diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 06f8a9c6d05a1..745101711171c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1386,7 +1386,90 @@ x-pack/test_serverless/**/test_suites/observability/ai_assistant @elastic/obs-ai
 /.eslintrc.js @elastic/kibana-operations
 /.eslintignore @elastic/kibana-operations
 
-# Appex QA
+# QA - Appex QA
+/test/server_integration/services/index.js @elastic/appex-qa
+/x-pack/test/stack_functional_integration/configs/config.stack_functional_integration_base.js @elastic/appex-qa
+/x-pack/test/stack_functional_integration/configs/consume_state.js @elastic/appex-qa
+/x-pack/test/functional/services/remote_es/remote_es_archiver.ts @elastic/appex-qa
+/test/functional/services/remote_es/remote_es_archiver.ts @elastic/appex-qa
+/x-pack/test/kibana.jsonc @elastic/appex-qa
+/x-pack/test/functional_with_es_ssl/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/stack_functional_integration/apps @elastic/appex-qa
+/x-pack/test/plugin_functional/config.ts @elastic/appex-qa
+/x-pack/test/plugin_functional/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/plugin_functional/page_objects.ts @elastic/appex-qa
+/x-pack/test/upgrade/services/index.ts @elastic/appex-qa
+/x-pack/test/upgrade/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/upgrade/config.ts @elastic/appex-qa
+/x-pack/test/functional_basic/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/functional/services/remote_es/remote_es.ts @elastic/appex-qa
+/x-pack/test/functional/services/random.js @elastic/appex-qa
+/x-pack/test/functional/services/index.ts @elastic/appex-qa
+/x-pack/test/functional/page_objects/index.ts @elastic/appex-qa
+/x-pack/test/functional/ftr_provider_context.ts @elastic/appex-qa
+/x-pack/test/functional/README.md @elastic/appex-qa
+/x-pack/test/examples/config.ts @elastic/appex-qa
+/x-pack/test/common/services/index.ts @elastic/appex-qa
+/x-pack/test/common/services/bsearch_secure.ts @elastic/appex-qa
+/x-pack/test/common/ftr_provider_context.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/ftr_provider_context.d.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/config.ts @elastic/appex-qa
+/x-pack/test/api_integration_basic/apis/index.ts @elastic/appex-qa
+/x-pack/test/api_integration/services/index.ts @elastic/appex-qa
+/x-pack/test/api_integration/services/es_supertest_without_auth.js @elastic/appex-qa
+/x-pack/test/api_integration/config.ts @elastic/appex-qa
+/x-pack/test/api_integration/apis/kibana/config.ts @elastic/appex-qa
+/x-pack/test/tsconfig.json @elastic/appex-qa
+/x-pack/test/load @elastic/appex-qa
+/test/tsconfig.json @elastic/appex-qa
+/test/plugin_functional/services/index.ts @elastic/appex-qa
+/test/plugin_functional/README.md @elastic/appex-qa
+/test/plugin_functional/config.ts @elastic/appex-qa
+/test/kibana.jsonc @elastic/appex-qa
+/test/harden @elastic/appex-qa
+/test/functional/services/supertest.ts @elastic/appex-qa
+/test/functional/services/remote_es/remote_es.ts @elastic/appex-qa
+/test/functional/services/query_bar.ts @elastic/appex-qa
+/test/functional/services/menu_toggle.ts @elastic/appex-qa
+/test/functional/services/listing_table.ts @elastic/appex-qa
+/test/common/fixtures/plugins/coverage @elastic/appex-qa
+/test/functional/services/index.ts @elastic/appex-qa
+/test/functional/services/global_nav.ts @elastic/appex-qa
+/test/functional/services/flyout.ts @elastic/appex-qa
+/test/functional/services/filter_bar.ts @elastic/appex-qa
+/test/functional/services/field_editor.ts @elastic/appex-qa
+/test/functional/services/embedding.ts @elastic/appex-qa
+/test/functional/services/doc_table.ts @elastic/appex-qa
+/test/functional/services/data_grid.ts @elastic/appex-qa
+/test/functional/services/combo_box.ts @elastic/appex-qa
+/test/functional/page_objects/unified_field_list.ts @elastic/appex-qa
+/test/functional/page_objects/time_picker.ts @elastic/appex-qa
+/test/functional/page_objects/index.ts @elastic/appex-qa
+/test/functional/page_objects/header_page.ts @elastic/appex-qa
+/test/functional/page_objects/error_page.ts @elastic/appex-qa
+/test/functional/page_objects/common_page.ts @elastic/appex-qa
+/test/functional/jest.config.js @elastic/appex-qa
+/test/functional/ftr_provider_context.ts @elastic/appex-qa
+/test/functional/fixtures/es_archiver/README.md @elastic/appex-qa
+/test/functional/firefox/config.base.ts @elastic/appex-qa
+/test/functional/config.* @elastic/appex-qa
+/test/functional/README.md @elastic/appex-qa
+/test/examples/config.js @elastic/appex-qa
+/test/examples/README.md @elastic/appex-qa
+/test/common/services/index.ts @elastic/appex-qa
+/test/common/fixtures/plugins/coverage/*.ts @elastic/appex-qa
+/test/common/config.js @elastic/appex-qa
+/test/api_integration/services/index.ts @elastic/appex-qa
+/test/api_integration/jest.config.js @elastic/appex-qa
+/test/api_integration/ftr_provider_context.d.ts @elastic/appex-qa
+/test/api_integration/config.js @elastic/appex-qa
+/test/api_integration/apis/index.ts @elastic/appex-qa
+/test/accessibility/services/index.ts @elastic/appex-qa
+/test/accessibility/services/a11y @elastic/appex-qa
+/test/accessibility/page_objects.ts @elastic/appex-qa
+/test/accessibility/ftr_provider_context.ts @elastic/appex-qa
+/test/accessibility/config.ts @elastic/appex-qa
+/test/accessibility/apps/index.ts @elastic/appex-qa
 /x-pack/test/scalability @elastic/appex-qa
 /src/dev/performance @elastic/appex-qa
 /x-pack/test/functional/config.*.* @elastic/appex-qa
diff --git a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/constants.ts b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/constants.ts
index 95606e276362b..c72808d5fceab 100644
--- a/packages/kbn-alerts-ui-shared/src/alert_filter_controls/constants.ts
+++ b/packages/kbn-alerts-ui-shared/src/alert_filter_controls/constants.ts
@@ -70,6 +70,7 @@ export const COMMON_OPTIONS_LIST_CONTROL_INPUTS: Partial<OptionsListControlState
   hideSort: true,
   placeholder: '',
   width: 'small',
+  grow: true,
 };
 
 export const TIMEOUTS = {
diff --git a/packages/kbn-expect/expect.js b/packages/kbn-expect/expect.js
index 1a48d75a4615d..f2538c5a10fb5 100644
--- a/packages/kbn-expect/expect.js
+++ b/packages/kbn-expect/expect.js
@@ -647,6 +647,11 @@ function i (obj, showHidden, depth) {
       return stylize('null', 'null');
     }
 
