diff --git a/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/__tests__/run.test.ts b/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/__tests__/run.test.ts
index c9f1d158942f6..0757bd9fcc31d 100644
--- a/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/__tests__/run.test.ts
+++ b/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/__tests__/run.test.ts
@@ -126,8 +126,10 @@ describe('Automated Resolution', () => {
 
       const step1Query = mockEsClient.search.mock.calls[0][0] as any;
       const filters = step1Query.query.bool.filter;
-      const hasTimestampFilter = filters.some((f: any) => f.range && f.range['@timestamp']);
-      expect(hasTimestampFilter).toBe(false);
+      const hasLastSeenFilter = filters.some(
+        (f: any) => f.range && f.range['entity.lifecycle.last_seen']
+      );
+      expect(hasLastSeenFilter).toBe(false);
     });
 
     it('should include timestamp range filter for incremental scan', async () => {
@@ -153,9 +155,11 @@ describe('Automated Resolution', () => {
 
       const step1Query = mockEsClient.search.mock.calls[0][0] as any;
       const filters = step1Query.query.bool.filter;
-      const timestampFilter = filters.find((f: any) => f.range && f.range['@timestamp']);
-      expect(timestampFilter).toEqual({
-        range: { '@timestamp': { gt: '2026-03-09T00:00:00Z' } },
+      const lastSeenFilter = filters.find(
+        (f: any) => f.range && f.range['entity.lifecycle.last_seen']
+      );
+      expect(lastSeenFilter).toEqual({
+        range: { 'entity.lifecycle.last_seen': { gt: '2026-03-09T00:00:00Z' } },
       });
     });
 
diff --git a/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/run.ts b/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/run.ts
index 70c652f38059e..94b7fa77c3666 100644
--- a/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/run.ts
+++ b/x-pack/solutions/security/plugins/entity_store/server/maintainers/automated_resolution/run.ts
@@ -118,7 +118,9 @@ async function collectNewEmailValues(
   ];
 
   if (state.lastProcessedTimestamp) {
-    filters.push({ range: { '@timestamp': { gt: state.lastProcessedTimestamp } } });
+    filters.push({
+      range: { 'entity.lifecycle.last_seen': { gt: state.lastProcessedTimestamp } },
+    });
   }
 
   do {
@@ -137,7 +139,7 @@ async function collectNewEmailValues(
             ...(afterKey ? { after: afterKey } : {}),
           },
         },
-        max_timestamp: { max: { field: '@timestamp' } },
+        max_timestamp: { max: { field: 'entity.lifecycle.last_seen' } },
       },
     });