diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
index 589af011452539..10f18481ecc191 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
@@ -35,6 +35,8 @@ describe('TelemetryEventsSender', () => {
             name: 'test',
           },
           rule: {
+            id: 'X',
+            name: 'Y',
             ruleset: 'Z',
           },
           file: {
@@ -50,6 +52,9 @@ describe('TelemetryEventsSender', () => {
               malware_classification: {
                 key1: 'X',
               },
+              malware_signature: {
+                key1: 'X',
+              },
               quarantine_result: true,
               quarantine_message: 'this file is bad',
               something_else: 'nope',
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
index 38137b04f957d5..3ee18a84e11333 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -308,6 +308,8 @@ const allowlistEventFields: AllowlistFields = {
   elastic: true,
   event: true,
   rule: {
+    id: true,
+    name: true,
     ruleset: true,
   },
   file: {
@@ -322,6 +324,7 @@ const allowlistEventFields: AllowlistFields = {
     Ext: {
       code_signature: true,
       malware_classification: true,
+      malware_signature: true,
       quarantine_result: true,
       quarantine_message: true,
     },