diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.test.ts
index caf2cea1f05e2..8fb2ac90195ba 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.test.ts
@@ -4,213 +4,470 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getRulesToUpdate } from './get_rules_to_update';
+import { filterInstalledRules, getRulesToUpdate, mergeExceptionLists } from './get_rules_to_update';
 import { getResult } from '../routes/__mocks__/request_responses';
 import { getAddPrepackagedRulesSchemaDecodedMock } from '../../../../common/detection_engine/schemas/request/add_prepackaged_rules_schema.mock';
 
 describe('get_rules_to_update', () => {
-  test('should return empty array if both rule sets are empty', () => {
-    const update = getRulesToUpdate([], []);
-    expect(update).toEqual([]);
+  describe('get_rules_to_update', () => {
+    test('should return empty array if both rule sets are empty', () => {
+      const update = getRulesToUpdate([], []);
+      expect(update).toEqual([]);
+    });
+
+    test('should return empty array if the id of the two rules do not match', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 2;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-2';
+      installedRule.params.version = 1;
+      const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
+      expect(update).toEqual([]);
+    });
+
+    test('should return empty array if the id of file system rule is less than the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 1;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 2;
+      const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
+      expect(update).toEqual([]);
+    });
+
+    test('should return empty array if the id of file system rule is the same as the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 1;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 1;
+      const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
+      expect(update).toEqual([]);
+    });
+
+    test('should return the rule to update if the id of file system rule is greater than the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 2;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 1;
+      installedRule.params.exceptionsList = [];
+
+      const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
+      expect(update).toEqual([ruleFromFileSystem]);
+    });
+
+    test('should return 1 rule out of 2 to update if the id of file system rule is greater than the installed version of just one', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [];
+
+      const installedRule2 = getResult();
+      installedRule2.params.ruleId = 'rule-2';
+      installedRule2.params.version = 1;
+      installedRule2.params.exceptionsList = [];
+
+      const update = getRulesToUpdate([ruleFromFileSystem], [installedRule1, installedRule2]);
+      expect(update).toEqual([ruleFromFileSystem]);
+    });
+
+    test('should return 2 rules out of 2 to update if the id of file system rule is greater than the installed version of both', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const ruleFromFileSystem2 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem2.rule_id = 'rule-2';
+      ruleFromFileSystem2.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [];
+
+      const installedRule2 = getResult();
+      installedRule2.params.ruleId = 'rule-2';
+      installedRule2.params.version = 1;
+      installedRule2.params.exceptionsList = [];
+
+      const update = getRulesToUpdate(
+        [ruleFromFileSystem1, ruleFromFileSystem2],
+        [installedRule1, installedRule2]
+      );
+      expect(update).toEqual([ruleFromFileSystem1, ruleFromFileSystem2]);
+    });
+
+    test('should add back an exception_list if it was removed by the end user on an immutable rule during an upgrade', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [];
+
+      const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
+      expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
+    });
+
+    test('should not remove an additional exception_list if an additional one was added by the end user on an immutable rule during an upgrade', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'second_exception_list',
+          list_id: 'some-other-id',
+          namespace_type: 'single',
+          type: 'detection',
+        },
+      ];
+
+      const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
+      expect(update.exceptions_list).toEqual([
+        ...ruleFromFileSystem1.exceptions_list,
+        ...installedRule1.params.exceptionsList,
+      ]);
+    });
+
+    test('should not remove an existing exception_list if they are the same between the current installed one and the upgraded one', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
+      expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
+    });
+
+    test('should not remove an existing exception_list if the rule has an empty exceptions list', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
+      expect(update.exceptions_list).toEqual(installedRule1.params.exceptionsList);
+    });
+
+    test('should not remove an existing exception_list if the rule has an empty exceptions list for multiple rules', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const ruleFromFileSystem2 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem2.exceptions_list = [];
+      ruleFromFileSystem2.rule_id = 'rule-2';
+      ruleFromFileSystem2.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      const installedRule2 = getResult();
+      installedRule2.params.ruleId = 'rule-2';
+      installedRule2.params.version = 1;
+      installedRule2.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const [update1, update2] = getRulesToUpdate(
+        [ruleFromFileSystem1, ruleFromFileSystem2],
+        [installedRule1, installedRule2]
+      );
+      expect(update1.exceptions_list).toEqual(installedRule1.params.exceptionsList);
+      expect(update2.exceptions_list).toEqual(installedRule2.params.exceptionsList);
+    });
+
