Type to search.

Use Elastic Defend with a remote Elasticsearch output

Serverless Unavailable

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Unavailable

    This functionality is not available in Elastic Cloud Serverless.

Stack 9.5+

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available since 9.5

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

By default, Elastic Defend sends endpoint data to the same cluster that manages the Elastic Agent. You can instead configure Elastic Agents to send their data to a separate cluster using a remote Elasticsearch output, while still managing those Elastic Agents from your local cluster. This is useful when you want to keep endpoint data separate from the deployment where you run Fleet and Elastic Security.

When Elastic Agents use a remote Elasticsearch output, their endpoint data (metadata, events, policy responses, and response action responses) is written to the remote cluster instead of the local cluster. For Elastic Security to display and act on this data, the local cluster reads it back using cross-cluster search (CCS).

The setup relies on two independent links between the local cluster and the remote cluster:

  • Write path (remote Elasticsearch output): Elastic Agents managed by the local cluster ship their data to the remote cluster.
  • Read path (cross-cluster search): the local cluster's Kibana reads that data back from the remote cluster so it can appear in Elastic Security.

Elastic Agents always enroll into and are managed by the local cluster. They send their data directly to the remote cluster, but never enroll into it or receive management instructions from it.

Once configured, the following Elastic Security endpoint management features can read Elastic Defend data stored on the remote cluster:

  • The Endpoints page and endpoint details flyout
  • Response actions, including response actions history and status
  • Policy responses
  • Automatic troubleshooting

Make sure you have the following before you start:

  • A local cluster running Fleet and Elastic Security, and a separate remote cluster to receive endpoint data.
  • Permission to use Fleet in Kibana on the local cluster, so you can create outputs and manage Elastic Agent policies.

  1. Configure a remote Elasticsearch output

    In the local cluster, create a remote Elasticsearch output and point an Elastic Agent policy at it, so that Elastic Agents on that policy send their data to the remote cluster.

    To confirm the output is working, go to Fleet → Settings and check that the remote Elasticsearch output appears in the Outputs list without connection errors.

  2. Add Elastic Defend and enroll Elastic Agents

    Install Elastic Defend: add the Elastic Defend integration to the Elastic Agent policy that uses the remote output, then enroll your Elastic Agents into the local cluster. Their endpoint data now lands on the remote cluster.

    To confirm enrollment, go to Fleet → Agents and check that each Elastic Agent shows a Healthy status.

  3. Configure cross-cluster search

    Configure CCS so the local cluster can read the endpoint data back from the remote cluster. Follow Set up cross-cluster search to query remote data.

Once the remote output and CCS are configured, Elastic Security automatically reads Elastic Defend data from the remote cluster.