diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_histogram.test.ts.snap b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_histogram.test.ts.snap
index 158bdf6cdff751..dabf33958fbb37 100644
--- a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_histogram.test.ts.snap
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_histogram.test.ts.snap
@@ -109,7 +109,7 @@ Object {
           "key": "_index",
           "negate": false,
           "params": Array [
-            "auditbeat-mytest-*",
+            "signal-index",
           ],
           "type": "phrases",
         },
@@ -119,7 +119,7 @@ Object {
             "should": Array [
               Object {
                 "match_phrase": Object {
-                  "_index": "auditbeat-mytest-*",
+                  "_index": "signal-index",
                 },
               },
             ],
@@ -268,7 +268,7 @@ Object {
           "key": "_index",
           "negate": false,
           "params": Array [
-            "auditbeat-mytest-*",
+            "signal-index",
           ],
           "type": "phrases",
         },
@@ -278,7 +278,7 @@ Object {
             "should": Array [
               Object {
                 "match_phrase": Object {
-                  "_index": "auditbeat-mytest-*",
+                  "_index": "signal-index",
                 },
               },
             ],
@@ -459,7 +459,7 @@ Object {
           "key": "_index",
           "negate": false,
           "params": Array [
-            "auditbeat-mytest-*",
+            "signal-index",
           ],
           "type": "phrases",
         },
@@ -469,7 +469,7 @@ Object {
             "should": Array [
               Object {
                 "match_phrase": Object {
-                  "_index": "auditbeat-mytest-*",
+                  "_index": "signal-index",
                 },
               },
             ],
@@ -650,7 +650,7 @@ Object {
           "key": "_index",
           "negate": false,
           "params": Array [
-            "auditbeat-mytest-*",
+            "signal-index",
           ],
           "type": "phrases",
         },
@@ -660,7 +660,7 @@ Object {
             "should": Array [
               Object {
                 "match_phrase": Object {
-                  "_index": "auditbeat-mytest-*",
+                  "_index": "signal-index",
                 },
               },
             ],
@@ -824,7 +824,7 @@ Object {
           "key": "_index",
           "negate": false,
           "params": Array [
-            "auditbeat-mytest-*",
+            "signal-index",
           ],
           "type": "phrases",
         },
@@ -834,7 +834,7 @@ Object {
             "should": Array [
               Object {
                 "match_phrase": Object {
-                  "_index": "auditbeat-mytest-*",
+                  "_index": "signal-index",
                 },
               },
             ],
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_table.test.ts.snap b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_table.test.ts.snap
new file mode 100644
index 00000000000000..5196780c11dcf0
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_table.test.ts.snap
@@ -0,0 +1,945 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`getAlertsTableLensAttributes should render with extra options - breakdownField 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of agent.type",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "agent.type",
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Count of agent.type",
+                "operationType": "count",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "agent.type",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "columns": Array [
+        Object {
+          "columnId": "2881fedd-54b7-42ba-8c97-5175dec86166",
+          "isTransposed": false,
+          "width": 362,
+        },
+        Object {
+          "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+          "isTransposed": false,
+        },
+        Object {
+          "columnId": "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          "isTransposed": false,
+        },
+      ],
+      "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "layerType": "data",
+      "paging": Object {
+        "enabled": true,
+        "size": 10,
+      },
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsDatatable",
+}
+`;
+
+exports[`getAlertsTableLensAttributes should render with extra options - showBuildingBlockAlerts 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Count of undefined",
+                "operationType": "count",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": undefined,
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "columns": Array [
+        Object {
+          "columnId": "2881fedd-54b7-42ba-8c97-5175dec86166",
+          "isTransposed": false,
+          "width": 362,
+        },
+        Object {
+          "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+          "isTransposed": false,
+        },
+        Object {
+          "columnId": "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          "isTransposed": false,
+        },
+      ],
+      "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "layerType": "data",
+      "paging": Object {
+        "enabled": true,
+        "size": 10,
+      },
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsDatatable",
+}
+`;
+
+exports[`getAlertsTableLensAttributes should render with extra options - showOnlyThreatIndicatorAlerts 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Count of undefined",
+                "operationType": "count",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": undefined,
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "kibana.alert.rule.type",
+          "negate": false,
+          "params": Object {
+            "query": "threat_match",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "kibana.alert.rule.type": "threat_match",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "columns": Array [
+        Object {
+          "columnId": "2881fedd-54b7-42ba-8c97-5175dec86166",
+          "isTransposed": false,
+          "width": 362,
+        },
+        Object {
+          "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+          "isTransposed": false,
+        },
+        Object {
+          "columnId": "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          "isTransposed": false,