+    test('should not remove an existing exception_list if the rule has an empty exceptions list for mixed rules', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const ruleFromFileSystem2 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem2.exceptions_list = [];
+      ruleFromFileSystem2.rule_id = 'rule-2';
+      ruleFromFileSystem2.version = 2;
+      ruleFromFileSystem2.exceptions_list = [
+        {
+          id: 'second_list',
+          list_id: 'second_list',
+          namespace_type: 'single',
+          type: 'detection',
+        },
+      ];
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const installedRule2 = getResult();
+      installedRule2.params.ruleId = 'rule-2';
+      installedRule2.params.version = 1;
+      installedRule2.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const [update1, update2] = getRulesToUpdate(
+        [ruleFromFileSystem1, ruleFromFileSystem2],
+        [installedRule1, installedRule2]
+      );
+      expect(update1.exceptions_list).toEqual(installedRule1.params.exceptionsList);
+      expect(update2.exceptions_list).toEqual([
+        ...ruleFromFileSystem2.exceptions_list,
+        ...installedRule2.params.exceptionsList,
+      ]);
+    });
   });
 
-  test('should return empty array if the id of the two rules do not match', () => {
-    const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem.rule_id = 'rule-1';
-    ruleFromFileSystem.version = 2;
-
-    const installedRule = getResult();
-    installedRule.params.ruleId = 'rule-2';
-    installedRule.params.version = 1;
-    const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
-    expect(update).toEqual([]);
-  });
-
-  test('should return empty array if the id of file system rule is less than the installed version', () => {
-    const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem.rule_id = 'rule-1';
-    ruleFromFileSystem.version = 1;
-
-    const installedRule = getResult();
-    installedRule.params.ruleId = 'rule-1';
-    installedRule.params.version = 2;
-    const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
-    expect(update).toEqual([]);
-  });
-
-  test('should return empty array if the id of file system rule is the same as the installed version', () => {
-    const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem.rule_id = 'rule-1';
-    ruleFromFileSystem.version = 1;
-
-    const installedRule = getResult();
-    installedRule.params.ruleId = 'rule-1';
-    installedRule.params.version = 1;
-    const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
-    expect(update).toEqual([]);
-  });
-
-  test('should return the rule to update if the id of file system rule is greater than the installed version', () => {
-    const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem.rule_id = 'rule-1';
-    ruleFromFileSystem.version = 2;
-
-    const installedRule = getResult();
-    installedRule.params.ruleId = 'rule-1';
-    installedRule.params.version = 1;
-    installedRule.params.exceptionsList = [];
-
-    const update = getRulesToUpdate([ruleFromFileSystem], [installedRule]);
-    expect(update).toEqual([ruleFromFileSystem]);
-  });
-
-  test('should return 1 rule out of 2 to update if the id of file system rule is greater than the installed version of just one', () => {
-    const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem.rule_id = 'rule-1';
-    ruleFromFileSystem.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [];
-
-    const installedRule2 = getResult();
-    installedRule2.params.ruleId = 'rule-2';
-    installedRule2.params.version = 1;
-    installedRule2.params.exceptionsList = [];
-
-    const update = getRulesToUpdate([ruleFromFileSystem], [installedRule1, installedRule2]);
-    expect(update).toEqual([ruleFromFileSystem]);
-  });
-
-  test('should return 2 rules out of 2 to update if the id of file system rule is greater than the installed version of both', () => {
-    const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem1.rule_id = 'rule-1';
-    ruleFromFileSystem1.version = 2;
-
-    const ruleFromFileSystem2 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem2.rule_id = 'rule-2';
-    ruleFromFileSystem2.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [];
-
-    const installedRule2 = getResult();
-    installedRule2.params.ruleId = 'rule-2';
-    installedRule2.params.version = 1;
-    installedRule2.params.exceptionsList = [];
-
-    const update = getRulesToUpdate(
-      [ruleFromFileSystem1, ruleFromFileSystem2],
-      [installedRule1, installedRule2]
-    );
-    expect(update).toEqual([ruleFromFileSystem1, ruleFromFileSystem2]);
-  });
-
-  test('should add back an exception_list if it was removed by the end user on an immutable rule during an upgrade', () => {
-    const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem1.exceptions_list = [
-      {
-        id: 'endpoint_list',
-        list_id: 'endpoint_list',
-        namespace_type: 'agnostic',
-        type: 'endpoint',
-      },
-    ];
-    ruleFromFileSystem1.rule_id = 'rule-1';
-    ruleFromFileSystem1.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [];
-
-    const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
-    expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
-  });
-
-  test('should not remove an additional exception_list if an additional one was added by the end user on an immutable rule during an upgrade', () => {
-    const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem1.exceptions_list = [
-      {
-        id: 'endpoint_list',
-        list_id: 'endpoint_list',
-        namespace_type: 'agnostic',
-        type: 'endpoint',
-      },
-    ];
-    ruleFromFileSystem1.rule_id = 'rule-1';
-    ruleFromFileSystem1.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [
-      {
-        id: 'second_exception_list',
-        list_id: 'some-other-id',
-        namespace_type: 'single',
-        type: 'detection',
-      },
-    ];
-
-    const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
-    expect(update.exceptions_list).toEqual([
-      ...ruleFromFileSystem1.exceptions_list,
-      ...installedRule1.params.exceptionsList,
