diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap
deleted file mode 100644
index e9b11d9bcdf71..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/event_details.test.tsx.snap
+++ /dev/null
@@ -1,1332 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`EventDetails rendering should match snapshot 1`] = `
-<Styled(EuiTabbedContent)
-  data-test-subj="eventDetails"
-  onTabClick={[Function]}
-  selectedTab={
-    Object {
-      "content": <React.Fragment>
-        <EuiSpacer
-          size="l"
-        />
-        <Memo(EventFieldsBrowser)
-          browserFields={
-            Object {
-              "agent": Object {
-                "fields": Object {
-                  "agent.ephemeral_id": Object {
-                    "aggregatable": true,
-                    "category": "agent",
-                    "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
-                    "example": "8a4f500f",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "agent.ephemeral_id",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "agent.hostname": Object {
-                    "aggregatable": true,
-                    "category": "agent",
-                    "description": null,
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "agent.hostname",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "agent.id": Object {
-                    "aggregatable": true,
-                    "category": "agent",
-                    "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
-                    "example": "8a4f500d",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "agent.id",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "agent.name": Object {
-                    "aggregatable": true,
-                    "category": "agent",
-                    "description": "Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
-                    "example": "foo",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "agent.name",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                },
-              },
-              "auditd": Object {
-                "fields": Object {
-                  "auditd.data.a0": Object {
-                    "aggregatable": true,
-                    "category": "auditd",
-                    "description": null,
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                    ],
-                    "name": "auditd.data.a0",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "auditd.data.a1": Object {
-                    "aggregatable": true,
-                    "category": "auditd",
-                    "description": null,
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                    ],
-                    "name": "auditd.data.a1",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "auditd.data.a2": Object {
-                    "aggregatable": true,
-                    "category": "auditd",
-                    "description": null,
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                    ],
-                    "name": "auditd.data.a2",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                },
-              },
-              "base": Object {
-                "fields": Object {
-                  "@timestamp": Object {
-                    "aggregatable": true,
-                    "category": "base",
-                    "description": "Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.",
-                    "example": "2016-05-23T08:05:34.853Z",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "@timestamp",
-                    "searchable": true,
-                    "type": "date",
-                  },
-                },
-              },
-              "client": Object {
-                "fields": Object {
-                  "client.address": Object {
-                    "aggregatable": true,
-                    "category": "client",
-                    "description": "Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "client.address",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "client.bytes": Object {
-                    "aggregatable": true,
-                    "category": "client",
-                    "description": "Bytes sent from the client to the server.",
-                    "example": "184",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "client.bytes",
-                    "searchable": true,
-                    "type": "number",
-                  },
-                  "client.domain": Object {
-                    "aggregatable": true,
-                    "category": "client",
-                    "description": "Client domain.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "client.domain",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "client.geo.country_iso_code": Object {
-                    "aggregatable": true,
-                    "category": "client",
-                    "description": "Country ISO code.",
-                    "example": "CA",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "client.geo.country_iso_code",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                },
-              },
-              "cloud": Object {
-                "fields": Object {
-                  "cloud.account.id": Object {
-                    "aggregatable": true,
-                    "category": "cloud",
