diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
index 7088f094ddcb4..77e975a46d37b 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts
@@ -31,7 +31,43 @@ export const getPolicyDataForUpdate = (
 ): NewPolicyData | Immutable<NewPolicyData> => {
   // eslint-disable-next-line @typescript-eslint/naming-convention
   const { id, revision, created_by, created_at, updated_by, updated_at, ...newPolicy } = policy;
-  return newPolicy;
+
+  // trim custom malware notification string
+  return {
+    ...newPolicy,
+    inputs: (newPolicy as Immutable<NewPolicyData>).inputs.map((input) => ({
+      ...input,
+      config: input.config && {
+        ...input.config,
+        policy: {
+          ...input.config.policy,
+          value: {
+            ...input.config.policy.value,
+            windows: {
+              ...input.config.policy.value.windows,
+              popup: {
+                ...input.config.policy.value.windows.popup,
+                malware: {
+                  ...input.config.policy.value.windows.popup.malware,
+                  message: input.config.policy.value.windows.popup.malware.message.trim(),
+                },
+              },
+            },
+            mac: {
+              ...input.config.policy.value.mac,
+              popup: {
+                ...input.config.policy.value.mac.popup,
+                malware: {
+                  ...input.config.policy.value.mac.popup.malware,
+                  message: input.config.policy.value.mac.popup.malware.message.trim(),
+                },
+              },
+            },
+          },
+        },
+      },
+    })),
+  };
 };
 
 /**
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
index c78455aa8d990..330a0ba407453 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx
@@ -193,7 +193,7 @@ export const MalwareProtections = React.memo(() => {
       if (policyDetailsConfig) {
         const newPayload = cloneDeep(policyDetailsConfig);
         for (const os of OSes) {
-          newPayload[os].popup[protection].message = event.target.value.trim();
+          newPayload[os].popup[protection].message = event.target.value;
         }
         dispatch({
           type: 'userChangedPolicyConfig',