public async getTimelineDetails(
    request: FrameworkRequest,
    options: RequestDetailsOptions
  ): Promise<TimelineDetailsData> {
    const [mapResponse, searchResponse] = await Promise.all([
      this.framework.callWithRequest(request, 'indices.getMapping', {
        allowNoIndices: true,
        ignoreUnavailable: true,
        index: options.indexName,
      }),
      this.framework.callWithRequest<EventHit, TermAggregation>(
        request,
        'search',
        buildDetailsQuery(options.indexName, options.eventId)
      ),
    ]);

    const sourceData = getOr({}, 'hits.hits.0._source', searchResponse);
    const hitsData = getOr({}, 'hits.hits.0', searchResponse);
    delete hitsData._source;

    return {
      data: getSchemaFromData(
        {
          ...addBasicElasticSearchProperties(),
          ...getOr({}, [options.indexName, 'mappings', 'properties'], mapResponse),
        },
        getDataFromHits(merge(sourceData, hitsData)),
        getIndexAlias(options.defaultIndex, options.indexName)
      ),
    };
  }

  public async getUncommonProcesses(
    request: FrameworkRequest,
    options: RequestOptions
  ): Promise<UncommonProcessesData> {
    const response = await this.framework.callWithRequest<UncommonProcessData, TermAggregation>(
      request,
      'search',
      buildQuery(options)
    );
    const { cursor, limit } = options.pagination;
    const totalCount = getOr(0, 'aggregations.process_count.value', response);
    const buckets = getOr([], 'aggregations.group_by_process.buckets', response);
    const hits = getHits(buckets);

    const uncommonProcessesEdges = hits.map(hit =>
      formatUncommonProcessesData(options.fields, hit, { ...processFieldsMap, ...userFieldsMap })
    );
    const hasNextPage = uncommonProcessesEdges.length === limit + 1;
    const beginning = cursor != null ? parseInt(cursor!, 10) : 0;
    const edges = uncommonProcessesEdges.splice(beginning, limit - beginning);
    return {
      edges,
      totalCount,
      pageInfo: {
        hasNextPage,
        endCursor: {
          value: String(limit),
          tiebreaker: null,
        },
      },
    };
  }

  public async getNetworkDns(
    request: FrameworkRequest,
    options: NetworkDnsRequestOptions
  ): Promise<NetworkTopNFlowData> {
    const response = await this.framework.callWithRequest<NetworkTopNFlowData, TermAggregation>(
      request,
      'search',
      buildDnsQuery(options)
    );
    const { cursor, limit } = options.pagination;
    const totalCount = getOr(0, 'aggregations.dns_count.value', response);
    const networkDnsEdges: NetworkDnsEdges[] = formatDnsEdges(
      getOr([], 'aggregations.dns_name_query_count.buckets', response)
    );
    const hasNextPage = networkDnsEdges.length > limit;
    const beginning = cursor != null ? parseInt(cursor, 10) : 0;
    const edges = networkDnsEdges.splice(beginning, limit - beginning);

    return {
      edges,
      totalCount,
      pageInfo: {
        hasNextPage,
        endCursor: {
          value: String(limit),
          tiebreaker: null,
        },
      },
    };
  }

 ).map((bucket: AuthenticationBucket) => ({
   _id: bucket.authentication.hits.hits[0]._id,
   _source: {
     lastSuccess: getOr(null, 'successes.lastSuccess.hits.hits[0]._source', bucket),
     lastFailure: getOr(null, 'failures.lastFailure.hits.hits[0]._source', bucket),
   },
   user: bucket.key,
   cursor: bucket.key.user_uid,
   failures: bucket.failures.doc_count,
   successes: bucket.successes.doc_count,
 }));

 public async getKpiHosts(
   request: FrameworkRequest,
   options: RequestBasicOptions
 ): Promise<KpiHostsData> {
   const generalQuery: KpiHostsESMSearchBody[] = buildGeneralQuery(options);
   const authQuery: KpiHostsESMSearchBody[] = buildAuthQuery(options);
   const response = await this.framework.callWithRequest<
     KpiHostsGeneralHit | KpiHostsAuthHit,
     TermAggregation
   >(request, 'msearch', {
     body: [...generalQuery, ...authQuery],
   });
   return {
     hosts: getOr(null, 'responses.0.aggregations.hosts.value', response),
     hostsHistogram: getOr(null, 'responses.0.aggregations.hosts_histogram.buckets', response),
     authSuccess: getOr(
       null,
       'responses.1.aggregations.authentication_success.doc_count',
       response
     ),
     authSuccessHistogram: getOr(
       null,
       'responses.1.aggregations.authentication_success_histogram.buckets',
       response
     ),
     authFailure: getOr(
       null,
       'responses.1.aggregations.authentication_failure.doc_count',
       response
     ),
     authFailureHistogram: getOr(
       null,
       'responses.1.aggregations.authentication_failure_histogram.buckets',
       response
     ),
     uniqueSourceIps: getOr(null, 'responses.0.aggregations.unique_source_ips.value', response),
     uniqueSourceIpsHistogram: getOr(
       null,
       'responses.0.aggregations.unique_source_ips_histogram.buckets',
       response
     ),
     uniqueDestinationIps: getOr(
       null,
       'responses.0.aggregations.unique_destination_ips.value',
       response
     ),
     uniqueDestinationIpsHistogram: getOr(
       null,
       'responses.0.aggregations.unique_destination_ips_histogram.buckets',
       response
     ),
   };
 }