-                    "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                    "example": "666777888999",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "cloud.account.id",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "cloud.availability_zone": Object {
-                    "aggregatable": true,
-                    "category": "cloud",
-                    "description": "Availability zone in which this host is running.",
-                    "example": "us-east-1c",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "cloud.availability_zone",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                },
-              },
-              "container": Object {
-                "fields": Object {
-                  "container.id": Object {
-                    "aggregatable": true,
-                    "category": "container",
-                    "description": "Unique container id.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "container.id",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "container.image.name": Object {
-                    "aggregatable": true,
-                    "category": "container",
-                    "description": "Name of the image the container was built on.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "container.image.name",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "container.image.tag": Object {
-                    "aggregatable": true,
-                    "category": "container",
-                    "description": "Container image tag.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "container.image.tag",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                },
-              },
-              "destination": Object {
-                "fields": Object {
-                  "destination.address": Object {
-                    "aggregatable": true,
-                    "category": "destination",
-                    "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "destination.address",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "destination.bytes": Object {
-                    "aggregatable": true,
-                    "category": "destination",
-                    "description": "Bytes sent from the destination to the source.",
-                    "example": "184",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "destination.bytes",
-                    "searchable": true,
-                    "type": "number",
-                  },
-                  "destination.domain": Object {
-                    "aggregatable": true,
-                    "category": "destination",
-                    "description": "Destination domain.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "destination.domain",
-                    "searchable": true,
-                    "type": "string",
-                  },
-                  "destination.ip": Object {
-                    "aggregatable": true,
-                    "category": "destination",
-                    "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
-                    "example": "",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "destination.ip",
-                    "searchable": true,
-                    "type": "ip",
-                  },
-                  "destination.port": Object {
-                    "aggregatable": true,
-                    "category": "destination",
-                    "description": "Port of the destination.",
-                    "example": "",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "destination.port",
-                    "searchable": true,
-                    "type": "long",
-                  },
-                },
-              },
-              "event": Object {
-                "fields": Object {
-                  "event.end": Object {
-                    "aggregatable": true,
-                    "category": "event",
-                    "description": "event.end contains the date when the event ended or when the activity was last observed.",
-                    "example": null,
-                    "format": "",
-                    "indexes": Array [
-                      "apm-*-transaction*",
-                      "auditbeat-*",
-                      "endgame-*",
-                      "filebeat-*",
-                      "logs-*",
-                      "packetbeat-*",
-                      "winlogbeat-*",
-                    ],
-                    "name": "event.end",
-                    "searchable": true,
-                    "type": "date",
-                  },
-                },
-              },
-              "source": Object {
-                "fields": Object {
-                  "source.ip": Object {
-                    "aggregatable": true,
-                    "category": "source",
-                    "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
-                    "example": "",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "source.ip",
-                    "searchable": true,
-                    "type": "ip",
-                  },
-                  "source.port": Object {
-                    "aggregatable": true,
-                    "category": "source",
-                    "description": "Port of the source.",
-                    "example": "",
-                    "format": "",
-                    "indexes": Array [
-                      "auditbeat",
-                      "filebeat",
-                      "packetbeat",
-                    ],
-                    "name": "source.port",
-                    "searchable": true,
