diff --git a/src/Components/ClusterRules/ClusterRules.js b/src/Components/ClusterRules/ClusterRules.js
index b9b56386..b62ce8ca 100644
--- a/src/Components/ClusterRules/ClusterRules.js
+++ b/src/Components/ClusterRules/ClusterRules.js
@@ -62,7 +62,6 @@ const ClusterRules = ({ cluster }) => {
   const { isError, isUninitialized, isFetching, isSuccess, data, error } =
     cluster;
   const reports = data?.report?.data || [];
-
   const [filteredRows, setFilteredRows] = useState([]);
   const [displayedRows, setDisplayedRows] = useState([]);
   const [isAllExpanded, setIsAllExpanded] = useState(false);
@@ -119,13 +118,19 @@ const ClusterRules = ({ cluster }) => {
     setDisplayedRows(collapseRows);
   };
 
-  const buildFilteredRows = (allRows, filters) =>
-    allRows
+  const buildFilteredRows = (allRows, filters) => {
+    const expandedRowsSet = new Set(
+      displayedRows
+        .filter((ruleExpanded) => ruleExpanded?.isOpen)
+        .map((object) => object?.rule?.rule_id)
+    );
+
+    return allRows
       .filter((rule) => passFilters(rule, filters))
       .map((value, key) => [
         {
           rule: value,
-          isOpen: isAllExpanded,
+          isOpen: isAllExpanded || expandedRowsSet?.has(value?.rule_id),
           cells: [
             {
               title: (
@@ -194,6 +199,7 @@ const ClusterRules = ({ cluster }) => {
           ],
         },
       ]);
+  };
 
   const buildDisplayedRows = (rows, index, direction) => {
     let sortingRows = [...rows];
@@ -227,6 +233,7 @@ const ClusterRules = ({ cluster }) => {
   };
 
   const onSort = (_e, index, direction) => {
+    setExpandFirst(false);
     setFirstRule('');
     return updateFilters({
       ...filters,
diff --git a/src/Components/ClusterRules/ClusterRules.spec.ct.js b/src/Components/ClusterRules/ClusterRules.spec.ct.js
index 276c73af..52a654a4 100644
--- a/src/Components/ClusterRules/ClusterRules.spec.ct.js
+++ b/src/Components/ClusterRules/ClusterRules.spec.ct.js
@@ -186,7 +186,7 @@ describe('cluster rules table', () => {
   });
 
   describe('defaults', () => {
-    it('only first item expanded', () => {
+    it('only one row is expanded', () => {
       cy.get('#expanded-content1').should('have.length', 1);
       cy.get(EXPANDABLES).should('have.length', 1);
     });
@@ -207,6 +207,16 @@ describe('cluster rules table', () => {
     cy.get(EXPANDABLES).should('have.length', 0);
   });
 
+  it('expand one row then sort', () => {
+    cy.get(ROOT).find('#expandable-toggle2').click();
+    cy.get(ROOT)
+      .find('th[data-label=Description]')
+      .find('button')
+      .click()
+      .click();
+    cy.get(EXPANDABLES).should('have.length', 2);
+  });
+
   describe('sorting', () => {
     // all tables must preserve original ordering
     _.zip(['description', 'created_at', 'total_risk'], TABLE_HEADERS).forEach(