+    // format sets like arrays
+    if (value instanceof Set) {
+      value = Array.from(value)
+    }
+
     if (isDOMElement(value)) {
       return getOuterHTML(value);
     }
@@ -930,6 +935,10 @@ expect.eql = function eql(actual, expected) {
   // to determine equivalence.
   } else if (isRegExp(actual) && isRegExp(expected)) {
     return regExpEquiv(actual, expected);
+  // If both are Sets, they should be treated equal if they have the same
+  // entries, independent of the ordering
+  } else if (actual instanceof Set && expected instanceof Set) {
+    return actual.size === expected.size && actual.difference(expected).size === 0;
   // 7.4. For all other Object pairs, including Array objects, equivalence is
   // determined by having the same number of owned properties (as verified
   // with Object.prototype.hasOwnProperty.call), the same set of keys
diff --git a/packages/kbn-expect/expect.test.ts b/packages/kbn-expect/expect.test.ts
new file mode 100644
index 0000000000000..b26d0363eb345
--- /dev/null
+++ b/packages/kbn-expect/expect.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+// importing this package's expect as `kbnExpect` to not conflict with Jest's expect
+import kbnExpect from './expect';
+
+it('asserts that sets with same entries but different ordering are equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['c', 'b', 'a']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).not.toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).not.toThrow();
+});
+
+it('asserts that sets with same size but different entries are not equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['x', 'y', 'z']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).toThrow();
+});
+
+it('asserts that sets with different size but overlapping items are not equal', async () => {
+  const setA = new Set(['a', 'b', 'c']);
+  const setB = new Set(['a', 'b']);
+
+  expect(() => {
+    kbnExpect(setA).to.eql(setB);
+  }).toThrow();
+  expect(() => {
+    kbnExpect(setB).to.eql(setA);
+  }).toThrow();
+});
diff --git a/packages/kbn-expect/jest.config.js b/packages/kbn-expect/jest.config.js
new file mode 100644
index 0000000000000..4e517d865391a
--- /dev/null
+++ b/packages/kbn-expect/jest.config.js
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-expect'],
+};
diff --git a/packages/kbn-expect/tsconfig.json b/packages/kbn-expect/tsconfig.json
index 4346803ced341..bf599d834c806 100644
--- a/packages/kbn-expect/tsconfig.json
+++ b/packages/kbn-expect/tsconfig.json
@@ -1,10 +1,14 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "target/types"
+    "outDir": "target/types",
+    "types": [
+      "jest",
+    ],
   },
   "include": [
-    "expect.d.ts"
+    "expect.d.ts",
+    "**/*.ts"
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/field_formats/common/converters/url.test.ts b/src/plugins/field_formats/common/converters/url.test.ts
index 7e465829e1eb1..d1c89575b2d4d 100644
--- a/src/plugins/field_formats/common/converters/url.test.ts
+++ b/src/plugins/field_formats/common/converters/url.test.ts
@@ -19,6 +19,14 @@ describe('UrlFormat', () => {
     );
   });
 
+  test('outputs a mailto: link when URL starts with mailto:', () => {
+    const url = new UrlFormat({});
+
+    expect(url.convert('mailto:test@example.com', HTML_CONTEXT_TYPE)).toBe(
+      '<a href="mailto:test@example.com" target="_blank" rel="noopener noreferrer">mailto:test@example.com</a>'
+    );
+  });
+
   test('outputs an <audio> if type === "audio"', () => {
     const url = new UrlFormat({ type: 'audio' });
 
diff --git a/src/plugins/field_formats/common/converters/url.ts b/src/plugins/field_formats/common/converters/url.ts
index ef40bde8d6433..a0b423a737f08 100644
--- a/src/plugins/field_formats/common/converters/url.ts
+++ b/src/plugins/field_formats/common/converters/url.ts
@@ -21,7 +21,7 @@ import {
 } from '../types';
 
 const templateMatchRE = /{{([\s\S]+?)}}/g;
-const allowedUrlSchemes = ['http://', 'https://'];
+const allowedUrlSchemes = ['http://', 'https://', 'mailto:'];
 
 const URL_TYPES = [
   {
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
index 316bfaa228b09..ba85785a1f4c8 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.mock.ts
@@ -15,6 +15,8 @@ const createClientMock = (): jest.Mocked<AgentClient> => ({
   getAgentStatusForAgentPolicy: jest.fn(),
   listAgents: jest.fn(),
   getLatestAgentAvailableVersion: jest.fn(),
+  getLatestAgentAvailableBaseVersion: jest.fn(),
+  getLatestAgentAvailableDockerImageVersion: jest.fn(),
   getByIds: jest.fn(async (..._) => []),
 });
 
