diff --git a/x-pack/plugins/endpoint/common/alert_constants.ts b/x-pack/plugins/endpoint/common/alert_constants.ts
new file mode 100644
index 00000000000000..85e1643d684f2c
--- /dev/null
+++ b/x-pack/plugins/endpoint/common/alert_constants.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export class AlertConstants {
+  /**
+   * The prefix for all Alert APIs
+   */
+  static BASE_API_URL = '/api/endpoint';
+  /**
+   * The path for the Alert's Index Pattern API.
+   */
+  static INDEX_PATTERN_ROUTE = `${AlertConstants.BASE_API_URL}/index_pattern`;
+  /**
+   * Alert's Index pattern
+   */
+  static ALERT_INDEX_NAME = 'events-endpoint-1';
+  /**
+   * A paramter passed to Alert's Index Pattern.
+   */
+  static EVENT_DATASET = 'events';
+  /**
+   * Alert's Search API default page size
+   */
+  static DEFAULT_TOTAL_HITS = 10000;
+  /**
+   * Alerts
+   **/
+  static ALERT_LIST_DEFAULT_PAGE_SIZE = 10;
+  static ALERT_LIST_DEFAULT_SORT = '@timestamp';
+  static MAX_LONG_INT = '9223372036854775807'; // 2^63-1
+}
diff --git a/x-pack/plugins/endpoint/common/generate_data.ts b/x-pack/plugins/endpoint/common/generate_data.ts
index 4f5a6eaeb0a5eb..61fbb779986dc9 100644
--- a/x-pack/plugins/endpoint/common/generate_data.ts
+++ b/x-pack/plugins/endpoint/common/generate_data.ts
@@ -9,9 +9,9 @@ import seedrandom from 'seedrandom';
 import {
   AlertEvent,
   EndpointEvent,
-  HostFields,
+  Host,
   HostMetadata,
-  OSFields,
+  HostOS,
   PolicyData,
   HostPolicyResponse,
   HostPolicyResponseActionStatus,
@@ -29,7 +29,7 @@ interface EventOptions {
   processName?: string;
 }
 
-const Windows: OSFields[] = [
+const Windows: HostOS[] = [
   {
     name: 'windows 10.0',
     full: 'Windows 10',
@@ -56,11 +56,11 @@ const Windows: OSFields[] = [
   },
 ];
 
-const Linux: OSFields[] = [];
+const Linux: HostOS[] = [];
 
-const Mac: OSFields[] = [];
+const Mac: HostOS[] = [];
 
-const OS: OSFields[] = [...Windows, ...Mac, ...Linux];
+const OS: HostOS[] = [...Windows, ...Mac, ...Linux];
 
 const POLICIES: Array<{ name: string; id: string }> = [
   {
@@ -102,7 +102,7 @@ interface HostInfo {
     version: string;
     id: string;
   };
-  host: HostFields;
+  host: Host;
   endpoint: {
     policy: {
       id: string;
diff --git a/x-pack/plugins/endpoint/common/schema/alert_index.ts b/x-pack/plugins/endpoint/common/schema/alert_index.ts
index 7b48780f2d86bb..cffc00661515f6 100644
--- a/x-pack/plugins/endpoint/common/schema/alert_index.ts
+++ b/x-pack/plugins/endpoint/common/schema/alert_index.ts
@@ -7,7 +7,7 @@
 import { schema, Type } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
 import { decode } from 'rison-node';
-import { EndpointAppConstants } from '../types';
+import { AlertConstants } from '../alert_constants';
 
 /**
  * Used to validate GET requests against the index of the alerting APIs.
@@ -18,7 +18,7 @@ export const alertingIndexGetQuerySchema = schema.object(
       schema.number({
         min: 1,
         max: 100,
-        defaultValue: EndpointAppConstants.ALERT_LIST_DEFAULT_PAGE_SIZE,
+        defaultValue: AlertConstants.ALERT_LIST_DEFAULT_PAGE_SIZE,
       })
     ),
     page_index: schema.maybe(
diff --git a/x-pack/plugins/endpoint/common/types.ts b/x-pack/plugins/endpoint/common/types.ts
index 4da4f9bc797ca6..8773c5441860a7 100644
--- a/x-pack/plugins/endpoint/common/types.ts
+++ b/x-pack/plugins/endpoint/common/types.ts
@@ -25,32 +25,19 @@ export type Immutable<T> = T extends undefined | null | boolean | string | numbe
   ? ImmutableSet<M>
   : ImmutableObject<T>;
 
