Application-level network security for Elastic Cloud Hosted deployments

**What the feature is**

Apply network security policies **per deployment application** (Elasticsearch, Kibana, APM, etc) on Elastic Cloud Hosted.

Security administrators can attach IP filters and Private connectivity to **selected applications** of a hosted deployment, such as Elasticsearch, Kibana, APM, Fleet, and other stack applications, instead of enforcing identical rules on every endpoint at once. This supports zero-trust patterns (data plane on PrivateLink, UI on controlled public access), selective exposure for telemetry paths like APM/RUM, and staged rollouts of restrictive filters before applying them to mission-critical endpoints.

**Value proposition**

Hosted network security today is **all-or-nothing** at the deployment level: one policy covers every component, which forces customers to expose their data layer unnecessarily or block legitimate access to UI and ingestion paths. Enterprise and regulated accounts have filed numerous enhancement requests for per-component traffic filters; they need granular control to adopt best-practice architectures and meet compliance without sacrificing workforce or telemetry access.

This feature removes that binary trade-off on Elastic Cloud Hosted while preserving backward-compatible defaults (apply to all components when no subset is chosen).

**Expected outcome**

- Admins choose **all applications** or a **subset** when associating an IP filter or Private connection with a deployment.
- Multiple policies can target different applications on the same deployment (e.g. PrivateLink on Elasticsearch, corporate IP allowlist on Kibana).
- The Cloud Console clearly shows which applications each policy protects on Deployment → Security and in Network Security workflows.
- Default behavior remains **apply to all** so existing deployments are unchanged unless admins opt into granularity.
- API and automation support application-scoped associations via an optional component list in policy payloads.
- Initial delivery targets **Elastic Cloud Hosted** (Serverless delivery is tracked separately).