[Security] Elastic Defend support for remote output and CCS

[natasha-moore-elastic]

Documents support for using Elastic Defend with a remote Elasticsearch output, available on Elastic Stack deployments starting in 9.5. When agents use a remote Elasticsearch output, their endpoint data is written to the remote cluster, and the management cluster reads it back using cross-cluster search.

Changes:

• Adds a new how-to page for setting up Elastic Defend with a remote Elasticsearch output and cross-cluster search.
• Updates the Fleet remote Elasticsearch output page to version-gate the previous Elastic Defend limitation and add Elastic Defend as a cross-cluster search use case.

Resolves #7220

Made with Cursor

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• reference/fleet/remote-elasticsearch-output.md
• solutions/security/configure-elastic-defend.md
• solutions/security/configure-elastic-defend/use-elastic-defend-with-remote-output-and-ccs.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 suggestion found

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
reference/fleet/remote-elasticsearch-output.md	217	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[florent-leborgne]

LGTM with 1 suggestion

[leemthompo]

Looks good to me, with one nit: the standard CCS terminology is "local (and remote) cluster" but this PR uses "management cluster" throughout (and "main cluster" once).

Don't know if it makes sense to align :)

[natasha-moore-elastic]

Looks good to me, with one nit: the standard CCS terminology is "local (and remote) cluster" but this PR uses "management cluster" throughout (and "main cluster" once).

Don't know if it makes sense to align :)

Hey @leemthompo, thanks for flagging this, I'll update the PR to use that term instead. 👍
We'll probably want to update https://www.elastic.co/docs/reference/fleet/remote-elasticsearch-output as well – this is where my PR sourced the term "management cluster" from. (cc @vishaangelova I think you might own that page?)

[szwarckonrad]

One question, otherwise LGTM