-                    "type": "long",
-                  },
-                },
-              },
-            }
-          }
-          data={
-            Array [
-              Object {
-                "field": "_id",
-                "originalValue": "pEMaMmkBUV60JmNWmWVi",
-                "values": Array [
-                  "pEMaMmkBUV60JmNWmWVi",
-                ],
-              },
-              Object {
-                "field": "_index",
-                "originalValue": "filebeat-8.0.0-2019.02.19-000001",
-                "values": Array [
-                  "filebeat-8.0.0-2019.02.19-000001",
-                ],
-              },
-              Object {
-                "field": "_type",
-                "originalValue": "_doc",
-                "values": Array [
-                  "_doc",
-                ],
-              },
-              Object {
-                "field": "_score",
-                "originalValue": 1,
-                "values": Array [
-                  "1",
-                ],
-              },
-              Object {
-                "field": "@timestamp",
-                "originalValue": "2019-02-28T16:50:54.621Z",
-                "values": Array [
-                  "2019-02-28T16:50:54.621Z",
-                ],
-              },
-              Object {
-                "field": "agent.ephemeral_id",
-                "originalValue": "9d391ef2-a734-4787-8891-67031178c641",
-                "values": Array [
-                  "9d391ef2-a734-4787-8891-67031178c641",
-                ],
-              },
-              Object {
-                "field": "agent.hostname",
-                "originalValue": "siem-kibana",
-                "values": Array [
-                  "siem-kibana",
-                ],
-              },
-              Object {
-                "field": "agent.id",
-                "originalValue": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                "values": Array [
-                  "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                ],
-              },
-              Object {
-                "field": "agent.type",
-                "originalValue": "filebeat",
-                "values": Array [
-                  "filebeat",
-                ],
-              },
-              Object {
-                "field": "agent.version",
-                "originalValue": "8.0.0",
-                "values": Array [
-                  "8.0.0",
-                ],
-              },
-              Object {
-                "field": "cloud.availability_zone",
-                "originalValue": "projects/189716325846/zones/us-east1-b",
-                "values": Array [
-                  "projects/189716325846/zones/us-east1-b",
-                ],
-              },
-              Object {
-                "field": "cloud.instance.id",
-                "originalValue": "5412578377715150143",
-                "values": Array [
-                  "5412578377715150143",
-                ],
-              },
-              Object {
-                "field": "cloud.instance.name",
-                "originalValue": "siem-kibana",
-                "values": Array [
-                  "siem-kibana",
-                ],
-              },
-              Object {
-                "field": "cloud.machine.type",
-                "originalValue": "projects/189716325846/machineTypes/n1-standard-1",
-                "values": Array [
-                  "projects/189716325846/machineTypes/n1-standard-1",
-                ],
-              },
-              Object {
-                "field": "cloud.project.id",
-                "originalValue": "elastic-beats",
-                "values": Array [
-                  "elastic-beats",
-                ],
-              },
-              Object {
-                "field": "cloud.provider",
-                "originalValue": "gce",
-                "values": Array [
-                  "gce",
-                ],
-              },
-              Object {
-                "field": "destination.bytes",
-                "originalValue": 584,
-                "values": Array [
-                  "584",
-                ],
-              },
-              Object {
-                "field": "destination.ip",
-                "originalValue": "10.47.8.200",
-                "values": Array [
-                  "10.47.8.200",
-                ],
-              },
-              Object {
-                "field": "destination.packets",
-                "originalValue": 4,
-                "values": Array [
-                  "4",
-                ],
-              },
-              Object {
-                "field": "destination.port",
-                "originalValue": 902,
-                "values": Array [
-                  "902",
-                ],
-              },
-              Object {
-                "field": "event.kind",
-                "originalValue": "event",
-                "values": Array [
-                  "event",
-                ],
-              },
-            ]
-          }
-          eventId="Y-6TfmcB0WOhS6qyMv3s"
-          timelineId="test"
-          timelineTabType="query"
-        />
-      </React.Fragment>,
-      "id": "table-view",
-      "name": "Table",
-    }
-  }
-  tabs={
-    Array [
-      Object {
-        "content": <React.Fragment>
-          <EuiSpacer
-            size="l"
-          />
-          <Memo(EventFieldsBrowser)
-            browserFields={