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
index 95d61060c7e66..b480631188c22 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.test.ts
@@ -267,4 +267,28 @@ function expectApisToCallServicesSuccessfully(
     );
     expect(mockgetLatestAvailableAgentVersion).toHaveBeenCalledTimes(1);
   });
+
+  test('client.getLatestAgentAvailableBaseVersion strips away IAR suffix', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('1.2.3+build12345678987654321');
+    await expect(agentClient.getLatestAgentAvailableBaseVersion()).resolves.toEqual('1.2.3');
+  });
+
+  test('client.getLatestAgentAvailableBaseVersion does not break on usual version numbers', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('8.17.0');
+    await expect(agentClient.getLatestAgentAvailableBaseVersion()).resolves.toEqual('8.17.0');
+  });
+
+  test('client.getLatestAgentAvailableDockerImageVersion transforms IAR suffix', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('1.2.3+build12345678987654321');
+    await expect(agentClient.getLatestAgentAvailableDockerImageVersion()).resolves.toEqual(
+      '1.2.3.build12345678987654321'
+    );
+  });
+
+  test('client.getLatestAgentAvailableDockerImageVersion does not break on usual version numbers', async () => {
+    mockgetLatestAvailableAgentVersion.mockResolvedValue('8.17.0');
+    await expect(agentClient.getLatestAgentAvailableDockerImageVersion()).resolves.toEqual(
+      '8.17.0'
+    );
+  });
 }
diff --git a/x-pack/plugins/fleet/server/services/agents/agent_service.ts b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
index b6791b061e985..94583284d87f8 100644
--- a/x-pack/plugins/fleet/server/services/agents/agent_service.ts
+++ b/x-pack/plugins/fleet/server/services/agents/agent_service.ts
@@ -108,6 +108,14 @@ export interface AgentClient {
    * Return the latest agent available version
    */
   getLatestAgentAvailableVersion(includeCurrentVersion?: boolean): Promise<string>;
+  /**
+   * Return the latest agent available version, not taking into account IAR versions
+   */
+  getLatestAgentAvailableBaseVersion(includeCurrentVersion?: boolean): Promise<string>;
+  /**
+   * Return the latest agent available version formatted for the docker image
+   */
+  getLatestAgentAvailableDockerImageVersion(includeCurrentVersion?: boolean): Promise<string>;
 }
 
 /**
@@ -163,6 +171,16 @@ class AgentClientImpl implements AgentClient {
     );
   }
 
+  public async getLatestAgentAvailableBaseVersion(includeCurrentVersion?: boolean) {
+    const fullVersion = await this.getLatestAgentAvailableVersion(includeCurrentVersion);
+    return fullVersion.split('+')[0];
+  }
+
+  public async getLatestAgentAvailableDockerImageVersion(includeCurrentVersion?: boolean) {
+    const fullVersion = await this.getLatestAgentAvailableVersion(includeCurrentVersion);
+    return fullVersion.replace('+', '.');
+  }
+
   public async getLatestAgentAvailableVersion(includeCurrentVersion?: boolean) {
     await this.#runPreflight();
     return getLatestAvailableAgentVersion({ includeCurrentVersion });
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts b/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts
new file mode 100644
index 0000000000000..798af67a988f1
--- /dev/null
+++ b/x-pack/plugins/observability_solution/observability_onboarding/common/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface ElasticAgentVersionInfo {
+  agentVersion: string;
+  agentBaseVersion: string;
+  agentDockerImageVersion: string;
+}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
index d9e695b8c10f0..b3c769030f18b 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/auto_detect/get_auto_detect_command.tsx
@@ -19,7 +19,7 @@ export function getAutoDetectCommand(
       --kibana-url=${options.kibanaUrl}
       --install-key=${options.installApiKey}
       --ingest-key=${options.ingestApiKey}
-      --ea-version=${options.elasticAgentVersion}
+      --ea-version=${options.elasticAgentVersionInfo.agentVersion}
   `;
 }
 function oneLine(parts: TemplateStringsArray, ...args: string[]) {
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
index 18fdc833483fe..bb44d3ec38458 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/custom_logs/install_elastic_agent.tsx
@@ -312,7 +312,7 @@ export function InstallElasticAgent() {
           apiKeyEncoded,
           apiEndpoint: setup?.apiEndpoint,
           scriptDownloadUrl: setup?.scriptDownloadUrl,
-          elasticAgentVersion: setup?.elasticAgentVersion,
+          elasticAgentVersion: setup?.elasticAgentVersionInfo.agentVersion,
           autoDownloadConfig,
           onboardingId,
         })}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
index 59de30111649d..24d7a2ccd92c3 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/build_kubectl_command.ts
@@ -5,11 +5,13 @@
  * 2.0.
  */
 
+import { ElasticAgentVersionInfo } from '../../../../common/types';
+
 interface Params {
   encodedApiKey: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
 }
 
 const KUSTOMIZE_TEMPLATE_URL =
@@ -19,16 +21,16 @@ export function buildKubectlCommand({
   encodedApiKey,
   onboardingId,
   elasticsearchUrl,
-  elasticAgentVersion,
+  elasticAgentVersionInfo,
 }: Params) {
   const escapedElasticsearchUrl = elasticsearchUrl.replace(/\//g, '\\/');
 
   return `
-    kubectl kustomize ${KUSTOMIZE_TEMPLATE_URL}\\?ref\\=v${elasticAgentVersion}
+    kubectl kustomize ${KUSTOMIZE_TEMPLATE_URL}\\?ref\\=v${elasticAgentVersionInfo.agentBaseVersion}
       | sed -e 's/JUFQSV9LRVkl/${encodedApiKey}/g'
             -e "s/%ES_HOST%/${escapedElasticsearchUrl}/g"
             -e "s/%ONBOARDING_ID%/${onboardingId}/g"
-            -e "s/\\(docker.elastic.co\\/beats\\/elastic-agent\:\\).*$/\\1${elasticAgentVersion}/g"
+            -e "s/\\(docker.elastic.co\\/beats\\/elastic-agent\:\\).*$/\\1${elasticAgentVersionInfo.agentDockerImageVersion}/g"
             -e  "/{CA_TRUSTED}/c\\ "
       |  kubectl apply -f-
   `
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
index 2ed3ff80f14bf..ac00190fb268d 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/command_snippet.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import { EuiCodeBlock, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { i18n } from '@kbn/i18n';
+import { ElasticAgentVersionInfo } from '../../../../common/types';
 import { buildKubectlCommand } from './build_kubectl_command';
 import { CopyToClipboardButton } from '../shared/copy_to_clipboard_button';
 
@@ -16,7 +17,7 @@ interface Props {
   encodedApiKey: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
   isCopyPrimaryAction: boolean;
 }
 
