diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/filterlists/prebuilt_rules_alerts.ts b/x-pack/plugins/security_solution/server/lib/telemetry/filterlists/prebuilt_rules_alerts.ts
index e02e62417f63a..b71ab6118adb5 100644
--- a/x-pack/plugins/security_solution/server/lib/telemetry/filterlists/prebuilt_rules_alerts.ts
+++ b/x-pack/plugins/security_solution/server/lib/telemetry/filterlists/prebuilt_rules_alerts.ts
@@ -77,7 +77,9 @@ export const prebuiltRuleAllowlistFields: AllowlistFields = {
   group: {
     name: true,
   },
-  host: true,
+  host: {
+    os: true,
+  },
   http: {
     request: {
       body: {