-              Object {
-                "agent": Object {
-                  "fields": Object {
-                    "agent.ephemeral_id": Object {
-                      "aggregatable": true,
-                      "category": "agent",
-                      "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
-                      "example": "8a4f500f",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "agent.ephemeral_id",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "agent.hostname": Object {
-                      "aggregatable": true,
-                      "category": "agent",
-                      "description": null,
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "agent.hostname",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "agent.id": Object {
-                      "aggregatable": true,
-                      "category": "agent",
-                      "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
-                      "example": "8a4f500d",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "agent.id",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "agent.name": Object {
-                      "aggregatable": true,
-                      "category": "agent",
-                      "description": "Name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
-                      "example": "foo",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "agent.name",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                  },
-                },
-                "auditd": Object {
-                  "fields": Object {
-                    "auditd.data.a0": Object {
-                      "aggregatable": true,
-                      "category": "auditd",
-                      "description": null,
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                      ],
-                      "name": "auditd.data.a0",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "auditd.data.a1": Object {
-                      "aggregatable": true,
-                      "category": "auditd",
-                      "description": null,
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                      ],
-                      "name": "auditd.data.a1",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "auditd.data.a2": Object {
-                      "aggregatable": true,
-                      "category": "auditd",
-                      "description": null,
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                      ],
-                      "name": "auditd.data.a2",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                  },
-                },
-                "base": Object {
-                  "fields": Object {
-                    "@timestamp": Object {
-                      "aggregatable": true,
-                      "category": "base",
-                      "description": "Date/time when the event originated. For log events this is the date/time when the event was generated, and not when it was read. Required field for all events.",
-                      "example": "2016-05-23T08:05:34.853Z",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "@timestamp",
-                      "searchable": true,
-                      "type": "date",
-                    },
-                  },
-                },
-                "client": Object {
-                  "fields": Object {
-                    "client.address": Object {
-                      "aggregatable": true,
-                      "category": "client",
-                      "description": "Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "client.address",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "client.bytes": Object {
-                      "aggregatable": true,
-                      "category": "client",
-                      "description": "Bytes sent from the client to the server.",
-                      "example": "184",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "client.bytes",
-                      "searchable": true,
-                      "type": "number",
-                    },
-                    "client.domain": Object {
-                      "aggregatable": true,
-                      "category": "client",
-                      "description": "Client domain.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "client.domain",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "client.geo.country_iso_code": Object {
-                      "aggregatable": true,
-                      "category": "client",
-                      "description": "Country ISO code.",
-                      "example": "CA",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "client.geo.country_iso_code",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                  },
-                },
-                "cloud": Object {
-                  "fields": Object {
-                    "cloud.account.id": Object {
-                      "aggregatable": true,
-                      "category": "cloud",
-                      "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                      "example": "666777888999",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "cloud.account.id",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "cloud.availability_zone": Object {
-                      "aggregatable": true,
-                      "category": "cloud",
-                      "description": "Availability zone in which this host is running.",
