Elastic Agent (Defender) – Public + On-Prem Deployment Question

Elastic Stack Elastic Agent
1

My goal is to deploy the Elastic Agent with the Defender integration as an XDR solution on our clients and forward all security alerts to our on-prem SIEM. Fleet and the rest of the Elastic components are reachable from the office network and through VPN.

The issue: employees are allowed to use their notebooks privately and we have a very flexible home-office policy. Not all work-related resources require a VPN connection.

My question:
Is it possible to configure the Elastic Agent so that it sends data to the internal ingest nodes when the device is on the corporate network, and automatically switches to a public log receiver when it is outside the company network or not connected to VPN?

2

Hello and welcome,

You can configure multiple hosts in an output, but the agent will use all of them, so you may have cases where the Agent is on the private network but it is sending logs using the public endpoint.

They would also need to have access to Fleet when not on the private network/VPN, not just the endpoint to send logs.

1 Like