diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
index a43ba1581773d..b1d7163ac70e0 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
@@ -52,7 +52,6 @@ describe('Exceptions', () => {
     waitForAlertsToPopulate();
     refreshPage();
 
-    cy.scrollTo('bottom');
     cy.get(SERVER_SIDE_EVENT_COUNT)
       .invoke('text')
       .then((numberOfInitialAlertsText) => {
@@ -78,7 +77,6 @@ describe('Exceptions', () => {
       goToAlertsTab();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterCreatingExceptionText) => {
@@ -88,7 +86,6 @@ describe('Exceptions', () => {
       goToClosedAlerts();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfClosedAlertsAfterCreatingExceptionText) => {
@@ -102,7 +99,6 @@ describe('Exceptions', () => {
       waitForTheRuleToBeExecuted();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfOpenedAlertsAfterCreatingExceptionText) => {
@@ -117,7 +113,6 @@ describe('Exceptions', () => {
       waitForAlertsToPopulate();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterRemovingExceptionsText) => {
@@ -135,7 +130,6 @@ describe('Exceptions', () => {
       addsException(exception);
       esArchiverLoad('auditbeat_for_exceptions2');
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterCreatingExceptionText) => {
@@ -145,7 +139,6 @@ describe('Exceptions', () => {
       goToClosedAlerts();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfClosedAlertsAfterCreatingExceptionText) => {
@@ -159,7 +152,6 @@ describe('Exceptions', () => {
       waitForTheRuleToBeExecuted();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfOpenedAlertsAfterCreatingExceptionText) => {
@@ -173,7 +165,6 @@ describe('Exceptions', () => {
       waitForAlertsToPopulate();
       refreshPage();
 
-      cy.scrollTo('bottom');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterRemovingExceptionsText) => {
diff --git a/x-pack/plugins/security_solution/cypress/objects/exception.ts b/x-pack/plugins/security_solution/cypress/objects/exception.ts
index 2182a5b6fa6d2..775a83dee2543 100644
--- a/x-pack/plugins/security_solution/cypress/objects/exception.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/exception.ts
@@ -12,6 +12,6 @@ export interface Exception {
 
 export const exception: Exception = {
   field: 'host.name',
-  operator: 'is one of',
-  values: ['siem-kibana', 'suricata-iowa', 'siem-es', 'jessie', 'siem'],
+  operator: 'is',
+  values: ['suricata-iowa'],
 };
diff --git a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
index fc871237c3f4f..4e263903a34a6 100644
--- a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
@@ -21,4 +21,4 @@ export const LOADING_SPINNER = '[data-test-subj="loading-spinner"]';
 export const OPERATOR_INPUT = '[data-test-subj="operatorAutocompleteComboBox"]';
 
 export const VALUES_INPUT =
-  '[data-test-subj="valuesAutocompleteMatchAny"] [data-test-subj="comboBoxInput"]';
+  '[data-test-subj="valuesAutocompleteMatch"] [data-test-subj="comboBoxInput"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts b/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
index 0b418af541dea..9dd23a1dfa71f 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
@@ -24,8 +24,13 @@ import {
 } from '../screens/rule_details';
 
 export const activatesRule = () => {
+  cy.server();
+  cy.route('PATCH', '**/api/detection_engine/rules/_bulk_update').as('bulk_update');
   cy.get(RULE_SWITCH).should('be.visible');
   cy.get(RULE_SWITCH).click();
+  cy.wait('@bulk_update').then((response) => {
+    cy.wrap(response.status).should('eql', 200);
+  });
 };
 
 export const deactivatesRule = () => {
diff --git a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz
index 6c0d4b234fe4b..4139fd9d28f46 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz
index ad234f460965e..0fdcb7d783ea6 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz differ