@@ -24,14 +25,14 @@ export function CommandSnippet({
   encodedApiKey,
   onboardingId,
   elasticsearchUrl,
-  elasticAgentVersion,
+  elasticAgentVersionInfo,
   isCopyPrimaryAction,
 }: Props) {
   const command = buildKubectlCommand({
     encodedApiKey,
     onboardingId,
     elasticsearchUrl,
-    elasticAgentVersion,
+    elasticAgentVersionInfo,
   });
 
   return (
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
index 94e5b27e028a8..96b7b5619377b 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/kubernetes/index.tsx
@@ -58,7 +58,7 @@ export const KubernetesPanel: React.FC = () => {
               encodedApiKey={data.apiKeyEncoded}
               onboardingId={data.onboardingId}
               elasticsearchUrl={data.elasticsearchUrl}
-              elasticAgentVersion={data.elasticAgentVersion}
+              elasticAgentVersionInfo={data.elasticAgentVersionInfo}
               isCopyPrimaryAction={!isMonitoringStepActive}
             />
           )}
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
index 4d0de71d6faaf..156f980de58df 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
+++ b/x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx
@@ -69,7 +69,9 @@ export const OtelLogsPanel: React.FC = () => {
   } = useKibana<ObservabilityOnboardingAppServices>();
 
   const AGENT_CDN_BASE_URL = 'artifacts.elastic.co/downloads/beats/elastic-agent';
-  const agentVersion = isServerless ? setup?.elasticAgentVersion : stackVersion;
+  const agentVersion =
+    isServerless && setup ? setup.elasticAgentVersionInfo.agentVersion : stackVersion;
+  const urlEncodedAgentVersion = encodeURIComponent(agentVersion);
 
   const allDatasetsLocator =
     share.url.locators.get<AllDatasetsLocatorParams>(ALL_DATASETS_LOCATOR_ID);
@@ -96,7 +98,7 @@ export const OtelLogsPanel: React.FC = () => {
       firstStepTitle: HOST_COMMAND,
       content: `arch=$(if ([[ $(arch) == "arm" || $(arch) == "aarch64" ]]); then echo "arm64"; else echo $(arch); fi)
 
-curl --output elastic-distro-${agentVersion}-linux-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${agentVersion}-linux-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p elastic-distro-${agentVersion}-linux-$arch && tar -xvf elastic-distro-${agentVersion}-linux-$arch.tar.gz -C "elastic-distro-${agentVersion}-linux-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-linux-$arch
+curl --output elastic-distro-${agentVersion}-linux-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${urlEncodedAgentVersion}-linux-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p elastic-distro-${agentVersion}-linux-$arch && tar -xvf elastic-distro-${agentVersion}-linux-$arch.tar.gz -C "elastic-distro-${agentVersion}-linux-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-linux-$arch
 
 rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mkdir -p ./data/otelcol && sed -i 's#\\\${env:STORAGE_DIR}#'"$PWD"/data/otelcol'#g' ./otel.yml && sed -i 's#\\\${env:ELASTIC_ENDPOINT}#${setup?.elasticsearchUrl}#g' ./otel.yml && sed -i 's/\\\${env:ELASTIC_API_KEY}/${apiKeyData?.apiKeyEncoded}/g' ./otel.yml`,
       start: 'sudo ./otelcol --config otel.yml',
@@ -108,7 +110,7 @@ rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mk
       firstStepTitle: HOST_COMMAND,
       content: `arch=$(if [[ $(uname -m) == "arm64" ]]; then echo "aarch64"; else echo $(uname -m); fi)
 
-curl --output elastic-distro-${agentVersion}-darwin-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${agentVersion}-darwin-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p "elastic-distro-${agentVersion}-darwin-$arch" && tar -xvf elastic-distro-${agentVersion}-darwin-$arch.tar.gz -C "elastic-distro-${agentVersion}-darwin-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-darwin-$arch
+curl --output elastic-distro-${agentVersion}-darwin-$arch.tar.gz --url https://${AGENT_CDN_BASE_URL}/elastic-agent-${urlEncodedAgentVersion}-darwin-$arch.tar.gz --proto '=https' --tlsv1.2 -fOL && mkdir -p "elastic-distro-${agentVersion}-darwin-$arch" && tar -xvf elastic-distro-${agentVersion}-darwin-$arch.tar.gz -C "elastic-distro-${agentVersion}-darwin-$arch" --strip-components=1 && cd elastic-distro-${agentVersion}-darwin-$arch
 
 rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mkdir -p ./data/otelcol  && sed -i '' 's#\\\${env:STORAGE_DIR}#'"$PWD"/data/otelcol'#g' ./otel.yml && sed -i '' 's#\\\${env:ELASTIC_ENDPOINT}#${setup?.elasticsearchUrl}#g' ./otel.yml && sed -i '' 's/\\\${env:ELASTIC_API_KEY}/${apiKeyData?.apiKeyEncoded}/g' ./otel.yml`,
       start: './otelcol --config otel.yml',
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
index c9dd959e6bb75..6474cc8e776fc 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/lib/get_agent_version.ts
@@ -6,8 +6,12 @@
  */
 
 import type { FleetStartContract } from '@kbn/fleet-plugin/server';
+import { ElasticAgentVersionInfo } from '../../common/types';
 
-export function getAgentVersion(fleetStart: FleetStartContract, kibanaVersion: string) {
+export async function getAgentVersionInfo(
+  fleetStart: FleetStartContract,
+  kibanaVersion: string
+): Promise<ElasticAgentVersionInfo> {
   // If undefined, we will follow fleet's strategy to select latest available version:
   // for serverless we will use the latest published version, for statefull we will use
   // current Kibana version. If false, irrespective of fleet flags and logic, we are
@@ -15,5 +19,14 @@ export function getAgentVersion(fleetStart: FleetStartContract, kibanaVersion: s
   const includeCurrentVersion = kibanaVersion.endsWith('-SNAPSHOT') ? false : undefined;
 
   const agentClient = fleetStart.agentService.asInternalUser;
-  return agentClient.getLatestAgentAvailableVersion(includeCurrentVersion);
+  const [agentVersion, agentBaseVersion, agentDockerImageVersion] = await Promise.all([
+    agentClient.getLatestAgentAvailableVersion(includeCurrentVersion),
+    agentClient.getLatestAgentAvailableBaseVersion(includeCurrentVersion),
+    agentClient.getLatestAgentAvailableDockerImageVersion(includeCurrentVersion),
+  ]);
+  return {
+    agentVersion,
+    agentBaseVersion,
+    agentDockerImageVersion,
+  };
 }
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
index f0663aa27ccad..372eaf7972373 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/flow/route.ts
@@ -20,7 +20,7 @@ import { ObservabilityOnboardingFlow } from '../../saved_objects/observability_o
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { getHasLogs } from './get_has_logs';
 import { getKibanaUrl } from '../../lib/get_fallback_urls';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { ElasticAgentStepPayload, InstalledIntegration, StepProgressPayloadRT } from '../types';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
@@ -220,21 +220,22 @@ const createFlowRoute = createObservabilityOnboardingServerRoute({
 
     const fleetPluginStart = await plugins.fleet.start();
 
