diff --git a/x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts b/x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts
index fd36a69dbde3c..bda03b445747b 100644
--- a/x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts
+++ b/x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts
@@ -41,12 +41,13 @@ export const determineDiffOutcome = <TValue>(
   if (baseVersion === MissingVersion) {
     /**
      * We couldn't find the base version of the rule in the package so further
-     * version comparison is not possible. We assume that the rule is not
-     * customized and the value can be updated if there's an update.
+     * version comparison is not possible. We assume that the rule is not customized
+     * if both current and target versions are the same and customized if they
+     * are different.
      */
     return currentEqlTarget
       ? ThreeWayDiffOutcome.StockValueNoUpdate
-      : ThreeWayDiffOutcome.StockValueCanUpdate;
+      : ThreeWayDiffOutcome.CustomizedValueCanUpdate;
   }
 
   if (baseEqlCurrent) {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts
index 43f6c9ed97e9d..653907a09ffd7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts
@@ -141,8 +141,8 @@ describe('numberDiffAlgorithm', () => {
       expect(result).toEqual(
         expect.objectContaining({
           merged_version: mockVersions.target_version,
-          diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-          merge_outcome: ThreeWayMergeOutcome.Target,
+          diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+          merge_outcome: ThreeWayMergeOutcome.Merged,
           has_conflict: false,
         })
       );
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/simple_diff_algorithm.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/simple_diff_algorithm.ts
index 51d3d8fc22d58..9087db6d6b087 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/simple_diff_algorithm.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/simple_diff_algorithm.ts
@@ -11,6 +11,7 @@ import type {
   ThreeWayDiff,
 } from '../../../../../../../../common/api/detection_engine/prebuilt_rules';
 import {
+  MissingVersion,
   determineDiffOutcome,
   determineIfValueCanUpdate,
   ThreeWayDiffOutcome,
@@ -34,7 +35,8 @@ export const simpleDiffAlgorithm = <TValue>(
   const diffOutcome = determineDiffOutcome(baseVersion, currentVersion, targetVersion);
   const valueCanUpdate = determineIfValueCanUpdate(diffOutcome);
 
-  const { mergeOutcome, mergedVersion } = mergeVersions({
+  const { mergeOutcome, mergedVersion, hasConflict } = mergeVersions({
+    baseVersion,
     currentVersion,
     targetVersion,
     diffOutcome,
@@ -49,22 +51,25 @@ export const simpleDiffAlgorithm = <TValue>(
     diff_outcome: diffOutcome,
     merge_outcome: mergeOutcome,
     has_update: valueCanUpdate,
-    has_conflict: mergeOutcome === ThreeWayMergeOutcome.Conflict,
+    has_conflict: hasConflict,
   };
 };
 
 interface MergeResult<TValue> {
   mergeOutcome: ThreeWayMergeOutcome;
   mergedVersion: TValue;
+  hasConflict: boolean;
 }
 
 interface MergeArgs<TValue> {
+  baseVersion: TValue | MissingVersion;
   currentVersion: TValue;
   targetVersion: TValue;
   diffOutcome: ThreeWayDiffOutcome;
 }
 
 const mergeVersions = <TValue>({
+  baseVersion,
   currentVersion,
   targetVersion,
   diffOutcome,
@@ -76,18 +81,29 @@ const mergeVersions = <TValue>({
       return {
         mergeOutcome: ThreeWayMergeOutcome.Current,
         mergedVersion: currentVersion,
+        hasConflict: false,
       };
     }
     case ThreeWayDiffOutcome.StockValueCanUpdate: {
       return {
         mergeOutcome: ThreeWayMergeOutcome.Target,
         mergedVersion: targetVersion,
+        hasConflict: false,
       };
     }
     case ThreeWayDiffOutcome.CustomizedValueCanUpdate: {
+      // Case for -AB scenario
+      if (baseVersion === MissingVersion) {
+        return {
+          mergeOutcome: ThreeWayMergeOutcome.Merged,
+          mergedVersion: targetVersion,
+          hasConflict: false,
+        };
+      }
       return {
         mergeOutcome: ThreeWayMergeOutcome.Conflict,
         mergedVersion: currentVersion,
+        hasConflict: true,
       };
     }
     default:
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/single_line_string_diff_algorithm.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/single_line_string_diff_algorithm.test.ts
index a4f5197979db4..850a381e105d2 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/single_line_string_diff_algorithm.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/single_line_string_diff_algorithm.test.ts
@@ -141,8 +141,8 @@ describe('singleLineStringDiffAlgorithm', () => {
       expect(result).toEqual(
         expect.objectContaining({
           merged_version: mockVersions.target_version,
-          diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-          merge_outcome: ThreeWayMergeOutcome.Target,
+          diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+          merge_outcome: ThreeWayMergeOutcome.Merged,
           has_conflict: false,
         })
       );
diff --git a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/upgrade_review_prebuilt_rules.ts b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/upgrade_review_prebuilt_rules.ts
index 9ad266e20740d..57404b13ca7de 100644
--- a/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/upgrade_review_prebuilt_rules.ts
+++ b/x-pack/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/management/trial_license_complete_tier/upgrade_review_prebuilt_rules.ts
@@ -306,8 +306,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 1,
                   target_version: 2,
                   merged_version: 2,
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },
@@ -350,8 +350,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 'B',
                   target_version: 'C',
                   merged_version: 'C',
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },
@@ -359,8 +359,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 1,
                   target_version: 2,
                   merged_version: 2,
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },
@@ -645,8 +645,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 1,
                   target_version: 2,
                   merged_version: 2,
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },
@@ -689,8 +689,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 2,
                   target_version: 3,
                   merged_version: 3,
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },
@@ -698,8 +698,8 @@ export default ({ getService }: FtrProviderContext): void => {
                   current_version: 1,
                   target_version: 2,
                   merged_version: 2,
-                  diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
-                  merge_outcome: ThreeWayMergeOutcome.Target,
+                  diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+                  merge_outcome: ThreeWayMergeOutcome.Merged,
                   has_conflict: false,
                   has_update: true,
                 },