diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
index 250a5b25230f..36649d22f730 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/middleware.ts
@@ -36,6 +36,13 @@ export const policyDetailsMiddlewareFactory: ImmutableMiddlewareFactory<PolicyDe
 
       try {
         policyItem = (await sendGetPackagePolicy(http, id)).item;
+        // sets default user notification message if policy config message is empty
+        if (policyItem.inputs[0].config.policy.value.windows.popup.malware.message === '') {
+          policyItem.inputs[0].config.policy.value.windows.popup.malware.message =
+            'Elastic Security { action } { filename }';
+          policyItem.inputs[0].config.policy.value.mac.popup.malware.message =
+            'Elastic Security { action } { filename }';
+        }
       } catch (error) {
         dispatch({
           type: 'serverFailedToReturnPolicyDetailsData',
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
index 215851fb2815..b61dee526973 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
@@ -13,6 +13,7 @@ import {
   EuiTitle,
   EuiText,
   EuiSpacer,
+  EuiTextArea,
   htmlIdGenerator,
   EuiCallOut,
   EuiCheckbox,
@@ -114,6 +115,8 @@ export const MalwareProtections = React.memo(() => {
   const selected = policyDetailsConfig && policyDetailsConfig.windows.malware.mode;
   const userNotificationSelected =
     policyDetailsConfig && policyDetailsConfig.windows.popup.malware.enabled;
+  const userNotificationMessage =
+    policyDetailsConfig && policyDetailsConfig.windows.popup.malware.message;
 
   const radios: Immutable<Array<{
     id: ProtectionModes;
@@ -178,16 +181,32 @@ export const MalwareProtections = React.memo(() => {
     [policyDetailsConfig, dispatch]
   );
 
+  const handleCustomUserNotification = useCallback(
+    (event) => {
+      if (policyDetailsConfig) {
+        const newPayload = cloneDeep(policyDetailsConfig);
+        for (const os of OSes) {
+          newPayload[os].popup[protection].message = event.target.value.trim();
+        }
+        dispatch({
+          type: 'userChangedPolicyConfig',
+          payload: { policyConfig: newPayload },
+        });
+      }
+    },
+    [policyDetailsConfig, dispatch]
+  );
+
   const radioButtons = useMemo(() => {
     return (
       <>
-        <EuiTitle size="xxxs">
-          <h6>
+        <EuiTitle size="xxs">
+          <h5>
             <FormattedMessage
               id="xpack.securitySolution.endpoint.policyDetailsConfig.protectionLevel"
               defaultMessage="Protection Level"
             />
-          </h6>
+          </h5>
         </EuiTitle>
         <EuiSpacer size="xs" />
         <ProtectionRadioGroup>
@@ -202,13 +221,13 @@ export const MalwareProtections = React.memo(() => {
           })}
         </ProtectionRadioGroup>
         <EuiSpacer size="s" />
-        <EuiTitle size="xxxs">
-          <h6>
+        <EuiTitle size="xxs">
+          <h5>
             <FormattedMessage
               id="xpack.securitySolution.endpoint.policyDetailsConfig.userNotification"
               defaultMessage="User Notification"
             />
-          </h6>
+          </h5>
         </EuiTitle>
         <SupportedVersionNotice optionName="malware" />
         <EuiSpacer size="s" />
@@ -220,9 +239,40 @@ export const MalwareProtections = React.memo(() => {
             defaultMessage: 'Notify User',
           })}
         />
+        {userNotificationSelected && (
+          <>
+            <EuiSpacer size="s" />
+            <EuiText size="xs">
+              <h4>
+                <FormattedMessage
+                  id="xpack.securitySolution.endpoint.policyDetailsConfig.customizeUserNotification"
+                  defaultMessage="Customize notification message"
+                />
+              </h4>
+            </EuiText>
+            <EuiSpacer size="xs" />
+            <EuiTextArea
+              placeholder={i18n.translate(
+                'xpack.securitySolution.endpoint.policyDetails.malware.userNotification.placeholder',
+                {
+                  defaultMessage: 'Input your custom notification message',
+                }
+              )}
+              value={userNotificationMessage}
+              onChange={handleCustomUserNotification}
+              fullWidth={true}
+            />
+          </>
+        )}
       </>
     );
-  }, [radios, handleUserNotificationCheckbox, userNotificationSelected]);
+  }, [
+    radios,
+    handleUserNotificationCheckbox,
+    userNotificationSelected,
+    userNotificationMessage,
+    handleCustomUserNotification,
+  ]);
 
   const protectionSwitch = useMemo(() => {
     return (
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 6af9ac2650e8..15c26a1b9374 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -199,7 +199,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                 popup: {
                   malware: {
                     enabled: true,
-                    message: '',
+                    message: 'Elastic Security { action } { filename }',
                   },
                 },
               },
@@ -218,7 +218,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
                 popup: {
                   malware: {
                     enabled: true,
-                    message: '',
+                    message: 'Elastic Security { action } { filename }',
                   },
                 },
               },