{
  "port": 9200,
  "protocol": "tcp",
  "service": "Elasticsearch / OpenSearch REST API",
  "oneLiner": "A search cluster's HTTP API — hit / and it hands you its name, version, and cluster.",
  "whatItIs": "Elasticsearch binds its REST API to the first free port in 9200-9300, which in practice is 9200 (node-to-node transport uses 9300); OpenSearch, the fork, keeps the same default. A plain GET of the root returns a JSON banner with the cluster name and version, and every index, document, and admin operation is available over the same interface. IANA's registration for the port is the long-obsolete WAP connectionless session service, which you will never actually meet.",
  "exposure": {
    "verdict": "never",
    "note": "Exposed clusters with no authentication are a standing cause of mass data leaks and ransom-note indices — the API can read, rewrite, and delete every document. Enable security and put it behind a proxy or a private network."
  },
  "checkCommand": "curl -sS -m 5 http://TARGET:9200/",
  "links": [
    {
      "title": "Elasticsearch — Networking (http.port defaults to 9200-9300)",
      "url": "https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html",
      "kind": "official-docs"
    },
    {
      "title": "elastic/elasticsearch",
      "url": "https://github.com/elastic/elasticsearch",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 9200 (wap-wsp)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9200",
      "kind": "iana"
    }
  ]
}