-    const [onboardingFlow, ingestApiKey, installApiKey, elasticAgentVersion] = await Promise.all([
-      saveObservabilityOnboardingFlow({
-        savedObjectsClient,
-        observabilityOnboardingState: {
-          type: 'autoDetect',
-          state: undefined,
-          progress: {},
-        },
-      }),
-      createShipperApiKey(client.asCurrentUser, `onboarding_ingest_${name}`),
-      (
-        await context.resolve(['core'])
-      ).core.security.authc.apiKeys.create(createInstallApiKey(`onboarding_install_${name}`)),
-      getAgentVersion(fleetPluginStart, kibanaVersion),
-    ]);
+    const [onboardingFlow, ingestApiKey, installApiKey, elasticAgentVersionInfo] =
+      await Promise.all([
+        saveObservabilityOnboardingFlow({
+          savedObjectsClient,
+          observabilityOnboardingState: {
+            type: 'autoDetect',
+            state: undefined,
+            progress: {},
+          },
+        }),
+        createShipperApiKey(client.asCurrentUser, `onboarding_ingest_${name}`),
+        (
+          await context.resolve(['core'])
+        ).core.security.authc.apiKeys.create(createInstallApiKey(`onboarding_install_${name}`)),
+        getAgentVersionInfo(fleetPluginStart, kibanaVersion),
+      ]);
 
     if (!installApiKey) {
       throw Boom.notFound('License does not allow API key creation.');
@@ -250,7 +251,7 @@ const createFlowRoute = createObservabilityOnboardingServerRoute({
       onboardingFlow,
       ingestApiKey: ingestApiKey.encoded,
       installApiKey: installApiKey.encoded,
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
       kibanaUrl,
       scriptDownloadUrl,
     };
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
index 691c28f5a14e6..b5ea3ef4ee5e6 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/kubernetes/route.ts
@@ -10,17 +10,18 @@ import * as t from 'io-ts';
 import Boom from '@hapi/boom';
 import { termQuery } from '@kbn/observability-plugin/server';
 import type { estypes } from '@elastic/elasticsearch';
+import { ElasticAgentVersionInfo } from '../../../common/types';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { hasLogMonitoringPrivileges } from '../../lib/api_key/has_log_monitoring_privileges';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 
 export interface CreateKubernetesOnboardingFlowRouteResponse {
   apiKeyEncoded: string;
   onboardingId: string;
   elasticsearchUrl: string;
-  elasticAgentVersion: string;
+  elasticAgentVersionInfo: ElasticAgentVersionInfo;
 }
 
 export interface HasKubernetesDataRouteResponse {
@@ -56,9 +57,9 @@ const createKubernetesOnboardingFlowRoute = createObservabilityOnboardingServerR
     const fleetPluginStart = await plugins.fleet.start();
     const packageClient = fleetPluginStart.packageService.asScoped(request);
 
-    const [{ encoded: apiKeyEncoded }, elasticAgentVersion] = await Promise.all([
+    const [{ encoded: apiKeyEncoded }, elasticAgentVersionInfo] = await Promise.all([
       createShipperApiKey(client.asCurrentUser, `${params.body.pkgName}_onboarding`, true),
-      getAgentVersion(fleetPluginStart, kibanaVersion),
+      getAgentVersionInfo(fleetPluginStart, kibanaVersion),
       // System package is always required
       packageClient.ensureInstalledPackage({ pkgName: 'system' }),
       // Kubernetes package is required for both classic kubernetes and otel
@@ -77,7 +78,7 @@ const createKubernetesOnboardingFlowRoute = createObservabilityOnboardingServerR
       onboardingId: uuidv4(),
       apiKeyEncoded,
       elasticsearchUrl: elasticsearchUrlList.length > 0 ? elasticsearchUrlList[0] : '',
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
     };
   },
 });
diff --git a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
index 017925cc44dee..6302df917469a 100644
--- a/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
+++ b/x-pack/plugins/observability_solution/observability_onboarding/server/routes/logs/route.ts
@@ -7,10 +7,11 @@
 
 import * as t from 'io-ts';
 import Boom from '@hapi/boom';
+import { ElasticAgentVersionInfo } from '../../../common/types';
 import { createObservabilityOnboardingServerRoute } from '../create_observability_onboarding_server_route';
 import { getFallbackESUrl } from '../../lib/get_fallback_urls';
 import { getKibanaUrl } from '../../lib/get_fallback_urls';
-import { getAgentVersion } from '../../lib/get_agent_version';
+import { getAgentVersionInfo } from '../../lib/get_agent_version';
 import { saveObservabilityOnboardingFlow } from '../../lib/state';
 import { createShipperApiKey } from '../../lib/api_key/create_shipper_api_key';
 import { ObservabilityOnboardingFlow } from '../../saved_objects/observability_onboarding_status';
@@ -39,7 +40,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
   async handler(resources): Promise<{
     apiEndpoint: string;
     scriptDownloadUrl: string;
-    elasticAgentVersion: string;
+    elasticAgentVersionInfo: ElasticAgentVersionInfo;
     elasticsearchUrl: string[];
   }> {
     const {
@@ -50,7 +51,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
     } = resources;
 
