diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index f547bc8185d02..d1c9dd76e4721 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -51,6 +51,7 @@ export const DEFAULT_INDEX_PATTERN = [
   'filebeat-*',
   'packetbeat-*',
   'winlogbeat-*',
+  'logs-*',
 ];
 
 /** This Kibana Advanced Setting enables the `Security news` feed widget */
diff --git a/x-pack/plugins/security_solution/public/alerts/containers/detection_engine/rules/fetch_index_patterns.test.tsx b/x-pack/plugins/security_solution/public/alerts/containers/detection_engine/rules/fetch_index_patterns.test.tsx
index 79d5886f8845f..c282a204f19a5 100644
--- a/x-pack/plugins/security_solution/public/alerts/containers/detection_engine/rules/fetch_index_patterns.test.tsx
+++ b/x-pack/plugins/security_solution/public/alerts/containers/detection_engine/rules/fetch_index_patterns.test.tsx
@@ -354,6 +354,7 @@ describe('useFetchIndexPatterns', () => {
                     'filebeat-*',
                     'packetbeat-*',
                     'winlogbeat-*',
+                    'logs-*',
                   ],
                   name: 'event.end',
                   searchable: true,
@@ -370,6 +371,7 @@ describe('useFetchIndexPatterns', () => {
             'filebeat-*',
             'packetbeat-*',
             'winlogbeat-*',
+            'logs-*',
           ],
           indicesExists: true,
           indexPatterns: {
@@ -415,7 +417,8 @@ describe('useFetchIndexPatterns', () => {
               { name: 'source.port', searchable: true, type: 'long', aggregatable: true },
               { name: 'event.end', searchable: true, type: 'date', aggregatable: true },
             ],
-            title: 'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*',
+            title:
+              'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*,logs-*',
           },
         },
         result.current[1],
@@ -449,6 +452,7 @@ describe('useFetchIndexPatterns', () => {
             'filebeat-*',
             'packetbeat-*',
             'winlogbeat-*',
+            'logs-*',
           ],
           indicesExists: false,
           isLoading: false,
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
index 07cbd6dfe0370..0c96d0320d198 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
@@ -371,6 +371,7 @@ exports[`DragDropContextWrapper rendering it renders against the snapshot 1`] =
               "filebeat-*",
               "packetbeat-*",
               "winlogbeat-*",
+              "logs-*",
             ],
             "name": "event.end",
             "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap
index 33ed6a8c87b5f..408a4c74e930f 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap
@@ -379,6 +379,7 @@ exports[`EventDetails rendering should match snapshot 1`] = `
                       "filebeat-*",
                       "packetbeat-*",
                       "winlogbeat-*",
+                      "logs-*",
                     ],
                     "name": "event.end",
                     "searchable": true,
@@ -1071,6 +1072,7 @@ In other use cases the message field can be used to concatenate different values
                         "filebeat-*",
                         "packetbeat-*",
                         "winlogbeat-*",
+                        "logs-*",
                       ],
                       "name": "event.end",
                       "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
index 69e4ac615ebf2..b9daba9a40941 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
@@ -28,7 +28,8 @@ describe('Index Fields & Browser Fields', () => {
       errorMessage: null,
       indexPattern: {
         fields: [],
-        title: 'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*',
+        title:
+          'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*,logs-*',
       },
       indicesExist: true,
       loading: true,
@@ -57,7 +58,8 @@ describe('Index Fields & Browser Fields', () => {
         browserFields: mockBrowserFields,
         indexPattern: {
           fields: mockIndexFields,
-          title: 'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*',
+          title:
+            'apm-*-transaction*,auditbeat-*,endgame-*,filebeat-*,packetbeat-*,winlogbeat-*,logs-*',
         },
         loading: false,
         errorMessage: null,
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
index 2b21385004a73..bb9fd73d2df8e 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_host/index.test.tsx
@@ -60,6 +60,7 @@ const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
           'filebeat-*',
           'packetbeat-*',
           'winlogbeat-*',
+          'logs-*',
         ],
         inspect: false,
       },
diff --git a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
index 42c80b6b115bd..0f6fce1486ee7 100644
--- a/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/overview_network/index.test.tsx
@@ -75,6 +75,7 @@ const mockOpenTimelineQueryResults: MockedProvidedQuery[] = [
           'filebeat-*',
           'packetbeat-*',
           'winlogbeat-*',
+          'logs-*',
         ],
         inspect: false,
       },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
index 012cfd66317de..7baefaa6ab951 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/__snapshots__/timeline.test.tsx.snap
@@ -476,6 +476,7 @@ exports[`Timeline rendering renders correctly against snapshot 1`] = `
                           "filebeat-*",
                           "packetbeat-*",
                           "winlogbeat-*",
+                          "logs-*",
                         ],
                         "name": "event.end",
                         "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index 9508e3f18a348..efd99e781d827 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -384,6 +384,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
                         "filebeat-*",
                         "packetbeat-*",
                         "winlogbeat-*",
+                        "logs-*",
                       ],
                       "name": "event.end",
                       "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
index 93b3046b57ed6..cba4b9aa72a25 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
@@ -373,6 +373,7 @@ exports[`suricata_row_renderer renders correctly against snapshot 1`] = `
                   "filebeat-*",
                   "packetbeat-*",
                   "winlogbeat-*",
+                  "logs-*",
                 ],
                 "name": "event.end",
                 "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
index 0a60c8facff9c..e1000637147a8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
@@ -371,6 +371,7 @@ exports[`ZeekDetails rendering it renders the default ZeekDetails 1`] = `
               "filebeat-*",
               "packetbeat-*",
               "winlogbeat-*",
+              "logs-*",
             ],
             "name": "event.end",
             "searchable": true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
index 460ad35b47678..d4c80441e6037 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
@@ -373,6 +373,7 @@ exports[`zeek_row_renderer renders correctly against snapshot 1`] = `
                   "filebeat-*",
                   "packetbeat-*",
                   "winlogbeat-*",
+                  "logs-*",
                 ],
                 "name": "event.end",
                 "searchable": true,