rules-elk

The Elasticsearch TransportClient (port 9300 binary protocol) was removed in Elasticsearch 8.x. Migrate to the Java High Level REST Client or the new Java API Client (co.elastic.clients:elasticsearch-java) to maintain support and receive security patches.

Hardcoded credential detected in ELK config — CWE-798. Hard-coding Elasticsearch/Kibana passwords in config files means every developer with repo access has cluster credentials. Use environment variable substitution (e.g., '${ES_PASSWORD}') or a secrets manager.

Elasticsearch dynamic inline script execution is enabled — CWE-94. This allows any authenticated user to run arbitrary Groovy/Painless code on the cluster nodes, leading to RCE. Remove 'script.inline: true' or restrict to 'script.inline: sandboxed' with a strict operator allow-list.

Elasticsearch is configured to bind to all network interfaces — CWE-284. Combined with disabled security this directly exposed the Meow botnet attack (2020) that deleted 13,000+ indices. Bind to a specific internal interface ('network.host: 127.0.0.1' or a private IP) and enforce TLS + auth before opening to any network.

Elasticsearch stored script execution is enabled — CWE-94. Stored scripts persist on the cluster and can be triggered by any user with write access. Use only pre-approved scripts, restrict with 'script.allowed_types: none' in production.

Elasticsearch TLS is explicitly disabled — CWE-319. Transport credentials and index data travel in plaintext. Enable TLS for both HTTP and transport layers and provide a signed certificate/keystore.

Elasticsearch X-Pack security is explicitly disabled — CWE-306. Without security enabled, any network-accessible node accepts unauthenticated reads and writes, including full index deletion and cluster shutdown. Remove this line or set it to 'true'.