diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
index bc0e3469b9c7e..0c1bd2ad48880 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_detection.cy.ts
@@ -48,8 +48,7 @@ describe('Ransomware Detection Alerts', { tags: ['@ess', '@serverless'] }, () =>
     });
   });
 
-  // FLAKY: https://github.com/elastic/kibana/issues/168602
-  describe.skip('Ransomware in Timelines', () => {
+  describe('Ransomware in Timelines', () => {
     before(() => {
       login();
       visitWithTimeRange(TIMELINES_URL);
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
index 31290ce9e17b0..98d76d984512d 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/investigations/alerts/ransomware_prevention.cy.ts
@@ -5,15 +5,16 @@
  * 2.0.
  */
 
-import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
 import { login } from '../../../tasks/login';
-import { visitWithTimeRange } from '../../../tasks/navigation';
+import { visitTimeline, visitWithTimeRange } from '../../../tasks/navigation';
 
-import { ALERTS_URL, TIMELINES_URL } from '../../../urls/navigation';
+import { ALERTS_URL } from '../../../urls/navigation';
 import { ALERTS_HISTOGRAM_SERIES, ALERT_RULE_NAME, MESSAGE } from '../../../screens/alerts';
-import { TIMELINE_QUERY, TIMELINE_VIEW_IN_ANALYZER } from '../../../screens/timeline';
+import { TIMELINE_VIEW_IN_ANALYZER } from '../../../screens/timeline';
 import { selectAlertsHistogram } from '../../../tasks/alerts';
-import { createTimeline } from '../../../tasks/timelines';
+import { deleteTimelines } from '../../../tasks/common';
+import { createTimeline } from '../../../tasks/api_calls/timelines';
+import { getTimeline } from '../../../objects/timeline';
 
 describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () => {
   before(() => {
@@ -32,7 +33,6 @@ describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () =
     beforeEach(() => {
       login();
       visitWithTimeRange(ALERTS_URL);
-      waitForAlertsToPopulate();
     });
 
     describe('Alerts table', () => {
@@ -52,17 +52,18 @@ describe('Ransomware Prevention Alerts', { tags: ['@ess', '@serverless'] }, () =
     });
   });
 
-  describe('Ransomware in Timelines', () => {
-    beforeEach(() => {
-      login();
-      visitWithTimeRange(TIMELINES_URL);
-
-      createTimeline();
+  describe('Ransomware in Timelines', function () {
+    before(() => {
+      deleteTimelines();
+      createTimeline({ ...getTimeline(), query: 'event.code: "ransomware"' }).then((response) => {
+        cy.wrap(response.body.data.persistTimeline.timeline.savedObjectId).as('timelineId');
+      });
     });
 
-    it('Renders ransomware entries in timelines table', () => {
-      cy.get(TIMELINE_QUERY).type('event.code: "ransomware"{enter}');
-
+    it('Renders ransomware entries in timelines table', function () {
+      login();
+      const timeline = this.timelineId;
+      visitTimeline(timeline);
       // Wait for grid to load, it should have an analyzer icon
       cy.get(TIMELINE_VIEW_IN_ANALYZER).should('exist');
 
diff --git a/x-pack/test/security_solution_cypress/cypress/objects/timeline.ts b/x-pack/test/security_solution_cypress/cypress/objects/timeline.ts
index d57f389a04fc4..88a3b04c410d8 100644
--- a/x-pack/test/security_solution_cypress/cypress/objects/timeline.ts
+++ b/x-pack/test/security_solution_cypress/cypress/objects/timeline.ts
@@ -131,6 +131,7 @@ export const expectedExportedTimeline = (timelineResponse: Cypress.Response<Time
       { id: 'event.category' },
       { id: 'event.action' },
       { id: 'host.name' },
+      { id: 'message' },
     ],
     kqlMode: 'filter',
     kqlQuery: {
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts b/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
index cd471c33f505b..9b6a0c98db40c 100644
--- a/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
+++ b/x-pack/test/security_solution_cypress/cypress/tasks/api_calls/timelines.ts
@@ -31,6 +31,9 @@ export const createTimeline = (timeline: CompleteTimeline) =>
           {
             id: 'host.name',
           },
+          {
+            id: 'message',
+          },
         ],
         kqlMode: 'filter',
         kqlQuery: {
@@ -42,7 +45,7 @@ export const createTimeline = (timeline: CompleteTimeline) =>
           },
         },
         dateRange: {
-          end: '2022-04-01T12:22:56.000Z',
+          end: '2023-04-01T12:22:56.000Z',
           start: '2018-01-01T12:22:56.000Z',
         },
         description: timeline.description,