clusterName = 'monitoring';
+
   it('return a list of clusters', async () => {
     const callCluster = jest.fn().mockImplementation(() => ({
-      aggregations: {
-        clusters: {
-          buckets: [
-            {
-              key: 'clusterA',
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_uuid: clusterUuid,
+              cluster_name: clusterName,
+            },
+          },
+        ],
+      },
+    }));
+    const index = '.monitoring-es-*';
+    const result = await fetchClusters(callCluster, index);
+    expect(result).toEqual([{ clusterUuid, clusterName }]);
+  });
+
+  it('return the metadata name if available', async () => {
+    const metadataName = 'custom-monitoring';
+    const callCluster = jest.fn().mockImplementation(() => ({
+      hits: {
+        hits: [
+          {
+            _source: {
+              cluster_uuid: clusterUuid,
+              cluster_name: clusterName,
+              cluster_settings: {
+                cluster: {
+                  metadata: {
+                    display_name: metadataName,
+                  },
+                },
+              },
             },
-          ],
-        },
+          },
+        ],
       },
     }));
     const index = '.monitoring-es-*';
     const result = await fetchClusters(callCluster, index);
-    expect(result).toEqual([{ clusterUuid: 'clusterA' }]);
+    expect(result).toEqual([{ clusterUuid, clusterName: metadataName }]);
   });
 
   it('should limit the time period in the query', async () => {
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
index 8ef7339618a2c..d1513ac16fb15 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_clusters.ts
@@ -4,18 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { get } from 'lodash';
-import { AlertCluster } from '../../alerts/types';
+import { AlertCommonCluster } from '../../alerts/types';
 
-interface AggregationResult {
-  key: string;
-}
-
-export async function fetchClusters(callCluster: any, index: string): Promise<AlertCluster[]> {
+export async function fetchClusters(
+  callCluster: any,
+  index: string
+): Promise<AlertCommonCluster[]> {
   const params = {
     index,
-    filterPath: 'aggregations.clusters.buckets',
+    filterPath: [
+      'hits.hits._source.cluster_settings.cluster.metadata.display_name',
+      'hits.hits._source.cluster_uuid',
+      'hits.hits._source.cluster_name',
+    ],
     body: {
-      size: 0,
+      size: 1000,
       query: {
         bool: {
           filter: [
@@ -34,19 +37,21 @@ export async function fetchClusters(callCluster: any, index: string): Promise<Al
           ],
         },
       },
-      aggs: {
-        clusters: {
-          terms: {
-            field: 'cluster_uuid',
-            size: 1000,
-          },
-        },
+      collapse: {
+        field: 'cluster_uuid',
       },
     },
   };
 
   const response = await callCluster('search', params);
-  return get(response, 'aggregations.clusters.buckets', []).map((bucket: AggregationResult) => ({
-    clusterUuid: bucket.key,
-  }));
+  return get(response, 'hits.hits', []).map((hit: any) => {
+    const clusterName: string =
+      get(hit, '_source.cluster_settings.cluster.metadata.display_name') ||
+      get(hit, '_source.cluster_name') ||
+      get(hit, '_source.cluster_uuid');
+    return {
+      clusterUuid: get(hit, '_source.cluster_uuid'),
+      clusterName,
+    };
+  });
 }
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
index dd6c074e68b1f..9dcb4ffb82a5f 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.test.ts
@@ -6,28 +6,28 @@
 import { fetchLicenses } from './fetch_licenses';
 
 describe('fetchLicenses', () => {
+  const clusterName = 'MyCluster';
+  const clusterUuid = 'clusterA';
+  const license = {
+    status: 'active',
+    expiry_date_in_millis: 1579532493876,
+    type: 'basic',
+  };
+
   it('return a list of licenses', async () => {
-    const clusterName = 'MyCluster';
-    const clusterUuid = 'clusterA';
-    const license = {
-      status: 'active',
-      expiry_date_in_millis: 1579532493876,
-      type: 'basic',
-    };
     const callCluster = jest.fn().mockImplementation(() => ({
       hits: {
         hits: [
           {
             _source: {
               license,
-              cluster_name: clusterName,
               cluster_uuid: clusterUuid,
             },
           },
         ],
       },
     }));
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     const result = await fetchLicenses(callCluster, clusters, index);
     expect(result).toEqual([
@@ -36,15 +36,13 @@ describe('fetchLicenses', () => {
         type: license.type,
         expiryDateMS: license.expiry_date_in_millis,
         clusterUuid,
-        clusterName,
       },
     ]);
   });
 
   it('should only search for the clusters provided', async () => {
-    const clusterUuid = 'clusterA';
     const callCluster = jest.fn();
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     await fetchLicenses(callCluster, clusters, index);
     const params = callCluster.mock.calls[0][1];
@@ -52,54 +50,11 @@ describe('fetchLicenses', () => {
   });
 
   it('should limit the time period in the query', async () => {
-    const clusterUuid = 'clusterA';
     const callCluster = jest.fn();
-    const clusters = [{ clusterUuid }];
+    const clusters = [{ clusterUuid, clusterName }];
     const index = '.monitoring-es-*';
     await fetchLicenses(callCluster, clusters, index);
     const params = callCluster.mock.calls[0][1];
     expect(params.body.query.bool.filter[2].range.timestamp.gte).toBe('now-2m');
   });
-
-  it('should give priority to the metadata name', async () => {
-    const clusterName = 'MyCluster';
-    const clusterUuid = 'clusterA';
-    const license = {
-      status: 'active',
-      expiry_date_in_millis: 1579532493876,
-      type: 'basic',
-    };
-    const callCluster = jest.fn().mockImplementation(() => ({
-      hits: {
-        hits: [
-          {
-            _source: {
-              license,
-              cluster_name: 'fakeName',
-              cluster_uuid: clusterUuid,
-              cluster_settings: {
-                cluster: {
-                  metadata: {
-                    display_name: clusterName,
-                  },
-                },
-              },
-            },
-          },
-        ],
-      },
-    }));
-    const clusters = [{ clusterUuid }];
-    const index = '.monitoring-es-*';
-    const result = await fetchLicenses(callCluster, clusters, index);
-    expect(result).toEqual([
-      {
-        status: license.status,
-        type: license.type,
-        expiryDateMS: license.expiry_date_in_millis,
-        clusterUuid,
-        clusterName,
-      },
-    ]);
-  });
 });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
index 31a68e8aa9c3e..5b05c907e796e 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_licenses.ts
@@ -4,21 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { get } from 'lodash';
-import { AlertLicense, AlertCluster } from '../../alerts/types';
+import { AlertLicense, AlertCommonCluster } from '../../alerts/types';
 
 export async function fetchLicenses(
   callCluster: any,
-  clusters: AlertCluster[],
+  clusters: AlertCommonCluster[],
   index: string
 ): Promise<AlertLicense[]> {
   const params = {
     index,
-    filterPath: [
-      'hits.hits._source.license.*',
-      'hits.hits._source.cluster_settings.cluster.metadata.display_name',
-      'hits.hits._source.cluster_uuid',
-      'hits.hits._source.cluster_name',
-    ],
+    filterPath: ['hits.hits._source.license.*', 'hits.hits._source.cluster_uuid'],
     body: {
       size: 1,
       sort: [{ timestamp: { order: 'desc' } }],
@@ -50,17 +45,12 @@ export async function fetchLicenses(
 