-export type ImmutableArray<T> = ReadonlyArray<Immutable<T>>;
-export type ImmutableMap<K, V> = ReadonlyMap<Immutable<K>, Immutable<V>>;
-export type ImmutableSet<T> = ReadonlySet<Immutable<T>>;
-export type ImmutableObject<T> = { readonly [K in keyof T]: Immutable<T[K]> };
-
-export type Direction = 'asc' | 'desc';
-
-export class EndpointAppConstants {
-  static BASE_API_URL = '/api/endpoint';
-  static INDEX_PATTERN_ROUTE = `${EndpointAppConstants.BASE_API_URL}/index_pattern`;
-  static ALERT_INDEX_NAME = 'events-endpoint-1';
-  static EVENT_DATASET = 'events';
-  static DEFAULT_TOTAL_HITS = 10000;
-  /**
-   * Legacy events are stored in indices with endgame-* prefix
-   */
-  static LEGACY_EVENT_INDEX_NAME = 'endgame-*';
+type ImmutableArray<T> = ReadonlyArray<Immutable<T>>;
+type ImmutableMap<K, V> = ReadonlyMap<Immutable<K>, Immutable<V>>;
+type ImmutableSet<T> = ReadonlySet<Immutable<T>>;
+type ImmutableObject<T> = { readonly [K in keyof T]: Immutable<T[K]> };
 
-  /**
-   * Alerts
-   **/
-  static ALERT_LIST_DEFAULT_PAGE_SIZE = 10;
-  static ALERT_LIST_DEFAULT_SORT = '@timestamp';
-  static MAX_LONG_INT = '9223372036854775807'; // 2^63-1
-}
+/**
+ * Values for the Alert APIs 'order' and 'direction' parameters.
+ */
+export type AlertAPIOrdering = 'asc' | 'desc';
 
+/**
+ * Returned by 'api/endpoint/alerts'
+ */
 export interface AlertResultList {
   /**
    * The alerts restricted by page size.
@@ -88,6 +75,9 @@ export interface AlertResultList {
   prev: string | null;
 }
 
+/**
+ * Returned by the server via /api/endpoint/metadata
+ */
 export interface HostResultList {
   /* the hosts restricted by the page size */
   hosts: HostInfo[];
@@ -99,43 +89,61 @@ export interface HostResultList {
   request_page_index: number;
 }
 
-export interface OSFields {
+/**
+ * Operating System metadata for a host.
+ */
+export interface HostOS {
   full: string;
   name: string;
   version: string;
   variant: string;
 }
-export interface HostFields {
+
+/**
+ * Host metadata. Describes an endpoint host.
+ */
+export interface Host {
   id: string;
   hostname: string;
   ip: string[];
   mac: string[];
-  os: OSFields;
+  os: HostOS;
 }
-export interface HashFields {
+
+/**
+ * A record of hashes for something. Provides hashes in multiple formats. A favorite structure of the Elastic Endpoint.
+ */
+interface Hashes {
+  /**
+   * A hash in MD5 format.
+   */
   md5: string;
+  /**
+   * A hash in SHA-1 format.
+   */
   sha1: string;
+  /**
+   * A hash in SHA-256 format.
+   */
   sha256: string;
 }
-export interface MalwareClassificationFields {
+
+interface MalwareClassification {
   identifier: string;
   score: number;
   threshold: number;
   version: string;
 }
-export interface PrivilegesFields {
-  description: string;
-  name: string;
-  enabled: boolean;
-}
-export interface ThreadFields {
+
+interface ThreadFields {
   id: number;
   service_name: string;
   start: number;
   start_address: number;
   start_address_module: string;
 }
-export interface DllFields {
+
+interface DllFields {
   pe: {
     architecture: string;
     imphash: string;
@@ -145,8 +153,8 @@ export interface DllFields {
     trusted: boolean;
   };
   compile_time: number;
-  hash: HashFields;
-  malware_classification: MalwareClassificationFields;
+  hash: Hashes;
+  malware_classification: MalwareClassification;
   mapped_address: number;
   mapped_size: number;
   path: string;
@@ -154,7 +162,6 @@ export interface DllFields {
 
