diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
index f3fc88f6518a..af35e636b7dc 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
@@ -5,16 +5,16 @@
  * 2.0.
  */
 
-import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
 import { login } from '../../../tasks/login';
-import { visitWithTimeRange } from '../../../tasks/navigation';
+import { visitTimeline, visitWithTimeRange } from '../../../tasks/navigation';
 
-import { ALERTS_URL, TIMELINES_URL } from '../../../urls/navigation';
+import { ALERTS_URL } from '../../../urls/navigation';
 import { ALERTS_HISTOGRAM_SERIES, ALERT_RULE_NAME, MESSAGE } from '../../../screens/alerts';
-import { TIMELINE_QUERY, TIMELINE_VIEW_IN_ANALYZER } from '../../../screens/timeline';
+import { TIMELINE_VIEW_IN_ANALYZER } from '../../../screens/timeline';
 import { selectAlertsHistogram } from '../../../tasks/alerts';
-import { createTimeline } from '../../../tasks/timelines';
 import { cleanKibana } from '../../../tasks/common';
+import { createTimeline } from '../../../tasks/api_calls/timelines';
+import { getTimeline } from '../../../objects/timeline';
 
 describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
@@ -34,7 +34,6 @@ describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () =
     beforeEach(() => {
       login();
       visitWithTimeRange(ALERTS_URL);
-      waitForAlertsToPopulate();
     });
 
     describe('Alerts table', () => {
@@ -57,14 +56,13 @@ describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () =
   describe('Ransomware in Timelines', () => {
     beforeEach(() => {
       login();
-      visitWithTimeRange(TIMELINES_URL);
-
-      createTimeline();
+      createTimeline({ ...getTimeline(), query: 'event.code: "ransomware"' }).then((response) => {
+        const timelineId = response.body.data.persistTimeline.timeline.savedObjectId;
+        visitTimeline(timelineId);
+      });
     });
 
     it('Renders ransomware entries in timelines table', () => {
-      cy.get(TIMELINE_QUERY).type('event.code: "ransomware"{enter}');
-
       // Wait for grid to load, it should have an analyzer icon
       cy.get(TIMELINE_VIEW_IN_ANALYZER).should('exist');
 
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts b/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
index 2f555e8a9ed9..0bacc12d96c2 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
@@ -31,6 +31,9 @@ export const createTimeline = (timeline: CompleteTimeline) =>
           {
             id: 'host.name',
           },
+          {
+            id: 'message',
+          },
         ],
         kqlMode: 'filter',
         kqlQuery: {
@@ -42,7 +45,7 @@ export const createTimeline = (timeline: CompleteTimeline) =>
           },
         },
         dateRange: {
-          end: '2022-04-01T12:22:56.000Z',
+          end: '2023-04-01T12:22:56.000Z',
           start: '2018-01-01T12:22:56.000Z',
         },
         description: timeline.description,