   const response = await callCluster('search', params);
   return get<any>(response, 'hits.hits', []).map((hit: any) => {
-    const clusterName: string =
-      get(hit, '_source.cluster_settings.cluster.metadata.display_name') ||
-      get(hit, '_source.cluster_name') ||
-      get(hit, '_source.cluster_uuid');
     const rawLicense: any = get(hit, '_source.license', {});
     const license: AlertLicense = {
       status: rawLicense.status,
       type: rawLicense.type,
       expiryDateMS: rawLicense.expiry_date_in_millis,
       clusterUuid: get(hit, '_source.cluster_uuid'),
-      clusterName,
     };
     return license;
   });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts
new file mode 100644
index 0000000000000..a3bcb61afacd6
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.test.ts
@@ -0,0 +1,122 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { fetchStatus } from './fetch_status';
+import { AlertCommonPerClusterState } from '../../alerts/types';
+
+describe('fetchStatus', () => {
+  const alertType = 'monitoringTest';
+  const log = { warn: jest.fn() };
+  const start = 0;
+  const end = 0;
+  const id = 1;
+  const defaultUiState = {
+    isFiring: false,
+    severity: 0,
+    message: null,
+    resolvedMS: 0,
+    lastCheckedMS: 0,
+    triggeredMS: 0,
+  };
+  const alertsClient = {
+    find: jest.fn(() => ({
+      total: 1,
+      data: [
+        {
+          id,
+        },
+      ],
+    })),
+    getAlertState: jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: defaultUiState,
+        } as AlertCommonPerClusterState,
+      },
+    })),
+  };
+
+  afterEach(() => {
+    (alertsClient.find as jest.Mock).mockClear();
+    (alertsClient.getAlertState as jest.Mock).mockClear();
+  });
+
+  it('should fetch from the alerts client', async () => {
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+
+  it('should return alerts that are firing', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: {
+            ...defaultUiState,
+            isFiring: true,
+          },
+        } as AlertCommonPerClusterState,
+      },
+    }));
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status.length).toBe(1);
+    expect(status[0].type).toBe(alertType);
+    expect(status[0].isFiring).toBe(true);
+  });
+
+  it('should return alerts that have been resolved in the time period', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: {
+        state: {
+          ui: {
+            ...defaultUiState,
+            resolvedMS: 1500,
+          },
+        } as AlertCommonPerClusterState,
+      },
+    }));
+
+    const customStart = 1000;
+    const customEnd = 2000;
+
+    const status = await fetchStatus(
+      alertsClient as any,
+      [alertType],
+      customStart,
+      customEnd,
+      log as any
+    );
+    expect(status.length).toBe(1);
+    expect(status[0].type).toBe(alertType);
+    expect(status[0].isFiring).toBe(false);
+  });
+
+  it('should pass in the right filter to the alerts client', async () => {
+    await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect((alertsClient.find as jest.Mock).mock.calls[0][0].options.filter).toBe(
+      `alert.attributes.alertTypeId:${alertType}`
+    );
+  });
+
+  it('should return nothing if no alert state is found', async () => {
+    alertsClient.getAlertState = jest.fn(() => ({
+      alertTypeState: null,
+    })) as any;
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+
+  it('should return nothing if no alerts are found', async () => {
+    alertsClient.find = jest.fn(() => ({
+      total: 0,
+      data: [],
+    })) as any;
+
+    const status = await fetchStatus(alertsClient as any, [alertType], start, end, log as any);
+    expect(status).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
index 9f7c1d5a994d2..bf6ee965d3b2f 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/fetch_status.ts
@@ -4,81 +4,53 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import moment from 'moment';
-import { get } from 'lodash';
-import { AlertClusterState } from '../../alerts/types';
-import { ALERT_TYPES, LOGGING_TAG } from '../../../common/constants';
+import { Logger } from '../../../../../../src/core/server';
+import { AlertCommonPerClusterState } from '../../alerts/types';
+import { AlertsClient } from '../../../../alerting/server';
 
