Elastic medium stable kql

Inbound Connection to an Unsecure Elasticsearch Node

Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port.

View Source

Detection Logic

(data_stream.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and
http.response.status_code: 200 and destination.port: 9200 and network.direction: (inbound or ingress) and
not http.response.headers.content-type: "image/x-icon" and not http.request.headers.authorization: *

False Positives

⚠ If you have front-facing proxies that provide authentication and TLS, this rule would need to be tuned to eliminate the source IP address of your reverse-proxy.

Field Validations

Loading…

Comments (0)

Loading comments...