-                      "example": "us-east-1c",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "cloud.availability_zone",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                  },
-                },
-                "container": Object {
-                  "fields": Object {
-                    "container.id": Object {
-                      "aggregatable": true,
-                      "category": "container",
-                      "description": "Unique container id.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "container.id",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "container.image.name": Object {
-                      "aggregatable": true,
-                      "category": "container",
-                      "description": "Name of the image the container was built on.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "container.image.name",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "container.image.tag": Object {
-                      "aggregatable": true,
-                      "category": "container",
-                      "description": "Container image tag.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "container.image.tag",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                  },
-                },
-                "destination": Object {
-                  "fields": Object {
-                    "destination.address": Object {
-                      "aggregatable": true,
-                      "category": "destination",
-                      "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the \`.address\` field. Then it should be duplicated to \`.ip\` or \`.domain\`, depending on which one it is.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "destination.address",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "destination.bytes": Object {
-                      "aggregatable": true,
-                      "category": "destination",
-                      "description": "Bytes sent from the destination to the source.",
-                      "example": "184",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "destination.bytes",
-                      "searchable": true,
-                      "type": "number",
-                    },
-                    "destination.domain": Object {
-                      "aggregatable": true,
-                      "category": "destination",
-                      "description": "Destination domain.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "destination.domain",
-                      "searchable": true,
-                      "type": "string",
-                    },
-                    "destination.ip": Object {
-                      "aggregatable": true,
-                      "category": "destination",
-                      "description": "IP address of the destination. Can be one or multiple IPv4 or IPv6 addresses.",
-                      "example": "",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "destination.ip",
-                      "searchable": true,
-                      "type": "ip",
-                    },
-                    "destination.port": Object {
-                      "aggregatable": true,
-                      "category": "destination",
-                      "description": "Port of the destination.",
-                      "example": "",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "destination.port",
-                      "searchable": true,
-                      "type": "long",
-                    },
-                  },
-                },
-                "event": Object {
-                  "fields": Object {
-                    "event.end": Object {
-                      "aggregatable": true,
-                      "category": "event",
-                      "description": "event.end contains the date when the event ended or when the activity was last observed.",
-                      "example": null,
-                      "format": "",
-                      "indexes": Array [
-                        "apm-*-transaction*",
-                        "auditbeat-*",
-                        "endgame-*",
-                        "filebeat-*",
-                        "logs-*",
-                        "packetbeat-*",
-                        "winlogbeat-*",
-                      ],
-                      "name": "event.end",
-                      "searchable": true,
-                      "type": "date",
-                    },
-                  },
-                },
-                "source": Object {
-                  "fields": Object {
-                    "source.ip": Object {
-                      "aggregatable": true,
-                      "category": "source",
-                      "description": "IP address of the source. Can be one or multiple IPv4 or IPv6 addresses.",
-                      "example": "",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "source.ip",
-                      "searchable": true,
-                      "type": "ip",
-                    },
-                    "source.port": Object {
-                      "aggregatable": true,
-                      "category": "source",
-                      "description": "Port of the source.",
-                      "example": "",
-                      "format": "",
-                      "indexes": Array [
-                        "auditbeat",
-                        "filebeat",