 /**
  * Describes an Alert Event.
- * Should be in line with ECS schema.
  */
 export type AlertEvent = Immutable<{
   '@timestamp': number;
@@ -191,14 +198,14 @@ export type AlertEvent = Immutable<{
       entity_id: string;
     };
     name: string;
-    hash: HashFields;
+    hash: Hashes;
     pe?: {
       imphash: string;
     };
     executable: string;
     sid?: string;
     start: number;
-    malware_classification?: MalwareClassificationFields;
+    malware_classification?: MalwareClassification;
     token: {
       domain: string;
       type: string;
@@ -206,7 +213,11 @@ export type AlertEvent = Immutable<{
       sid: string;
       integrity_level: number;
       integrity_level_name: string;
-      privileges?: PrivilegesFields[];
+      privileges?: Array<{
+        description: string;
+        name: string;
+        enabled: boolean;
+      }>;
     };
     thread?: ThreadFields[];
     uptime: number;
@@ -220,7 +231,7 @@ export type AlertEvent = Immutable<{
     mtime: number;
     created: number;
     size: number;
-    hash: HashFields;
+    hash: Hashes;
     pe?: {
       imphash: string;
     };
@@ -228,10 +239,10 @@ export type AlertEvent = Immutable<{
       trusted: boolean;
       subject_name: string;
     };
-    malware_classification: MalwareClassificationFields;
+    malware_classification: MalwareClassification;
     temp_file_path: string;
   };
-  host: HostFields;
+  host: Host;
   dll?: DllFields[];
 }>;
 
@@ -249,9 +260,6 @@ interface AlertState {
   };
 }
 
-/**
- * Union of alert data and metadata.
- */
 export type AlertData = AlertEvent & AlertMetadata;
 
 export type AlertDetails = AlertData & AlertState;
@@ -301,7 +309,7 @@ export type HostMetadata = Immutable<{
     id: string;
     version: string;
   };
-  host: HostFields;
+  host: Host;
 }>;
 
 /**
@@ -365,7 +373,7 @@ export interface EndpointEvent {
     hostname: string;
     ip: string[];
     mac: string[];
-    os: OSFields;
+    os: HostOS;
   };
   process: {
     entity_id: string;
@@ -500,28 +508,22 @@ export interface PolicyConfig {
   };
 }
 
-/**
- * Windows-specific policy configuration that is supported via the UI
- */
-type WindowsPolicyConfig = Pick<PolicyConfig['windows'], 'events' | 'malware'>;
-
-/**
- * Mac-specific policy configuration that is supported via the UI
- */
-type MacPolicyConfig = Pick<PolicyConfig['mac'], 'malware' | 'events'>;
-
-/**
- * Linux-specific policy configuration that is supported via the UI
- */
-type LinuxPolicyConfig = Pick<PolicyConfig['linux'], 'events'>;
-
 /**
  * The set of Policy configuration settings that are show/edited via the UI
  */
 export interface UIPolicyConfig {
-  windows: WindowsPolicyConfig;
-  mac: MacPolicyConfig;
-  linux: LinuxPolicyConfig;
+  /**
+   * Windows-specific policy configuration that is supported via the UI
+   */
+  windows: Pick<PolicyConfig['windows'], 'events' | 'malware'>;
+  /**
+   * Mac-specific policy configuration that is supported via the UI
+   */
+  mac: Pick<PolicyConfig['mac'], 'malware' | 'events'>;
+  /**
+   * Linux-specific policy configuration that is supported via the UI
+   */
+  linux: Pick<PolicyConfig['linux'], 'events'>;
 }
 
 interface PolicyConfigAdvancedOptions {
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
index 90d6b8b82198af..6bc728db99819c 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/alerts/middleware.ts
@@ -9,7 +9,7 @@ import { AlertResultList, AlertDetails } from '../../../../../common/types';
 import { ImmutableMiddlewareFactory, AlertListState } from '../../types';
 import { isOnAlertPage, apiQueryParams, hasSelectedAlert, uiQueryParams } from './selectors';
 import { cloneHttpFetchQuery } from '../../../../common/clone_http_fetch_query';
-import { EndpointAppConstants } from '../../../../../common/types';
+import { AlertConstants } from '../../../../../common/alert_constants';
 