+        },
+      ],
+      "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "layerType": "data",
+      "paging": Object {
+        "enabled": true,
+        "size": 10,
+      },
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsDatatable",
+}
+`;
+
+exports[`getAlertsTableLensAttributes should render with extra options - status 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Count of undefined",
+                "operationType": "count",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": undefined,
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "kibana.alert.workflow_status",
+          "negate": false,
+          "params": Object {
+            "query": "open",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "kibana.alert.workflow_status": "open",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "columns": Array [
+        Object {
+          "columnId": "2881fedd-54b7-42ba-8c97-5175dec86166",
+          "isTransposed": false,
+          "width": 362,
+        },
+        Object {
+          "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+          "isTransposed": false,
+        },
+        Object {
+          "columnId": "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          "isTransposed": false,
+        },
+      ],
+      "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "layerType": "data",
+      "paging": Object {
+        "enabled": true,
+        "size": 10,
+      },
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsDatatable",
+}
+`;
+
+exports[`getAlertsTableLensAttributes should render without extra options 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Count of undefined",
+                "operationType": "count",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": undefined,
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "columns": Array [
+        Object {
+          "columnId": "2881fedd-54b7-42ba-8c97-5175dec86166",
+          "isTransposed": false,
+          "width": 362,
+        },
+        Object {
+          "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+          "isTransposed": false,
+        },
+        Object {
+          "columnId": "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          "isTransposed": false,
+        },
+      ],
+      "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "layerType": "data",
+      "paging": Object {
+        "enabled": true,
+        "size": 10,
+      },
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsDatatable",
+}
+`;
diff --git a/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_treemap.test.ts.snap b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_treemap.test.ts.snap
new file mode 100644
index 00000000000000..4a440221a9f08c
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/visualization_actions/lens_attributes/common/alerts/__snapshots__/alerts_treemap.test.ts.snap
@@ -0,0 +1,940 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`getAlertsTreemapLensAttributes should render with extra options - breakdownField 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of agent.type",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "agent.type",
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Maximum of kibana.alert.risk_score",
+                "operationType": "max",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "kibana.alert.risk_score",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "layers": Array [
+        Object {
+          "categoryDisplay": "default",
+          "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+          "layerType": "data",
+          "legendDisplay": "show",
+          "legendPosition": "left",
+          "legendSize": "xlarge",
+          "metrics": Array [
+            "f04a71a3-399f-4d32-9efc-8a005e989991",
+          ],
+          "nestedLegend": true,
+          "numberDisplay": "value",
+          "primaryGroups": Array [
+            "2881fedd-54b7-42ba-8c97-5175dec86166",
+            "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          ],
+        },
+      ],
+      "shape": "treemap",
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsPie",
+}
+`;
+
+exports[`getAlertsTreemapLensAttributes should render with extra options - showBuildingBlockAlerts 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Maximum of kibana.alert.risk_score",
+                "operationType": "max",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "kibana.alert.risk_score",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "layers": Array [
+        Object {
+          "categoryDisplay": "default",
+          "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+          "layerType": "data",
+          "legendDisplay": "show",
+          "legendPosition": "left",
+          "legendSize": "xlarge",
+          "metrics": Array [
+            "f04a71a3-399f-4d32-9efc-8a005e989991",
+          ],
+          "nestedLegend": true,
+          "numberDisplay": "value",
+          "primaryGroups": Array [
+            "2881fedd-54b7-42ba-8c97-5175dec86166",
+            "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          ],
+        },
+      ],
+      "shape": "treemap",
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsPie",
+}
+`;
+
+exports[`getAlertsTreemapLensAttributes should render with extra options - showOnlyThreatIndicatorAlerts 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Maximum of kibana.alert.risk_score",
+                "operationType": "max",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "kibana.alert.risk_score",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "kibana.alert.rule.type",
+          "negate": false,
+          "params": Object {
+            "query": "threat_match",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "kibana.alert.rule.type": "threat_match",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "layers": Array [
+        Object {
+          "categoryDisplay": "default",
+          "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+          "layerType": "data",
+          "legendDisplay": "show",
+          "legendPosition": "left",
+          "legendSize": "xlarge",
+          "metrics": Array [
+            "f04a71a3-399f-4d32-9efc-8a005e989991",
+          ],
+          "nestedLegend": true,
+          "numberDisplay": "value",
+          "primaryGroups": Array [
