diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts
index f04f25f44b33c..2cf7e95f3c621 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.test.ts
@@ -365,6 +365,94 @@ describe('utils', () => {
         )
       ).toEqual(NOTIFICATION_THROTTLE_RULE);
     });
+
+    test('it will use the "rule" and not the "legacyRuleActions" if the rule and actions is defined', () => {
+      const legacyRuleActions: LegacyRuleActions = {
+        id: 'id_1',
+        ruleThrottle: '',
+        alertThrottle: '',
+        actions: [
+          {
+            id: 'id_2',
+            group: 'group',
+            action_type_id: 'actionTypeId',
+            params: {},
+          },
+        ],
+      };
+
+      expect(
+        transformFromAlertThrottle(
+          {
+            muteAll: true,
+            notifyWhen: 'onActiveAlert',
+            actions: [
+              {
+                group: 'group',
+                id: 'id-123',
+                actionTypeId: 'id-456',
+                params: {},
+              },
+            ],
+          } as SanitizedAlert<RuleParams>,
+          legacyRuleActions
+        )
+      ).toEqual(NOTIFICATION_THROTTLE_NO_ACTIONS);
+    });
+
+    test('it will use the "legacyRuleActions" and not the "rule" if the rule actions is an empty array', () => {
+      const legacyRuleActions: LegacyRuleActions = {
+        id: 'id_1',
+        ruleThrottle: NOTIFICATION_THROTTLE_RULE,
+        alertThrottle: null,
+        actions: [
+          {
+            id: 'id_2',
+            group: 'group',
+            action_type_id: 'actionTypeId',
+            params: {},
+          },
+        ],
+      };
+
+      expect(
+        transformFromAlertThrottle(
+          {
+            muteAll: true,
+            notifyWhen: 'onActiveAlert',
+            actions: [],
+          } as unknown as SanitizedAlert<RuleParams>,
+          legacyRuleActions
+        )
+      ).toEqual(NOTIFICATION_THROTTLE_RULE);
+    });
+
+    test('it will use the "legacyRuleActions" and not the "rule" if the rule actions is a null', () => {
+      const legacyRuleActions: LegacyRuleActions = {
+        id: 'id_1',
+        ruleThrottle: NOTIFICATION_THROTTLE_RULE,
+        alertThrottle: null,
+        actions: [
+          {
+            id: 'id_2',
+            group: 'group',
+            action_type_id: 'actionTypeId',
+            params: {},
+          },
+        ],
+      };
+
+      expect(
+        transformFromAlertThrottle(
+          {
+            muteAll: true,
+            notifyWhen: 'onActiveAlert',
+            actions: null,
+          } as unknown as SanitizedAlert<RuleParams>,
+          legacyRuleActions
+        )
+      ).toEqual(NOTIFICATION_THROTTLE_RULE);
+    });
   });
 
   describe('#transformActions', () => {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
index a54e606e92053..4647a4a9951df 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/utils.ts
@@ -64,6 +64,7 @@ import { RulesClient } from '../../../../../alerting/server';
 // eslint-disable-next-line no-restricted-imports
 import { LegacyRuleActions } from '../rule_actions/legacy_types';
 import { FullResponseSchema } from '../../../../common/detection_engine/schemas/request';
+import { transformAlertToRuleAction } from '../../../../common/detection_engine/transform_actions';
 
 export const calculateInterval = (
   interval: string | undefined,
@@ -230,12 +231,7 @@ export const transformActions = (
   legacyRuleActions: LegacyRuleActions | null | undefined
 ): FullResponseSchema['actions'] => {
   if (alertAction != null && alertAction.length !== 0) {
-    return alertAction.map((action) => ({
-      group: action.group,
-      id: action.id,
-      action_type_id: action.actionTypeId,
-      params: action.params,
-    }));
+    return alertAction.map((action) => transformAlertToRuleAction(action));
   } else if (legacyRuleActions != null) {
     return legacyRuleActions.actions;
   } else {