[Security] Update Elastic Defend troubleshooting

[natasha-moore-elastic]

Summary

Resolves https://github.com/elastic/docs-content-internal/issues/399:

• Adds new entries to the troubleshooting guide.
• Updates the Agent-Endpoint connection issues section.
• Converts dropdowns into level 2 sections to address the following issues:

1. The headings can be clicked on to expand them but when I do I don't get a link change to the URL. This makes it hard to link others to exact troubleshooting steps. It would be nice if I could share such links.
2. The "On this page" links on the right to exhibit the URL-change behavior, but the actual drill down options don't correspond to the top-level sections on the main page and don't change the page content.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

[github-actions]

Vale Linting Results

Summary: 4 suggestions found

💡 Suggestions (4)

File	Line	Rule	Message
troubleshoot/security/elastic-defend.md	23	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.
troubleshoot/security/elastic-defend.md	46	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'Disabled', unless the term is in the UI.
troubleshoot/security/elastic-defend.md	149	Elastic.Wordiness	Consider using 'because' instead of 'since'.
troubleshoot/security/elastic-defend.md	247	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• troubleshoot/security/elastic-defend.md

[ferullo]

The changes look great (thanks!) but I'm going to defer to @intxgo 's approval since he's the expert.

FYI @joeypoon

[intxgo]

The changes look great (thanks!) but I'm going to defer to @intxgo 's approval since he's the expert.

The changes are good, but we have so little documentation about the orphaned state that I think it's worth to add the sentece.

btw @ferullo I've just checked on serverless, still only Agent gets the orphaned status, but endpoint goes offline. We've discussed that some time ago, I thought it was going to be applied also on the Endpoints view.

[benironside]

LGTM, I like the reorg to use fewer notes. Left one suggestion for your consideration.