diff --git a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/columns.tsx b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/columns.tsx
index db2af21d4e325c..30f62c76379745 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/columns.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/columns.tsx
@@ -88,7 +88,13 @@ export const getHostsColumns = (showRiskColumn: boolean): HostsTableColumns => {
     },
     {
       field: 'node.host.os.name',
-      name: i18n.OS,
+      name: (
+        <EuiToolTip content={i18n.OS_LAST_SEEN_TOOLTIP}>
+          <>
+            {i18n.OS} <EuiIcon color="subdued" type="iInCircle" className="eui-alignTop" />
+          </>
+        </EuiToolTip>
+      ),
       truncateText: false,
       mobileOptions: { show: true },
       sortable: false,
diff --git a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/translations.ts b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/translations.ts
index 88c01f695b940f..ead534b1edc5b7 100644
--- a/x-pack/plugins/security_solution/public/hosts/components/hosts_table/translations.ts
+++ b/x-pack/plugins/security_solution/public/hosts/components/hosts_table/translations.ts
@@ -40,6 +40,13 @@ export const HOST_RISK_TOOLTIP = i18n.translate(
   }
 );
 
+export const OS_LAST_SEEN_TOOLTIP = i18n.translate(
+  'xpack.securitySolution.hostsTable.osLastSeenToolTip',
+  {
+    defaultMessage: 'Most recently observed OS',
+  }
+);
+
 export const OS = i18n.translate('xpack.securitySolution.hostsTable.osTitle', {
   defaultMessage: 'Operating system',
 });