diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
index 175784bc5ade57..6905f2be38966d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/index.ts
@@ -15,7 +15,13 @@ import {
   HostsRequestOptions,
   HostsStrategyResponse,
 } from './hosts';
-import { NetworkQueries, NetworkTlsStrategyResponse, NetworkTlsRequestOptions } from './network';
+import {
+  NetworkQueries,
+  NetworkTlsStrategyResponse,
+  NetworkTlsRequestOptions,
+  NetworkHttpStrategyResponse,
+  NetworkHttpRequestOptions,
+} from './network';
 
 export * from './hosts';
 export * from './network';
@@ -116,6 +122,8 @@ export type StrategyResponseType<T extends FactoryQueryTypes> = T extends HostsQ
   ? HostFirstLastSeenStrategyResponse
   : T extends NetworkQueries.tls
   ? NetworkTlsStrategyResponse
+  : T extends NetworkQueries.http
+  ? NetworkHttpStrategyResponse
   : never;
 
 export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQueries.hosts
@@ -126,4 +134,11 @@ export type StrategyRequestType<T extends FactoryQueryTypes> = T extends HostsQu
   ? HostFirstLastSeenRequestOptions
   : T extends NetworkQueries.tls
   ? NetworkTlsRequestOptions
+  : T extends NetworkQueries.http
+  ? NetworkHttpRequestOptions
   : never;
+
+export interface GenericBuckets {
+  key: string;
+  doc_count: number;
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts
new file mode 100644
index 00000000000000..c42b3d2ab8db30
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/http/index.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
+import {
+  Maybe,
+  CursorType,
+  Inspect,
+  RequestOptionsPaginated,
+  PageInfoPaginated,
+  GenericBuckets,
+} from '../..';
+
+export interface NetworkHttpRequestOptions extends RequestOptionsPaginated {
+  ip?: string;
+  defaultIndex: string[];
+}
+
+export interface NetworkHttpStrategyResponse extends IEsSearchResponse {
+  edges: NetworkHttpEdges[];
+  totalCount: number;
+  pageInfo: PageInfoPaginated;
+  inspect?: Maybe<Inspect>;
+}
+
+export interface NetworkHttpEdges {
+  node: NetworkHttpItem;
+  cursor: CursorType;
+}
+
+export interface NetworkHttpItem {
+  _id?: Maybe<string>;
+  domains: string[];
+  lastHost?: Maybe<string>;
+  lastSourceIp?: Maybe<string>;
+  methods: string[];
+  path?: Maybe<string>;
+  requestCount?: Maybe<number>;
+  statuses: string[];
+}
+
+export interface NetworkHttpBuckets {
+  key: string;
+  doc_count: number;
+  domains: {
+    buckets: GenericBuckets[];
+  };
+  methods: {
+    buckets: GenericBuckets[];
+  };
+  source: object;
+  status: {
+    buckets: GenericBuckets[];
+  };
+}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
index 680a3697ef0bd5..194bb5d057e3fc 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/index.ts
@@ -5,7 +5,9 @@
  */
 
 export * from './tls';
+export * from './http';
 
 export enum NetworkQueries {
+  http = 'http',
   tls = 'tls',
 }
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx b/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
index 60845d452d69e4..ae50f6919dce1f 100644
--- a/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/containers/network_http/index.tsx
@@ -4,29 +4,27 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getOr } from 'lodash/fp';
-import React from 'react';
-import { Query } from 'react-apollo';
-import { connect } from 'react-redux';
-import { compose } from 'redux';
+import { noop } from 'lodash/fp';
+import { useState, useEffect, useCallback, useRef } from 'react';
+import { shallowEqual, useSelector } from 'react-redux';
+import deepEqual from 'fast-deep-equal';
 
