diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index 1213312e2a22c..24bfeaa4dae1a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -53,6 +53,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
 
@@ -65,6 +66,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
         const expected = {
@@ -250,6 +252,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
         // @ts-ignore
@@ -279,6 +282,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
         // @ts-ignore
@@ -297,6 +301,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: mockEcsDataWithAlert,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
 
@@ -326,6 +331,7 @@ describe('alert actions', () => {
           apolloClient,
           createTimeline,
           ecsData: ecsDataMock,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
 
@@ -350,6 +356,7 @@ describe('alert actions', () => {
         await sendAlertToTimelineAction({
           createTimeline,
           ecsData: ecsDataMock,
+          nonEcsData: [],
           updateTimelineIsLoading,
         });
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index feac3df314e8d..11c13c2358e94 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -33,6 +33,7 @@ import {
   replaceTemplateFieldFromDataProviders,
 } from './helpers';
 import { KueryFilterQueryKind } from '../../../common/store';
+import { DataProvider } from '../../../timelines/components/timeline/data_providers/data_provider';
 
 export const getUpdateAlertsQuery = (eventIds: Readonly<string[]>) => {
   return {
@@ -105,7 +106,7 @@ export const determineToAndFrom = ({ ecsData }: { ecsData: Ecs }) => {
 export const getThresholdAggregationDataProvider = (
   ecsData: Ecs,
   nonEcsData: TimelineNonEcsData[]
-) => {
+): DataProvider[] => {
   const aggregationField = ecsData.signal?.rule?.threshold.field;
   const aggregationValue =
     get(aggregationField, ecsData) ?? find(['field', aggregationField], nonEcsData)?.value;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
index b127ff04eca46..34d18b4dedba6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
@@ -7,7 +7,7 @@
 import ApolloClient from 'apollo-client';
 
 import { Status } from '../../../../common/detection_engine/schemas/common/schemas';
-import { Ecs } from '../../../graphql/types';
+import { Ecs, TimelineNonEcsData } from '../../../graphql/types';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { inputsModel } from '../../../common/store';
 
@@ -53,6 +53,7 @@ export interface SendAlertToTimelineActionProps {
   apolloClient?: ApolloClient<{}>;
   createTimeline: CreateTimeline;
   ecsData: Ecs;
+  nonEcsData: TimelineNonEcsData[];
   updateTimelineIsLoading: UpdateTimelineLoading;
 }
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json
index d600bae2746d9..82996c4852316 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/signals_mapping.json
@@ -286,6 +286,9 @@
           },
           "status": {
             "type": "keyword"
+          },
+          "threshold_count": {
+            "type": "keyword"
           }
         }
       }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 9859854cdf2d6..9e77165063a3d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -251,12 +251,6 @@ export const signalRulesAlertType = ({
             threshold,
           });
 
-          // console.log(
-          //   'thresholdResults',
-          //   thresholdResults
-          //   // JSON.stringify(thresholdResults.aggregations?.threshold.buckets, null, 2)
-          // );
-
           const {
             success,
             bulkCreateDuration,