 export async function fetchStatus(
-  callCluster: any,
+  alertsClient: AlertsClient,
+  alertTypes: string[],
   start: number,
   end: number,
-  clusterUuid: string,
-  server: any
+  log: Logger
 ): Promise<any[]> {
-  // TODO: this shouldn't query task manager directly but rather
-  // use an api exposed by the alerting/actions plugin
-  // See https://github.com/elastic/kibana/issues/48442
   const statuses = await Promise.all(
-    ALERT_TYPES.map(
+    alertTypes.map(
       type =>
         new Promise(async (resolve, reject) => {
-          try {
-            const params = {
-              index: '.kibana_task_manager',
-              filterPath: ['hits.hits._source.task.state'],
-              body: {
-                size: 1,
-                sort: [{ updated_at: { order: 'desc' } }],
-                query: {
-                  bool: {
-                    filter: [
-                      {
-                        term: {
-                          'task.taskType': `alerting:${type}`,
-                        },
-                      },
-                    ],
-                  },
-                },
-              },
-            };
-
-            const response = await callCluster('search', params);
-            const state = get(response, 'hits.hits[0]._source.task.state', '{}');
-            const clusterState: AlertClusterState = get<AlertClusterState>(
-              JSON.parse(state),
-              `alertTypeState.${clusterUuid}`,
-              {
-                expiredCheckDateMS: 0,
-                ui: {
-                  isFiring: false,
-                  message: null,
-                  severity: 0,
-                  resolvedMS: 0,
-                  expirationTime: 0,
-                },
-              }
-            );
-            const isInBetween = moment(clusterState.ui.resolvedMS).isBetween(start, end);
-            if (clusterState.ui.isFiring || isInBetween) {
-              return resolve({
-                type,
-                ...clusterState.ui,
-              });
-            }
+          // We need to get the id from the alertTypeId
+          const alerts = await alertsClient.find({
+            options: {
+              filter: `alert.attributes.alertTypeId:${type}`,
+            },
+          });
+          if (alerts.total === 0) {
             return resolve(false);
-          } catch (err) {
-            const reason = get(err, 'body.error.type');
-            if (reason === 'index_not_found_exception') {
-              server.log(
-                ['error', LOGGING_TAG],
-                `Unable to fetch alerts. Alerts depends on task manager, which has not been started yet.`
-              );
-            } else {
-              server.log(['error', LOGGING_TAG], err.message);
-            }
+          }
+
+          if (alerts.total !== 1) {
+            log.warn(`Found more than one alert for type ${type} which is unexpected.`);
+          }
+
+          const id = alerts.data[0].id;
+
+          // Now that we have the id, we can get the state
+          const states = await alertsClient.getAlertState({ id });
+          if (!states || !states.alertTypeState) {
+            log.warn(`No alert states found for type ${type} which is unexpected.`);
             return resolve(false);
           }
+
+          const state = Object.values(states.alertTypeState)[0] as AlertCommonPerClusterState;
+          const isInBetween = moment(state.ui.resolvedMS).isBetween(start, end);
+          if (state.ui.isFiring || isInBetween) {
+            return resolve({
+              type,
+              ...state.ui,
+            });
+          }
+          return resolve(false);
         })
     )
   );
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts
new file mode 100644
index 0000000000000..1840a2026a753
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.test.ts
@@ -0,0 +1,163 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getPreparedAlert } from './get_prepared_alert';
+import { fetchClusters } from './fetch_clusters';
+import { fetchDefaultEmailAddress } from './fetch_default_email_address';
+
+jest.mock('./fetch_clusters', () => ({
+  fetchClusters: jest.fn(),
+}));
+
+jest.mock('./fetch_default_email_address', () => ({
+  fetchDefaultEmailAddress: jest.fn(),
+}));
+
+describe('getPreparedAlert', () => {
+  const uiSettings = { get: jest.fn() };
+  const alertType = 'test';
+  const getUiSettingsService = async () => ({
+    asScopedToClient: () => uiSettings,
+  });
+  const monitoringCluster = null;
+  const logger = { warn: jest.fn() };
+  const ccsEnabled = false;
+  const services = {
+    callCluster: jest.fn(),
+    savedObjectsClient: null,
+  };
+  const emailAddress = 'foo@foo.com';
+  const data = [{ foo: 1 }];
+  const dataFetcher = () => data;
+  const clusterName = 'MonitoringCluster';
+  const clusterUuid = 'sdf34sdf';
+  const clusters = [{ clusterName, clusterUuid }];
+
+  afterEach(() => {
+    (uiSettings.get as jest.Mock).mockClear();
+    (services.callCluster as jest.Mock).mockClear();
+    (fetchClusters as jest.Mock).mockClear();
+    (fetchDefaultEmailAddress as jest.Mock).mockClear();
+  });
+
+  beforeEach(() => {
+    (fetchClusters as jest.Mock).mockImplementation(() => clusters);
+    (fetchDefaultEmailAddress as jest.Mock).mockImplementation(() => emailAddress);
+  });
+
+  it('should return fields as expected', async () => {
+    (uiSettings.get as jest.Mock).mockImplementation(() => {
+      return emailAddress;
+    });
+
+    const alert = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      ccsEnabled,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect(alert && alert.emailAddress).toBe(emailAddress);
+    expect(alert && alert.data).toBe(data);
+  });
+
+  it('should add ccs if specified', async () => {
+    const ccsClusterName = 'remoteCluster';
+    (services.callCluster as jest.Mock).mockImplementation(() => {
+      return {
+        [ccsClusterName]: {
+          connected: true,
+        },
+      };
+    });
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect((fetchClusters as jest.Mock).mock.calls[0][1].includes(ccsClusterName)).toBe(true);
+  });
+
+  it('should ignore ccs if no remote clusters are available', async () => {
+    const ccsClusterName = 'remoteCluster';
+    (services.callCluster as jest.Mock).mockImplementation(() => {
+      return {
+        [ccsClusterName]: {
+          connected: false,
+        },
+      };
+    });
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect((fetchClusters as jest.Mock).mock.calls[0][1].includes(ccsClusterName)).toBe(false);
+  });
+
+  it('should pass in the clusters into the data fetcher', async () => {
+    const customDataFetcher = jest.fn(() => data);
+
+    await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      customDataFetcher as any
+    );
+
+    expect((customDataFetcher as jest.Mock).mock.calls[0][1]).toBe(clusters);
+  });
+
+  it('should return nothing if the data fetcher returns nothing', async () => {
+    const customDataFetcher = jest.fn(() => []);
+
+    const result = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      customDataFetcher as any
+    );
+
+    expect(result).toBe(null);
+  });
+
+  it('should return nothing if there is no email address', async () => {
+    (fetchDefaultEmailAddress as jest.Mock).mockImplementation(() => null);
+
+    const result = await getPreparedAlert(
+      alertType,
+      getUiSettingsService as any,
+      monitoringCluster as any,
+      logger as any,
+      true,
+      services as any,
+      dataFetcher as any
+    );
+
+    expect(result).toBe(null);
+  });
+});
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts
new file mode 100644
index 0000000000000..83a9e26e4c589
--- /dev/null
+++ b/x-pack/plugins/monitoring/server/lib/alerts/get_prepared_alert.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Logger, ICustomClusterClient, UiSettingsServiceStart } from 'kibana/server';
+import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { AlertServices } from '../../../../alerting/server';
+import { AlertCommonCluster } from '../../alerts/types';
+import { INDEX_PATTERN_ELASTICSEARCH } from '../../../common/constants';
+import { fetchAvailableCcs } from './fetch_available_ccs';
+import { getCcsIndexPattern } from './get_ccs_index_pattern';
+import { fetchClusters } from './fetch_clusters';
+import { fetchDefaultEmailAddress } from './fetch_default_email_address';
+
+export interface PreparedAlert {
+  emailAddress: string;
+  clusters: AlertCommonCluster[];
+  data: any[];
+  timezone: string;
+  dateFormat: string;
+}
+
+async function getCallCluster(
+  monitoringCluster: ICustomClusterClient,
+  services: Pick<AlertServices, 'callCluster'>
+): Promise<any> {
+  if (!monitoringCluster) {
+    return services.callCluster;
+  }
+
+  return monitoringCluster.callAsInternalUser;
+}
+
+export async function getPreparedAlert(
+  alertType: string,
+  getUiSettingsService: () => Promise<UiSettingsServiceStart>,
+  monitoringCluster: ICustomClusterClient,
+  logger: Logger,
+  ccsEnabled: boolean,
+  services: Pick<AlertServices, 'callCluster' | 'savedObjectsClient'>,
+  dataFetcher: (
+    callCluster: CallCluster,
+    clusters: AlertCommonCluster[],
+    esIndexPattern: string
+  ) => Promise<any>
+): Promise<PreparedAlert | null> {
+  const callCluster = await getCallCluster(monitoringCluster, services);
+
+  // Support CCS use cases by querying to find available remote clusters
+  // and then adding those to the index pattern we are searching against
+  let esIndexPattern = INDEX_PATTERN_ELASTICSEARCH;
+  if (ccsEnabled) {
+    const availableCcs = await fetchAvailableCcs(callCluster);
+    if (availableCcs.length > 0) {
+      esIndexPattern = getCcsIndexPattern(esIndexPattern, availableCcs);
+    }
+  }
+
+  const clusters = await fetchClusters(callCluster, esIndexPattern);
+
+  // Fetch the specific data
+  const data = await dataFetcher(callCluster, clusters, esIndexPattern);
+  if (data.length === 0) {
+    logger.warn(`No data found for ${alertType}.`);
+    return null;
+  }
+
+  const uiSettings = (await getUiSettingsService()).asScopedToClient(services.savedObjectsClient);
+  const dateFormat: string = await uiSettings.get<string>('dateFormat');
+  const timezone: string = await uiSettings.get<string>('dateFormat:tz');
+  const emailAddress = await fetchDefaultEmailAddress(uiSettings);
+  if (!emailAddress) {
+    // TODO: we can do more here
+    logger.warn(`Unable to send email for ${alertType} because there is no email configured.`);
+    return null;
+  }
+
+  return {
+    emailAddress,
+    data,
+    clusters,
+    dateFormat,
+    timezone,
+  };
+}
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
index 1a2eb1e44be84..b99208bdde2c8 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.test.ts
@@ -39,17 +39,26 @@ describe('licenseExpiration lib', () => {
   });
 
