{
  "port": 9600,
  "protocol": "both",
  "service": "Logstash monitoring API, OMRON FINS",
  "oneLiner": "Registered to Micromuse, but in the wild it is either Logstash's monitoring API or an OMRON PLC speaking FINS.",
  "whatItIs": "IANA's assignment is `micromuse-ncpw`, from the Micromuse/Netcool product line. Two unrelated modern uses dominate what you actually find. Logstash binds its HTTP monitoring API to tcp:9600 by default, serving unauthenticated JSON about pipelines, plugins, and JVM state. On industrial networks, OMRON PLCs speak the FINS protocol on 9600 over both TCP and UDP — Nmap ships an `omron-info` script that queries controller details there. A banner grab tells the two apart immediately: JSON means Logstash, binary means a PLC.",
  "exposure": {
    "verdict": "never",
    "note": "Both realistic occupants are bad news exposed. The Logstash API is unauthenticated introspection of your pipeline, and FINS is an unauthenticated industrial control protocol that should not touch a routable network at all."
  },
  "checkCommand": "curl -s http://TARGET:9600/",
  "links": [
    {
      "title": "Monitoring Logstash with APIs (default binding tcp:9600)",
      "url": "https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html",
      "kind": "official-docs"
    },
    {
      "title": "Nmap NSE omron-info — OMRON FINS on port 9600",
      "url": "https://nmap.org/nsedoc/scripts/omron-info.html",
      "kind": "official-docs"
    },
    {
      "title": "Logstash source repository",
      "url": "https://github.com/elastic/logstash",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}