 export const alertMiddlewareFactory: ImmutableMiddlewareFactory<AlertListState> = (
   coreStart,
@@ -18,7 +18,7 @@ export const alertMiddlewareFactory: ImmutableMiddlewareFactory<AlertListState>
   async function fetchIndexPatterns(): Promise<IIndexPattern[]> {
     const { indexPatterns } = depsStart.data;
     const eventsPattern: { indexPattern: string } = await coreStart.http.get(
-      `${EndpointAppConstants.INDEX_PATTERN_ROUTE}/${EndpointAppConstants.EVENT_DATASET}`
+      `${AlertConstants.INDEX_PATTERN_ROUTE}/${AlertConstants.EVENT_DATASET}`
     );
     const fields = await indexPatterns.getFieldsForWildcard({
       pattern: eventsPattern.indexPattern,
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
index 82b812b79670f7..58e706f20ec8e0 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
@@ -17,7 +17,6 @@ import {
   AlertData,
   AlertResultList,
   Immutable,
-  ImmutableArray,
   AlertDetails,
   MalwareFields,
   UIPolicyConfig,
@@ -312,7 +311,7 @@ export type AlertListData = AlertResultList;
 
 export interface AlertListState {
   /** Array of alert items. */
-  readonly alerts: ImmutableArray<AlertData>;
+  readonly alerts: Immutable<AlertData[]>;
 
   /** The total number of alerts on the page. */
   readonly total: number;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/events/windows.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/events/windows.tsx
index 7f946de9614ca7..9d73f12869058f 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/events/windows.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/events/windows.tsx
@@ -17,18 +17,18 @@ import {
 } from '../../../../store/policy_details/selectors';
 import { ConfigForm } from '../config_form';
 import { setIn, getIn } from '../../../../models/policy_details_config';
-import { UIPolicyConfig, ImmutableArray } from '../../../../../../../common/types';
+import { UIPolicyConfig, Immutable } from '../../../../../../../common/types';
 
 export const WindowsEvents = React.memo(() => {
   const selected = usePolicyDetailsSelector(selectedWindowsEvents);
   const total = usePolicyDetailsSelector(totalWindowsEvents);
 
   const checkboxes = useMemo(() => {
-    const items: ImmutableArray<{
+    const items: Immutable<Array<{
       name: string;
       os: 'windows';
       protectionField: keyof UIPolicyConfig['windows']['events'];
-    }> = [
+    }>> = [
       {
         name: i18n.translate('xpack.endpoint.policyDetailsConfig.windows.events.dllDriverLoad', {
           defaultMessage: 'DLL and Driver Load',
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/protections/malware.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/protections/malware.tsx
index 14871c71ec0386..4b2a6ece9f58fc 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/protections/malware.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_forms/protections/malware.tsx
@@ -11,7 +11,7 @@ import { EuiRadio, EuiSwitch, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { htmlIdGenerator } from '@elastic/eui';
-import { Immutable, ProtectionModes, ImmutableArray } from '../../../../../../../common/types';
+import { Immutable, ProtectionModes } from '../../../../../../../common/types';
 import { OS, MalwareProtectionOSes } from '../../../../types';
 import { ConfigForm } from '../config_form';
 import { policyConfig } from '../../../../store/policy_details/selectors';
@@ -73,11 +73,11 @@ export const MalwareProtections = React.memo(() => {
   // currently just taking windows.malware, but both windows.malware and mac.malware should be the same value
   const selected = policyDetailsConfig && policyDetailsConfig.windows.malware.mode;
 
-  const radios: ImmutableArray<{
+  const radios: Immutable<Array<{
     id: ProtectionModes;
     label: string;
     protection: 'malware';
-  }> = useMemo(() => {
+  }>> = useMemo(() => {
     return [
       {
         id: ProtectionModes.detect,
diff --git a/x-pack/plugins/endpoint/server/index_pattern.ts b/x-pack/plugins/endpoint/server/index_pattern.ts
index dcedd27fc5a3d4..903d48746bfb31 100644
--- a/x-pack/plugins/endpoint/server/index_pattern.ts
+++ b/x-pack/plugins/endpoint/server/index_pattern.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { Logger, LoggerFactory, RequestHandlerContext } from 'kibana/server';
-import { EndpointAppConstants } from '../common/types';
+import { AlertConstants } from '../common/alert_constants';
 import { ESIndexPatternService } from '../../ingest_manager/server';
 
 export interface IndexPatternRetriever {
@@ -33,7 +33,7 @@ export class IngestIndexPatternRetriever implements IndexPatternRetriever {
    * @returns a string representing the index pattern (e.g. `events-endpoint-*`)
    */
   async getEventIndexPattern(ctx: RequestHandlerContext) {
-    return await this.getIndexPattern(ctx, EndpointAppConstants.EVENT_DATASET);
+    return await this.getIndexPattern(ctx, AlertConstants.EVENT_DATASET);
   }
 
