diff --git a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
index ce1c9527904c..a97de99ec8e7 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.test.tsx
@@ -6,6 +6,8 @@
  */
 
 import React from 'react';
+import { RuleTypeParams } from '@kbn/alerting-plugin/common';
+import { Query } from '@kbn/data-plugin/common';
 import { dataViewPluginMocks } from '@kbn/data-views-plugin/public/mocks';
 import { queryClient } from '@kbn/osquery-plugin/public/query_client';
 import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
@@ -15,7 +17,7 @@ import { Aggregators, Comparator } from '../../../common/custom_threshold_rule/t
 import { useKibana } from '../../utils/kibana_react';
 import { kibanaStartMock } from '../../utils/kibana_react.mock';
 import Expressions from './custom_threshold_rule_expression';
-import { CustomThresholdPrefillOptions } from './types';
+import { AlertParams, CustomThresholdPrefillOptions } from './types';
 
 jest.mock('../../utils/kibana_react');
 jest.mock('./components/preview_chart/preview_chart', () => ({
@@ -42,7 +44,7 @@ describe('Expression', () => {
     currentOptions?: CustomThresholdPrefillOptions,
     customRuleParams?: Record<string, unknown>
   ) {
-    const ruleParams = {
+    const ruleParams: RuleTypeParams & AlertParams = {
       criteria: [],
       groupBy: undefined,
       sourceId: 'default',
@@ -161,23 +163,36 @@ describe('Expression', () => {
   it('should prefill the rule using the context metadata', async () => {
     const index = 'changedMockedIndex';
     const currentOptions: CustomThresholdPrefillOptions = {
+      alertOnGroupDisappear: false,
       groupBy: ['host.hostname'],
-      filterQuery: 'foo',
-      searchConfiguration: { index },
+      searchConfiguration: {
+        index,
+        query: {
+          query: 'foo',
+          language: 'kuery',
+        },
+      },
       criteria: [
         {
           metrics: [
             { name: 'A', aggType: Aggregators.AVERAGE, field: 'system.load.1' },
             { name: 'B', aggType: Aggregators.CARDINALITY, field: 'system.cpu.user.pct' },
           ],
+          comparator: Comparator.LT_OR_EQ,
+          equation: 'A * B',
+          label: 'prefill label',
+          threshold: [500],
+          timeSize: 7,
+          timeUnit: 'h',
         },
       ],
     };
 
     const { ruleParams } = await setup(currentOptions, { searchConfiguration: undefined });
 
+    expect(ruleParams.alertOnGroupDisappear).toEqual(false);
     expect(ruleParams.groupBy).toEqual(['host.hostname']);
-    expect(ruleParams.searchConfiguration.query.query).toBe('foo');
+    expect((ruleParams.searchConfiguration.query as Query).query).toBe('foo');
     expect(ruleParams.searchConfiguration.index).toBe(index);
     expect(ruleParams.criteria).toEqual([
       {
@@ -185,10 +200,12 @@ describe('Expression', () => {
           { name: 'A', aggType: Aggregators.AVERAGE, field: 'system.load.1' },
           { name: 'B', aggType: Aggregators.CARDINALITY, field: 'system.cpu.user.pct' },
         ],
-        comparator: Comparator.GT,
-        threshold: [100],
-        timeSize: 1,
-        timeUnit: 'm',
+        comparator: Comparator.LT_OR_EQ,
+        equation: 'A * B',
+        label: 'prefill label',
+        threshold: [500],
+        timeSize: 7,
+        timeUnit: 'h',
       },
     ]);
   });
diff --git a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
index 0df72511ce55..796e2e6bb13c 100644
--- a/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
+++ b/x-pack/plugins/observability/public/components/custom_threshold/custom_threshold_rule_expression.tsx
@@ -98,11 +98,11 @@ export default function Expressions(props: Props) {
       if (!ruleParams.searchConfiguration || !ruleParams.searchConfiguration.index) {
         if (metadata?.currentOptions?.searchConfiguration) {
           initialSearchConfiguration = {
-            ...metadata.currentOptions.searchConfiguration,
             query: {
               query: ruleParams.searchConfiguration?.query ?? '',
               language: 'kuery',
             },
+            ...metadata.currentOptions.searchConfiguration,
           };
         } else {
           const newSearchSource = data.search.searchSource.createEmpty();
@@ -164,10 +164,6 @@ export default function Expressions(props: Props) {
       preFillCriteria();
     }
 
-    if (!ruleParams.filterQuery) {
-      preFillFilterQuery();
-    }
-
     if (!ruleParams.groupBy) {
       preFillGroupBy();
     }
@@ -176,7 +172,7 @@ export default function Expressions(props: Props) {
       setRuleParams('alertOnNoData', true);
     }
     if (typeof ruleParams.alertOnGroupDisappear === 'undefined') {
-      setRuleParams('alertOnGroupDisappear', true);
+      preFillAlertOnGroupDisappear();
     }
   }, [metadata]); // eslint-disable-line react-hooks/exhaustive-deps
 
@@ -277,23 +273,13 @@ export default function Expressions(props: Props) {
     [ruleParams.criteria, setRuleParams]
   );
 
-  const preFillFilterQuery = useCallback(() => {
-    const md = metadata;
-
-    if (md && md.currentOptions?.filterQuery) {
-      setRuleParams('searchConfiguration', {
-        ...ruleParams.searchConfiguration,
-        query: {
-          query: md.currentOptions.filterQuery,
-          language: 'kuery',
-        },
-      });
-    }
-  }, [metadata, setRuleParams, ruleParams.searchConfiguration]);
-
   const preFillCriteria = useCallback(() => {
     const md = metadata;
     if (md?.currentOptions?.criteria?.length) {
+      const { timeSize: prefillTimeSize, timeUnit: prefillTimeUnit } =
+        md.currentOptions.criteria[0];
+      if (prefillTimeSize) setTimeSize(prefillTimeSize);
+      if (prefillTimeUnit) setTimeUnit(prefillTimeUnit);
       setRuleParams(
         'criteria',
         md.currentOptions.criteria.map((criterion) => ({
@@ -313,6 +299,15 @@ export default function Expressions(props: Props) {
     }
   }, [metadata, setRuleParams]);
 
+  const preFillAlertOnGroupDisappear = useCallback(() => {
+    const md = metadata;
+    if (md && typeof md.currentOptions?.alertOnGroupDisappear !== 'undefined') {
+      setRuleParams('alertOnGroupDisappear', md.currentOptions.alertOnGroupDisappear);
+    } else {
+      setRuleParams('alertOnGroupDisappear', true);
+    }
+  }, [metadata, setRuleParams]);
+
   const hasGroupBy = useMemo(
     () => ruleParams.groupBy && ruleParams.groupBy.length > 0,
     [ruleParams.groupBy]