[Internal]: CPS × Security docs for GA: correct the availability-by-app section + add a "CPS for Elastic Security" guidance page

### Description

What: Two related work items as CPS reaches GA (~Sep 1).

1) Correct and extend "Cross-project search availability in Elastic Security apps"
([/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-availability-security](https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-availability-security)):

- ADD detection rules — the section's biggest gap. Security detection rules on an origin
project query data across linked projects and generate alerts on the origin (the Central
SOC model). This is the primary Security CPS capability and it isn't documented here.
- ADD a note that the max-alerts-per-rule-execution cap applies across all linked projects
a rule covers.
- ADD the Cloud-identity requirement for rules: rules execute with the API key of the user
who created/last updated them. Elasticsearch API keys and local (file-realm) users are
origin-scoped, so their rules resolve no linked-project indices and skip with "no matching
indices" (root cause of elastic/kibana#283236, closed as not-a-bug). Users migrating rules or creating them via automation need this called out.
- CORRECT the Entity store entry. Current text says entity profiles "do not include data from
linked projects." Validated behavior: entity retrieval at the origin federates across every
linked project's entity store (elastic/kibana#260198). What remains per-project: store
build, risk scoring, and entity unification (same host appears once per project with no deduplication at origin today).
- CORRECT the "Defend and OSQuery" entry. No longer "origin only" (cross-project read support was feature-flagged in Aug).
- CORRECT Explore "origin only," and Overview "origin only". These pages will now show data from Linked Projects. However, flyouts are not supported yet for Session Viewer, for example.
- ADD machine learning: anomaly detection job datafeeds and transforms can read
linked-project data at GA; ML rule types alert on the anomalies they produce; jobs and
results live on the origin.
- ADD Cases to the origin-scoped list (linked-project alert attachments are not supported).

2) NEW page (or section): "Using cross-project search with Elastic Security" — the Central
SOC model end to end: origin vs linked responsibilities, where alerts/cases/investigations
live, triage and investigation workflow (including ES|QL patterns with METADATA _index and
qualified project patterns), and limitations users should plan around (read-only boundary,
alert surfaces showing origin alerts by design, remote-alert side effects, per-project
entity analytics, single-organization scope, 100-linked-project ceiling).

When: GA launch week (~Sep 1, 2026). Item 1 is launch-blocking for accuracy. item 2 can
follow within the launch window.

Why: The GA announcement drives Security customers to these docs. The current section
under-documents the flagship capability (centralized detections), states entity behavior
that contradicts what ships, and omits the rule-ownership requirement that produced our
most-escalated internal bug report. A dedicated guidance page prevents the top
misunderstanding we saw in testing: expecting merged cross-project alerts in the Alerts UI.

### Resources

Current page: https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-manage-scope#cps-availability-security
GA blog draft (Security Labs, PM-reviewed — reference for the guidance page):
https://docs.google.com/document/d/1epOazd4ZGU-aEHiSiQGl2LjM8QAeFYVPHwvJs_W-Ib8/edit
CPS Security PRD (Central SOC model, feature scope): https://docs.google.com/document/d/1_BvK6KCrMfArszm3sm1o_G_U7DX5VYB6rjvYPknnqf8/edit
Rule/API-key identity requirement: https://github.com/elastic/kibana/issues/283236 (closed, root-cause analysis in final comment)
Federated entity read: https://github.com/elastic/kibana/issues/260198
A PM-drafted support document covering feature behavior + limitations exists and can seed the new page — contact @chuddy-elastic.

### Which deployment methods does this change impact?

Elastic Cloud Serverless only

### Feature differences

CPS is Serverless-only. ECH/self-managed use cross-cluster search (CCS), documented
separately — no changes needed there. No differences within Serverless deployment methods,
but note the tier constraint: Security projects require the Complete tier for CPS.

### What Elastic Stack release is this request related to?

N/A

### Serverless release

The week of September 1, 2026 (CPS GA)

### Collaboration model

We expect to collaborate on the first draft

### Point of contact.

**Main contact:** @chuddy-elastic (Security PM, CPS/MSSP)
**Stakeholders:** Sneha Sachidananda (Director PM, Security), Tia Milosevic (Platform PM, CPS),
Yara Tercero (Security SIEM eng), Braxton Williams (PM — alert/investigation surfaces, for the
Defend/Explore/Overview verification), Leslie Lin (Program Manager)