diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
index 274c649ece9dc..b7a3c938fbbf7 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
@@ -47,7 +47,7 @@ export const useOsqueryTab = ({
     : undefined;
 
   const responseActions =
-    expandedEventFieldsObject?.kibana?.alert?.rule?.parameters?.[0].response_actions;
+    expandedEventFieldsObject?.kibana?.alert?.rule?.parameters?.[0]?.response_actions;
 
   const shouldEarlyReturn =
     !rawEventData ||
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/response_actions_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/response_actions_view.tsx
index 58e18114f08f9..619537f9b457f 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/response_actions_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/response_actions_view.tsx
@@ -80,7 +80,7 @@ export const useResponseActionsView = <T extends object = JSX.Element>({
     : undefined;
 
   const responseActions =
-    expandedEventFieldsObject?.kibana?.alert?.rule?.parameters?.[0].response_actions;
+    expandedEventFieldsObject?.kibana?.alert?.rule?.parameters?.[0]?.response_actions;
   const shouldEarlyReturn = !rawEventData || !responseActionsEnabled;
 
   const alertId = rawEventData?._id ?? '';
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/cases/attach_alert_to_case.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/cases/attach_alert_to_case.cy.ts
index a4370e9073509..886d4a1deedf7 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/cases/attach_alert_to_case.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/cases/attach_alert_to_case.cy.ts
@@ -6,37 +6,43 @@
  */
 import { ROLES, SecurityRoleName } from '@kbn/security-solution-plugin/common/test';
 
-import { getNewRule } from '../../../objects/rule';
-
 import { expandFirstAlertActions } from '../../../tasks/alerts';
-import { createRule } from '../../../tasks/api_calls/rules';
 import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
 import { login } from '../../../tasks/login';
-import { visit } from '../../../tasks/navigation';
+import { visitWithTimeRange } from '../../../tasks/navigation';
 
 import { ALERTS_URL } from '../../../urls/navigation';
 import { ATTACH_ALERT_TO_CASE_BUTTON, TIMELINE_CONTEXT_MENU_BTN } from '../../../screens/alerts';
 import { LOADING_INDICATOR } from '../../../screens/security_header';
 import { deleteAlertsAndRules } from '../../../tasks/api_calls/common';
 
-const loadDetectionsPage = (role: SecurityRoleName) => {
+const loadDetectionsPage = (role?: SecurityRoleName) => {
   login(role);
-  visit(ALERTS_URL);
+  visitWithTimeRange(ALERTS_URL);
   waitForAlertsToPopulate();
 };
 
+const cleanKibana = () => {
+  cy.task('esArchiverUnload', { archiveName: 'query_alert' });
+  deleteAlertsAndRules();
+};
+
 describe('Alerts timeline', { tags: ['@ess'] }, () => {
   beforeEach(() => {
-    // First we login as a privileged user to create alerts.
-    deleteAlertsAndRules();
-    createRule(getNewRule());
-    login();
-    visit(ALERTS_URL);
-    waitForAlertsToPopulate();
+    cleanKibana();
+
+    cy.task('esArchiverLoad', { archiveName: 'query_alert', useCreate: true, docsOnly: true });
+    // First we login as a privileged user so data view can be created.
+    loadDetectionsPage();
+  });
+
+  afterEach(() => {
+    cleanKibana();
   });
 
-  context('Privileges: read only', () => {
+  context('Privileges: read only', { tags: ['@ess'] }, () => {
     beforeEach(() => {
+      // ess only role
       loadDetectionsPage(ROLES.reader);
     });
 
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts
index cebc67a78d2ef..56665f74043da 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/explore/guided_onboarding/tour.cy.ts
@@ -21,26 +21,33 @@ import {
   goToStep,
   startTour,
 } from '../../../tasks/guided_onboarding';
-import { createRule } from '../../../tasks/api_calls/rules';
-import { getNewRule } from '../../../objects/rule';
 import { ALERTS_URL, DASHBOARDS_URL } from '../../../urls/navigation';
 import { waitForAlertsToPopulate } from '../../../tasks/create_new_rule';
 import { login } from '../../../tasks/login';
-import { visit } from '../../../tasks/navigation';
+import { visitWithTimeRange } from '../../../tasks/navigation';
 import { startAlertsCasesTour } from '../../../tasks/api_calls/tour';
 import { deleteAlertsAndRules } from '../../../tasks/api_calls/common';
 
+const cleanUpKibana = () => {
+  cy.task('esArchiverUnload', { archiveName: 'query_alert' });
+  deleteAlertsAndRules();
+};
+
 describe('Guided onboarding tour', { tags: ['@ess'] }, () => {
   beforeEach(() => {
-    deleteAlertsAndRules();
-    createRule(getNewRule({ query: 'user.name:*' }));
+    cleanUpKibana();
+    cy.task('esArchiverLoad', { archiveName: 'query_alert', useCreate: true, docsOnly: true });
     login();
     disableExpandableFlyout();
     startAlertsCasesTour();
-    visit(ALERTS_URL);
+    visitWithTimeRange(ALERTS_URL);
     waitForAlertsToPopulate();
   });
 
+  afterEach(() => {
+    cleanUpKibana();
+  });
+
   it('Completes the tour with next button clicks', () => {
     startTour();
     completeTourWithNextButton();