   describe('getUiMessage', () => {
-    const timezone = 'Europe/London';
-    const license: any = { expiryDateMS: moment.tz('2020-01-20 08:00:00', timezone).utc() };
-
     it('should return a message when firing', () => {
-      const message = getUiMessage(license, timezone, false);
-      expect(message).toBe(`This cluster's license is going to expire in #relative at #absolute.`);
+      const message = getUiMessage(false);
+      expect(message.text).toBe(
+        `This cluster's license is going to expire in #relative at #absolute. #start_linkPlease update your license.#end_link`
+      );
+      // LOL How do I avoid this in TS????
+      if (!message.tokens) {
+        return expect(false).toBe(true);
+      }
+      expect(message.tokens.length).toBe(3);
+      expect(message.tokens[0].startToken).toBe('#relative');
+      expect(message.tokens[1].startToken).toBe('#absolute');
+      expect(message.tokens[2].startToken).toBe('#start_link');
+      expect(message.tokens[2].endToken).toBe('#end_link');
     });
 
     it('should return a message when resolved', () => {
-      const message = getUiMessage(license, timezone, true);
-      expect(message).toBe(`This cluster's license is active.`);
+      const message = getUiMessage(true);
+      expect(message.text).toBe(`This cluster's license is active.`);
+      expect(message.tokens).not.toBeDefined();
     });
   });
 });
diff --git a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
index 41b68d69bbd25..cfe9f02b9bd6a 100644
--- a/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
+++ b/x-pack/plugins/monitoring/server/lib/alerts/license_expiration.lib.ts
@@ -6,7 +6,13 @@
 import { Moment } from 'moment-timezone';
 import { i18n } from '@kbn/i18n';
 import { AlertInstance } from '../../../../alerting/server';
-import { AlertLicense } from '../../alerts/types';
+import {
+  AlertCommonPerClusterMessageLinkToken,
+  AlertCommonPerClusterMessageTimeToken,
+  AlertCommonCluster,
+  AlertCommonPerClusterMessage,
+} from '../../alerts/types';
+import { AlertCommonPerClusterMessageTokenType } from '../../alerts/enums';
 
 const RESOLVED_SUBJECT = i18n.translate(
   'xpack.monitoring.alerts.licenseExpiration.resolvedSubject',
@@ -21,7 +27,7 @@ const NEW_SUBJECT = i18n.translate('xpack.monitoring.alerts.licenseExpiration.ne
 
 export function executeActions(
   instance: AlertInstance,
-  license: AlertLicense,
+  cluster: AlertCommonCluster,
   $expiry: Moment,
   dateFormat: string,
   emailAddress: string,
@@ -31,14 +37,14 @@ export function executeActions(
     instance.scheduleActions('default', {
       subject: RESOLVED_SUBJECT,
       message: `This cluster alert has been resolved: Cluster '${
-        license.clusterName
+        cluster.clusterName
       }' license was going to expire on ${$expiry.format(dateFormat)}.`,
       to: emailAddress,
     });
   } else {
     instance.scheduleActions('default', {
       subject: NEW_SUBJECT,
-      message: `Cluster '${license.clusterName}' license is going to expire on ${$expiry.format(
+      message: `Cluster '${cluster.clusterName}' license is going to expire on ${$expiry.format(
         dateFormat
       )}. Please update your license.`,
       to: emailAddress,
@@ -46,13 +52,37 @@ export function executeActions(
   }
 }
 
-export function getUiMessage(license: AlertLicense, timezone: string, resolved: boolean = false) {
+export function getUiMessage(resolved: boolean = false): AlertCommonPerClusterMessage {
   if (resolved) {
-    return i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage', {
-      defaultMessage: `This cluster's license is active.`,
-    });
+    return {
+      text: i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.resolvedMessage', {
+        defaultMessage: `This cluster's license is active.`,
+      }),
+    };
   }
-  return i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.firingMessage', {
-    defaultMessage: `This cluster's license is going to expire in #relative at #absolute.`,
-  });
+  return {
+    text: i18n.translate('xpack.monitoring.alerts.licenseExpiration.ui.firingMessage', {
+      defaultMessage: `This cluster's license is going to expire in #relative at #absolute. #start_linkPlease update your license.#end_link`,
+    }),
+    tokens: [
+      {
+        startToken: '#relative',
+        type: AlertCommonPerClusterMessageTokenType.Time,
+        isRelative: true,
+        isAbsolute: false,
+      } as AlertCommonPerClusterMessageTimeToken,
+      {
+        startToken: '#absolute',
+        type: AlertCommonPerClusterMessageTokenType.Time,
+        isAbsolute: true,
+        isRelative: false,
+      } as AlertCommonPerClusterMessageTimeToken,
+      {
+        startToken: '#start_link',
+        endToken: '#end_link',
+        type: AlertCommonPerClusterMessageTokenType.Link,
+        url: 'license',
+      } as AlertCommonPerClusterMessageLinkToken,
+    ],
+  };
 }
diff --git a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
index c5091c36c3bbe..1bddede52207b 100644
--- a/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
+++ b/x-pack/plugins/monitoring/server/lib/cluster/get_clusters_from_request.js
@@ -29,6 +29,7 @@ import {
   CODE_PATH_BEATS,
   CODE_PATH_APM,
   KIBANA_ALERTING_ENABLED,
+  ALERT_TYPES,
 } from '../../../common/constants';
 import { getApmsForClusters } from '../apm/get_apms_for_clusters';
 import { i18n } from '@kbn/i18n';
@@ -102,15 +103,8 @@ export async function getClustersFromRequest(
 
     if (isInCodePath(codePaths, [CODE_PATH_ALERTS])) {
       if (KIBANA_ALERTING_ENABLED) {
-        const { callWithRequest } = req.server.plugins.elasticsearch.getCluster('monitoring');
-        const callCluster = (...args) => callWithRequest(req, ...args);
-        cluster.alerts = await fetchStatus(
-          callCluster,
-          start,
-          end,
-          cluster.cluster_uuid,
-          req.server
-        );
+        const alertsClient = req.getAlertsClient ? req.getAlertsClient() : null;
+        cluster.alerts = await fetchStatus(alertsClient, ALERT_TYPES, start, end, req.logger);
       } else {
         cluster.alerts = await alertsClusterSearch(
           req,
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index 24d8bcaa4397c..784226dca66fe 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -47,6 +47,7 @@ import {
   PluginSetupContract as AlertingPluginSetupContract,
 } from '../../alerting/server';
 import { getLicenseExpiration } from './alerts/license_expiration';
+import { getClusterState } from './alerts/cluster_state';
 import { InfraPluginSetup } from '../../infra/server';
 
 export interface LegacyAPI {
@@ -154,6 +155,17 @@ export class Plugin {
           config.ui.ccs.enabled
         )
       );
+      plugins.alerting.registerType(
+        getClusterState(
+          async () => {
+            const coreStart = (await core.getStartServices())[0];
+            return coreStart.uiSettings;
+          },
+          cluster,
+          this.getLogger,
+          config.ui.ccs.enabled
+        )
+      );
     }
 
