rtexit-method 0.1.0 → 0.1.2

package/packaged-assets/.agents/skills/rt-exploit-elasticsearch/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: rt-exploit-elasticsearch
+description: "Elasticsearch and OpenSearch assessment skill for authorized exposure review, index permissions, authentication, TLS, snapshot security, sensitive data sampling, and remediation."
+---
+
+# rt-exploit-elasticsearch - Elasticsearch/OpenSearch Assessment
+
+## Overview
+
+Search clusters often contain logs, user data, tokens, and business records. Common risks include public exposure, weak roles, broad index permissions, unprotected snapshots, and excessive retention.
+
+## Prerequisites
+
+- In-scope clusters and indices.
+- Approved account and role.
+- Sampling limits and redaction rules.
+- Cloud provider or self-managed context.
+
+## Assessment Areas
+
+| Area | Checks |
+|---|---|
+| Exposure | Public endpoints, firewall rules, dashboards. |
+| Authentication | Anonymous access, SSO, basic users, API keys. |
+| Authorization | Index-level privileges and wildcard access. |
+| TLS | Enforced HTTPS and node-to-node security. |
+| Snapshots | Repository permissions and public storage exposure. |
+| Data | Sensitive logs, tokens, PII, secrets. |
+| Retention | Excessive data retention and deletion policy. |
+
+## Workflow
+
+1. Confirm cluster/indices and role scope.
+2. Inventory exposure, version, auth, and TLS.
+3. Review index privileges and dashboard access.
+4. Sample only approved documents with redaction.
+5. Review snapshot repository security.
+6. Document data classes and remediation priorities.
+
+## Evidence
+
+Use redacted index lists, role summaries, dashboard screenshots, and approved document samples. Do not bulk export indices.
+
+## Remediation
+
+- Require authentication and TLS.
+- Restrict public access.
+- Use least-privilege index roles.
+- Protect snapshots.
+- Remove secrets from logs.
+- Add retention and data minimization.
+- Monitor anomalous searches and exports.
+
+
+## Finding Examples
+
+| Finding | Severity Driver |
+|---|---|
+| Public cluster endpoint | Internet exposure and anonymous access. |
+| Broad index wildcard role | Excessive access to unrelated data. |
+| Secrets in logs | Credential rotation and blast radius. |
+| Unprotected snapshots | Offline data exposure risk. |
+
+## Autodoc
+
+```bash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-elasticsearch --phase exploitation --cmd "Elasticsearch posture review" --output "redacted cluster risk summary"
+```