diff --git a/x-pack/plugins/security_solution/cypress/cypress.json b/x-pack/plugins/security_solution/cypress/cypress.json
index 173514565c8bb..b097b0432e75d 100644
--- a/x-pack/plugins/security_solution/cypress/cypress.json
+++ b/x-pack/plugins/security_solution/cypress/cypress.json
@@ -1,9 +1,6 @@
 {
   "baseUrl": "http://localhost:5601",
   "defaultCommandTimeout": 120000,
-  "retries": {
-    "runMode": 2
-  },
   "screenshotsFolder": "../../../target/kibana-security-solution/cypress/screenshots",
   "trashAssetsBeforeRuns": false,
   "video": false,
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
index 266453b13adae..09bc24613053c 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_exceptions.spec.ts
@@ -25,7 +25,6 @@ import {
   activatesRule,
   addsException,
   addsExceptionFromRuleSettings,
-  deactivatesRule,
   goToAlertsTab,
   goToExceptionsTab,
   removeException,
@@ -53,6 +52,8 @@ describe('Exceptions', () => {
     waitForAlertsToPopulate();
     refreshPage();
 
+    cy.screenshot('after-activating-rule');
+
     cy.scrollTo('bottom');
     cy.get(SERVER_SIDE_EVENT_COUNT)
       .invoke('text')
@@ -62,7 +63,6 @@ describe('Exceptions', () => {
           NUMBER_OF_AUDITBEAT_EXCEPTIONS_ALERTS
         );
       });
-    deactivatesRule();
   });
 
   afterEach(() => {
@@ -76,12 +76,14 @@ describe('Exceptions', () => {
       goToExceptionsTab();
       addsExceptionFromRuleSettings(exception);
       esArchiverLoad('auditbeat_for_exceptions2');
-      activatesRule();
       waitForTheRuleToBeExecuted();
       goToAlertsTab();
       refreshPage();
+      cy.screenshot('after-adding-exceptions-alert-tab');
 
       cy.scrollTo('bottom');
+      cy.screenshot('after-adding-exceptions-alert-tab-after-scrolling');
+
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterCreatingExceptionText) => {
@@ -90,8 +92,10 @@ describe('Exceptions', () => {
 
       goToClosedAlerts();
       refreshPage();
+      cy.screenshot('closed-alerts');
 
       cy.scrollTo('bottom');
+      cy.screenshot('closed-alerts-after-scroll');
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfClosedAlertsAfterCreatingExceptionText) => {
@@ -139,7 +143,6 @@ describe('Exceptions', () => {
       esArchiverLoad('auditbeat_for_exceptions2');
 
       cy.scrollTo('bottom');
-      activatesRule();
       cy.get(SERVER_SIDE_EVENT_COUNT)
         .invoke('text')
         .then((numberOfAlertsAfterCreatingExceptionText) => {
diff --git a/x-pack/plugins/security_solution/cypress/objects/exception.ts b/x-pack/plugins/security_solution/cypress/objects/exception.ts
index 2182a5b6fa6d2..775a83dee2543 100644
--- a/x-pack/plugins/security_solution/cypress/objects/exception.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/exception.ts
@@ -12,6 +12,6 @@ export interface Exception {
 
 export const exception: Exception = {
   field: 'host.name',
-  operator: 'is one of',
-  values: ['siem-kibana', 'suricata-iowa', 'siem-es', 'jessie', 'siem'],
+  operator: 'is',
+  values: ['suricata-iowa'],
 };
diff --git a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
index fc871237c3f4f..4e263903a34a6 100644
--- a/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/exceptions.ts
@@ -21,4 +21,4 @@ export const LOADING_SPINNER = '[data-test-subj="loading-spinner"]';
 export const OPERATOR_INPUT = '[data-test-subj="operatorAutocompleteComboBox"]';
 
 export const VALUES_INPUT =
-  '[data-test-subj="valuesAutocompleteMatchAny"] [data-test-subj="comboBoxInput"]';
+  '[data-test-subj="valuesAutocompleteMatch"] [data-test-subj="comboBoxInput"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts b/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
index 9dd23a1dfa71f..16631e0399abd 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/rule_details.ts
@@ -66,6 +66,7 @@ export const addsExceptionFromRuleSettings = (exception: Exception) => {
     cy.get(VALUES_INPUT).type(`${value}{enter}`);
   });
   cy.get(CLOSE_ALERTS_CHECKBOX).click({ force: true });
+  cy.screenshot('exceptions-modal-filled');
   cy.get(CONFIRM_BTN).click();
   cy.get(CONFIRM_BTN).should('have.attr', 'disabled');
   cy.get(CONFIRM_BTN).should('not.have.attr', 'disabled');
diff --git a/x-pack/plugins/security_solution/package.json b/x-pack/plugins/security_solution/package.json
index 048f3846cc322..04c08d85ddbe3 100644
--- a/x-pack/plugins/security_solution/package.json
+++ b/x-pack/plugins/security_solution/package.json
@@ -10,7 +10,7 @@
     "build-graphql-types": "node scripts/generate_types_from_graphql.js",
     "cypress:open": "../../../node_modules/.bin/cypress open --config-file ./cypress/cypress.json",
     "cypress:open-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/visual_config.ts",
-    "cypress:run": "../../../node_modules/.bin/cypress run --browser chrome --headless --spec ./cypress/integration/**/*.spec.ts --config-file ./cypress/cypress.json --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=./cypress/reporter_config.json; status=$?; ../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-security-solution/cypress/results/mochawesome*.json > ../../../target/kibana-security-solution/cypress/results/output.json; ../../../node_modules/.bin/marge ../../../target/kibana-security-solution/cypress/results/output.json --reportDir ../../../target/kibana-security-solution/cypress/results; mkdir -p ../../../target/junit && cp ../../../target/kibana-security-solution/cypress/results/*.xml ../../../target/junit/ && exit $status;",
+    "cypress:run": "../../../node_modules/.bin/cypress run --browser chrome --headless --spec ./cypress/integration/alerts_detection_exceptions.spec.ts --config-file ./cypress/cypress.json --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=./cypress/reporter_config.json; status=$?; ../../../node_modules/.bin/mochawesome-merge ../../../target/kibana-security-solution/cypress/results/mochawesome*.json > ../../../target/kibana-security-solution/cypress/results/output.json; ../../../node_modules/.bin/marge ../../../target/kibana-security-solution/cypress/results/output.json --reportDir ../../../target/kibana-security-solution/cypress/results; mkdir -p ../../../target/junit && cp ../../../target/kibana-security-solution/cypress/results/*.xml ../../../target/junit/ && exit $status;",
     "cypress:run-as-ci": "node --max-old-space-size=2048 ../../../scripts/functional_tests --config ../../test/security_solution_cypress/cli_config.ts",
     "test:generate": "node scripts/endpoint/resolver_generator"
   }
diff --git a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz
index 6c0d4b234fe4b..4139fd9d28f46 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions/data.json.gz differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz
index ad234f460965e..0fdcb7d783ea6 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/auditbeat_for_exceptions2/data.json.gz differ