   /**
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts b/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts
index e438ab853f3b52..92f8aacbf26a29 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/details/handlers.ts
@@ -5,7 +5,8 @@
  */
 import { GetResponse } from 'elasticsearch';
 import { KibanaRequest, RequestHandler } from 'kibana/server';
-import { AlertEvent, EndpointAppConstants } from '../../../../common/types';
+import { AlertEvent } from '../../../../common/types';
+import { AlertConstants } from '../../../../common/alert_constants';
 import { EndpointAppContext } from '../../../types';
 import { AlertDetailsRequestParams } from '../types';
 import { AlertDetailsPagination } from './lib';
@@ -22,7 +23,7 @@ export const alertDetailsHandlerWrapper = function(
     try {
       const alertId = req.params.id;
       const response = (await ctx.core.elasticsearch.dataClient.callAsCurrentUser('get', {
-        index: EndpointAppConstants.ALERT_INDEX_NAME,
+        index: AlertConstants.ALERT_INDEX_NAME,
         id: alertId,
       })) as GetResponse<AlertEvent>;
 
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts b/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts
index d482da03872c62..0f69e1bb60c44e 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/details/lib/pagination.ts
@@ -5,12 +5,8 @@
  */
 
 import { GetResponse, SearchResponse } from 'elasticsearch';
-import {
-  AlertEvent,
-  AlertHits,
-  Direction,
-  EndpointAppConstants,
-} from '../../../../../common/types';
+import { AlertEvent, AlertHits, AlertAPIOrdering } from '../../../../../common/types';
+import { AlertConstants } from '../../../../../common/alert_constants';
 import { EndpointConfigType } from '../../../../config';
 import { searchESForAlerts, Pagination } from '../../lib';
 import { AlertSearchQuery, SearchCursor, AlertDetailsRequestParams } from '../../types';
@@ -36,12 +32,12 @@ export class AlertDetailsPagination extends Pagination<
   }
 
   protected async doSearch(
-    direction: Direction,
+    direction: AlertAPIOrdering,
     cursor: SearchCursor
   ): Promise<SearchResponse<AlertEvent>> {
     const reqData: AlertSearchQuery = {
       pageSize: 1,
-      sort: EndpointAppConstants.ALERT_LIST_DEFAULT_SORT,
+      sort: AlertConstants.ALERT_LIST_DEFAULT_SORT,
       order: 'desc',
       query: { query: '', language: 'kuery' },
       filters: [] as Filter[],
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/index.ts b/x-pack/plugins/endpoint/server/routes/alerts/index.ts
index 09de11897813b5..b61f90b5b17f5a 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/index.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/index.ts
@@ -5,12 +5,12 @@
  */
 import { IRouter } from 'kibana/server';
 import { EndpointAppContext } from '../../types';
-import { EndpointAppConstants } from '../../../common/types';
+import { AlertConstants } from '../../../common/alert_constants';
 import { alertListHandlerWrapper } from './list';
 import { alertDetailsHandlerWrapper, alertDetailsReqSchema } from './details';
 import { alertingIndexGetQuerySchema } from '../../../common/schema/alert_index';
 
-export const BASE_ALERTS_ROUTE = `${EndpointAppConstants.BASE_API_URL}/alerts`;
+export const BASE_ALERTS_ROUTE = `${AlertConstants.BASE_API_URL}/alerts`;
 
 export function registerAlertRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
   router.get(
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/lib/index.ts b/x-pack/plugins/endpoint/server/routes/alerts/lib/index.ts
index 74db24c85eab5e..7bc1c0c306ae2b 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/lib/index.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/lib/index.ts
@@ -7,7 +7,8 @@ import { SearchResponse } from 'elasticsearch';
 import { IScopedClusterClient } from 'kibana/server';
 import { JsonObject } from '../../../../../../../src/plugins/kibana_utils/public';
 import { esQuery } from '../../../../../../../src/plugins/data/server';
-import { AlertEvent, Direction, EndpointAppConstants } from '../../../../common/types';
+import { AlertEvent, AlertAPIOrdering } from '../../../../common/types';
+import { AlertConstants } from '../../../../common/alert_constants';
 import {
   AlertSearchQuery,
   AlertSearchRequest,
@@ -18,7 +19,7 @@ import {
 
 export { Pagination } from './pagination';
 
