---
title: Use Elastic Defend with a remote Elasticsearch output
description: Configure Elastic Defend to send endpoint data to a remote Elasticsearch output and read it back using cross-cluster search.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/solutions/security/configure-elastic-defend/use-elastic-defend-with-remote-output-and-ccs
products:
  - Elastic Security
  - Fleet
applies_to:
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Planned
---

# Use Elastic Defend with a remote Elasticsearch output
By default, Elastic Defend sends endpoint data to the same cluster that manages the Elastic Agent. You can instead configure Elastic Agents to send their data to a separate cluster using a [remote Elasticsearch output](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/reference/fleet/remote-elasticsearch-output), while still managing those Elastic Agents from your local cluster. This is useful when you want to keep endpoint data separate from the deployment where you run Fleet and Elastic Security.
When Elastic Agents use a remote Elasticsearch output, their endpoint data (metadata, events, policy responses, and response action responses) is written to the remote cluster instead of the local cluster. For Elastic Security to display and act on this data, the local cluster reads it back using [cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/explore-analyze/cross-cluster-search) (CCS).

## How it works

The setup relies on two independent links between the local cluster and the remote cluster:
- **Write path (remote Elasticsearch output):** Elastic Agents managed by the local cluster ship their data to the remote cluster.
- **Read path (cross-cluster search):** the local cluster's Kibana reads that data back from the remote cluster so it can appear in Elastic Security.

Elastic Agents always enroll into and are managed by the local cluster. They send their data directly to the remote cluster, but never enroll into it or receive management instructions from it.
Once configured, the following Elastic Security endpoint management features can read Elastic Defend data stored on the remote cluster:
- The **Endpoints** page and endpoint details flyout
- Response actions, including response actions history and status
- Policy responses
- Automatic troubleshooting


## Before you begin

Make sure you have the following before you start:
- A local cluster running Fleet and Elastic Security, and a separate remote cluster to receive endpoint data.
- Permission to use Fleet in Kibana on the local cluster, so you can create outputs and manage Elastic Agent policies.


## Set up Elastic Defend with a remote Elasticsearch output

<stepper>
  <step title="Configure a remote {{es}} output">
    In the local cluster, create a [remote Elasticsearch output](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/reference/fleet/remote-elasticsearch-output) and point an Elastic Agent policy at it, so that Elastic Agents on that policy send their data to the remote cluster.To confirm the output is working, go to **Fleet → Settings** and check that the remote Elasticsearch output appears in the **Outputs** list without connection errors.
  </step>

  <step title="Add {{elastic-defend}} and enroll {{agents}}">
    [Install Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/solutions/security/configure-elastic-defend/install-elastic-defend): add the Elastic Defend integration to the Elastic Agent policy that uses the remote output, then enroll your Elastic Agents into the local cluster. Their endpoint data now lands on the remote cluster.To confirm enrollment, go to **Fleet → Agents** and check that each Elastic Agent shows a **Healthy** status.
  </step>

  <step title="Configure {{ccs}}">
    Configure CCS so the local cluster can read the endpoint data back from the remote cluster. Follow [Set up cross-cluster search to query remote data](/elastic/docs-content/pull/7565/reference/fleet/remote-elasticsearch-output#set-up-ccs).
  </step>
</stepper>

Once the remote output and CCS are configured, Elastic Security automatically reads Elastic Defend data from the remote cluster.

## Related pages

- [Configure endpoint protection with Elastic Defend](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/solutions/security/configure-elastic-defend)
- [Remote Elasticsearch output](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/reference/fleet/remote-elasticsearch-output)
- [Cross-cluster search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7565/explore-analyze/cross-cluster-search)