diff --git a/src/detect-engine.c b/src/detect-engine.c
index ae8ee52222..e3320894e6 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -2919,7 +2919,6 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx)
                 SCFree(de_ctx->fw_policies->pkt_policy_signatures[i]);
             }
         }
-        HashTableFree(de_ctx->fw_policies->policy_signatures);
         HashTableFree(de_ctx->fw_policies->app_policies);
     }
     SCFree(de_ctx->fw_policies);
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 97803dcd82..2c055eb3d9 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -3970,36 +3970,13 @@ static char AppPolicyCompareFunc(void *data1, uint16_t datalen1, void *data2, ui
 static void AppPolicyHashFree(void *data)
 {
     struct DetectFirewallAppPolicy *p = data;
+    Signature *s = p->alert_signature;
+    if (s != NULL) {
+        SCFree(s->msg);
+        SCFree(s);
+    }
     SCFree(p);
 }
-static uint32_t PolicySignatureHashFunc(HashTable *ht, void *data, uint16_t datalen)
-{
-    const Signature *s = data;
-    const int dir = 1 + (s->flags & SIG_FLAG_TOSERVER) != 0; // 2 for ts, 1 for tc
-    uint32_t hash = s->alproto * s->app_progress_hook * dir;
-    hash = hash % ht->array_size;
-    return hash;
-}
-
-static char PolicySignatureCompareFunc(
-        void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
-{
-    const Signature *s1 = data1;
-    const Signature *s2 = data2;
-
-    if (s1 == NULL || s2 == NULL)
-        return 0;
-
-    return s1->flags == s2->flags && s1->alproto == s2->alproto &&
-           s1->app_progress_hook == s2->app_progress_hook;
-}
-
-static void PolicySignatureHashFree(void *data)
-{
-    Signature *s = data;
-    SCFree(s->msg);
-    SCFree(s);
-}
 
 const char *ActionScopeToString(enum ActionScope s)
 {
@@ -4090,9 +4067,7 @@ static int AddPktPolicySignature(struct DetectFirewallPolicies *fw_policies,
     return 0;
 }
 
-static int AddAppPolicySignature(HashTable *ht, const int direction, const AppProto alproto,
-        const char *app_name, const uint8_t hook, const char *hookname,
-        struct DetectFirewallPolicy *pol)
+static int AddAppPolicySignature(struct DetectFirewallAppPolicy *pol)
 {
     Signature *s = SCCalloc(1, sizeof(*s)); // SigAlloc does way more than we need
     if (s == NULL)
@@ -4104,11 +4079,11 @@ static int AddAppPolicySignature(HashTable *ht, const int direction, const AppPr
         SCFree(s);
         return -1;
     }
-    s->app_progress_hook = hook;
-    s->action = pol->action;
-    s->action_scope = pol->action_scope;
-    s->alproto = alproto;
-    s->flags = (direction == STREAM_TOSERVER) ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
+    s->app_progress_hook = pol->progress;
+    s->action = pol->policy.action;
+    s->action_scope = pol->policy.action_scope;
+    s->alproto = pol->alproto;
+    s->flags = (pol->direction == STREAM_TOSERVER) ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT;
     s->flags |= SIG_FLAG_FIREWALL;
     s->type = SIG_TYPE_APP_TX;
     s->detect_table = DETECT_TABLE_APP_FILTER;
@@ -4117,11 +4092,7 @@ static int AddAppPolicySignature(HashTable *ht, const int direction, const AppPr
     s->gid = 1;
     s->prio = 3;
 
-    if (HashTableAdd(ht, s, 0) != 0) {
-        SCFree(s->msg);
-        SCFree(s);
-        return -1;
-    }
+    pol->alert_signature = s;
     SCLogDebug("added to hash");
     return 0;
 }
@@ -4200,8 +4171,7 @@ static int DoParseAppSubStatePolicy(const char *prefix, const AppProto app_proto
     /* for policies with an alert action, create a policy sig */
     if (r == 1 && app_pol->policy.action & ACTION_ALERT) {
         SCLogDebug("adding policy signature");
-        return AddAppPolicySignature(fw_policies->policy_signatures, direction, app_proto, app_name,
-                state, hookname, &app_pol->policy);
+        return AddAppPolicySignature(app_pol);
     }
     SCLogDebug("r %d", r);
     return r;
@@ -4290,8 +4260,7 @@ static int DoParseAppPolicy(const char *prefix, const AppProto app_proto, const
     /* for policies with an alert action, create a policy sig */
     if (r == 1 && app_pol->policy.action & ACTION_ALERT) {
         SCLogDebug("adding policy signature");
-        return AddAppPolicySignature(fw_policies->policy_signatures, direction, app_proto, app_name,
-                state, hookname, &app_pol->policy);
+        return AddAppPolicySignature(app_pol);
     }
 
     return r;
@@ -4303,16 +4272,9 @@ int DetectFirewallInitDefaultPolicies(DetectEngineCtx *de_ctx)
     struct DetectFirewallPolicies *fw_policies = SCCalloc(1, sizeof(*fw_policies));
     if (fw_policies == NULL)
         return -1;
-    fw_policies->policy_signatures = HashTableInit(
-            512, PolicySignatureHashFunc, PolicySignatureCompareFunc, PolicySignatureHashFree);
-    if (fw_policies->policy_signatures == NULL) {
-        SCFree(fw_policies);
-        return -1;
-    }
     fw_policies->app_policies =
             HashTableInit(512, AppPolicyHashFunc, AppPolicyCompareFunc, AppPolicyHashFree);
     if (fw_policies->app_policies == NULL) {
-        HashTableFree(fw_policies->policy_signatures);
         SCFree(fw_policies);
         return -1;
     }
@@ -4450,22 +4412,6 @@ int DetectFirewallLoadDefaultPolicies(DetectEngineCtx *de_ctx)
     return 0;
 }
 