-    ]);
-  });
-
-  test('should not remove an existing exception_list if they are the same between the current installed one and the upgraded one', () => {
-    const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem1.exceptions_list = [
-      {
-        id: 'endpoint_list',
-        list_id: 'endpoint_list',
-        namespace_type: 'agnostic',
-        type: 'endpoint',
-      },
-    ];
-    ruleFromFileSystem1.rule_id = 'rule-1';
-    ruleFromFileSystem1.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [
-      {
-        id: 'endpoint_list',
-        list_id: 'endpoint_list',
-        namespace_type: 'agnostic',
-        type: 'endpoint',
-      },
-    ];
-
-    const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
-    expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
+  describe('filterInstalledRules', () => {
+    test('should return "false" if the id of the two rules do not match', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 2;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-2';
+      installedRule.params.version = 1;
+      const shouldUpdate = filterInstalledRules(ruleFromFileSystem, [installedRule]);
+      expect(shouldUpdate).toEqual(false);
+    });
+
+    test('should return "false" if the id of file system rule is less than the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 1;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 2;
+      const shouldUpdate = filterInstalledRules(ruleFromFileSystem, [installedRule]);
+      expect(shouldUpdate).toEqual(false);
+    });
+
+    test('should return "false" if the id of file system rule is the same as the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 1;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 1;
+      const shouldUpdate = filterInstalledRules(ruleFromFileSystem, [installedRule]);
+      expect(shouldUpdate).toEqual(false);
+    });
+
+    test('should return "true" to update if the id of file system rule is greater than the installed version', () => {
+      const ruleFromFileSystem = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem.rule_id = 'rule-1';
+      ruleFromFileSystem.version = 2;
+
+      const installedRule = getResult();
+      installedRule.params.ruleId = 'rule-1';
+      installedRule.params.version = 1;
+      installedRule.params.exceptionsList = [];
+
+      const shouldUpdate = filterInstalledRules(ruleFromFileSystem, [installedRule]);
+      expect(shouldUpdate).toEqual(true);
+    });
   });
 
-  test('should not remove an existing exception_list if the rule has an empty exceptions list', () => {
-    const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
-    ruleFromFileSystem1.exceptions_list = [];
-    ruleFromFileSystem1.rule_id = 'rule-1';
-    ruleFromFileSystem1.version = 2;
-
-    const installedRule1 = getResult();
-    installedRule1.params.ruleId = 'rule-1';
-    installedRule1.params.version = 1;
-    installedRule1.params.exceptionsList = [
-      {
-        id: 'endpoint_list',
-        list_id: 'endpoint_list',
-        namespace_type: 'agnostic',
-        type: 'endpoint',
-      },
-    ];
-
-    const [update] = getRulesToUpdate([ruleFromFileSystem1], [installedRule1]);
-    expect(update.exceptions_list).toEqual(installedRule1.params.exceptionsList);
+  describe('mergeExceptionLists', () => {
+    test('should add back an exception_list if it was removed by the end user on an immutable rule during an upgrade', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [];
+
+      const update = mergeExceptionLists(ruleFromFileSystem1, [installedRule1]);
+      expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
+    });
+
+    test('should not remove an additional exception_list if an additional one was added by the end user on an immutable rule during an upgrade', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'second_exception_list',
+          list_id: 'some-other-id',
+          namespace_type: 'single',
+          type: 'detection',
+        },
+      ];
+
+      const update = mergeExceptionLists(ruleFromFileSystem1, [installedRule1]);
+      expect(update.exceptions_list).toEqual([
+        ...ruleFromFileSystem1.exceptions_list,
+        ...installedRule1.params.exceptionsList,
+      ]);
+    });
+
+    test('should not remove an existing exception_list if they are the same between the current installed one and the upgraded one', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const update = mergeExceptionLists(ruleFromFileSystem1, [installedRule1]);
+      expect(update.exceptions_list).toEqual(ruleFromFileSystem1.exceptions_list);
+    });
+
+    test('should not remove an existing exception_list if the rule has an empty exceptions list', () => {
+      const ruleFromFileSystem1 = getAddPrepackagedRulesSchemaDecodedMock();
+      ruleFromFileSystem1.exceptions_list = [];
+      ruleFromFileSystem1.rule_id = 'rule-1';
+      ruleFromFileSystem1.version = 2;
+
+      const installedRule1 = getResult();
+      installedRule1.params.ruleId = 'rule-1';
+      installedRule1.params.version = 1;
+      installedRule1.params.exceptionsList = [
+        {
+          id: 'endpoint_list',
+          list_id: 'endpoint_list',
+          namespace_type: 'agnostic',
+          type: 'endpoint',
+        },
+      ];
+
+      const update = mergeExceptionLists(ruleFromFileSystem1, [installedRule1]);
+      expect(update.exceptions_list).toEqual(installedRule1.params.exceptionsList);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.ts
index a5fa30679f813..28a58ea49b903 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_rules_to_update.ts
@@ -7,41 +7,38 @@
 import { AddPrepackagedRulesSchemaDecoded } from '../../../../common/detection_engine/schemas/request/add_prepackaged_rules_schema';
 import { RuleAlertType } from './types';
 
+/**
+ * Returns the rules to update by doing a compare to the rules from the file system against
+ * the installed rules already. This also merges exception list items between the two since
+ * exception list items can exist on both rules to update and already installed rules.