+import { ESTermQuery } from '../../../../common/typed_json';
 import { DEFAULT_INDEX_KEY } from '../../../../common/constants';
-import {
-  GetNetworkHttpQuery,
-  NetworkHttpEdges,
-  NetworkHttpSortField,
-  PageInfoPaginated,
-} from '../../../graphql/types';
-import { inputsModel, inputsSelectors, State } from '../../../common/store';
-import { withKibana, WithKibanaProps } from '../../../common/lib/kibana';
+import { inputsModel, State } from '../../../common/store';
+import { useKibana } from '../../../common/lib/kibana';
+import { createFilter } from '../../../common/containers/helpers';
+import { NetworkHttpEdges, PageInfoPaginated } from '../../../graphql/types';
 import { generateTablePaginationOptions } from '../../../common/components/paginated_table/helpers';
-import { createFilter, getDefaultFetchPolicy } from '../../../common/containers/helpers';
-import {
-  QueryTemplatePaginated,
-  QueryTemplatePaginatedProps,
-} from '../../../common/containers/query_template_paginated';
 import { networkModel, networkSelectors } from '../../store';
-import { networkHttpQuery } from './index.gql_query';
+import {
+  NetworkQueries,
+  NetworkHttpRequestOptions,
+  NetworkHttpStrategyResponse,
+  SortField,
+} from '../../../../common/search_strategy/security_solution';
+import { AbortError } from '../../../../../../../src/plugins/data/common';
+import * as i18n from './translations';
 
 const ID = 'networkHttpQuery';
 
@@ -35,7 +33,6 @@ export interface NetworkHttpArgs {
   ip?: string;
   inspect: inputsModel.InspectQuery;
   isInspected: boolean;
-  loading: boolean;
   loadPage: (newActivePage: number) => void;
   networkHttp: NetworkHttpEdges[];
   pageInfo: PageInfoPaginated;
@@ -43,118 +40,161 @@ export interface NetworkHttpArgs {
   totalCount: number;
 }
 
-export interface OwnProps extends QueryTemplatePaginatedProps {
-  children: (args: NetworkHttpArgs) => React.ReactNode;
+interface UseNetworkHttp {
+  id?: string;
   ip?: string;
   type: networkModel.NetworkType;
+  filterQuery?: ESTermQuery | string;
+  endDate: string;
+  startDate: string;
+  skip: boolean;
 }
 
-export interface NetworkHttpComponentReduxProps {
-  activePage: number;
-  isInspected: boolean;
-  limit: number;
-  sort: NetworkHttpSortField;
-}
+export const useNetworkHttp = ({
+  endDate,
+  filterQuery,
+  id = ID,
+  ip,
+  skip,
+  startDate,
+  type,
+}: UseNetworkHttp): [boolean, NetworkHttpArgs] => {
+  const getHttpSelector = networkSelectors.httpSelector();
+  const { activePage, limit, sort } = useSelector(
+    (state: State) => getHttpSelector(state, type),
+    shallowEqual
+  );
+  const { data, notifications, uiSettings } = useKibana().services;
+  const refetch = useRef<inputsModel.Refetch>(noop);
+  const abortCtrl = useRef(new AbortController());
+  const defaultIndex = uiSettings.get<string[]>(DEFAULT_INDEX_KEY);
+  const [loading, setLoading] = useState(false);
+
+  const [networkHttpRequest, setHostRequest] = useState<NetworkHttpRequestOptions>({
+    defaultIndex,
+    factoryQueryType: NetworkQueries.http,
+    filterQuery: createFilter(filterQuery),
+    ip,
+    pagination: generateTablePaginationOptions(activePage, limit),
+    sort: sort as SortField,
+    timerange: {
+      interval: '12h',
+      from: startDate ? startDate : '',
+      to: endDate ? endDate : new Date(Date.now()).toISOString(),
+    },
+  });
+
+  const wrappedLoadMore = useCallback(
+    (newActivePage: number) => {
+      setHostRequest((prevRequest) => {
+        return {
+          ...prevRequest,
+          pagination: generateTablePaginationOptions(newActivePage, limit),
+        };
+      });
+    },
+    [limit]
+  );
 
-type NetworkHttpProps = OwnProps & NetworkHttpComponentReduxProps & WithKibanaProps;
+  const [networkHttpResponse, setNetworkHttpResponse] = useState<NetworkHttpArgs>({
+    networkHttp: [],
+    id: ID,
+    inspect: {
+      dsl: [],
+      response: [],
+    },
+    isInspected: false,
+    loadPage: wrappedLoadMore,
+    pageInfo: {
+      activePage: 0,
+      fakeTotalCount: 0,
+      showMorePagesIndicator: false,
+    },
+    refetch: refetch.current,
+    totalCount: -1,
+  });
 