-function reverseSortDirection(order: Direction): Direction {
+function reverseSortDirection(order: AlertAPIOrdering): AlertAPIOrdering {
   if (order === 'asc') {
     return 'desc';
   }
@@ -100,13 +101,13 @@ const buildAlertSearchQuery = async (
   query: AlertSearchQuery,
   indexPattern: string
 ): Promise<AlertSearchRequestWrapper> => {
-  let totalHitsMin: number = EndpointAppConstants.DEFAULT_TOTAL_HITS;
+  let totalHitsMin: number = AlertConstants.DEFAULT_TOTAL_HITS;
 
   // Calculate minimum total hits set to indicate there's a next page
   if (query.fromIndex) {
     totalHitsMin = Math.max(
       query.fromIndex + query.pageSize * 2,
-      EndpointAppConstants.DEFAULT_TOTAL_HITS
+      AlertConstants.DEFAULT_TOTAL_HITS
     );
   }
 
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/list/lib/index.ts b/x-pack/plugins/endpoint/server/routes/alerts/list/lib/index.ts
index 95c8e4662cfcea..92bd07a813d264 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/list/lib/index.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/list/lib/index.ts
@@ -13,10 +13,10 @@ import {
   AlertData,
   AlertResultList,
   AlertHits,
-  EndpointAppConstants,
   ESTotal,
   AlertingIndexGetQueryResult,
 } from '../../../../../common/types';
+import { AlertConstants } from '../../../../../common/alert_constants';
 import { EndpointAppContext } from '../../../../types';
 import { AlertSearchQuery } from '../../types';
 import { AlertListPagination } from './pagination';
@@ -28,8 +28,8 @@ export const getRequestData = async (
   const config = await endpointAppContext.config();
   const reqData: AlertSearchQuery = {
     // Defaults not enforced by schema
-    pageSize: request.query.page_size || EndpointAppConstants.ALERT_LIST_DEFAULT_PAGE_SIZE,
-    sort: request.query.sort || EndpointAppConstants.ALERT_LIST_DEFAULT_SORT,
+    pageSize: request.query.page_size || AlertConstants.ALERT_LIST_DEFAULT_PAGE_SIZE,
+    sort: request.query.sort || AlertConstants.ALERT_LIST_DEFAULT_SORT,
     order: request.query.order || 'desc',
     dateRange: ((request.query.date_range !== undefined
       ? decode(request.query.date_range)
@@ -67,7 +67,7 @@ export const getRequestData = async (
     reqData.searchBefore[0] === '' &&
     reqData.emptyStringIsUndefined
   ) {
-    reqData.searchBefore[0] = EndpointAppConstants.MAX_LONG_INT;
+    reqData.searchBefore[0] = AlertConstants.MAX_LONG_INT;
   }
 
   if (
@@ -75,7 +75,7 @@ export const getRequestData = async (
     reqData.searchAfter[0] === '' &&
     reqData.emptyStringIsUndefined
   ) {
-    reqData.searchAfter[0] = EndpointAppConstants.MAX_LONG_INT;
+    reqData.searchAfter[0] = AlertConstants.MAX_LONG_INT;
   }
 
   return reqData;
diff --git a/x-pack/plugins/endpoint/server/routes/alerts/types.ts b/x-pack/plugins/endpoint/server/routes/alerts/types.ts
index cf4eac5d25f800..5aefc35b5758f1 100644
--- a/x-pack/plugins/endpoint/server/routes/alerts/types.ts
+++ b/x-pack/plugins/endpoint/server/routes/alerts/types.ts
@@ -5,14 +5,14 @@
  */
 import { Query, Filter, TimeRange } from '../../../../../../src/plugins/data/server';
 import { JsonObject } from '../../../../../../src/plugins/kibana_utils/public';
-import { Direction } from '../../../common/types';
+import { AlertAPIOrdering } from '../../../common/types';
 