     const fleetPluginStart = await plugins.fleet.start();
-    const elasticAgentVersion = await getAgentVersion(fleetPluginStart, kibanaVersion);
+    const elasticAgentVersionInfo = await getAgentVersionInfo(fleetPluginStart, kibanaVersion);
     const kibanaUrl = getKibanaUrl(core.setup, plugins.cloud?.setup);
     const scriptDownloadUrl = new URL(
       core.setup.http.staticAssets.getPluginAssetHref('standalone_agent_setup.sh'),
@@ -67,7 +68,7 @@ const installShipperSetupRoute = createObservabilityOnboardingServerRoute({
       apiEndpoint,
       elasticsearchUrl,
       scriptDownloadUrl,
-      elasticAgentVersion,
+      elasticAgentVersionInfo,
     };
   },
 });
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
index cbb0350da1731..4217fa111786e 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/upgrade_prebuilt_rules_table_context.tsx
@@ -8,10 +8,18 @@
 import type { Dispatch, SetStateAction } from 'react';
 import React, { createContext, useCallback, useContext, useMemo, useState } from 'react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
+import { isNonUpgradeableFieldName } from '../../../../rule_management/model/prebuilt_rule_upgrade/fields';
+import type {
+  RuleFieldsToUpgrade,
+  RuleUpgradeSpecifier,
+  RuleUpgradeInfoForReview,
+} from '../../../../../../common/api/detection_engine';
 import { useIsPrebuiltRulesCustomizationEnabled } from '../../../../rule_management/hooks/use_is_prebuilt_rules_customization_enabled';
 import { useAppToasts } from '../../../../../common/hooks/use_app_toasts';
-import type { RuleUpgradeInfoForReview } from '../../../../../../common/api/detection_engine';
-import type { RulesUpgradeState } from '../../../../rule_management/model/prebuilt_rule_upgrade';
+import type {
+  RuleUpgradeState,
+  RulesUpgradeState,
+} from '../../../../rule_management/model/prebuilt_rule_upgrade';
 import { RuleUpgradeConflictsResolverTab } from '../../../../rule_management/components/rule_details/three_way_diff/rule_upgrade_conflicts_resolver_tab';
 import { PerFieldRuleDiffTab } from '../../../../rule_management/components/rule_details/per_field_rule_diff_tab';
 import { useIsUpgradingSecurityPackages } from '../../../../rule_management/logic/use_upgrade_security_packages';
@@ -26,13 +34,14 @@ import type { UpgradePrebuiltRulesTableFilterOptions } from './use_filter_prebui
 import { useFilterPrebuiltRulesToUpgrade } from './use_filter_prebuilt_rules_to_upgrade';
 import { TabContentPadding } from '../../../../rule_management/components/rule_details/rule_details_flyout';
 import { RuleDiffTab } from '../../../../rule_management/components/rule_details/rule_diff_tab';
+import { FieldUpgradeState } from '../../../../rule_management/model/prebuilt_rule_upgrade/field_upgrade_state';
+import { useRulePreviewFlyout } from '../use_rule_preview_flyout';
 import { MlJobUpgradeModal } from './modals/ml_job_upgrade_modal';
 import { UpgradeConflictsModal } from './modals/upgrade_conflicts_modal';
-import * as ruleDetailsI18n from '../../../../rule_management/components/rule_details/translations';
-import * as i18n from './translations';
 import { usePrebuiltRulesUpgradeState } from './use_prebuilt_rules_upgrade_state';
-import { useRulePreviewFlyout } from '../use_rule_preview_flyout';
 import { useMlJobUpgradeModal, useUpgradeConflictsModal } from './use_upgrade_modals';
+import * as ruleDetailsI18n from '../../../../rule_management/components/rule_details/translations';
+import * as i18n from './translations';
 
 export interface UpgradePrebuiltRulesTableState {
   /**
@@ -160,20 +169,6 @@ export const UpgradePrebuiltRulesTableContextProvider = ({
   } = useUpgradeConflictsModal();
 
   const shouldConfirmMLJobs = legacyJobsInstalled.length > 0;
-  const getRulesWithConflicts = useCallback(
-    (ruleIds?: RuleSignatureId[]) => {
-      const rulesToUpgrade =
-        ruleIds?.map((ruleId) => {
-          const rule = rulesUpgradeState[ruleId];
-          invariant(rule, `Rule with ID ${ruleId} not found.`);
-
-          return rule;
-        }) ?? [];
-
-      return rulesToUpgrade.filter((rule) => rule.diff.num_fields_with_conflicts > 0);
-    },
-    [rulesUpgradeState]
-  );
 
   const { mutateAsync: upgradeSpecificRulesRequest } = usePerformUpgradeSpecificRules({
     pickVersion: isPrebuiltRulesCustomizationEnabled ? 'MERGED' : 'TARGET',
@@ -181,49 +176,57 @@ export const UpgradePrebuiltRulesTableContextProvider = ({
 
   const upgradeRules = useCallback(
     async (ruleIds: RuleSignatureId[]) => {
-      const rulesToUpgrade = ruleIds.map((ruleId) => ({
-        rule_id: ruleId,
-        version:
-          rulesUpgradeState[ruleId].diff.fields.version?.target_version ??
-          rulesUpgradeState[ruleId].current_rule.version,
-        revision: rulesUpgradeState[ruleId].revision,
-      }));
-      setLoadingRules((prev) => [...prev, ...rulesToUpgrade.map((r) => r.rule_id)]);
+      const conflictRuleIdsSet = new Set(
+        isPrebuiltRulesCustomizationEnabled
+          ? ruleIds.filter(
+              (ruleId) =>
+                rulesUpgradeState[ruleId].diff.num_fields_with_conflicts > 0 &&
+                rulesUpgradeState[ruleId].hasUnresolvedConflicts
+            )
+          : []
+      );
+      const ruleUpgradeSpecifiers: RuleUpgradeSpecifier[] = ruleIds
+        .filter((ruleId) => !conflictRuleIdsSet.has(ruleId))
+        .map((ruleId) => ({
+          rule_id: ruleId,
+          version:
+            rulesUpgradeState[ruleId].diff.fields.version?.target_version ??
+            rulesUpgradeState[ruleId].current_rule.version,
+          revision: rulesUpgradeState[ruleId].revision,
+          fields: isPrebuiltRulesCustomizationEnabled
+            ? constructRuleFieldsToUpgrade(rulesUpgradeState[ruleId])
+            : undefined,
+        }));
+
+      setLoadingRules((prev) => [...prev, ...ruleUpgradeSpecifiers.map((x) => x.rule_id)]);
+
       try {
         // Handle MLJobs modal
         if (shouldConfirmMLJobs && !(await confirmLegacyMLJobs())) {
           return;
         }
 
