diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/README.md b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/README.md
index 059005707625f..893797afa44d7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/README.md
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/README.md
@@ -58,7 +58,7 @@ to any newly saved rule:
             {
               "name" : "param:exceptionsList_0",
               "id" : "endpoint_list",
-              "type" : "exception-list"
+              "type" : "exception-list-agnostic"
             },
             {
               "name" : "param:exceptionsList_1",
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.test.ts
index 56a1e875ac5e7..75180c6eaee48 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.test.ts
@@ -8,8 +8,11 @@
 import { extractExceptionsList } from './extract_exceptions_list';
 import { loggingSystemMock } from 'src/core/server/mocks';
 import { RuleParams } from '../../schemas/rule_schemas';
-import { EXCEPTION_LIST_NAMESPACE } from '@kbn/securitysolution-list-constants';
-import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils';
+import {
+  EXCEPTION_LIST_NAMESPACE,
+  EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
+} from '@kbn/securitysolution-list-constants';
+import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils/constants';
 
 describe('extract_exceptions_list', () => {
   type FuncReturn = ReturnType<typeof extractExceptionsList>;
@@ -48,21 +51,21 @@ describe('extract_exceptions_list', () => {
       {
         id: '123',
         name: `${EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME}_0`,
-        type: EXCEPTION_LIST_NAMESPACE,
+        type: EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
       },
     ]);
   });
 
-  test('It returns two exception lists transformed into a saved object references', () => {
+  test('It returns 2 exception lists transformed into a saved object references', () => {
     const twoInputs: RuleParams['exceptionsList'] = [
       mockExceptionsList()[0],
-      { ...mockExceptionsList()[0], id: '976' },
+      { ...mockExceptionsList()[0], id: '976', namespace_type: 'single' },
     ];
     expect(extractExceptionsList({ logger, exceptionsList: twoInputs })).toEqual<FuncReturn>([
       {
         id: '123',
         name: `${EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME}_0`,
-        type: EXCEPTION_LIST_NAMESPACE,
+        type: EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
       },
       {
         id: '976',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.ts
index 9b7f8bbcefee1..93deae014005b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_exceptions_list.ts
@@ -6,7 +6,7 @@
  */
 
 import { Logger, SavedObjectReference } from 'src/core/server';
-import { EXCEPTION_LIST_NAMESPACE } from '@kbn/securitysolution-list-constants';
+import { getSavedObjectType } from '@kbn/securitysolution-list-utils';
 import { RuleParams } from '../../schemas/rule_schemas';
 import { getSavedObjectNamePatternForExceptionsList } from './utils';
 
@@ -35,7 +35,7 @@ export const extractExceptionsList = ({
     return exceptionsList.map((exceptionItem, index) => ({
       name: getSavedObjectNamePatternForExceptionsList(index),
       id: exceptionItem.id,
-      type: EXCEPTION_LIST_NAMESPACE,
+      type: getSavedObjectType({ namespaceType: exceptionItem.namespace_type }),
     }));
   }
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_references.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_references.test.ts
index 31288559e9437..df5fdf4fcead4 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_references.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/extract_references.test.ts
@@ -8,8 +8,11 @@
 import { loggingSystemMock } from 'src/core/server/mocks';
 import { extractReferences } from './extract_references';
 import { RuleParams } from '../../schemas/rule_schemas';
-import { EXCEPTION_LIST_NAMESPACE } from '@kbn/securitysolution-list-constants';
-import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils';
+import {
+  EXCEPTION_LIST_NAMESPACE,
+  EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
+} from '@kbn/securitysolution-list-constants';
+import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils/constants';
 
 describe('extract_references', () => {
   type FuncReturn = ReturnType<typeof extractReferences>;
@@ -43,6 +46,36 @@ describe('extract_references', () => {
         {
           id: '123',
           name: `${EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME}_0`,
+          type: EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
+        },
+      ],
+    });
+  });
+
+  test('It returns params untouched and the references extracted as 2 exception list saved object references', () => {
+    const params: Partial<RuleParams> = {
+      note: 'some note',
+      exceptionsList: [
+        mockExceptionsList()[0],
+        { ...mockExceptionsList()[0], id: '456', namespace_type: 'single' },
+      ],
+    };
+    expect(
+      extractReferences({
+        logger,
+        params: params as RuleParams,
+      })
+    ).toEqual<FuncReturn>({
+      params: params as RuleParams,
+      references: [
+        {
+          id: '123',
+          name: `${EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME}_0`,
+          type: EXCEPTION_LIST_NAMESPACE_AGNOSTIC,
+        },
+        {
+          id: '456',
+          name: `${EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME}_1`,
           type: EXCEPTION_LIST_NAMESPACE,
         },
       ],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_exceptions_list.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_exceptions_list.test.ts
index fc35088da66fc..72373eebf4fba 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_exceptions_list.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_exceptions_list.test.ts
@@ -7,10 +7,10 @@
 
 import { loggingSystemMock } from 'src/core/server/mocks';
 import { SavedObjectReference } from 'src/core/server';
-import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils';
 import { EXCEPTION_LIST_NAMESPACE } from '@kbn/securitysolution-list-constants';
 import { injectExceptionsReferences } from './inject_exceptions_list';
 import { RuleParams } from '../../schemas/rule_schemas';
+import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils/constants';
 
 describe('inject_exceptions_list', () => {
   type FuncReturn = ReturnType<typeof injectExceptionsReferences>;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_references.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_references.test.ts
index a80f19ae011d7..eae4cb20f7948 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_references.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/inject_references.test.ts
@@ -7,10 +7,10 @@
 
 import { loggingSystemMock } from 'src/core/server/mocks';
 import { SavedObjectReference } from 'src/core/server';
-import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils';
 import { EXCEPTION_LIST_NAMESPACE } from '@kbn/securitysolution-list-constants';
 import { injectReferences } from './inject_references';
 import { RuleParams } from '../../schemas/rule_schemas';
+import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './utils/constants';
 
 describe('inject_references', () => {
   type FuncReturn = ReturnType<typeof injectReferences>;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern.ts
index f4e33cf57fa2b..f0fd4e86e44b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern.ts
@@ -6,7 +6,7 @@
  */
 
 /**
- * Given a name and index this will return the pattern of "${name_${index}"
+ * Given a name and index this will return the pattern of "${name}_${index}"
  * @param name The name to suffix the string
  * @param index The index to suffix the string
  * @returns The pattern "${name_${index}"
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern_for_exception_list.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern_for_exception_list.test.ts
index 98c575e8835be..82bf2e1506f97 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern_for_exception_list.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/saved_object_references/utils/get_saved_object_name_pattern_for_exception_list.test.ts
@@ -5,10 +5,8 @@
  * 2.0.
  */
 
-import {
-  EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME,
-  getSavedObjectNamePatternForExceptionsList,
-} from '.';
+import { EXCEPTIONS_SAVED_OBJECT_REFERENCE_NAME } from './constants';
+import { getSavedObjectNamePatternForExceptionsList } from './get_saved_object_name_pattern_for_exception_list';
 
 describe('get_saved_object_name_pattern_for_exception_list', () => {
   test('returns expected pattern given a zero', () => {