# Elatic fleet custom fields to Elastic Defend

**URL:** <https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794>\
**Category:** Endpoint Security\
**Created:** [January 29, 2026, 12:42pm UTC](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794 "2026-01-29T12:42:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GyciakasGh0st](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gyciakasgh0st/32/142112_2.png) [@GyciakasGh0st](https://discuss.elastic.co/u/GyciakasGh0st)\
**Post date:** [January 29, 2026, 12:42pm UTC](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794/1 "2026-01-29T12:42:31Z")

</div>

Hi,

I have the issue. For my elastic fleet policy in settings i seted two custom fields.  
For all other integrations documents these fields appearing during ingest.  
But only for elastic defend these two custom fields are not ingesting. Am I missing something ?

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [January 29, 2026, 1:26pm UTC](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794/2 "2026-01-29T13:26:57Z")

</div>

Hi @GyciakasGh0st . You’re correct. Defend does not support custom fields like other integrations. `[linux,mac,windows].advanced.document_enrichment.fields` which is described [here](https://www.elastic.co/docs/reference/security/defend-advanced-settings) is the closest analog.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2026, 1:27pm UTC](https://discuss.elastic.co/t/elatic-fleet-custom-fields-to-elastic-defend/384794/3 "2026-02-26T13:27:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
