diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_query_columns.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_query_columns.ts
index a382c73edf036..be4c53a31cef8 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_query_columns.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation/logic/esql_query_columns.ts
@@ -5,7 +5,12 @@
  * 2.0.
  */
 
-import type { QueryClient, QueryFunction, QueryKey } from '@tanstack/react-query';
+import type {
+  FetchQueryOptions,
+  QueryClient,
+  QueryFunction,
+  QueryKey,
+} from '@tanstack/react-query';
 import { useQuery } from '@tanstack/react-query';
 import type { DatatableColumn } from '@kbn/expressions-plugin/common';
 import { getESQLQueryColumns } from '@kbn/esql-utils';
@@ -22,12 +27,7 @@ export async function fetchEsqlQueryColumns({
   esqlQuery,
   queryClient,
 }: FetchEsqlQueryColumnsParams): Promise<DatatableColumn[]> {
-  const data = await queryClient.fetchQuery({
-    queryKey: [esqlQuery.trim()],
-    queryFn: queryEsqlColumnsFactory(esqlQuery),
-    staleTime: DEFAULT_STALE_TIME,
-    retry: false,
-  });
+  const data = await queryClient.fetchQuery(createSharedTanstackQueryOptions(esqlQuery));
 
   if (data instanceof Error) {
     throw data;
@@ -43,10 +43,7 @@ interface UseEsqlQueryColumnsResult {
 
 export function useEsqlQueryColumns(esqlQuery: string): UseEsqlQueryColumnsResult {
   const { data, isLoading } = useQuery({
-    queryKey: [esqlQuery.trim()],
-    queryFn: queryEsqlColumnsFactory(esqlQuery),
-    staleTime: DEFAULT_STALE_TIME,
-    retry: false,
+    ...createSharedTanstackQueryOptions(esqlQuery),
     retryOnMount: false,
     refetchOnMount: false,
     refetchOnWindowFocus: false,
@@ -55,6 +52,17 @@ export function useEsqlQueryColumns(esqlQuery: string): UseEsqlQueryColumnsResul
   return { columns: !data || data instanceof Error ? [] : data, isLoading };
 }
 
+function createSharedTanstackQueryOptions(
+  esqlQuery: string
+): FetchQueryOptions<DatatableColumn[] | Error> {
+  return {
+    queryKey: [esqlQuery.trim()],
+    queryFn: queryEsqlColumnsFactory(esqlQuery),
+    staleTime: DEFAULT_STALE_TIME,
+    retry: false,
+  };
+}
+
 function queryEsqlColumnsFactory(
   esqlQuery: string
 ): QueryFunction<DatatableColumn[] | Error, QueryKey> {
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.test.tsx
index 9d2d4b38833a8..83aa6a114362a 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.test.tsx
@@ -677,6 +677,8 @@ describe('StepDefineRule', () => {
     });
 
     it('updates EQL query correctly', async () => {
+      jest.useFakeTimers();
+
       const timelineEqlQuery = {
         index: ['.alerts-security.alerts-default', 'logs-*', 'packetbeat-*'],
         queryBar: {
@@ -714,6 +716,8 @@ describe('StepDefineRule', () => {
 
       await setRuleFromTimeline();
 
+      jest.runAllTimers();
+
       expect(screen.getByTestId('eqlQueryBarTextInput')).toHaveValue(
         timelineEqlQuery.queryBar.query.query
       );