     // Initialize telemetry
diff --git a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
index 56922bd8e87e2..d5a43d32f600a 100644
--- a/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
+++ b/x-pack/plugins/monitoring/server/routes/api/v1/alerts/alerts.js
@@ -8,8 +8,12 @@ import { schema } from '@kbn/config-schema';
 import { isFunction } from 'lodash';
 import {
   ALERT_TYPE_LICENSE_EXPIRATION,
+  ALERT_TYPE_CLUSTER_STATE,
   MONITORING_CONFIG_ALERTING_EMAIL_ADDRESS,
+  ALERT_TYPES,
 } from '../../../../../common/constants';
+import { handleError } from '../../../../lib/errors';
+import { fetchStatus } from '../../../../lib/alerts/fetch_status';
 
 async function createAlerts(req, alertsClient, { selectedEmailActionId }) {
   const createdAlerts = [];
@@ -17,7 +21,21 @@ async function createAlerts(req, alertsClient, { selectedEmailActionId }) {
   // Create alerts
   const ALERT_TYPES = {
     [ALERT_TYPE_LICENSE_EXPIRATION]: {
-      schedule: { interval: '10s' },
+      schedule: { interval: '1m' },
+      actions: [
+        {
+          group: 'default',
+          id: selectedEmailActionId,
+          params: {
+            subject: '{{context.subject}}',
+            message: `{{context.message}}`,
+            to: ['{{context.to}}'],
+          },
+        },
+      ],
+    },
+    [ALERT_TYPE_CLUSTER_STATE]: {
+      schedule: { interval: '1m' },
       actions: [
         {
           group: 'default',
@@ -86,4 +104,37 @@ export function createKibanaAlertsRoute(server) {
       return { alerts, emailResponse };
     },
   });
+
+  server.route({
+    method: 'POST',
+    path: '/api/monitoring/v1/alert_status',
+    config: {
+      validate: {
+        payload: schema.object({
+          timeRange: schema.object({
+            min: schema.string(),
+            max: schema.string(),
+          }),
+        }),
+      },
+    },
+    async handler(req, headers) {
+      const alertsClient = isFunction(req.getAlertsClient) ? req.getAlertsClient() : null;
+      if (!alertsClient) {
+        return headers.response().code(404);
+      }
+
+      const start = req.payload.timeRange.min;
+      const end = req.payload.timeRange.max;
+      let alerts;
+
+      try {
+        alerts = await fetchStatus(alertsClient, ALERT_TYPES, start, end, req.logger);
+      } catch (err) {
+        throw handleError(err, req);
+      }
+
+      return { alerts };
+    },
+  });
 }
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/__snapshots__/remote_cluster_form.test.js.snap b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/__snapshots__/remote_cluster_form.test.js.snap
index 4c109c557fdb0..1e6c2c4d289aa 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/__snapshots__/remote_cluster_form.test.js.snap
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/__snapshots__/remote_cluster_form.test.js.snap
@@ -350,7 +350,7 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
         description={
           <React.Fragment>
             <FormattedMessage
-              defaultMessage="Use seed nodes by default, or switch to a single proxy address."
+              defaultMessage="Use seed nodes by default, or switch to proxy mode."
               id="xpack.remoteClusters.remoteClusterForm.sectionModeDescription"
               values={Object {}}
             />
@@ -367,7 +367,7 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                 data-test-subj="remoteClusterFormConnectionModeToggle"
                 label={
                   <FormattedMessage
-                    defaultMessage="Use a single proxy address"
+                    defaultMessage="Use proxy mode"
                     id="xpack.remoteClusters.remoteClusterForm.fieldModeLabel"
                     values={Object {}}
                   />
@@ -443,11 +443,11 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                           className="euiTextColor euiTextColor--subdued"
                         >
                           <FormattedMessage
-                            defaultMessage="Use seed nodes by default, or switch to a single proxy address."
+                            defaultMessage="Use seed nodes by default, or switch to proxy mode."
                             id="xpack.remoteClusters.remoteClusterForm.sectionModeDescription"
                             values={Object {}}
                           >
-                            Use seed nodes by default, or switch to a single proxy address.
+                            Use seed nodes by default, or switch to proxy mode.
                           </FormattedMessage>
                           <EuiFormRow
                             describedByIds={Array []}
@@ -470,7 +470,7 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                                   id="mockId"
                                   label={
                                     <FormattedMessage
-                                      defaultMessage="Use a single proxy address"
+                                      defaultMessage="Use proxy mode"
                                       id="xpack.remoteClusters.remoteClusterForm.fieldModeLabel"
                                       values={Object {}}
                                     />
@@ -534,11 +534,11 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                                       onClick={[Function]}
                                     >
                                       <FormattedMessage
-                                        defaultMessage="Use a single proxy address"
+                                        defaultMessage="Use proxy mode"
                                         id="xpack.remoteClusters.remoteClusterForm.fieldModeLabel"
                                         values={Object {}}
                                       >
-                                        Use a single proxy address
+                                        Use proxy mode
                                       </FormattedMessage>
                                     </span>
                                   </div>
@@ -687,23 +687,37 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                     </div>
                   </EuiFormRow>
                   <EuiFormRow
-                    data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
+                    data-test-subj="remoteClusterFormServerNameFormRow"
                     describedByIds={Array []}
                     display="row"
+                    error={null}
                     fullWidth={true}
                     hasChildLabel={true}
                     hasEmptyLabelSpace={false}
                     helpText={
                       <FormattedMessage
-                        defaultMessage="The number of socket connections to open per remote cluster."
-                        id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
-                        values={Object {}}
+                        defaultMessage="A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. {learnMoreLink}"
+                        id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText"
+                        values={
+                          Object {
+                            "learnMoreLink": <ForwardRef
+                              target="_blank"
+                            >
+                              <FormattedMessage
+                                defaultMessage="Learn more."
+                                id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
+                                values={Object {}}
+                              />
+                            </ForwardRef>,
+                          }
+                        }
                       />
                     }
+                    isInvalid={false}
                     label={
                       <FormattedMessage
-                        defaultMessage="Socket connections"
-                        id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
+                        defaultMessage="Server name (optional)"
+                        id="xpack.remoteClusters.remoteClusterForm.fieldServerNameOptionalLabel"
                         values={Object {}}
                       />
                     }
@@ -711,28 +725,31 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                   >
                     <div
                       className="euiFormRow euiFormRow--fullWidth"
-                      data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
+                      data-test-subj="remoteClusterFormServerNameFormRow"
                       id="mockId-row"
                     >
                       <div
                         className="euiFormRow__labelWrapper"
                       >
                         <EuiFormLabel
+                          aria-invalid={false}
                           className="euiFormRow__label"
                           htmlFor="mockId"
                           isFocused={false}
+                          isInvalid={false}
                           type="label"
                         >
                           <label
+                            aria-invalid={false}
                             className="euiFormLabel euiFormRow__label"
                             htmlFor="mockId"
                           >
                             <FormattedMessage
-                              defaultMessage="Socket connections"
-                              id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
+                              defaultMessage="Server name (optional)"
+                              id="xpack.remoteClusters.remoteClusterForm.fieldServerNameOptionalLabel"
                               values={Object {}}
                             >
-                              Socket connections
+                              Server name (optional)
                             </FormattedMessage>
                           </label>
                         </EuiFormLabel>
@@ -740,20 +757,19 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                       <div
                         className="euiFormRow__fieldWrapper"
                       >
-                        <EuiFieldNumber
+                        <EuiFieldText
                           aria-describedby="mockId-help"
                           fullWidth={true}
                           id="mockId"
+                          isInvalid={false}
                           onBlur={[Function]}
                           onChange={[Function]}
                           onFocus={[Function]}
-                          value={18}
+                          value=""
                         >
                           <EuiFormControlLayout
-                            compressed={false}
                             fullWidth={true}
                             inputId="mockId"
-                            isLoading={false}
                           >
                             <div
                               className="euiFormControlLayout euiFormControlLayout--fullWidth"
@@ -761,25 +777,25 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                               <div
                                 className="euiFormControlLayout__childrenWrapper"
                               >
-                                <EuiValidatableControl>
+                                <EuiValidatableControl
+                                  isInvalid={false}
+                                >
                                   <input
                                     aria-describedby="mockId-help"
-                                    className="euiFieldNumber euiFieldNumber--fullWidth"
+                                    className="euiFieldText euiFieldText--fullWidth"
                                     id="mockId"
                                     onBlur={[Function]}
                                     onChange={[Function]}
                                     onFocus={[Function]}
-                                    type="number"
-                                    value={18}
+                                    type="text"
+                                    value=""
                                   />
                                 </EuiValidatableControl>
-                                <EuiFormControlLayoutIcons
-                                  isLoading={false}
-                                />
+                                <EuiFormControlLayoutIcons />
                               </div>
                             </div>
                           </EuiFormControlLayout>
-                        </EuiFieldNumber>
+                        </EuiFieldText>
                         <EuiFormHelpText
                           className="euiFormRow__text"
                           id="mockId-help"