-        // Handle Rule Upgrades modal
-        const rulesWithConflicts = getRulesWithConflicts(ruleIds);
         if (
           isPrebuiltRulesCustomizationEnabled &&
-          rulesWithConflicts.length > 0 &&
+          conflictRuleIdsSet.size > 0 &&
           !(await confirmConflictsUpgrade())
         ) {
           return;
         }
 
-        // Prepare payload for upgrade with rules with no conflicts
-        const ruleIdsWithConflicts = new Set(rulesWithConflicts.map((rule) => rule.rule_id));
-        const rulesToUpgradeWithNoConflicts = isPrebuiltRulesCustomizationEnabled
-          ? rulesToUpgrade.filter((rule) => !ruleIdsWithConflicts.has(rule.rule_id))
-          : rulesToUpgrade;
-        await upgradeSpecificRulesRequest(rulesToUpgradeWithNoConflicts);
+        await upgradeSpecificRulesRequest(ruleUpgradeSpecifiers);
       } catch (err) {
         addError(err, { title: i18n.UPDATE_ERROR });
       } finally {
-        setLoadingRules((prev) =>
-          prev.filter((id) => !rulesToUpgrade.some((r) => r.rule_id === id))
-        );
+        const upgradedRuleIdsSet = new Set(ruleUpgradeSpecifiers.map((x) => x.rule_id));
+
+        setLoadingRules((prev) => prev.filter((id) => !upgradedRuleIdsSet.has(id)));
       }
     },
     [
       confirmLegacyMLJobs,
       confirmConflictsUpgrade,
       shouldConfirmMLJobs,
-      getRulesWithConflicts,
       rulesUpgradeState,
       upgradeSpecificRulesRequest,
       isPrebuiltRulesCustomizationEnabled,
@@ -408,3 +411,26 @@ export const useUpgradePrebuiltRulesTableContext = (): UpgradePrebuiltRulesConte
 
   return rulesTableContext;
 };
+
+function constructRuleFieldsToUpgrade(ruleUpgradeState: RuleUpgradeState): RuleFieldsToUpgrade {
+  const finalRule = ruleUpgradeState.finalRule as Record<string, unknown>;
+  const ruleFieldsToUpgrade: Record<string, unknown> = {};
+
+  for (const fieldName of Object.keys(ruleUpgradeState.fieldsUpgradeState)) {
+    const fieldUpgradeState = ruleUpgradeState.fieldsUpgradeState[fieldName];
+
+    if (!isNonUpgradeableFieldName(fieldName) && fieldUpgradeState === FieldUpgradeState.Accepted) {
+      invariant(
+        fieldName in finalRule,
+        `Ready to upgrade field "${fieldName}" is not found in final rule`
+      );
+
+      ruleFieldsToUpgrade[fieldName] = {
+        pick_version: 'RESOLVED',
+        resolved_value: finalRule[fieldName],
+      };
+    }
+  }
+
+  return ruleFieldsToUpgrade;
+}
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
index 8c97a4ef52e2b..b50ca7da1849d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/upgrade_prebuilt_rules_table/use_prebuilt_rules_upgrade_state.ts
@@ -19,11 +19,12 @@ import {
   type DiffableRule,
   type RuleUpgradeInfoForReview,
   ThreeWayDiffConflict,
+  type RuleSignatureId,
 } from '../../../../../../common/api/detection_engine';
 import { convertRuleToDiffable } from '../../../../../../common/detection_engine/prebuilt_rules/diff/convert_rule_to_diffable';
 
 type RuleResolvedConflicts = Partial<DiffableAllFields>;
-type RulesResolvedConflicts = Record<string, RuleResolvedConflicts>;
+type RulesResolvedConflicts = Record<RuleSignatureId, RuleResolvedConflicts>;
 
 interface UseRulesUpgradeStateResult {
   rulesUpgradeState: RulesUpgradeState;
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
index c64128274aa3d..966068eb4c074 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/constants.ts
@@ -5,5 +5,11 @@
  * 2.0.
  */
 
-export const SUPPORTED_FILE_TYPES = ['text/csv', 'text/plain', 'text/tab-separated-values'];
+export const SUPPORTED_FILE_TYPES = [
+  'text/csv',
+  'text/plain',
+  'text/tab-separated-values',
+  '.tsv', // Useful for Windows when it can't recognise the file extension.
+  '.csv', // Useful for Windows when it can't recognise the file extension.
+];
 export const SUPPORTED_FILE_EXTENSIONS = ['CSV', 'TXT', 'TSV'];
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
index 675535365a0b0..a3b9a2e0ce24e 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/hooks.test.ts
@@ -37,12 +37,13 @@ describe('useFileValidation', () => {
   test('should call onError when an error occurs', () => {
     const onErrorMock = jest.fn();
     const onCompleteMock = jest.fn();
+    const invalidFileType = 'invalid file type';
 
     const { result } = renderHook(
       () => useFileValidation({ onError: onErrorMock, onComplete: onCompleteMock }),
       { wrapper: TestProviders }
     );
-    result.current(new File([invalidLine], 'test.csv'));
+    result.current(new File([invalidLine], 'test.csv', { type: invalidFileType }));
 
     expect(onErrorMock).toHaveBeenCalled();
     expect(onCompleteMock).not.toHaveBeenCalled();
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
index 4e742d4d92505..4a77e024528dd 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.test.ts
@@ -56,6 +56,14 @@ describe('validateFile', () => {
     expect(result.valid).toBe(true);
   });
 