-                        "packetbeat",
-                      ],
-                      "name": "source.port",
-                      "searchable": true,
-                      "type": "long",
-                    },
-                  },
-                },
-              }
-            }
-            data={
-              Array [
-                Object {
-                  "field": "_id",
-                  "originalValue": "pEMaMmkBUV60JmNWmWVi",
-                  "values": Array [
-                    "pEMaMmkBUV60JmNWmWVi",
-                  ],
-                },
-                Object {
-                  "field": "_index",
-                  "originalValue": "filebeat-8.0.0-2019.02.19-000001",
-                  "values": Array [
-                    "filebeat-8.0.0-2019.02.19-000001",
-                  ],
-                },
-                Object {
-                  "field": "_type",
-                  "originalValue": "_doc",
-                  "values": Array [
-                    "_doc",
-                  ],
-                },
-                Object {
-                  "field": "_score",
-                  "originalValue": 1,
-                  "values": Array [
-                    "1",
-                  ],
-                },
-                Object {
-                  "field": "@timestamp",
-                  "originalValue": "2019-02-28T16:50:54.621Z",
-                  "values": Array [
-                    "2019-02-28T16:50:54.621Z",
-                  ],
-                },
-                Object {
-                  "field": "agent.ephemeral_id",
-                  "originalValue": "9d391ef2-a734-4787-8891-67031178c641",
-                  "values": Array [
-                    "9d391ef2-a734-4787-8891-67031178c641",
-                  ],
-                },
-                Object {
-                  "field": "agent.hostname",
-                  "originalValue": "siem-kibana",
-                  "values": Array [
-                    "siem-kibana",
-                  ],
-                },
-                Object {
-                  "field": "agent.id",
-                  "originalValue": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                  "values": Array [
-                    "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                  ],
-                },
-                Object {
-                  "field": "agent.type",
-                  "originalValue": "filebeat",
-                  "values": Array [
-                    "filebeat",
-                  ],
-                },
-                Object {
-                  "field": "agent.version",
-                  "originalValue": "8.0.0",
-                  "values": Array [
-                    "8.0.0",
-                  ],
-                },
-                Object {
-                  "field": "cloud.availability_zone",
-                  "originalValue": "projects/189716325846/zones/us-east1-b",
-                  "values": Array [
-                    "projects/189716325846/zones/us-east1-b",
-                  ],
-                },
-                Object {
-                  "field": "cloud.instance.id",
-                  "originalValue": "5412578377715150143",
-                  "values": Array [
-                    "5412578377715150143",
-                  ],
-                },
-                Object {
-                  "field": "cloud.instance.name",
-                  "originalValue": "siem-kibana",
-                  "values": Array [
-                    "siem-kibana",
-                  ],
-                },
-                Object {
-                  "field": "cloud.machine.type",
-                  "originalValue": "projects/189716325846/machineTypes/n1-standard-1",
-                  "values": Array [
-                    "projects/189716325846/machineTypes/n1-standard-1",
-                  ],
-                },
-                Object {
-                  "field": "cloud.project.id",
-                  "originalValue": "elastic-beats",
-                  "values": Array [
-                    "elastic-beats",
-                  ],
-                },
-                Object {
-                  "field": "cloud.provider",
-                  "originalValue": "gce",
-                  "values": Array [
-                    "gce",
-                  ],
-                },
-                Object {
-                  "field": "destination.bytes",
-                  "originalValue": 584,
-                  "values": Array [
-                    "584",
-                  ],
-                },
-                Object {
-                  "field": "destination.ip",
-                  "originalValue": "10.47.8.200",
-                  "values": Array [
-                    "10.47.8.200",
-                  ],
-                },
-                Object {
-                  "field": "destination.packets",
-                  "originalValue": 4,
-                  "values": Array [
-                    "4",
-                  ],
-                },
-                Object {
-                  "field": "destination.port",
-                  "originalValue": 902,
-                  "values": Array [
-                    "902",
-                  ],
-                },
-                Object {
-                  "field": "event.kind",
-                  "originalValue": "event",
-                  "values": Array [
-                    "event",
-                  ],
-                },