 /**
  * Sort parameters for alerts in ES.
  */
 export interface AlertSortParam {
   [key: string]: {
-    order: Direction;
+    order: AlertAPIOrdering;
     missing?: UndefinedResultPosition;
   };
 }
@@ -38,7 +38,7 @@ export interface AlertSearchQuery {
   filters: Filter[];
   dateRange?: TimeRange;
   sort: string;
-  order: Direction;
+  order: AlertAPIOrdering;
   searchAfter?: SearchCursor;
   searchBefore?: SearchCursor;
   emptyStringIsUndefined?: boolean;
@@ -83,7 +83,7 @@ export interface AlertListRequestQuery {
   filters?: string;
   date_range: string;
   sort: string;
-  order: Direction;
+  order: AlertAPIOrdering;
   after?: SearchCursor;
   before?: SearchCursor;
   empty_string_is_undefined?: boolean;
diff --git a/x-pack/plugins/endpoint/server/routes/index_pattern.ts b/x-pack/plugins/endpoint/server/routes/index_pattern.ts
index 79083f5f05e149..7e78caaf178e46 100644
--- a/x-pack/plugins/endpoint/server/routes/index_pattern.ts
+++ b/x-pack/plugins/endpoint/server/routes/index_pattern.ts
@@ -6,7 +6,8 @@
 
 import { IRouter, Logger, RequestHandler } from 'kibana/server';
 import { EndpointAppContext } from '../types';
-import { IndexPatternGetParamsResult, EndpointAppConstants } from '../../common/types';
+import { IndexPatternGetParamsResult } from '../../common/types';
+import { AlertConstants } from '../../common/alert_constants';
 import { indexPatternGetParamsSchema } from '../../common/schema/index_pattern';
 
 function handleIndexPattern(
@@ -33,7 +34,7 @@ export function registerIndexPatternRoute(router: IRouter, endpointAppContext: E
 
   router.get(
     {
-      path: `${EndpointAppConstants.INDEX_PATTERN_ROUTE}/{datasetPath}`,
+      path: `${AlertConstants.INDEX_PATTERN_ROUTE}/{datasetPath}`,
       validate: { params: indexPatternGetParamsSchema },
       options: { authRequired: true },
     },
diff --git a/x-pack/plugins/endpoint/server/routes/resolver/queries/base.ts b/x-pack/plugins/endpoint/server/routes/resolver/queries/base.ts
index b049439207e508..3b3b4b0c9e8ac1 100644
--- a/x-pack/plugins/endpoint/server/routes/resolver/queries/base.ts
+++ b/x-pack/plugins/endpoint/server/routes/resolver/queries/base.ts
@@ -5,9 +5,9 @@
  */
 
 import { IScopedClusterClient } from 'kibana/server';
-import { EndpointAppConstants } from '../../../../common/types';
 import { paginate, paginatedResults, PaginationParams } from '../utils/pagination';
 import { JsonObject } from '../../../../../../../src/plugins/kibana_utils/public';
+import { legacyEventIndexPattern } from './legacy_event_index_pattern';
 
 export abstract class ResolverQuery {
   constructor(
@@ -25,7 +25,7 @@ export abstract class ResolverQuery {
 
   build(...ids: string[]) {
     if (this.endpointID) {
-      return this.legacyQuery(this.endpointID, ids, EndpointAppConstants.LEGACY_EVENT_INDEX_NAME);
+      return this.legacyQuery(this.endpointID, ids, legacyEventIndexPattern);
     }
     return this.query(ids, this.indexPattern);
   }
diff --git a/x-pack/plugins/endpoint/server/routes/resolver/queries/children.test.ts b/x-pack/plugins/endpoint/server/routes/resolver/queries/children.test.ts
index e73053d53dee08..d1d090579f0cd1 100644
--- a/x-pack/plugins/endpoint/server/routes/resolver/queries/children.test.ts
+++ b/x-pack/plugins/endpoint/server/routes/resolver/queries/children.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { ChildrenQuery } from './children';
-import { EndpointAppConstants } from '../../../../common/types';
+import { legacyEventIndexPattern } from './legacy_event_index_pattern';
 
 export const fakeEventIndexPattern = 'events-endpoint-*';
 