@@ -789,11 +805,39 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                             id="mockId-help"
                           >
                             <FormattedMessage
-                              defaultMessage="The number of socket connections to open per remote cluster."
-                              id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
-                              values={Object {}}
+                              defaultMessage="A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. {learnMoreLink}"
+                              id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText"
+                              values={
+                                Object {
+                                  "learnMoreLink": <ForwardRef
+                                    target="_blank"
+                                  >
+                                    <FormattedMessage
+                                      defaultMessage="Learn more."
+                                      id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
+                                      values={Object {}}
+                                    />
+                                  </ForwardRef>,
+                                }
+                              }
                             >
-                              The number of socket connections to open per remote cluster.
+                              A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. 
+                              <EuiLink
+                                target="_blank"
+                              >
+                                <button
+                                  className="euiLink euiLink--primary"
+                                  type="button"
+                                >
+                                  <FormattedMessage
+                                    defaultMessage="Learn more."
+                                    id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
+                                    values={Object {}}
+                                  >
+                                    Learn more.
+                                  </FormattedMessage>
+                                </button>
+                              </EuiLink>
                             </FormattedMessage>
                           </div>
                         </EuiFormHelpText>
@@ -801,37 +845,23 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                     </div>
                   </EuiFormRow>
                   <EuiFormRow
-                    data-test-subj="remoteClusterFormServerNameFormRow"
+                    data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
                     describedByIds={Array []}
                     display="row"
-                    error={null}
                     fullWidth={true}
                     hasChildLabel={true}
                     hasEmptyLabelSpace={false}
                     helpText={
                       <FormattedMessage
-                        defaultMessage="A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. {learnMoreLink}"
-                        id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText"
-                        values={
-                          Object {
-                            "learnMoreLink": <ForwardRef
-                              target="_blank"
-                            >
-                              <FormattedMessage
-                                defaultMessage="Learn more."
-                                id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
-                                values={Object {}}
-                              />
-                            </ForwardRef>,
-                          }
-                        }
+                        defaultMessage="The number of socket connections to open per remote cluster."
+                        id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
+                        values={Object {}}
                       />
                     }
-                    isInvalid={false}
                     label={
                       <FormattedMessage
-                        defaultMessage="Server name (optional)"
-                        id="xpack.remoteClusters.remoteClusterForm.fieldServerNameOptionalLabel"
+                        defaultMessage="Socket connections"
+                        id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
                         values={Object {}}
                       />
                     }
@@ -839,31 +869,28 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                   >
                     <div
                       className="euiFormRow euiFormRow--fullWidth"
-                      data-test-subj="remoteClusterFormServerNameFormRow"
+                      data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
                       id="mockId-row"
                     >
                       <div
                         className="euiFormRow__labelWrapper"
                       >
                         <EuiFormLabel
-                          aria-invalid={false}
                           className="euiFormRow__label"
                           htmlFor="mockId"
                           isFocused={false}
-                          isInvalid={false}
                           type="label"
                         >
                           <label
-                            aria-invalid={false}
                             className="euiFormLabel euiFormRow__label"
                             htmlFor="mockId"
                           >
                             <FormattedMessage
-                              defaultMessage="Server name (optional)"
-                              id="xpack.remoteClusters.remoteClusterForm.fieldServerNameOptionalLabel"
+                              defaultMessage="Socket connections"
+                              id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
                               values={Object {}}
                             >
-                              Server name (optional)
+                              Socket connections
                             </FormattedMessage>
                           </label>
                         </EuiFormLabel>
@@ -871,19 +898,20 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                       <div
                         className="euiFormRow__fieldWrapper"
                       >
-                        <EuiFieldText
+                        <EuiFieldNumber
                           aria-describedby="mockId-help"
                           fullWidth={true}
                           id="mockId"
-                          isInvalid={false}
                           onBlur={[Function]}
                           onChange={[Function]}
                           onFocus={[Function]}
-                          value=""
+                          value={18}
                         >
                           <EuiFormControlLayout
+                            compressed={false}
                             fullWidth={true}
                             inputId="mockId"
+                            isLoading={false}
                           >
                             <div
                               className="euiFormControlLayout euiFormControlLayout--fullWidth"
@@ -891,25 +919,25 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                               <div
                                 className="euiFormControlLayout__childrenWrapper"
                               >
-                                <EuiValidatableControl
-                                  isInvalid={false}
-                                >
+                                <EuiValidatableControl>
                                   <input
                                     aria-describedby="mockId-help"
-                                    className="euiFieldText euiFieldText--fullWidth"
+                                    className="euiFieldNumber euiFieldNumber--fullWidth"
                                     id="mockId"
                                     onBlur={[Function]}
                                     onChange={[Function]}
                                     onFocus={[Function]}
-                                    type="text"
-                                    value=""
+                                    type="number"
+                                    value={18}
                                   />
                                 </EuiValidatableControl>
-                                <EuiFormControlLayoutIcons />
+                                <EuiFormControlLayoutIcons
+                                  isLoading={false}
+                                />
                               </div>
                             </div>
                           </EuiFormControlLayout>
-                        </EuiFieldText>
+                        </EuiFieldNumber>
                         <EuiFormHelpText
                           className="euiFormRow__text"
                           id="mockId-help"
@@ -919,39 +947,11 @@ exports[`RemoteClusterForm proxy mode renders correct connection settings when u
                             id="mockId-help"
                           >
                             <FormattedMessage
-                              defaultMessage="A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. {learnMoreLink}"
-                              id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText"
-                              values={
-                                Object {
-                                  "learnMoreLink": <ForwardRef
-                                    target="_blank"
-                                  >
-                                    <FormattedMessage
-                                      defaultMessage="Learn more."
-                                      id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
-                                      values={Object {}}
-                                    />
-                                  </ForwardRef>,
-                                }
-                              }
+                              defaultMessage="The number of socket connections to open per remote cluster."
+                              id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
+                              values={Object {}}
                             >
-                              A string sent in the server_name field of the TLS Server Name Indication extension if TLS is enabled. 
-                              <EuiLink
-                                target="_blank"
-                              >
-                                <button
-                                  className="euiLink euiLink--primary"
-                                  type="button"
-                                >
-                                  <FormattedMessage
-                                    defaultMessage="Learn more."
-                                    id="xpack.remoteClusters.remoteClusterForm.fieldServerNameHelpText.learnMoreLinkLabel"
-                                    values={Object {}}
-                                  >
-                                    Learn more.
-                                  </FormattedMessage>
-                                </button>
-                              </EuiLink>
+                              The number of socket connections to open per remote cluster.
                             </FormattedMessage>
                           </div>
                         </EuiFormHelpText>
@@ -1447,7 +1447,7 @@ Array [
             <div
               class="euiTextColor euiTextColor--subdued"
             >
-              Use seed nodes by default, or switch to a single proxy address.
+              Use seed nodes by default, or switch to proxy mode.
               <div
                 class="euiFormRow euiFormRow--hasEmptyLabelSpace euiFormRow--fullWidth"
                 id="mockId-row"
@@ -1491,7 +1491,7 @@ Array [
                       class="euiSwitch__label"
                       id="mockId"
                     >
-                      Use a single proxy address
+                      Use proxy mode
                     </span>
                   </div>
                 </div>
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.js b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.js
index c98bd73bf83a0..a392cc9607784 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.js
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/remote_cluster_form.js
@@ -405,30 +405,6 @@ export class RemoteClusterForm extends Component {
           />
         </EuiFormRow>
 
