[Internal]: CPS × Security docs for GA: correct the availability-by-app section + add a "CPS for Elastic Security" guidance page

[chuddy-elastic]

Description

What: Two related work items as CPS reaches GA (~Sep 1).

1. Correct and extend "Cross-project search availability in Elastic Security apps"
   (/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-availability-security):

• ADD detection rules — the section's biggest gap. Security detection rules on an origin
  project query data across linked projects and generate alerts on the origin (the Central
  SOC model). This is the primary Security CPS capability and it isn't documented here.
• ADD a note that the max-alerts-per-rule-execution cap applies across all linked projects
  a rule covers.
• ADD the Cloud-identity requirement for rules: rules execute with the API key of the user
  who created/last updated them. Elasticsearch API keys and local (file-realm) users are
  origin-scoped, so their rules resolve no linked-project indices and skip with "no matching
  indices" (root cause of [DEX][CPS] Detection rules skip execution when origin has no matching indices kibana#283236, closed as not-a-bug). Users migrating rules or creating them via automation need this called out.
• CORRECT the Entity store entry. Current text says entity profiles "do not include data from
  linked projects." Validated behavior: entity retrieval at the origin federates across every
  linked project's entity store ([Entity Store] Add support for CPS in Entity Store kibana#260198). What remains per-project: store
  build, risk scoring, and entity unification (same host appears once per project with no deduplication at origin today).
• CORRECT the "Defend and OSQuery" entry. No longer "origin only" (cross-project read support was feature-flagged in Aug).
• CORRECT Explore "origin only," and Overview "origin only". These pages will now show data from Linked Projects. However, flyouts are not supported yet for Session Viewer, for example.
• ADD machine learning: anomaly detection job datafeeds and transforms can read
  linked-project data at GA; ML rule types alert on the anomalies they produce; jobs and
  results live on the origin.
• ADD Cases to the origin-scoped list (linked-project alert attachments are not supported).

2. NEW page (or section): "Using cross-project search with Elastic Security" — the Central
   SOC model end to end: origin vs linked responsibilities, where alerts/cases/investigations
   live, triage and investigation workflow (including ES|QL patterns with METADATA _index and
   qualified project patterns), and limitations users should plan around (read-only boundary,
   alert surfaces showing origin alerts by design, remote-alert side effects, per-project
   entity analytics, single-organization scope, 100-linked-project ceiling).

When: GA launch week (~Sep 1, 2026). Item 1 is launch-blocking for accuracy. item 2 can
follow within the launch window.

Why: The GA announcement drives Security customers to these docs. The current section
under-documents the flagship capability (centralized detections), states entity behavior
that contradicts what ships, and omits the rule-ownership requirement that produced our
most-escalated internal bug report. A dedicated guidance page prevents the top
misunderstanding we saw in testing: expecting merged cross-project alerts in the Alerts UI.

Resources

Current page: https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-availability-security
GA blog draft (Security Labs, PM-reviewed — reference for the guidance page):
https://docs.google.com/document/d/1epOazd4ZGU-aEHiSiQGl2LjM8QAeFYVPHwvJs_W-Ib8/edit
CPS Security PRD (Central SOC model, feature scope): https://docs.google.com/document/d/1_BvK6KCrMfArszm3sm1o_G_U7DX5VYB6rjvYPknnqf8/edit
Rule/API-key identity requirement: elastic/kibana#283236 (closed, root-cause analysis in final comment)
Federated entity read: elastic/kibana#260198
A PM-drafted support document covering feature behavior + limitations exists and can seed the new page — contact @chuddy-elastic.

Which deployment methods does this change impact?

Elastic Cloud Serverless only

Feature differences

CPS is Serverless-only. ECH/self-managed use cross-cluster search (CCS), documented
separately — no changes needed there. No differences within Serverless deployment methods,
but note the tier constraint: Security projects require the Complete tier for CPS.

What Elastic Stack release is this request related to?

N/A

Serverless release

The week of September 1, 2026 (CPS GA)

Collaboration model

We expect to collaborate on the first draft

Point of contact.

Main contact: @chuddy-elastic (Security PM, CPS/MSSP)
Stakeholders: Sneha Sachidananda (Director PM, Security), Tia Milosevic (Platform PM, CPS),
Yara Tercero (Security SIEM eng), Braxton Williams (PM — alert/investigation surfaces, for the
Defend/Explore/Overview verification), Leslie Lin (Program Manager)

[github-actions]

Elastic Docs AI Menu

Check one box to run an AI workflow for this issue.

• Triage (docs-triage). Status: not started.
• Scope the docs work (docs-scope). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.