diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
index f9874478e7a5d..bfff03c954761 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
@@ -7,6 +7,7 @@
 
 import {
   ALERT_OWNER,
+  ALERT_REASON,
   ALERT_RULE_NAMESPACE,
   ALERT_STATUS,
   ALERT_WORKFLOW_STATUS,
@@ -50,8 +51,9 @@ describe('buildAlert', () => {
     const doc = sampleDocNoSortIdWithTimestamp('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
     delete doc._source.event;
     const rule = getRulesSchemaMock();
+    const reason = 'alert reasonable reason';
     const alert = {
-      ...buildAlert([doc], rule, SPACE_ID),
+      ...buildAlert([doc], rule, SPACE_ID, reason),
       ...additionalAlertFields(doc),
     };
     const timestamp = alert['@timestamp'];
@@ -68,6 +70,7 @@ describe('buildAlert', () => {
         },
       ],
       [ALERT_ORIGINAL_TIME]: '2020-04-20T21:27:45.000Z',
+      [ALERT_REASON]: 'alert reasonable reason',
       [ALERT_STATUS]: 'open',
       [ALERT_WORKFLOW_STATUS]: 'open',
       ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
@@ -119,8 +122,9 @@ describe('buildAlert', () => {
       module: 'system',
     };
     const rule = getRulesSchemaMock();
+    const reason = 'alert reasonable reason';
     const alert = {
-      ...buildAlert([doc], rule, SPACE_ID),
+      ...buildAlert([doc], rule, SPACE_ID, reason),
       ...additionalAlertFields(doc),
     };
     const timestamp = alert['@timestamp'];
@@ -143,6 +147,7 @@ describe('buildAlert', () => {
         kind: 'event',
         module: 'system',
       },
+      [ALERT_REASON]: 'alert reasonable reason',
       [ALERT_STATUS]: 'open',
       [ALERT_WORKFLOW_STATUS]: 'open',
       ...flattenWithPrefix(ALERT_RULE_NAMESPACE, {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
index 521c244cefa94..de7314ffb4244 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -138,8 +138,6 @@ export const buildSignalFromSequence = (
     alertRiskScore: ruleSO.attributes.params.riskScore,
     alertSeverity: ruleSO.attributes.params.severity,
     timestamp,
-    userName: null,
-    hostName: null,
   });
   const signal: Signal = buildSignal(events, rule, reason);
   const mergedEvents = objectArrayIntersection(events.map((event) => event._source));
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.test.ts
index 8c0790761a5e0..90b9cce9e057d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_signal.test.ts
@@ -31,8 +31,10 @@ describe('buildSignal', () => {
     const doc = sampleDocNoSortId('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
     delete doc._source.event;
     const rule = getRulesSchemaMock();
+    const reason = 'signal reasonable reason';
+
     const signal = {
-      ...buildSignal([doc], rule),
+      ...buildSignal([doc], rule, reason),
       ...additionalSignalFields(doc),
     };
     const expected: Signal = {
@@ -62,6 +64,7 @@ describe('buildSignal', () => {
         },
       ],
       original_time: '2020-04-20T21:27:45.000Z',
+      reason: 'signal reasonable reason',
       status: 'open',
       rule: {
         author: [],
@@ -112,8 +115,9 @@ describe('buildSignal', () => {
       module: 'system',
     };
     const rule = getRulesSchemaMock();
+    const reason = 'signal reasonable reason';
     const signal = {
-      ...buildSignal([doc], rule),
+      ...buildSignal([doc], rule, reason),
       ...additionalSignalFields(doc),
     };
     const expected: Signal = {
@@ -143,6 +147,7 @@ describe('buildSignal', () => {
         },
       ],
       original_time: '2020-04-20T21:27:45.000Z',
+      reason: 'signal reasonable reason',
       original_event: {
         action: 'socket_opened',
         dataset: 'socket',