-        <EuiFormRow
-          data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
-          label={
-            <FormattedMessage
-              id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
-              defaultMessage="Socket connections"
-            />
-          }
-          helpText={
-            <FormattedMessage
-              id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
-              defaultMessage="The number of socket connections to open per remote cluster."
-            />
-          }
-          fullWidth
-        >
-          <EuiFieldNumber
-            value={proxySocketConnections || ''}
-            onChange={e =>
-              this.onFieldsChange({ proxySocketConnections: Number(e.target.value) || null })
-            }
-            fullWidth
-          />
-        </EuiFormRow>
         <EuiFormRow
           data-test-subj="remoteClusterFormServerNameFormRow"
           isInvalid={Boolean(areErrorsVisible && errorServerName)}
@@ -471,6 +447,31 @@ export class RemoteClusterForm extends Component {
             fullWidth
           />
         </EuiFormRow>
+
+        <EuiFormRow
+          data-test-subj="remoteClusterFormProxySocketConnectionsFormRow"
+          label={
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterForm.fieldProxySocketConnectionsLabel"
+              defaultMessage="Socket connections"
+            />
+          }
+          helpText={
+            <FormattedMessage
+              id="xpack.remoteClusters.remoteClusterForm.fieldSocketConnectionsHelpText"
+              defaultMessage="The number of socket connections to open per remote cluster."
+            />
+          }
+          fullWidth
+        >
+          <EuiFieldNumber
+            value={proxySocketConnections || ''}
+            onChange={e =>
+              this.onFieldsChange({ proxySocketConnections: Number(e.target.value) || null })
+            }
+            fullWidth
+          />
+        </EuiFormRow>
       </>
     );
   }
@@ -498,14 +499,14 @@ export class RemoteClusterForm extends Component {
           <>
             <FormattedMessage
               id="xpack.remoteClusters.remoteClusterForm.sectionModeDescription"
-              defaultMessage="Use seed nodes by default, or switch to a single proxy address."
+              defaultMessage="Use seed nodes by default, or switch to proxy mode."
             />
             <EuiFormRow hasEmptyLabelSpace fullWidth>
               <EuiSwitch
                 label={
                   <FormattedMessage
                     id="xpack.remoteClusters.remoteClusterForm.fieldModeLabel"
-                    defaultMessage="Use a single proxy address"
+                    defaultMessage="Use proxy mode"
                   />
                 }
                 checked={mode === PROXY_MODE}
@@ -519,15 +520,38 @@ export class RemoteClusterForm extends Component {
               <>
                 <EuiSpacer size="s" />
                 <EuiCallOut
+                  iconType="pin"
+                  size="s"
                   title={
                     <FormattedMessage
                       id="xpack.remoteClusters.cloudClusterInformationTitle"
-                      defaultMessage="You can find the proxy address and server name of your cluster in the Security section of your deployment."
+                      defaultMessage="Use proxy mode for Elasticsearch Cloud deployment"
                     />
                   }
-                  iconType="pin"
-                  size="s"
-                />
+                >
+                  <FormattedMessage
+                    id="xpack.remoteClusters.cloudClusterInformationDescription"
+                    defaultMessage="To find the proxy address and server name of your cluster, go to the {security} page of your deployment menu and search for {searchString}."
+                    values={{
+                      security: (
+                        <strong>
+                          <FormattedMessage
+                            id="xpack.remoteClusters.cloudClusterSecurityDescription"
+                            defaultMessage="Security"
+                          />
+                        </strong>
+                      ),
+                      searchString: (
+                        <strong>
+                          <FormattedMessage
+                            id="xpack.remoteClusters.cloudClusterSearchDescription"
+                            defaultMessage="Remote cluster parameters"
+                          />
+                        </strong>
+                      ),
+                    }}
+                  />
+                </EuiCallOut>
               </>
             ) : null}
           </>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
index 6ce954f61bcdb..d83396f200829 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.test.tsx
@@ -134,7 +134,7 @@ describe('IndexParamsFields renders', () => {
       ActionParamsProps<IndexActionParams>
     >;
     const actionParams = {
-      documents: ['test'],
+      documents: [{ test: 123 }],
     };
     const wrapper = mountWithIntl(
       <ParamsFields
@@ -149,6 +149,11 @@ describe('IndexParamsFields renders', () => {
         .find('[data-test-subj="actionIndexDoc"]')
         .first()
         .prop('value')
-    ).toBe('"test"');
+    ).toBe(`{
+  "test": 123
+}`);
+    expect(
+      wrapper.find('[data-test-subj="indexDocumentAddVariableButton"]').length > 0
+    ).toBeTruthy();
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
index d631882e1f581..56d9f40e40021 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/es_index.tsx
@@ -14,6 +14,10 @@ import {
   EuiSelect,
   EuiTitle,
   EuiIconTip,
+  EuiPopover,
+  EuiButtonIcon,
+  EuiContextMenuPanel,
+  EuiContextMenuItem,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
@@ -31,6 +35,7 @@ import {
   getIndexOptions,
   getIndexPatterns,
 } from '../../../common/index_controls';
+import { useXJsonMode } from '../../lib/use_x_json_mode';
 
