diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log_handler.ts
index 538f395283b5e..0109dfd0f0241 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log_handler.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/audit_log_handler.ts
@@ -78,10 +78,16 @@ export const actionsLogRequestHandler = (
     }
 
     return res.ok({
-      body: result.body.hits.hits.map((e) => {
-        const type = /^.fleet-actions-\d+$/.test(e._index) ? 'action' : 'response';
-        return { type, item: e._source };
-      }),
+      body: {
+        total:
+          typeof result.body.hits.total === 'number'
+            ? result.body.hits.total
+            : result.body.hits.total.value,
+        items: result.body.hits.hits.map((e) => ({
+          type: e._index.startsWith('.fleet-actions') ? 'action' : 'response',
+          item: { id: e._id, data: e._source },
+        })),
+      },
     });
   };
 };