+            "2881fedd-54b7-42ba-8c97-5175dec86166",
+            "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          ],
+        },
+      ],
+      "shape": "treemap",
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsPie",
+}
+`;
+
+exports[`getAlertsTreemapLensAttributes should render with extra options - status 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Maximum of kibana.alert.risk_score",
+                "operationType": "max",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "kibana.alert.risk_score",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "kibana.alert.workflow_status",
+          "negate": false,
+          "params": Object {
+            "query": "open",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "kibana.alert.workflow_status": "open",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "layers": Array [
+        Object {
+          "categoryDisplay": "default",
+          "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+          "layerType": "data",
+          "legendDisplay": "show",
+          "legendPosition": "left",
+          "legendSize": "xlarge",
+          "metrics": Array [
+            "f04a71a3-399f-4d32-9efc-8a005e989991",
+          ],
+          "nestedLegend": true,
+          "numberDisplay": "value",
+          "primaryGroups": Array [
+            "2881fedd-54b7-42ba-8c97-5175dec86166",
+            "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          ],
+        },
+      ],
+      "shape": "treemap",
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsPie",
+}
+`;
+
+exports[`getAlertsTreemapLensAttributes should render without extra options 1`] = `
+Object {
+  "description": "",
+  "references": Array [
+    Object {
+      "id": "security-solution-my-test",
+      "name": "indexpattern-datasource-layer-4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+      "type": "index-pattern",
+    },
+  ],
+  "state": Object {
+    "adHocDataViews": Object {},
+    "datasourceStates": Object {
+      "formBased": Object {
+        "layers": Object {
+          "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b": Object {
+            "columnOrder": Array [
+              "2881fedd-54b7-42ba-8c97-5175dec86166",
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+              "f04a71a3-399f-4d32-9efc-8a005e989991",
+            ],
+            "columns": Object {
+              "2881fedd-54b7-42ba-8c97-5175dec86166": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of event.category",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": "event.category",
+              },
+              "75ce269b-ee9c-4c7d-a14e-9226ba0fe059": Object {
+                "dataType": "string",
+                "isBucketed": true,
+                "label": "Top values of undefined",
+                "operationType": "terms",
+                "params": Object {
+                  "exclude": Array [],
+                  "excludeIsRegex": false,
+                  "include": Array [],
+                  "includeIsRegex": false,
+                  "missingBucket": false,
+                  "orderBy": Object {
+                    "columnId": "f04a71a3-399f-4d32-9efc-8a005e989991",
+                    "type": "column",
+                  },
+                  "orderDirection": "desc",
+                  "otherBucket": true,
+                  "parentFormat": Object {
+                    "id": "terms",
+                  },
+                  "size": 1000,
+                },
+                "scale": "ordinal",
+                "sourceField": undefined,
+              },
+              "f04a71a3-399f-4d32-9efc-8a005e989991": Object {
+                "dataType": "number",
+                "isBucketed": false,
+                "label": "Maximum of kibana.alert.risk_score",
+                "operationType": "max",
+                "params": Object {
+                  "emptyAsNull": true,
+                },
+                "scale": "ratio",
+                "sourceField": "kibana.alert.risk_score",
+              },
+            },
+            "incompleteColumns": Object {},
+            "sampling": 1,
+          },
+        },
+      },
+      "textBased": Object {
+        "layers": Object {},
+      },
+    },
+    "filters": Array [
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "index": ".alerts-security.alerts-id",
+          "key": "kibana.alert.building_block_type",
+          "negate": true,
+          "type": "exists",
+        },
+        "query": Object {
+          "exists": Object {
+            "field": "kibana.alert.building_block_type",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "host.id",
+          "negate": false,
+          "params": Object {
+            "query": "123",
+          },
+          "type": "phrase",
+        },
+        "query": Object {
+          "match_phrase": Object {
+            "host.id": "123",
+          },
+        },
+      },
+      Object {
+        "meta": Object {
+          "alias": null,
+          "disabled": false,
+          "key": "_index",
+          "negate": false,
+          "params": Array [
+            "signal-index",
+          ],
+          "type": "phrases",
+        },
+        "query": Object {
+          "bool": Object {
+            "minimum_should_match": 1,
+            "should": Array [
+              Object {
+                "match_phrase": Object {
+                  "_index": "signal-index",
+                },
+              },
+            ],
+          },
+        },
+      },
+    ],
+    "internalReferences": Array [],
+    "query": Object {
+      "language": "kql",
+      "query": "host.name: *",
+    },
+    "visualization": Object {
+      "layers": Array [
+        Object {
+          "categoryDisplay": "default",
+          "layerId": "4aa7cf71-cf20-4e62-8ca6-ca6be6b0988b",
+          "layerType": "data",
+          "legendDisplay": "show",
+          "legendPosition": "left",
+          "legendSize": "xlarge",
+          "metrics": Array [
+            "f04a71a3-399f-4d32-9efc-8a005e989991",
+          ],
+          "nestedLegend": true,
+          "numberDisplay": "value",
+          "primaryGroups": Array [
+            "2881fedd-54b7-42ba-8c97-5175dec86166",
+            "75ce269b-ee9c-4c7d-a14e-9226ba0fe059",
+          ],
+        },
+      ],
+      "shape": "treemap",
+    },
+  },
+  "title": "Alerts",
+  "visualizationType": "lnsPie",
+}
+`;