 export function getActionType(): ActionTypeModel {
   return {
@@ -271,9 +276,29 @@ const IndexParamsFields: React.FunctionComponent<ActionParamsProps<IndexActionPa
   actionParams,
   index,
   editAction,
+  messageVariables,
 }) => {
   const { documents } = actionParams;
-
+  const { xJsonMode, convertToJson, setXJson, xJson } = useXJsonMode(
+    documents && documents.length > 0 ? documents[0] : null
+  );
+  const [isVariablesPopoverOpen, setIsVariablesPopoverOpen] = useState<boolean>(false);
+  const messageVariablesItems = messageVariables?.map((variable: string, i: number) => (
+    <EuiContextMenuItem
+      key={variable}
+      data-test-subj={`variableMenuButton-${i}`}
+      icon="empty"
+      onClick={() => {
+        const value = (xJson ?? '').concat(` {{${variable}}}`);
+        setXJson(value);
+        // Keep the documents in sync with the editor content
+        onDocumentsChange(convertToJson(value));
+        setIsVariablesPopoverOpen(false);
+      }}
+    >
+      {`{{${variable}}}`}
+    </EuiContextMenuItem>
+  ));
   function onDocumentsChange(updatedDocuments: string) {
     try {
       const documentsJSON = JSON.parse(updatedDocuments);
@@ -291,27 +316,55 @@ const IndexParamsFields: React.FunctionComponent<ActionParamsProps<IndexActionPa
             defaultMessage: 'Document to index',
           }
         )}
+        labelAppend={
+          // TODO: replace this button with a proper Eui component, when it will be ready
+          <EuiPopover
+            button={
+              <EuiButtonIcon
+                data-test-subj="indexDocumentAddVariableButton"
+                onClick={() => setIsVariablesPopoverOpen(true)}
+                iconType="indexOpen"
+                title={i18n.translate(
+                  'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.addVariableTitle',
+                  {
+                    defaultMessage: 'Add variable',
+                  }
+                )}
+                aria-label={i18n.translate(
+                  'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.addVariablePopoverButton',
+                  {
+                    defaultMessage: 'Add variable',
+                  }
+                )}
+              />
+            }
+            isOpen={isVariablesPopoverOpen}
+            closePopover={() => setIsVariablesPopoverOpen(false)}
+            panelPaddingSize="none"
+            anchorPosition="downLeft"
+          >
+            <EuiContextMenuPanel items={messageVariablesItems} />
+          </EuiPopover>
+        }
       >
         <EuiCodeEditor
-          aria-label={''}
-          mode={'json'}
+          mode={xJsonMode}
+          width="100%"
+          height="200px"
           theme="github"
           data-test-subj="actionIndexDoc"
-          value={JSON.stringify(documents && documents.length > 0 ? documents[0] : {}, null, 2)}
-          onChange={onDocumentsChange}
-          width="100%"
-          height="auto"
-          minLines={6}
-          maxLines={30}
-          isReadOnly={false}
-          setOptions={{
-            showLineNumbers: true,
-            tabSize: 2,
-          }}
-          editorProps={{
-            $blockScrolling: Infinity,
+          aria-label={i18n.translate(
+            'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.jsonDocAriaLabel',
+            {
+              defaultMessage: 'Code editor',
+            }
+          )}
+          value={xJson}
+          onChange={(xjson: string) => {
+            setXJson(xjson);
+            // Keep the documents in sync with the editor content
+            onDocumentsChange(convertToJson(xjson));
           }}
-          showGutter={true}
         />
       </EuiFormRow>
     </Fragment>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
index fd35db4304275..84d8b6e8caede 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
@@ -39,7 +39,7 @@ export interface PagerDutyActionParams {
 }
 
 export interface IndexActionParams {
-  documents: string[];
+  documents: Array<Record<string, any>>;
 }
 
 export enum ServerLogLevelOptions {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/use_x_json_mode.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/use_x_json_mode.ts
new file mode 100644
index 0000000000000..b677924724ffe
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/use_x_json_mode.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { useState } from 'react';
+import { XJsonMode } from '../../../../../../src/plugins/es_ui_shared/console_lang/ace/modes/x_json';
+import {
+  collapseLiteralStrings,
+  expandLiteralStrings,
+} from '../../../../../../src/plugins/es_ui_shared/console_lang/lib';
+// @ts-ignore
+export const xJsonMode = new XJsonMode();
+export const useXJsonMode = (json: Record<string, any> | null) => {
+  const [xJson, setXJson] = useState(
+    json === null ? '' : expandLiteralStrings(JSON.stringify(json, null, 2))
+  );
+
+  return {
+    xJson,
+    setXJson,
+    xJsonMode,
+    convertToJson: collapseLiteralStrings,
+  };
+};
diff --git a/x-pack/test/api_integration/apis/management/index_lifecycle_management/policies.js b/x-pack/test/api_integration/apis/management/index_lifecycle_management/policies.js
index 9cb2e5ee54596..e41dd40bbd417 100644
--- a/x-pack/test/api_integration/apis/management/index_lifecycle_management/policies.js
+++ b/x-pack/test/api_integration/apis/management/index_lifecycle_management/policies.js
@@ -32,7 +32,9 @@ export default function({ getService }) {
     after(() => Promise.all([cleanUpEsResources(), cleanUpPolicies()]));
 
     describe('list', () => {
-      it('should have a default policy to manage the Watcher history indices', async () => {
+      // Disabled as the underline ES API has changed. Need to investigate
+      // Opened issue: https://github.com/elastic/kibana/issues/62778
+      it.skip('should have a default policy to manage the Watcher history indices', async () => {
         const { body } = await loadPolicies().expect(200);
         const policy = body.find(policy => policy.name === DEFAULT_POLICY_NAME);
 
diff --git a/x-pack/test/api_integration/apis/ml/index.ts b/x-pack/test/api_integration/apis/ml/index.ts
index 4e21faa610bfe..bcba156a64f0e 100644
--- a/x-pack/test/api_integration/apis/ml/index.ts
+++ b/x-pack/test/api_integration/apis/ml/index.ts
@@ -9,7 +9,10 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function({ getService, loadTestFile }: FtrProviderContext) {
   const ml = getService('ml');
 
-  describe('Machine Learning', function() {
+  // ML tests need to be disabled in orde to get the ES snapshot with
+  // https://github.com/elastic/elasticsearch/pull/54713 promoted
+  // and should be re-enabled as part of https://github.com/elastic/kibana/pull/61980
+  describe.skip('Machine Learning', function() {
     this.tags(['mlqa']);
 
     before(async () => {
diff --git a/x-pack/test/functional/apps/machine_learning/index.ts b/x-pack/test/functional/apps/machine_learning/index.ts
index 47c699e309491..143899a61ffb9 100644
--- a/x-pack/test/functional/apps/machine_learning/index.ts
+++ b/x-pack/test/functional/apps/machine_learning/index.ts
@@ -8,7 +8,10 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function({ getService, loadTestFile }: FtrProviderContext) {
   const ml = getService('ml');
 
-  describe('machine learning', function() {
+  // ML tests need to be disabled in orde to get the ES snapshot with
+  // https://github.com/elastic/elasticsearch/pull/54713 promoted
+  // and should be re-enabled as part of https://github.com/elastic/kibana/pull/61980
+  describe.skip('machine learning', function() {
     this.tags('ciGroup3');
 
     before(async () => {