-class NetworkHttpComponentQuery extends QueryTemplatePaginated<
-  NetworkHttpProps,
-  GetNetworkHttpQuery.Query,
-  GetNetworkHttpQuery.Variables
-> {
-  public render() {
-    const {
-      activePage,
-      children,
-      endDate,
-      filterQuery,
-      id = ID,
-      ip,
-      isInspected,
-      kibana,
-      limit,
-      skip,
-      sourceId,
-      sort,
-      startDate,
-    } = this.props;
-    const variables: GetNetworkHttpQuery.Variables = {
-      defaultIndex: kibana.services.uiSettings.get<string[]>(DEFAULT_INDEX_KEY),
-      filterQuery: createFilter(filterQuery),
-      inspect: isInspected,
-      ip,
-      pagination: generateTablePaginationOptions(activePage, limit),
-      sort,
-      sourceId,
-      timerange: {
-        interval: '12h',
-        from: startDate!,
-        to: endDate!,
-      },
-    };
-    return (
-      <Query<GetNetworkHttpQuery.Query, GetNetworkHttpQuery.Variables>
-        fetchPolicy={getDefaultFetchPolicy()}
-        notifyOnNetworkStatusChange
-        query={networkHttpQuery}
-        skip={skip}
-        variables={variables}
-      >
-        {({ data, loading, fetchMore, networkStatus, refetch }) => {
-          const networkHttp = getOr([], `source.NetworkHttp.edges`, data);
-          this.setFetchMore(fetchMore);
-          this.setFetchMoreOptions((newActivePage: number) => ({
-            variables: {
-              pagination: generateTablePaginationOptions(newActivePage, limit),
+  const networkHttpSearch = useCallback(
+    (request: NetworkHttpRequestOptions) => {
+      let didCancel = false;
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading(true);
+
+        const searchSubscription$ = data.search
+          .search<NetworkHttpRequestOptions, NetworkHttpStrategyResponse>(request, {
+            strategy: 'securitySolutionSearchStrategy',
+            signal: abortCtrl.current.signal,
+          })
+          .subscribe({
+            next: (response) => {
+              if (!response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                  setNetworkHttpResponse((prevResponse) => ({
+                    ...prevResponse,
+                    networkHttp: response.edges,
+                    inspect: response.inspect ?? prevResponse.inspect,
+                    pageInfo: response.pageInfo,
+                    refetch: refetch.current,
+                    totalCount: response.totalCount,
+                  }));
+                }
+                searchSubscription$.unsubscribe();
+              } else if (response.isPartial && !response.isRunning) {
+                if (!didCancel) {
+                  setLoading(false);
+                }
+                // TODO: Make response error status clearer
+                notifications.toasts.addWarning(i18n.ERROR_NETWORK_HTTP);
+                searchSubscription$.unsubscribe();
+              }
             },
-            updateQuery: (prev, { fetchMoreResult }) => {
-              if (!fetchMoreResult) {
-                return prev;
+            error: (msg) => {
+              if (!(msg instanceof AbortError)) {
+                notifications.toasts.addDanger({
+                  title: i18n.FAIL_NETWORK_HTTP,
+                  text: msg.message,
+                });
               }
-              return {
-                ...fetchMoreResult,
-                source: {
-                  ...fetchMoreResult.source,
-                  NetworkHttp: {
-                    ...fetchMoreResult.source.NetworkHttp,
-                    edges: [...fetchMoreResult.source.NetworkHttp.edges],
-                  },
-                },
-              };
             },
-          }));
-          const isLoading = this.isItAValidLoading(loading, variables, networkStatus);
-          return children({
-            id,
-            inspect: getOr(null, 'source.NetworkHttp.inspect', data),
-            isInspected,
-            loading: isLoading,
-            loadPage: this.wrappedLoadMore,
-            networkHttp,
-            pageInfo: getOr({}, 'source.NetworkHttp.pageInfo', data),
-            refetch: this.memoizedRefetchQuery(variables, limit, refetch),
-            totalCount: getOr(-1, 'source.NetworkHttp.totalCount', data),
           });
-        }}
-      </Query>
-    );
-  }
-}
+      };
+      abortCtrl.current.abort();
+      asyncSearch();
+      refetch.current = asyncSearch;
+      return () => {
+        didCancel = true;
+        abortCtrl.current.abort();
+      };
+    },
+    [data.search, notifications.toasts]
+  );
 