-              ]
-            }
-            eventId="Y-6TfmcB0WOhS6qyMv3s"
-            timelineId="test"
-            timelineTabType="query"
-          />
-        </React.Fragment>,
-        "id": "table-view",
-        "name": "Table",
-      },
-      Object {
-        "content": <React.Fragment>
-          <EuiSpacer
-            size="m"
-          />
-          <Memo(JsonView)
-            data={
-              Array [
-                Object {
-                  "field": "_id",
-                  "originalValue": "pEMaMmkBUV60JmNWmWVi",
-                  "values": Array [
-                    "pEMaMmkBUV60JmNWmWVi",
-                  ],
-                },
-                Object {
-                  "field": "_index",
-                  "originalValue": "filebeat-8.0.0-2019.02.19-000001",
-                  "values": Array [
-                    "filebeat-8.0.0-2019.02.19-000001",
-                  ],
-                },
-                Object {
-                  "field": "_type",
-                  "originalValue": "_doc",
-                  "values": Array [
-                    "_doc",
-                  ],
-                },
-                Object {
-                  "field": "_score",
-                  "originalValue": 1,
-                  "values": Array [
-                    "1",
-                  ],
-                },
-                Object {
-                  "field": "@timestamp",
-                  "originalValue": "2019-02-28T16:50:54.621Z",
-                  "values": Array [
-                    "2019-02-28T16:50:54.621Z",
-                  ],
-                },
-                Object {
-                  "field": "agent.ephemeral_id",
-                  "originalValue": "9d391ef2-a734-4787-8891-67031178c641",
-                  "values": Array [
-                    "9d391ef2-a734-4787-8891-67031178c641",
-                  ],
-                },
-                Object {
-                  "field": "agent.hostname",
-                  "originalValue": "siem-kibana",
-                  "values": Array [
-                    "siem-kibana",
-                  ],
-                },
-                Object {
-                  "field": "agent.id",
-                  "originalValue": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                  "values": Array [
-                    "5de03d5f-52f3-482e-91d4-853c7de073c3",
-                  ],
-                },
-                Object {
-                  "field": "agent.type",
-                  "originalValue": "filebeat",
-                  "values": Array [
-                    "filebeat",
-                  ],
-                },
-                Object {
-                  "field": "agent.version",
-                  "originalValue": "8.0.0",
-                  "values": Array [
-                    "8.0.0",
-                  ],
-                },
-                Object {
-                  "field": "cloud.availability_zone",
-                  "originalValue": "projects/189716325846/zones/us-east1-b",
-                  "values": Array [
-                    "projects/189716325846/zones/us-east1-b",
-                  ],
-                },
-                Object {
-                  "field": "cloud.instance.id",
-                  "originalValue": "5412578377715150143",
-                  "values": Array [
-                    "5412578377715150143",
-                  ],
-                },
-                Object {
-                  "field": "cloud.instance.name",
-                  "originalValue": "siem-kibana",
-                  "values": Array [
-                    "siem-kibana",
-                  ],
-                },
-                Object {
-                  "field": "cloud.machine.type",
-                  "originalValue": "projects/189716325846/machineTypes/n1-standard-1",
-                  "values": Array [
-                    "projects/189716325846/machineTypes/n1-standard-1",
-                  ],
-                },
-                Object {
-                  "field": "cloud.project.id",
-                  "originalValue": "elastic-beats",
-                  "values": Array [
-                    "elastic-beats",
-                  ],
-                },
-                Object {
-                  "field": "cloud.provider",
-                  "originalValue": "gce",
-                  "values": Array [
-                    "gce",
-                  ],
-                },
-                Object {
-                  "field": "destination.bytes",
-                  "originalValue": 584,
-                  "values": Array [
-                    "584",
-                  ],
-                },
-                Object {
-                  "field": "destination.ip",
-                  "originalValue": "10.47.8.200",
-                  "values": Array [
-                    "10.47.8.200",
-                  ],
-                },
-                Object {
-                  "field": "destination.packets",
-                  "originalValue": 4,
-                  "values": Array [
-                    "4",
-                  ],
-                },
-                Object {
-                  "field": "destination.port",
-                  "originalValue": 902,
-                  "values": Array [
-                    "902",
-                  ],
-                },
-                Object {
-                  "field": "event.kind",
-                  "originalValue": "event",
