Elastic Cloud Credentials

Description

General

• Documentation: https://www.elastic.co/guide/en/cloud/current/index.html
• Summary: Elastic Cloud is an Elastic hosting service. The URI found by the detector enables to access a cluster.
• IPs allowlist: IPs can be restricted with Traffic Filters rules.
• Scopes: Yes. Users with different roles can be managed through Kibana.

Revoke the secret

To reset the password, go to the Security tab on the console and click on Reset Password.

Check for suspicious activity

Logs can be accessed through the Logs and metrics tab in the console.

Details for Elastic cloud uri

• Family: Database

• Category: Data storage

• Company: Elastic

• High recall: True

• Validity check available: True

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Minimum number of matches: 5

• Occurrences found for one million commits: 1.27

• Prefixed: True

• PreValidators:

- type: FilenameBanlistPreValidator
  banlist_extensions: []
  banlist_filenames: []
  check_binaries: false
  include_default_banlist_extensions: true
  ban_markup: false
- type: ContentWhitelistPreValidator
  patterns:
    - \.(gcp|aws)\.(found\.io|cloud\.es\.io)
- type: ContentWhitelistPreValidator
  patterns:
    - https?://

Examples

- text: |
    "elasticsearch": {
    -    "url": "http://localhost:9200/",
    +    "url": "https://elastic:p92iamsUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243/",
      "index": "polyglot-test"}

  connection_uri: https://elastic:p92iamsUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243
  scheme: https
  username: elastic
  password: p92iamsUdFsNDn4JMooOlHHH
  host: 802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io
  port: '9243'

# Test special characters in password
- text: |
    "elasticsearch": {
    -    "url": "http://localhost:9200/",
    +    "url": "https://elastic:p92!@msUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243/",
      "index": "polyglot-test"}

  connection_uri: https://elastic:p92!@msUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243
  scheme: https
  username: elastic
  password: p92!@msUdFsNDn4JMooOlHHH
  host: 802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io
  port: '9243'

# Test detection in md files
- text: |
    "elasticsearch": {
    -    "url": "http://localhost:9200/",
    +    "url": "https://elastic:p92!@msUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243/",
      "index": "polyglot-test"}

  connection_uri: https://elastic:p92!@msUdFsNDn4JMooOlHHH@802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io:9243
  scheme: https
  username: elastic
  password: p92!@msUdFsNDn4JMooOlHHH
  host: 802bb6d77d8244c482aa8ee1f1f4d555.eu-central-1.aws.cloud.es.io
  port: '9243'