-const makeMapStateToProps = () => {
-  const getHttpSelector = networkSelectors.httpSelector();
-  const getQuery = inputsSelectors.globalQueryByIdSelector();
-  return (state: State, { id = ID, type }: OwnProps) => {
-    const { isInspected } = getQuery(state, id);
-    return {
-      ...getHttpSelector(state, type),
-      isInspected,
-    };
-  };
-};
+  useEffect(() => {
+    setHostRequest((prevRequest) => {
+      const myRequest = {
+        ...prevRequest,
+        defaultIndex,
+        filterQuery: createFilter(filterQuery),
+        pagination: generateTablePaginationOptions(activePage, limit),
+        sort: sort as SortField,
+        timerange: {
+          interval: '12h',
+          from: startDate,
+          to: endDate,
+        },
+      };
+      if (!skip && !deepEqual(prevRequest, myRequest)) {
+        return myRequest;
+      }
+      return prevRequest;
+    });
+  }, [activePage, defaultIndex, endDate, filterQuery, limit, startDate, sort, skip]);
+
+  useEffect(() => {
+    networkHttpSearch(networkHttpRequest);
+  }, [networkHttpRequest, networkHttpSearch]);
 
-export const NetworkHttpQuery = compose<React.ComponentClass<OwnProps>>(
-  connect(makeMapStateToProps),
-  withKibana
-)(NetworkHttpComponentQuery);
+  return [loading, networkHttpResponse];
+};
diff --git a/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts b/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts
new file mode 100644
index 00000000000000..7909a5e48b8c4e
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/network/containers/network_http/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_NETWORK_HTTP = i18n.translate(
+  'xpack.securitySolution.networkHttp.errorSearchDescription',
+  {
+    defaultMessage: `An error has occurred on network http search`,
+  }
+);
+
+export const FAIL_NETWORK_HTTP = i18n.translate(
+  'xpack.securitySolution.networkHttp.failSearchDescription',
+  {
+    defaultMessage: `Failed to run search on network http`,
+  }
+);
diff --git a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
index 551de698cfa08d..1b1b2b5f4f46e2 100644
--- a/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/ip_details/network_http_query_table.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { OwnProps } from './types';
-import { NetworkHttpQuery } from '../../containers/network_http';
+import { useNetworkHttp } from '../../containers/network_http';
 import { NetworkHttpTable } from '../../components/network_http_table';
 
 const NetworkHttpTableManage = manageQuery(NetworkHttpTable);
@@ -21,43 +21,35 @@ export const NetworkHttpQueryTable = ({
   skip,
   startDate,
   type,
-}: OwnProps) => (
-  <NetworkHttpQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    ip={ip}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={type}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkHttp,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkHttpTableManage
-        data={networkHttp}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={type}
-      />
-    )}
-  </NetworkHttpQuery>
-);
+}: OwnProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkHttp, pageInfo, refetch, totalCount },
+  ] = useNetworkHttp({
+    endDate,
+    filterQuery,
+    ip,
+    skip,
+    startDate,
+    type,
+  });
+
+  return (
+    <NetworkHttpTableManage
+      data={networkHttp}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={type}
+    />
+  );
+};
 
 NetworkHttpQueryTable.displayName = 'NetworkHttpQueryTable';
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx b/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
index 7e0c4025d6cac1..3caff05734c1e4 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/http_query_tab_body.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { getOr } from 'lodash/fp';
 
 import { NetworkHttpTable } from '../../components/network_http_table';
-import { NetworkHttpQuery } from '../../containers/network_http';
+import { useNetworkHttp } from '../../containers/network_http';
 import { networkModel } from '../../store';
 import { manageQuery } from '../../../common/components/page/manage_query';
 
