diff --git a/elastic/security/templates/component/logs-endpoint.events.file@package.json b/elastic/security/templates/component/logs-endpoint.events.file@package.json
index 69f9e1bf..9acdfaf5 100644
--- a/elastic/security/templates/component/logs-endpoint.events.file@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.file@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.file@settings.json b/elastic/security/templates/component/logs-endpoint.events.file@settings.json
index 466cfde9..29299dee 100644
--- a/elastic/security/templates/component/logs-endpoint.events.file@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.file@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.library@package.json b/elastic/security/templates/component/logs-endpoint.events.library@package.json
index b3afbeb2..b541ab25 100644
--- a/elastic/security/templates/component/logs-endpoint.events.library@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.library@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.library@settings.json b/elastic/security/templates/component/logs-endpoint.events.library@settings.json
index 9a617dd1..22b0c1ab 100644
--- a/elastic/security/templates/component/logs-endpoint.events.library@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.library@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.network@package.json b/elastic/security/templates/component/logs-endpoint.events.network@package.json
index 18c0a7b9..201be000 100644
--- a/elastic/security/templates/component/logs-endpoint.events.network@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.network@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.network@settings.json b/elastic/security/templates/component/logs-endpoint.events.network@settings.json
index a0fdf73a..d70ad22b 100644
--- a/elastic/security/templates/component/logs-endpoint.events.network@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.network@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.process@package.json b/elastic/security/templates/component/logs-endpoint.events.process@package.json
index b9d312fd..736babfd 100644
--- a/elastic/security/templates/component/logs-endpoint.events.process@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.process@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.process@settings.json b/elastic/security/templates/component/logs-endpoint.events.process@settings.json
index a0dc1474..3edcc01a 100644
--- a/elastic/security/templates/component/logs-endpoint.events.process@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.process@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.registry@package.json b/elastic/security/templates/component/logs-endpoint.events.registry@package.json
index 84f9be80..ad15252e 100644
--- a/elastic/security/templates/component/logs-endpoint.events.registry@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.registry@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.registry@settings.json b/elastic/security/templates/component/logs-endpoint.events.registry@settings.json
index 0c2a99e4..8cd3ea68 100644
--- a/elastic/security/templates/component/logs-endpoint.events.registry@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.registry@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.security@package.json b/elastic/security/templates/component/logs-endpoint.events.security@package.json
index 88b8f7fd..5bd1fecf 100644
--- a/elastic/security/templates/component/logs-endpoint.events.security@package.json
+++ b/elastic/security/templates/component/logs-endpoint.events.security@package.json
@@ -4,9 +4,13 @@
     "template": {
       "settings": {
         "index": {
-          "lifecycle": {
-            "name": "logs"
-          },
+          {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+            "lifecycle": {
+              "name": "logs"
+            },
+          {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+              "lifecycle": {},
+          {%- endif -%}
           "codec": "best_compression",
           "mapping": {
             "total_fields": {
diff --git a/elastic/security/templates/component/logs-endpoint.events.security@settings.json b/elastic/security/templates/component/logs-endpoint.events.security@settings.json
index c82f6f2f..1abbbca0 100644
--- a/elastic/security/templates/component/logs-endpoint.events.security@settings.json
+++ b/elastic/security/templates/component/logs-endpoint.events.security@settings.json
@@ -2,9 +2,13 @@
   "template": {
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "logs"
-        },
+        {% if lifecycle == "ilm" or (not lifecycle and build_flavor == "default") %}
+          "lifecycle": {
+            "name": "logs"
+          },
+        {%- elif lifecycle == "dlm" or (not lifecycle and build_flavor == "serverless") %}
+            "lifecycle": {},
+        {%- endif -%}
         "codec": "best_compression",
         "mapping": {
           "total_fields": {