-Signature *DetectFirewallGetPolicySignature(struct DetectFirewallPolicies *fw_policies,
-        const AppProto alproto, const int direction, const uint8_t hook)
-{
-    if (fw_policies != NULL && fw_policies->policy_signatures != NULL) {
-        Signature lookup;
-        lookup.alproto = alproto;
-        lookup.flags = SIG_FLAG_FIREWALL |
-                       (direction == STREAM_TOSERVER ? SIG_FLAG_TOSERVER : SIG_FLAG_TOCLIENT);
-        lookup.app_progress_hook = hook;
-
-        Signature *s = HashTableLookup(fw_policies->policy_signatures, &lookup, 0);
-        return s;
-    }
-    return NULL;
-}
-
 /*
  * TESTS
  */
diff --git a/src/detect-parse.h b/src/detect-parse.h
index 1925ac9385..4083163ea8 100644
--- a/src/detect-parse.h
+++ b/src/detect-parse.h
@@ -122,7 +122,5 @@ struct DetectFirewallPolicy;
 void DetectFirewallPolicyToString(const struct DetectFirewallPolicy *p, char *out, size_t out_size);
 int DetectFirewallInitDefaultPolicies(DetectEngineCtx *);
 int DetectFirewallLoadDefaultPolicies(DetectEngineCtx *);
-Signature *DetectFirewallGetPolicySignature(struct DetectFirewallPolicies *fw_policies,
-        const AppProto alproto, const int direction, const uint8_t hook);
 
 #endif /* SURICATA_DETECT_PARSE_H */
diff --git a/src/detect.c b/src/detect.c
index f3eb1a34ed..75258837c3 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -1719,12 +1719,10 @@ struct DetectFirewallAppTxState {
 };
 
 static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *det_ctx, Packet *p,
-        const bool apply_to_packet, const int direction, const uint64_t tx_id,
-        const AppProto alproto, const uint8_t hook)
+        const bool apply_to_packet, const uint64_t tx_id, const struct DetectFirewallAppPolicy *ap)
 {
     if (EngineModeIsFirewall()) {
-        Signature *s = DetectFirewallGetPolicySignature(
-                det_ctx->de_ctx->fw_policies, alproto, direction, hook);
+        const Signature *s = ap->alert_signature;
         BUG_ON(s == NULL);
         uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
         AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags);
@@ -1765,8 +1763,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
             p->flow->flags |= FLOW_ACTION_BY_FIREWALL;
         }
         if (policy->action & ACTION_ALERT) {
-            DetectRunAppendDefaultAppPolicyAlert(
-                    det_ctx, p, true, direction, tx->tx_id, alproto, progress);
+            DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, true, tx->tx_id, ap);
         }
     } else if (policy->action & ACTION_ACCEPT) {
         /* should the accept be applied to the packet?
@@ -1799,8 +1796,7 @@ static const struct DetectFirewallPolicy *DetectFirewallApplyDefaultAppPolicy(
 
         if (policy->action & ACTION_ALERT) {
             SCLogDebug("policy alert, do the append");
-            DetectRunAppendDefaultAppPolicyAlert(
-                    det_ctx, p, apply_to_packet, direction, tx->tx_id, alproto, progress);
+            DetectRunAppendDefaultAppPolicyAlert(det_ctx, p, apply_to_packet, tx->tx_id, ap);
         } else if (apply_to_packet) {
             SCLogDebug("default accept: last_tx");
             DetectRunAppendDefaultAccept(det_ctx, p);
diff --git a/src/detect.h b/src/detect.h
index 6c7e1bdfdc..c712680236 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -940,6 +940,9 @@ struct DetectFirewallAppPolicy {
     uint8_t progress;
     uint8_t direction;
     struct DetectFirewallPolicy policy;
+    /* signature that will be logged if the policy includes "alert". Will
+     * be set to NULL if alert is not part of the policy. */
+    Signature *alert_signature;
 };
 
 struct DetectFirewallPolicies {
@@ -947,9 +950,6 @@ struct DetectFirewallPolicies {
     struct DetectFirewallPolicy pkt[DETECT_FIREWALL_POLICY_SIZE];
     Signature *pkt_policy_signatures[DETECT_FIREWALL_POLICY_SIZE];
 
-    /* hash table with a Signature object per default policy that has `alert` enabled. */
-    HashTable *policy_signatures;
-
     /* hash table with policies, hashed by alproto, sub_state, progress and direction */
     HashTable *app_policies;
 };