diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_saved_query_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_saved_query_rule.cy.ts
index 5a87350b730da..913218797fd76 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_saved_query_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/custom_saved_query_rule.cy.ts
@@ -51,8 +51,7 @@ const savedQueryName = 'custom saved query';
 const savedQueryQuery = 'process.name: test';
 const savedQueryFilterKey = 'testAgent.value';
 
-// TODO: https://github.com/elastic/kibana/issues/161539
-describe('Saved query rules', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
+describe('Saved query rules', { tags: ['@ess', '@serverless'] }, () => {
   describe('Custom saved_query detection rule creation', () => {
     beforeEach(() => {
       login();
diff --git a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
index b2b000803e6c4..9ce0bbb5be44a 100644
--- a/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
+++ b/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/rule_creation/indicator_match_rule.cy.ts
@@ -115,8 +115,7 @@ import { deleteAlertsAndRules } from '../../../../tasks/api_calls/common';
 
 const DEFAULT_THREAT_MATCH_QUERY = '@timestamp >= "now-30d/d"';
 
-// TODO: https://github.com/elastic/kibana/issues/161539
-describe('indicator match', { tags: ['@ess', '@serverless', '@brokenInServerless'] }, () => {
+describe('indicator match', { tags: ['@ess', '@serverless'] }, () => {
   describe('Detection rules, Indicator Match', () => {
     const expectedUrls = getNewThreatIndicatorRule().references?.join('');
     const expectedFalsePositives = getNewThreatIndicatorRule().false_positives?.join('');
diff --git a/x-pack/test/security_solution_cypress/es_archives/threat_indicator/mappings.json b/x-pack/test/security_solution_cypress/es_archives/threat_indicator/mappings.json
index bc5f6e3db9169..e22f719255fe5 100644
--- a/x-pack/test/security_solution_cypress/es_archives/threat_indicator/mappings.json
+++ b/x-pack/test/security_solution_cypress/es_archives/threat_indicator/mappings.json
@@ -811,10 +811,6 @@
     },
     "settings": {
       "index": {
-        "lifecycle": {
-          "name": "filebeat",
-          "rollover_alias": "filebeat-7.12.0"
-        },
         "mapping": {
           "total_fields": {
             "limit": "10000"