@@ -22,42 +22,34 @@ export const HttpQueryTabBody = ({
   skip,
   startDate,
   setQuery,
-}: HttpQueryTabBodyProps) => (
-  <NetworkHttpQuery
-    endDate={endDate}
-    filterQuery={filterQuery}
-    skip={skip}
-    sourceId="default"
-    startDate={startDate}
-    type={networkModel.NetworkType.page}
-  >
-    {({
-      id,
-      inspect,
-      isInspected,
-      loading,
-      loadPage,
-      networkHttp,
-      pageInfo,
-      refetch,
-      totalCount,
-    }) => (
-      <NetworkHttpTableManage
-        data={networkHttp}
-        fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
-        id={id}
-        inspect={inspect}
-        isInspect={isInspected}
-        loading={loading}
-        loadPage={loadPage}
-        refetch={refetch}
-        setQuery={setQuery}
-        showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
-        totalCount={totalCount}
-        type={networkModel.NetworkType.page}
-      />
-    )}
-  </NetworkHttpQuery>
-);
+}: HttpQueryTabBodyProps) => {
+  const [
+    loading,
+    { id, inspect, isInspected, loadPage, networkHttp, pageInfo, refetch, totalCount },
+  ] = useNetworkHttp({
+    endDate,
+    filterQuery,
+    skip,
+    startDate,
+    type: networkModel.NetworkType.page,
+  });
+
+  return (
+    <NetworkHttpTableManage
+      data={networkHttp}
+      fakeTotalCount={getOr(50, 'fakeTotalCount', pageInfo)}
+      id={id}
+      inspect={inspect}
+      isInspect={isInspected}
+      loading={loading}
+      loadPage={loadPage}
+      refetch={refetch}
+      setQuery={setQuery}
+      showMorePagesIndicator={getOr(false, 'showMorePagesIndicator', pageInfo)}
+      totalCount={totalCount}
+      type={networkModel.NetworkType.page}
+    />
+  );
+};
 