-                  "values": Array [
-                    "event",
-                  ],
-                },
-              ]
-            }
-          />
-        </React.Fragment>,
-        "id": "json-view",
-        "name": "JSON View",
-      },
-    ]
-  }
-/>
-`;
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index 9ab286b120dd3..4bd3ae126e9dc 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -5,7 +5,7 @@
  */
 
 import { waitFor } from '@testing-library/dom';
-import { ReactWrapper, shallow } from 'enzyme';
+import { ReactWrapper } from 'enzyme';
 import React from 'react';
 
 import '../../mock/match_media';
@@ -54,12 +54,6 @@ describe('EventDetails', () => {
     ) as ReactWrapper;
     await waitFor(() => wrapper.update());
   });
-  describe('rendering', () => {
-    test('should match snapshot', () => {
-      const shallowWrap = shallow(<EventDetails {...defaultProps} />);
-      expect(shallowWrap).toMatchSnapshot();
-    });
-  });
 
   describe('tabs', () => {
     ['Table', 'JSON View'].forEach((tab) => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index 123a3fa7b610b..0a8046e461d20 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -48,6 +48,11 @@ const StyledEuiTabbedContent = styled(EuiTabbedContent)`
   }
 `;
 
+const TabContentWrapper = styled.div`
+  height: 100%;
+  position: relative;
+`;
+
 const EventDetailsComponent: React.FC<Props> = ({
   browserFields,
   data,
@@ -105,7 +110,9 @@ const EventDetailsComponent: React.FC<Props> = ({
         content: (
           <>
             <EuiSpacer size="m" />
-            <JsonView data={data} />
+            <TabContentWrapper>
+              <JsonView data={data} />
+            </TabContentWrapper>
           </>
         ),
       },
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/event_details_flyout.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/event_details_flyout.tsx
index 9c09f2e696104..72ec918fd0577 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/event_details_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/event_details_flyout.tsx
@@ -25,6 +25,20 @@ const StyledEuiFlyout = styled(EuiFlyout)`
   z-index: ${({ theme }) => theme.eui.euiZLevel7};
 `;
 
+const StyledEuiFlyoutBody = styled(EuiFlyoutBody)`
+  .euiFlyoutBody__overflow {
+    display: flex;
+    flex: 1;
+    overflow: hidden;
+
+    .euiFlyoutBody__overflowContent {
+      flex: 1;
+      overflow: hidden;
+      padding: ${({ theme }) => `${theme.eui.paddingSizes.xs} ${theme.eui.paddingSizes.m} 64px`};
+    }
+  }
+`;
+
 interface EventDetailsFlyoutProps {
   browserFields: BrowserFields;
   docValueFields: DocValueFields[];
@@ -67,7 +81,7 @@ const EventDetailsFlyoutComponent: React.FC<EventDetailsFlyoutProps> = ({
       <EuiFlyoutHeader hasBorder>
         <ExpandableEventTitle isAlert={isAlert} loading={loading} />
       </EuiFlyoutHeader>
-      <EuiFlyoutBody>
+      <StyledEuiFlyoutBody>
         <ExpandableEvent
           browserFields={browserFields}
           detailsData={detailsData}
@@ -77,7 +91,7 @@ const EventDetailsFlyoutComponent: React.FC<EventDetailsFlyoutProps> = ({
           timelineId={timelineId}
           timelineTabType="flyout"
         />
-      </EuiFlyoutBody>
+      </StyledEuiFlyoutBody>
     </StyledEuiFlyout>
   );
 };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
index a38fde0e3f548..27d28aa525d56 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/expandable_event/index.tsx
@@ -38,6 +38,7 @@ interface Props {
   event: TimelineExpandedEventType;
   isAlert: boolean;
   loading: boolean;
+  messageHeight?: number;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
 }
@@ -52,6 +53,14 @@ const StyledEuiFlexGroup = styled(EuiFlexGroup)`
   flex: 0;
 `;
 
+const StyledFlexGroup = styled(EuiFlexGroup)`
+  height: 100%;
+`;
+
+const StyledEuiFlexItem = styled(EuiFlexItem)`
+  overflow: hidden;
+`;
+
 export const ExpandableEventTitle = React.memo<ExpandableEventTitleProps>(
   ({ isAlert, loading, handleOnEventClosed }) => (
     <StyledEuiFlexGroup justifyContent="spaceBetween" wrap={true}>
@@ -99,9 +108,9 @@ export const ExpandableEvent = React.memo<Props>(
     }
 
     return (
-      <>
+      <StyledFlexGroup direction="column" gutterSize="none">
         {message && (
-          <>
+          <EuiFlexItem grow={false}>
             <EuiDescriptionList data-test-subj="event-message" compressed>
               <EuiDescriptionListTitle>{i18n.MESSAGE}</EuiDescriptionListTitle>
               <EuiDescriptionListDescription>
@@ -109,19 +118,21 @@ export const ExpandableEvent = React.memo<Props>(
               </EuiDescriptionListDescription>
             </EuiDescriptionList>
             <EuiSpacer size="m" />
-          </>
+          </EuiFlexItem>
         )}
-        <EventDetails
-          browserFields={browserFields}
-          data={detailsData!}
-          id={event.eventId!}
-          isAlert={isAlert}
-          onViewSelected={setView}
-          timelineTabType={timelineTabType}
-          timelineId={timelineId}
-          view={view}
-        />
-      </>
+        <StyledEuiFlexItem grow={true}>
+          <EventDetails
+            browserFields={browserFields}
+            data={detailsData!}
+            id={event.eventId!}
+            isAlert={isAlert}
+            onViewSelected={setView}
+            timelineTabType={timelineTabType}
+            timelineId={timelineId}
+            view={view}
+          />
+        </StyledEuiFlexItem>
+      </StyledFlexGroup>
     );
   }
 );