+  it('should return valid if the mime type is empty (Windows)', () => {
+    const file = new File(['file content'], 'test.csv', { type: '' });
+
+    const result = validateFile(file, formatBytes);
+
+    expect(result.valid).toBe(true);
+  });
+
   it('should return an error message if the file type is invalid', () => {
     const file = new File(['file content'], 'test.txt', { type: 'invalid-type' });
 
diff --git a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
index 06018a2496768..6f8bd8fb816bf 100644
--- a/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
+++ b/x-pack/plugins/security_solution/public/entity_analytics/components/asset_criticality_file_uploader/validations.ts
@@ -53,7 +53,10 @@ export const validateFile = (
   file: File,
   formatBytes: (bytes: number) => string
 ): { valid: false; errorMessage: string; code: string } | { valid: true } => {
-  if (!SUPPORTED_FILE_TYPES.includes(file.type)) {
+  if (
+    file.type !== '' && // file.type might be an empty string on windows
+    !SUPPORTED_FILE_TYPES.includes(file.type)
+  ) {
     return {
       valid: false,
       code: 'unsupported_file_type',
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts
new file mode 100644
index 0000000000000..37a5dc2aa9a6f
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/constants/archives_metadata.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import archivesMetadata from '../../../../../../apm_api_integration/common/fixtures/es_archiver/archives_metadata';
+
+export default archivesMetadata;
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
index 5d15e563c919a..498aecdde6510 100644
--- a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/index.ts
@@ -29,6 +29,7 @@ export default function apmApiIntegrationTests({
     loadTestFile(require.resolve('./observability_overview'));
     loadTestFile(require.resolve('./latency'));
     loadTestFile(require.resolve('./infrastructure'));
+    loadTestFile(require.resolve('./inspect'));
     loadTestFile(require.resolve('./service_groups'));
   });
 }
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts
new file mode 100644
index 0000000000000..8169a30a04d0f
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context';
+
+export default function ({ loadTestFile }: DeploymentAgnosticFtrProviderContext) {
+  describe('inspect', () => {
+    loadTestFile(require.resolve('./inspect.spec.ts'));
+  });
+}
diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts
new file mode 100644
index 0000000000000..b2f93635b79f0
--- /dev/null
+++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/apm/inspect/inspect.spec.ts
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+
+import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context';
+import { ARCHIVER_ROUTES } from '../constants/archiver';
+import archives_metadata from '../constants/archives_metadata';
+
+export default function inspectFlagTests({ getService }: DeploymentAgnosticFtrProviderContext) {
+  const apmApiClient = getService('apmApi');
+  const esArchiver = getService('esArchiver');
+
+  const archiveName = '8.0.0';
+  const metadata = archives_metadata['apm_8.0.0'];
+
+  describe('Inspect feature', () => {
+    before(async () => {
+      await esArchiver.load(ARCHIVER_ROUTES[archiveName]);
+    });
+    after(async () => {
+      await esArchiver.unload(ARCHIVER_ROUTES[archiveName]);
+    });
+
+    describe('when omitting `_inspect` query param', () => {
+      it('returns response without `_inspect`', async () => {
+        const { status, body } = await apmApiClient.readUser({
+          endpoint: 'GET /internal/apm/environments',
+          params: {
+            query: {
+              start: metadata.start,
+              end: metadata.end,
+            },
+          },
+        });
+
+        expect(status).to.be(200);
+        expect(body._inspect).to.be(undefined);
+      });
+    });
+
+    describe('when passing `_inspect` as query param', () => {
+      describe('elasticsearch calls made with end-user auth are returned', () => {
+        it('for environments', async () => {
+          const { status, body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/environments',
+            params: {
+              query: {
+                start: metadata.start,
+                end: metadata.end,
+                _inspect: true,
+              },
+            },
+          });
+          expect(status).to.be(200);
+          expect(body._inspect).not.to.be.empty();
+
+          // @ts-expect-error
+          expect(Object.keys(body._inspect[0])).to.eql([
+            'id',
+            'json',
+            'name',
+            'response',
+            'startTime',
+            'stats',
+            'status',
+          ]);
+        });
+      });
+
+      describe('elasticsearch calls made with internal user should not leak internal queries', () => {
+        it('for custom links', async () => {
+          const { status, body } = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/settings/custom_links',
+            params: {
+              query: {
+                'service.name': 'opbeans-node',
+                'transaction.type': 'request',
+                _inspect: true,
+              },
+            },
+          });
+
+          expect(status).to.be(200);
+          expect(body._inspect).to.eql([]);
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts b/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
index f15c9900488a0..b2e0931971a6e 100644
--- a/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/inspect/inspect.spec.ts
@@ -8,79 +8,15 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 
-import archives_metadata from '../../common/fixtures/es_archiver/archives_metadata';
-
 export default function inspectFlagTests({ getService }: FtrProviderContext) {
   const registry = getService('registry');
   const apmApiClient = getService('apmApiClient');
 
   const archiveName = 'apm_8.0.0';
-  const metadata = archives_metadata[archiveName];
 
   registry.when('Inspect feature', { config: 'trial', archives: [archiveName] }, () => {
-    describe('when omitting `_inspect` query param', () => {
-      it('returns response without `_inspect`', async () => {
-        const { status, body } = await apmApiClient.readUser({
-          endpoint: 'GET /internal/apm/environments',
-          params: {
-            query: {
-              start: metadata.start,
-              end: metadata.end,
-            },
-          },
-        });
-
-        expect(status).to.be(200);
-        expect(body._inspect).to.be(undefined);
-      });
-    });
-
     describe('when passing `_inspect` as query param', () => {
-      describe('elasticsearch calls made with end-user auth are returned', () => {
-        it('for environments', async () => {
-          const { status, body } = await apmApiClient.readUser({
-            endpoint: 'GET /internal/apm/environments',
-            params: {
-              query: {
-                start: metadata.start,
-                end: metadata.end,
-                _inspect: true,
-              },
-            },
-          });
-          expect(status).to.be(200);
-          expect(body._inspect).not.to.be.empty();
-
-          // @ts-expect-error
-          expect(Object.keys(body._inspect[0])).to.eql([
-            'id',
-            'json',
-            'name',
-            'response',
-            'startTime',
-            'stats',
-            'status',
-          ]);
-        });
-      });
-
       describe('elasticsearch calls made with internal user should not leak internal queries', () => {
-        it('for custom links', async () => {
-          const { status, body } = await apmApiClient.readUser({
-            endpoint: 'GET /internal/apm/settings/custom_links',
-            params: {
-              query: {
-                'service.name': 'opbeans-node',
-                'transaction.type': 'request',
-                _inspect: true,
-              },
-            },
-          });
-
-          expect(status).to.be(200);
-          expect(body._inspect).to.eql([]);
-        });
-
         it('for agent configs', async () => {
           const { status, body } = await apmApiClient.readUser({
             endpoint: 'GET /api/apm/settings/agent-configuration 2023-10-31',