+ * @param rulesFromFileSystem The rules on the file system to check against installed
+ * @param installedRules The installed rules
+ */
 export const getRulesToUpdate = (
   rulesFromFileSystem: AddPrepackagedRulesSchemaDecoded[],
   installedRules: RuleAlertType[]
 ): AddPrepackagedRulesSchemaDecoded[] => {
   return rulesFromFileSystem
-    .filter((ruleFromFileSystem) =>
-      installedRules.some((installedRule) => {
-        return (
-          ruleFromFileSystem.rule_id === installedRule.params.ruleId &&
-          ruleFromFileSystem.version > installedRule.params.version
-        );
-      })
-    )
-    .map((ruleFromFileSystem) => {
-      if (ruleFromFileSystem.exceptions_list != null) {
-        const installedRule = installedRules.find(
-          (ruleToFind) => ruleToFind.params.ruleId === ruleFromFileSystem.rule_id
-        );
-        if (installedRule != null && installedRule.params.exceptionsList != null) {
-          const installedExceptionList = installedRule.params.exceptionsList;
-          const fileSystemExceptions = ruleFromFileSystem.exceptions_list.filter(
-            (potentialDuplicate) =>
-              installedExceptionList.every((item) => item.list_id !== potentialDuplicate.list_id)
-          );
-          return {
-            ...ruleFromFileSystem,
-            exceptions_list: [...fileSystemExceptions, ...installedRule.params.exceptionsList],
-          };
-        } else {
-          return ruleFromFileSystem;
-        }
-      } else {
-        return ruleFromFileSystem;
-      }
-    });
+    .filter((ruleFromFileSystem) => filterInstalledRules(ruleFromFileSystem, installedRules))
+    .map((ruleFromFileSystem) => mergeExceptionLists(ruleFromFileSystem, installedRules));
+};
+
+/**
+ * Filters rules from the file system that do not match the installed rules so you only
+ * get back rules that are going to be updated
+ * @param ruleFromFileSystem The rules from the file system to check if any are updates
+ * @param installedRules The installed rules to compare against for updates
+ */
+export const filterInstalledRules = (
+  ruleFromFileSystem: AddPrepackagedRulesSchemaDecoded,
+  installedRules: RuleAlertType[]
+): boolean => {
+  return installedRules.some((installedRule) => {
+    return (
+      ruleFromFileSystem.rule_id === installedRule.params.ruleId &&
+      ruleFromFileSystem.version > installedRule.params.version
+    );
+  });
 };
 
 /**
@@ -59,15 +56,13 @@ export const mergeExceptionLists = (
       (ruleToFind) => ruleToFind.params.ruleId === ruleFromFileSystem.rule_id
     );
     if (installedRule != null && installedRule.params.exceptionsList != null) {
-      const installedExceptions = installedRule.params.exceptionsList.filter(
-        (installedExceptionList) =>
-          ruleFromFileSystem.exceptions_list.some(
-            (exceptionList) => installedExceptionList.list_id !== exceptionList.list_id
-          )
+      const installedExceptionList = installedRule.params.exceptionsList;
+      const fileSystemExceptions = ruleFromFileSystem.exceptions_list.filter((potentialDuplicate) =>
+        installedExceptionList.every((item) => item.list_id !== potentialDuplicate.list_id)
       );
       return {
         ...ruleFromFileSystem,
-        exceptions_list: [...ruleFromFileSystem.exceptions_list, ...installedExceptions],
+        exceptions_list: [...fileSystemExceptions, ...installedRule.params.exceptionsList],
       };
     } else {
       return ruleFromFileSystem;