---
name: rt-exploit-elasticsearch
description: "Elasticsearch and OpenSearch assessment skill for authorized exposure review, index permissions, authentication, TLS, snapshot security, sensitive data sampling, and remediation."
---

# rt-exploit-elasticsearch - Elasticsearch/OpenSearch Assessment

## Overview

Search clusters often contain logs, user data, tokens, and business records. Common risks include public exposure, weak roles, broad index permissions, unprotected snapshots, and excessive retention.

## Prerequisites

- In-scope clusters and indices.
- Approved account and role.
- Sampling limits and redaction rules.
- Cloud provider or self-managed context.

## Assessment Areas

| Area | Checks |
|---|---|
| Exposure | Public endpoints, firewall rules, dashboards. |
| Authentication | Anonymous access, SSO, basic users, API keys. |
| Authorization | Index-level privileges and wildcard access. |
| TLS | Enforced HTTPS and node-to-node security. |
| Snapshots | Repository permissions and public storage exposure. |
| Data | Sensitive logs, tokens, PII, secrets. |
| Retention | Excessive data retention and deletion policy. |

## Workflow

1. Confirm cluster/indices and role scope.
2. Inventory exposure, version, auth, and TLS.
3. Review index privileges and dashboard access.
4. Sample only approved documents with redaction.
5. Review snapshot repository security.
6. Document data classes and remediation priorities.

## Evidence

Use redacted index lists, role summaries, dashboard screenshots, and approved document samples. Do not bulk export indices.

## Remediation

- Require authentication and TLS.
- Restrict public access.
- Use least-privilege index roles.
- Protect snapshots.
- Remove secrets from logs.
- Add retention and data minimization.
- Monitor anomalous searches and exports.


## Finding Examples

| Finding | Severity Driver |
|---|---|
| Public cluster endpoint | Internet exposure and anonymous access. |
| Broad index wildcard role | Excessive access to unrelated data. |
| Secrets in logs | Credential rotation and blast radius. |
| Unprotected snapshots | Offline data exposure risk. |

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-elasticsearch --phase exploitation --cmd "Elasticsearch posture review" --output "redacted cluster risk summary"
```
