diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.test.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.test.tsx
index 3e4ca31aa1050..3d1bfe2fafee2 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.test.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.test.tsx
@@ -37,11 +37,13 @@ import {
 } from '../../../rule_creation/components/alert_suppression_edit';
 import { THRESHOLD_ALERT_SUPPRESSION_ENABLED } from '../../../rule_creation/components/threshold_alert_suppression_edit';
 import { AlertSuppressionMissingFieldsStrategyEnum } from '../../../../../common/api/detection_engine';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 
 jest.mock('../../../../common/lib/kibana');
 jest.mock('../../../../common/containers/source');
 jest.mock('../../../../common/components/ml/hooks/use_get_jobs');
 jest.mock('../../../../common/components/ml_popover/hooks/use_security_jobs');
+jest.mock('../../../../common/hooks/use_experimental_features');
 jest.mock('@elastic/eui', () => {
   const original = jest.requireActual('@elastic/eui');
   return {
@@ -54,6 +56,9 @@ jest.mock('@elastic/eui', () => {
   };
 });
 const mockedUseKibana = mockUseKibana();
+(useIsExperimentalFeatureEnabled as jest.Mock).mockImplementation((param) => {
+  return param === 'endpointExceptionsMovedUnderManagement';
+});
 
 export const stepDefineStepMLRule: DefineStepRule = {
   ruleType: 'machine_learning',
@@ -143,6 +148,19 @@ describe('StepAboutRuleComponent', () => {
     expect(wrapper.find(StepRuleDescription).exists()).toBeTruthy();
   });
 
+  it('only shows endpoint exceptions for rule definition if feature flag enabled', async () => {
+    const wrapper = mount(<TestComp setFormRef={() => {}} />, {
+      wrappingComponent: TestProviders as EnzymeComponentType<{}>,
+    });
+    await act(async () => {
+      expect(
+        wrapper
+          .find('[data-test-subj="detectionEngineStepAboutRuleAssociatedToEndpointList"]')
+          .exists()
+      ).toBeFalsy();
+    });
+  });
+
   it('is invalid if description is not present', async () => {
     let form: FormHook<AboutStepRule, AboutStepRule>;
     const wrapper = mount(
diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
index 365d72a90e597..5b757a295ecc9 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/index.tsx
@@ -40,6 +40,7 @@ import { MultiSelectFieldsAutocomplete } from '../multi_select_fields';
 import { useAllEsqlRuleFields } from '../../hooks';
 import { MaxSignals } from '../max_signals';
 import { ThreatMatchIndicatorPathEdit } from '../../../rule_creation/components/threat_match_indicator_path_edit';
+import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -71,6 +72,7 @@ const TagContainer = styled.div`
 `;
 
 TagContainer.displayName = 'TagContainer';
+const GhostFormField = () => <></>;
 
 const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   ruleType,
@@ -101,6 +103,10 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
 
   const [indexPattern, setIndexPattern] = useState<DataViewBase>(indexIndexPattern);
 
+  const endpointExceptionsMovedUnderManagement = useIsExperimentalFeatureEnabled(
+    'endpointExceptionsMovedUnderManagement'
+  );
+
   useEffect(() => {
     if (index != null && (dataViewId === '' || dataViewId == null)) {
       setIndexPattern(indexIndexPattern);
@@ -324,18 +330,22 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
               />
             </EuiToolTip>
             <EuiSpacer size="l" />
-            <EuiFormRow label={I18n.GLOBAL_ENDPOINT_EXCEPTION_LIST} fullWidth>
-              <CommonUseField
-                path="isAssociatedToEndpointList"
-                componentProps={{
-                  idAria: 'detectionEngineStepAboutRuleAssociatedToEndpointList',
-                  'data-test-subj': 'detectionEngineStepAboutRuleAssociatedToEndpointList',
-                  euiFieldProps: {
-                    disabled: isLoading,
-                  },
-                }}
-              />
-            </EuiFormRow>
+            {!endpointExceptionsMovedUnderManagement ? (
+              <EuiFormRow label={I18n.GLOBAL_ENDPOINT_EXCEPTION_LIST} fullWidth>
+                <CommonUseField
+                  path="isAssociatedToEndpointList"
+                  componentProps={{
+                    idAria: 'detectionEngineStepAboutRuleAssociatedToEndpointList',
+                    'data-test-subj': 'detectionEngineStepAboutRuleAssociatedToEndpointList',
+                    euiFieldProps: {
+                      disabled: isLoading,
+                    },
+                  }}
+                />
+              </EuiFormRow>
+            ) : (
+              <UseField path="isAssociatedToEndpointList" component={GhostFormField} />
+            )}
             <EuiFormRow label={I18n.BUILDING_BLOCK} fullWidth>
               <CommonUseField
                 path="isBuildingBlock"
diff --git a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/schema.tsx b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/schema.tsx
index d6b87febc961e..9643e38cfc3c2 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/schema.tsx
+++ b/x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_about_rule/schema.tsx
@@ -118,6 +118,7 @@ export const schema: FormSchema<AboutStepRule> = {
     ],
   },
   isAssociatedToEndpointList: {
+    defaultValue: false,
     type: FIELD_TYPES.CHECKBOX,
     label: i18n.translate(
       'xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel',