Elastic Agent (Defender) – Public + On-Prem Deployment Question

Animate4498
Tue, 18 Nov 2025 14:28:05 +0000
Elastic Agent

My goal is to deploy the Elastic Agent with the Defender integration as an XDR solution on our clients and forward all security alerts to our on-prem SIEM. Fleet and the rest of the Elastic components are reachable from the office network and through VPN.

The issue: employees are allowed to use their notebooks privately and we have a very flexible home-office policy. Not all work-related resources require a VPN connection.

My question:
Is it possible to configure the Elastic Agent so that it sends data to the internal ingest nodes when the device is on the corporate network, and automatically switches to a public log receiver when it is outside the company network or not connected to VPN?

9 posts - 4 participants