@@ -12,7 +12,7 @@ describe('children events query', () => {
   it('generates the correct legacy queries', () => {
     const timestamp = new Date().getTime();
     expect(
-      new ChildrenQuery(EndpointAppConstants.LEGACY_EVENT_INDEX_NAME, 'awesome-id', {
+      new ChildrenQuery(legacyEventIndexPattern, 'awesome-id', {
         size: 1,
         timestamp,
         eventID: 'foo',
@@ -48,7 +48,7 @@ describe('children events query', () => {
         size: 1,
         sort: [{ '@timestamp': 'asc' }, { 'endgame.serial_event_id': 'asc' }],
       },
-      index: EndpointAppConstants.LEGACY_EVENT_INDEX_NAME,
+      index: legacyEventIndexPattern,
     });
   });
 
diff --git a/x-pack/plugins/endpoint/server/routes/resolver/queries/legacy_event_index_pattern.ts b/x-pack/plugins/endpoint/server/routes/resolver/queries/legacy_event_index_pattern.ts
new file mode 100644
index 00000000000000..01e818c89b3efc
--- /dev/null
+++ b/x-pack/plugins/endpoint/server/routes/resolver/queries/legacy_event_index_pattern.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * Legacy events are stored in indices with endgame-* prefix
+ */
+export const legacyEventIndexPattern = 'endgame-*';
diff --git a/x-pack/plugins/endpoint/server/routes/resolver/queries/lifecycle.test.ts b/x-pack/plugins/endpoint/server/routes/resolver/queries/lifecycle.test.ts
index 8a3955706b2781..9d3c675ecc54cf 100644
--- a/x-pack/plugins/endpoint/server/routes/resolver/queries/lifecycle.test.ts
+++ b/x-pack/plugins/endpoint/server/routes/resolver/queries/lifecycle.test.ts
@@ -3,15 +3,14 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EndpointAppConstants } from '../../../../common/types';
+
 import { LifecycleQuery } from './lifecycle';
 import { fakeEventIndexPattern } from './children.test';
+import { legacyEventIndexPattern } from './legacy_event_index_pattern';
 
 describe('lifecycle query', () => {
   it('generates the correct legacy queries', () => {
-    expect(
-      new LifecycleQuery(EndpointAppConstants.LEGACY_EVENT_INDEX_NAME, 'awesome-id').build('5')
-    ).toStrictEqual({
+    expect(new LifecycleQuery(legacyEventIndexPattern, 'awesome-id').build('5')).toStrictEqual({
       body: {
         query: {
           bool: {
@@ -30,7 +29,7 @@ describe('lifecycle query', () => {
         },
         sort: [{ '@timestamp': 'asc' }],
       },
-      index: EndpointAppConstants.LEGACY_EVENT_INDEX_NAME,
+      index: legacyEventIndexPattern,
     });
   });
 
diff --git a/x-pack/plugins/endpoint/server/routes/resolver/queries/related_events.test.ts b/x-pack/plugins/endpoint/server/routes/resolver/queries/related_events.test.ts
index 5caef935ce6214..26205e9db6e45e 100644
--- a/x-pack/plugins/endpoint/server/routes/resolver/queries/related_events.test.ts
+++ b/x-pack/plugins/endpoint/server/routes/resolver/queries/related_events.test.ts
@@ -4,14 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { RelatedEventsQuery } from './related_events';
-import { EndpointAppConstants } from '../../../../common/types';
 import { fakeEventIndexPattern } from './children.test';
+import { legacyEventIndexPattern } from './legacy_event_index_pattern';
 
 describe('related events query', () => {
   it('generates the correct legacy queries', () => {
     const timestamp = new Date().getTime();
     expect(
-      new RelatedEventsQuery(EndpointAppConstants.LEGACY_EVENT_INDEX_NAME, 'awesome-id', {
+      new RelatedEventsQuery(legacyEventIndexPattern, 'awesome-id', {
         size: 1,
         timestamp,
         eventID: 'foo',
@@ -48,7 +48,7 @@ describe('related events query', () => {
         size: 1,
         sort: [{ '@timestamp': 'asc' }, { 'endgame.serial_event_id': 'asc' }],
       },
-      index: EndpointAppConstants.LEGACY_EVENT_INDEX_NAME,
+      index: legacyEventIndexPattern,
     });
   });