Loading

Use Elastic Defend with a remote Elasticsearch output

By default, Elastic Defend sends endpoint data to the same cluster that manages the Elastic Agent. You can instead configure Elastic Agents to send their data to a separate cluster using a remote Elasticsearch output, while still managing those Elastic Agents from your local cluster. This is useful when you want to keep endpoint data separate from the deployment where you run Fleet and Elastic Security.

When Elastic Agents use a remote Elasticsearch output, their endpoint data (metadata, events, policy responses, and response action responses) is written to the remote cluster instead of the local cluster. For Elastic Security to display and act on this data, the local cluster reads it back using cross-cluster search (CCS).

The setup relies on two independent links between the local cluster and the remote cluster:

  • Write path (remote Elasticsearch output): Elastic Agents managed by the local cluster ship their data to the remote cluster.
  • Read path (cross-cluster search): the local cluster's Kibana reads that data back from the remote cluster so it can appear in Elastic Security.

Elastic Agents always enroll into and are managed by the local cluster. They send their data directly to the remote cluster, but never enroll into it or receive management instructions from it.

Once configured, the following Elastic Security endpoint management features can read Elastic Defend data stored on the remote cluster:

  • The Endpoints page and endpoint details flyout
  • Response actions, including response actions history and status
  • Policy responses
  • Automatic troubleshooting

Make sure you have the following before you start:

  • A local cluster running Fleet and Elastic Security, and a separate remote cluster to receive endpoint data.
  • Permission to use Fleet in Kibana on the local cluster, so you can create outputs and manage Elastic Agent policies.

  1. Configure a remote Elasticsearch output

    In the local cluster, create a remote Elasticsearch output and point an Elastic Agent policy at it, so that Elastic Agents on that policy send their data to the remote cluster.

    To confirm the output is working, go to Fleet → Settings and check that the remote Elasticsearch output appears in the Outputs list without connection errors.

  2. Add Elastic Defend and enroll Elastic Agents

    Install Elastic Defend: add the Elastic Defend integration to the Elastic Agent policy that uses the remote output, then enroll your Elastic Agents into the local cluster. Their endpoint data now lands on the remote cluster.

    To confirm enrollment, go to Fleet → Agents and check that each Elastic Agent shows a Healthy status.

  3. Configure cross-cluster search

    Configure CCS so the local cluster can read the endpoint data back from the remote cluster. Follow Set up cross-cluster search to query remote data.

Once the remote output and CCS are configured, Elastic Security automatically reads Elastic Defend data from the remote cluster.