diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
index 1a59dd06570c..be32c1c5dd03 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/helpers.tsx
@@ -219,8 +219,8 @@ export const getAlertAttachment = ({
   alertId: string;
   index: string;
   loadingAlertData: boolean;
-  ruleId: string;
-  ruleName: string;
+  ruleId?: string | null;
+  ruleName?: string | null;
 }): EuiCommentProps => {
   return {
     username: (
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
index cf68d07859ce..bc7961b75a30 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/index.tsx
@@ -379,11 +379,10 @@ export const UserActionTree = React.memo(
                   return comments;
                 }
 
-                const ruleId = comment?.rule?.id ?? manualAlertsData[alertId]?.rule?.id?.[0] ?? '';
+                const ruleId =
+                  comment?.rule?.id ?? manualAlertsData[alertId]?.signal?.rule?.id?.[0] ?? null;
                 const ruleName =
-                  comment?.rule?.name ??
-                  manualAlertsData[alertId]?.rule?.name?.[0] ??
-                  i18n.UNKNOWN_RULE;
+                  comment?.rule?.name ?? manualAlertsData[alertId]?.signal?.rule?.name?.[0] ?? null;
 
                 return [
                   ...comments,
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.test.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.test.tsx
index 228945bacf8a..f4f610d07e2f 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.test.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.test.tsx
@@ -46,11 +46,10 @@ describe('UserActionAvatar ', () => {
     expect(wrapper.text()).toBe('added an alert from Awesome rule');
   });
 
-  it('does NOT render the link when the alert is undefined', async () => {
+  it('does NOT render the link when the rule is null', async () => {
     const wrapper = mount(
       <TestProviders>
-        {/* @ts-expect-error */}
-        <AlertCommentEvent alert={undefined} commentType={CommentType.alert} />
+        <AlertCommentEvent {...props} ruleId={null} />
       </TestProviders>
     );
 
@@ -58,27 +57,7 @@ describe('UserActionAvatar ', () => {
       wrapper.find(`[data-test-subj="alert-rule-link-alert-id-1"]`).first().exists()
     ).toBeFalsy();
 
-    expect(wrapper.text()).toBe('added an alert from ');
-  });
-
-  it('does NOT render the link when the rule is undefined', async () => {
-    const alert = {
-      alertId: 'alert-id-1',
-      commentType: CommentType.alert,
-    };
-
-    const wrapper = mount(
-      <TestProviders>
-        {/* @ts-expect-error*/}
-        <AlertCommentEvent alert={alert} />
-      </TestProviders>
-    );
-
-    expect(
-      wrapper.find(`[data-test-subj="alert-rule-link-alert-id-1"]`).first().exists()
-    ).toBeFalsy();
-
-    expect(wrapper.text()).toBe('added an alert from ');
+    expect(wrapper.text()).toBe('added an alert from Unknown rule');
   });
 
   it('navigate to app on link click', async () => {
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.tsx
index 2a604b7c54d6..57c366d41266 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_alert_comment_event.tsx
@@ -6,6 +6,7 @@
  */
 
 import React, { memo, useCallback } from 'react';
+import { isEmpty } from 'lodash';
 import { EuiText, EuiLoadingSpinner } from '@elastic/eui';
 
 import { APP_ID } from '../../../../common/constants';
@@ -20,8 +21,8 @@ import { LinkAnchor } from '../../../common/components/links';
 interface Props {
   alertId: string;
   commentType: CommentType;
-  ruleId: string;
-  ruleName: string;
+  ruleId?: string | null;
+  ruleName?: string | null;
   alertsCount?: number;
   loadingAlertData?: boolean;
 }
@@ -51,16 +52,16 @@ const AlertCommentEventComponent: React.FC<Props> = ({
     <>
       {`${i18n.ALERT_COMMENT_LABEL_TITLE} `}
       {loadingAlertData && <EuiLoadingSpinner size="m" />}
-      {!loadingAlertData && ruleId !== '' && (
+      {!loadingAlertData && !isEmpty(ruleId) && (
         <LinkAnchor
           onClick={onLinkClick}
           href={formatUrl(getRuleDetailsUrl(ruleId ?? '', urlSearch))}
           data-test-subj={`alert-rule-link-${alertId ?? 'deleted'}`}
         >
-          {ruleName}
+          {ruleName ?? i18n.UNKNOWN_RULE}
         </LinkAnchor>
       )}
-      {!loadingAlertData && ruleId === '' && <EuiText>{ruleName}</EuiText>}
+      {!loadingAlertData && isEmpty(ruleId) && i18n.UNKNOWN_RULE}
     </>
   ) : (
     <>