 HttpQueryTabBody.displayName = 'HttpQueryTabBody';
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
new file mode 100644
index 00000000000000..b8a28441337c7b
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/helpers.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get, getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+import {
+  NetworkHttpBuckets,
+  NetworkHttpEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+export const getHttpEdges = (response: IEsSearchResponse<unknown>): NetworkHttpEdges[] =>
+  formatHttpEdges(getOr([], `aggregations.url.buckets`, response.rawResponse));
+
+const formatHttpEdges = (buckets: NetworkHttpBuckets[]): NetworkHttpEdges[] =>
+  buckets.map((bucket: NetworkHttpBuckets) => ({
+    node: {
+      _id: bucket.key,
+      domains: bucket.domains.buckets.map(({ key }) => key),
+      methods: bucket.methods.buckets.map(({ key }) => key),
+      statuses: bucket.status.buckets.map(({ key }) => `${key}`),
+      lastHost: get('source.hits.hits[0]._source.host.name', bucket),
+      lastSourceIp: get('source.hits.hits[0]._source.source.ip', bucket),
+      path: bucket.key,
+      requestCount: bucket.doc_count,
+    },
+    cursor: {
+      value: bucket.key,
+      tiebreaker: null,
+    },
+  }));
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
new file mode 100644
index 00000000000000..b6c26cd533de23
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/index.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getOr } from 'lodash/fp';
+
+import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
+
+import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
+import {
+  NetworkHttpStrategyResponse,
+  NetworkQueries,
+  NetworkHttpRequestOptions,
+  NetworkHttpEdges,
+} from '../../../../../../common/search_strategy/security_solution/network';
+
+import { inspectStringifyObject } from '../../../../../utils/build_query';
+import { SecuritySolutionFactory } from '../../types';
+
+import { getHttpEdges } from './helpers';
+import { buildHttpQuery } from './query.http_network.dsl';
+
+export const networkHttp: SecuritySolutionFactory<NetworkQueries.http> = {
+  buildDsl: (options: NetworkHttpRequestOptions) => {
+    if (options.pagination && options.pagination.querySize >= DEFAULT_MAX_TABLE_QUERY_SIZE) {
+      throw new Error(`No query size above ${DEFAULT_MAX_TABLE_QUERY_SIZE}`);
+    }
+    return buildHttpQuery(options);
+  },
+  parse: async (
+    options: NetworkHttpRequestOptions,
+    response: IEsSearchResponse<unknown>
+  ): Promise<NetworkHttpStrategyResponse> => {
+    const { activePage, cursorStart, fakePossibleCount, querySize } = options.pagination;
+    const totalCount = getOr(0, 'aggregations.http_count.value', response.rawResponse);
+    const networkHttpEdges: NetworkHttpEdges[] = getHttpEdges(response);
+    const fakeTotalCount = fakePossibleCount <= totalCount ? fakePossibleCount : totalCount;
+    const edges = networkHttpEdges.splice(cursorStart, querySize - cursorStart);
+    const inspect = {
+      dsl: [inspectStringifyObject(buildHttpQuery(options))],
+      response: [inspectStringifyObject(response)],
+    };
+    const showMorePagesIndicator = totalCount > fakeTotalCount;
+
+    return {
+      ...response,
+      edges,
+      inspect,
+      pageInfo: {
+        activePage: activePage ? activePage : 0,
+        fakeTotalCount,
+        showMorePagesIndicator,
+      },
+      totalCount,
+    };
+  },
+};
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
new file mode 100644
index 00000000000000..31d695d6a05910
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/http/query.http_network.dsl.ts
@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createQueryFilterClauses } from '../../../../../utils/build_query';
+
+import {
+  NetworkHttpRequestOptions,
+  SortField,
+} from '../../../../../../common/search_strategy/security_solution';
+
+const getCountAgg = () => ({
+  http_count: {
+    cardinality: {
+      field: 'url.path',
+    },
+  },
+});
+
+export const buildHttpQuery = ({
+  defaultIndex,
+  filterQuery,
+  sort,
+  pagination: { querySize },
+  timerange: { from, to },
+  ip,
+}: NetworkHttpRequestOptions) => {
+  const filter = [
+    ...createQueryFilterClauses(filterQuery),
+    {
+      range: {
+        '@timestamp': { gte: from, lte: to, format: 'strict_date_optional_time' },
+      },
+    },
+    { exists: { field: 'http.request.method' } },
+  ];
+
+  const dslQuery = {
+    allowNoIndices: true,
+    index: defaultIndex,
+    ignoreUnavailable: true,
+    body: {
+      aggregations: {
+        ...getCountAgg(),
+        ...getHttpAggs(sort, querySize),
+      },
+      query: {
+        bool: ip
+          ? {
+              filter,
+              should: [
+                {
+                  term: {
+                    'source.ip': ip,
+                  },
+                },
+                {
+                  term: {
+                    'destination.ip': ip,
+                  },
+                },
+              ],
+              minimum_should_match: 1,
+            }
+          : {
+              filter,
+            },
+      },
+    },
+    size: 0,
+    track_total_hits: false,
+  };
+  return dslQuery;
+};
+
+const getHttpAggs = (sortField: SortField, querySize: number) => ({
+  url: {
+    terms: {
+      field: `url.path`,
+      size: querySize,
+      order: {
+        _count: sortField.direction,
+      },
+    },
+    aggs: {
+      methods: {
+        terms: {
+          field: 'http.request.method',
+          size: 4,
+        },
+      },
+      domains: {
+        terms: {
+          field: 'url.domain',
+          size: 4,
+        },
+      },
+      status: {
+        terms: {
+          field: 'http.response.status_code',
+          size: 4,
+        },
+      },
+      source: {
+        top_hits: {
+          size: 1,
+          _source: {
+            includes: ['host.name', 'source.ip'],
+          },
+        },
+      },
+    },
+  },
+});
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
index 2c21d9741d648f..7d40b034c66bb0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/index.ts
@@ -8,8 +8,10 @@ import { FactoryQueryTypes } from '../../../../../common/search_strategy/securit
 import { NetworkQueries } from '../../../../../common/search_strategy/security_solution/network';
 
 import { SecuritySolutionFactory } from '../types';
+import { networkHttp } from './http';
 import { networkTls } from './tls';
 
 export const networkFactory: Record<NetworkQueries, SecuritySolutionFactory<FactoryQueryTypes>> = {
+  [NetworkQueries.http]: networkHttp,
   [NetworkQueries.tls]: networkTls,
 };