 public async getIpDetails(
   request: FrameworkRequest,
   options: IpOverviewRequestOptions
 ): Promise<IpOverviewData> {
   const response = await this.framework.callWithRequest<IpOverviewHit, TermAggregation>(
     request,
     'search',
     buildOverviewQuery(options)
   );
   return {
     ...getIpOverviewAgg('source', getOr({}, 'aggregations.source', response)),
     ...getIpOverviewAgg('destination', getOr({}, 'aggregations.destination', response)),
   };
 }

  public async persistFavorite(
    request: FrameworkRequest,
    timelineId: string | null
  ): Promise<ResponseFavoriteTimeline> {
    let timeline: SavedTimeline = {};
    if (timelineId != null) {
      const {
        eventIdToNoteIds,
        notes,
        noteIds,
        pinnedEventIds,
        pinnedEventsSaveObject,
        savedObjectId,
        version,
        ...savedTimeline
      } = await this.getBasicSavedTimeline(request, timelineId);
      timelineId = savedObjectId;
      timeline = savedTimeline;
    }
    const userName = getOr(null, 'credentials.username', request[internalFrameworkRequest].auth);
    const fullName = getOr(null, 'credentials.fullname', request[internalFrameworkRequest].auth);
    const userFavoriteTimeline = {
      fullName,
      userName,
      favoriteDate: new Date().valueOf(),
    };
    if (timeline.favorite != null) {
      const alreadyExistsTimelineFavoriteByUser = timeline.favorite.findIndex(
        user => user.userName === userName
      );

      timeline.favorite =
        alreadyExistsTimelineFavoriteByUser > -1
          ? [
              ...timeline.favorite.slice(0, alreadyExistsTimelineFavoriteByUser),
              ...timeline.favorite.slice(alreadyExistsTimelineFavoriteByUser + 1),
            ]
          : [...timeline.favorite, userFavoriteTimeline];
    } else if (timeline.favorite == null) {
      timeline.favorite = [userFavoriteTimeline];
    }

    const persistResponse = await this.persistTimeline(request, timelineId, null, timeline);
    return {
      savedObjectId: persistResponse.timeline.savedObjectId,
      version: persistResponse.timeline.version,
      favorite: persistResponse.timeline.favorite != null ? persistResponse.timeline.favorite : [],
    };
  }

const getTopNFlowEdges = (
  response: DatabaseSearchResponse<NetworkTopNFlowData, TermAggregation>,
  options: NetworkTopNFlowRequestOptions
): NetworkTopNFlowEdges[] => {
  if (options.flowDirection === FlowDirection.uniDirectional) {
    return formatTopNFlowEdges(
      getOr([], 'aggregations.top_uni_flow.buckets', response),
      options.flowTarget
    );
  }
  return formatTopNFlowEdges(
    getOr([], 'aggregations.top_bi_flow.buckets', response),
    options.flowTarget
  );
};

  public async getEvents(request: FrameworkRequest, options: RequestOptions): Promise<EventsData> {
    const queryOptions = cloneDeep(options);
    queryOptions.fields = reduceFields(options.fields, eventFieldsMap);
    const response = await this.framework.callWithRequest<EventHit, TermAggregation>(
      request,
      'search',
      buildQuery(queryOptions)
    );

    const kpiEventType: KpiItem[] =
      response.aggregations && response.aggregations.count_event_type
        ? response.aggregations.count_event_type.buckets.map(item => ({
            value: item.key,
            count: item.doc_count,
          }))
        : [];
    const { limit } = options.pagination;
    const totalCount = getOr(0, 'hits.total.value', response);
    const hits = response.hits.hits;
    const eventsEdges: EcsEdges[] = hits.map(hit =>
      formatEventsData(options.fields, hit, eventFieldsMap)
    );
    const hasNextPage = eventsEdges.length === limit + 1;
    const edges = hasNextPage ? eventsEdges.splice(0, limit) : eventsEdges;
    const lastCursor = get('cursor', last(edges));
    return { kpiEventType, edges, totalCount, pageInfo: { hasNextPage, endCursor: lastCursor } };
  }

 public async getTimelineData(
   request: FrameworkRequest,
   options: EventsRequestOptions
 ): Promise<TimelineData> {
   const queryOptions = cloneDeep(options);
   queryOptions.fields = uniq([
     ...queryOptions.fieldRequested,
     ...reduceFields(queryOptions.fields, eventFieldsMap),
   ]);
   delete queryOptions.fieldRequested;
   const response = await this.framework.callWithRequest<EventHit, TermAggregation>(
     request,
     'search',
     buildQuery(queryOptions)
   );
   const { limit } = options.pagination;
   const totalCount = getOr(0, 'hits.total.value', response);
   const hits = response.hits.hits;
   const timelineEdges: TimelineEdges[] = hits.map(hit =>
     formatTimelineData(options.fieldRequested, options.fields, hit, eventFieldsMap)
   );
   const hasNextPage = timelineEdges.length === limit + 1;
   const edges = hasNextPage ? timelineEdges.splice(0, limit) : timelineEdges;
   const lastCursor = get('cursor', last(edges));
   return { edges, totalCount, pageInfo: { hasNextPage, endCursor: lastCursor } };
 }