diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
index d3212eb3faf4dd..e1f6bac2620ea4 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.test.ts
@@ -146,7 +146,12 @@ describe('manifest', () => {
     });
 
     test('Manifest can be created from list of artifacts', async () => {
-      const manifest = Manifest.fromArtifacts(artifacts, 'v1', ManifestConstants.INITIAL_VERSION);
+      const oldManifest = new Manifest(
+        new Date(),
+        ManifestConstants.SCHEMA_VERSION,
+        ManifestConstants.INITIAL_VERSION
+      );
+      const manifest = Manifest.fromArtifacts(artifacts, 'v1', oldManifest);
       expect(
         manifest.contains(
           'endpoint-exceptionlist-linux-v1-5f16e5e338c53e77cfa945c17c11b175c3967bf109aa87131de41fb93b149735'
diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.ts
index c0124602ddb811..576ecb08d69232 100644
--- a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/manifest.ts
@@ -47,11 +47,17 @@ export class Manifest {
   public static fromArtifacts(
     artifacts: InternalArtifactSchema[],
     schemaVersion: string,
-    version: string
+    oldManifest: Manifest
   ): Manifest {
-    const manifest = new Manifest(new Date(), schemaVersion, version);
+    const manifest = new Manifest(new Date(), schemaVersion, oldManifest.getVersion());
     artifacts.forEach((artifact) => {
-      manifest.addEntry(artifact);
+      const id = `${artifact.identifier}-${artifact.decodedSha256}`;
+      const existingArtifact = oldManifest.getArtifact(id);
+      if (existingArtifact) {
+        manifest.addEntry(existingArtifact);
+      } else {
+        manifest.addEntry(artifact);
+      }
     });
     return manifest;
   }
@@ -81,8 +87,8 @@ export class Manifest {
     return this.entries;
   }
 
-  public getArtifact(artifactId: string): InternalArtifactSchema {
-    return this.entries[artifactId].getArtifact();
+  public getArtifact(artifactId: string): InternalArtifactSchema | undefined {
+    return this.entries[artifactId]?.getArtifact();
   }
 
   public diff(manifest: Manifest): ManifestDiff[] {
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
index 9726e28f541868..b9e289cee62af1 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -154,7 +154,7 @@ export class ManifestManager {
       const newManifest = Manifest.fromArtifacts(
         artifacts,
         ManifestConstants.SCHEMA_VERSION,
-        oldManifest.getVersion()
+        oldManifest
       );
 
       // Get diffs
@@ -202,6 +202,11 @@ export class ManifestManager {
 
     for (const diff of adds) {
       const artifact = snapshot.manifest.getArtifact(diff.id);
+      if (artifact === undefined) {
+        throw new Error(
+          `Corrupted manifest detected. Diff contained artifact ${diff.id} not in manifest.`
+        );
+      }
       const compressedArtifact = await compressExceptionList(Buffer.from(artifact.body, 'base64'));
       artifact.body = compressedArtifact.toString('base64');
       artifact.encodedSize = compressedArtifact.byteLength;