{"resources":{"elasticsearch":{"id":"elasticsearch","name":"elasticsearch","fields":{"apiKey":{"name":"apiKey","type":"\u001belasticsearch.apiKey","title":"Elasticsearch API key","desc":"An API key and its lifetime: its owner, when it was created, when it expires, and whether it has been invalidated. A key with no expiration never expires, a posture concern. The id field selects the key.","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"cluster":{"name":"cluster","type":"\u001belasticsearch.cluster","title":"Elasticsearch cluster","desc":"The connected cluster: its name, version, health, and node counts, plus the security posture, users, roles, role mappings, and API keys reached from here. Populated from the cluster info, health, and security APIs; fields the connecting credential is not permitted to read are left null rather than failing.","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"role":{"name":"role","type":"\u001belasticsearch.role","title":"Elasticsearch role","desc":"A role and the privileges it grants: cluster privileges, per-index privileges, application privileges, and run-as targets. Built-in roles such as superuser are marked with isReserved. The name field selects the role, for example elasticsearch.cluster.roles.where(name == \"superuser\").","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"roleMapping":{"name":"roleMapping","type":"\u001belasticsearch.roleMapping","title":"Elasticsearch role mapping","desc":"A rule that assigns roles to users and groups based on their realm attributes. The name field selects the mapping, for example elasticsearch.cluster.roleMappings.where(name == \"admins\").","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"security":{"name":"security","type":"\u001belasticsearch.security","title":"Elasticsearch security posture","desc":"Cluster-wide security settings: whether the security features are enabled, whether anonymous access is allowed, whether the HTTP and transport layers use TLS, and whether audit logging is on. Read from the security usage API.","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"user":{"name":"user","type":"\u001belasticsearch.user","title":"Elasticsearch user","desc":"A user in the native realm, its assigned roles, and whether it is enabled. Built-in users such as elastic and kibana_system are marked with isReserved. The name field selects the user, for example elasticsearch.cluster.users.where(name == \"elastic\").","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true}},"title":"Elasticsearch cluster","desc":"Root of the Elasticsearch provider. The connected cluster and everything queryable through it (security posture, users, roles, role mappings, and API keys) is reached from elasticsearch.cluster.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.apiKey":{"id":"elasticsearch.apiKey","name":"elasticsearch.apiKey","fields":{"creation":{"name":"creation","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"expiration":{"name":"expiration","type":"\t","is_mandatory":true,"title":"Time the key expires, or null when it never expires","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"API key identifier","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"invalidated":{"name":"invalidated","type":"\u0004","is_mandatory":true,"title":"Whether the key has been invalidated","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"API key name","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"neverExpires":{"name":"neverExpires","type":"\u0004","is_mandatory":true,"title":"Whether the key never expires","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"User that owns the key","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch API key","desc":"An API key and its lifetime: its owner, when it was created, when it expires, and whether it has been invalidated. A key with no expiration never expires, a posture concern. The id field selects the key.","min_provider_version":"13.0.0","defaults":"name username neverExpires","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.cluster":{"id":"elasticsearch.cluster","name":"elasticsearch.cluster","fields":{"apiKeys":{"name":"apiKeys","type":"\u0019\u001belasticsearch.apiKey","title":"API keys defined on the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"buildFlavor":{"name":"buildFlavor","type":"\u0007","is_mandatory":true,"title":"Build flavor, for example \"default\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"dataNodeCount":{"name":"dataNodeCount","type":"\u0005","is_mandatory":true,"title":"Number of data nodes in the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"distribution":{"name":"distribution","type":"\u0007","is_mandatory":true,"title":"Product distribution serving the cluster, for example \"elasticsearch\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"healthStatus":{"name":"healthStatus","type":"\u0007","is_mandatory":true,"title":"Cluster health status: \"green\", \"yellow\", or \"red\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"luceneVersion":{"name":"luceneVersion","type":"\u0007","is_mandatory":true,"title":"Lucene version backing the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"nodeCount":{"name":"nodeCount","type":"\u0005","is_mandatory":true,"title":"Total number of nodes in the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"roleMappings":{"name":"roleMappings","type":"\u0019\u001belasticsearch.roleMapping","title":"Role mappings that assign roles to users and groups","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"roles":{"name":"roles","type":"\u0019\u001belasticsearch.role","title":"Roles defined on the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"security":{"name":"security","type":"\u001belasticsearch.security","title":"Security posture of the cluster","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"users":{"name":"users","type":"\u0019\u001belasticsearch.user","title":"Users defined in the native realm","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"uuid":{"name":"uuid","type":"\u0007","is_mandatory":true,"title":"Cluster UUID","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Server version, for example \"8.15.3\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch cluster","desc":"The connected cluster: its name, version, health, and node counts, plus the security posture, users, roles, role mappings, and API keys reached from here. Populated from the cluster info, health, and security APIs; fields the connecting credential is not permitted to read are left null rather than failing.","min_provider_version":"13.0.0","defaults":"name version healthStatus","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.role":{"id":"elasticsearch.role","name":"elasticsearch.role","fields":{"applicationNames":{"name":"applicationNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the applications the role grants privileges on","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"clusterPrivileges":{"name":"clusterPrivileges","type":"\u0019\u0007","is_mandatory":true,"title":"Cluster-level privileges granted, for example \"monitor\" or \"all\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"indexPrivilege":{"name":"indexPrivilege","type":"\u001belasticsearch.role.indexPrivilege","title":"Elasticsearch index privilege","desc":"A single per-index privilege grant of a role: the index patterns it applies to, the privileges granted, and whether field- or document-level security narrows access. For example the privileges \"read\" on the index pattern \"logs-*\".","provider":"go.mondoo.com/mql/v13/providers/elasticsearch","is_implicit_resource":true},"indexPrivileges":{"name":"indexPrivileges","type":"\u0019\u001belasticsearch.role.indexPrivilege","title":"Per-index privilege grants","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"isReserved":{"name":"isReserved","type":"\u0004","is_mandatory":true,"title":"Whether this is a built-in, reserved role","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"runAs":{"name":"runAs","type":"\u0019\u0007","is_mandatory":true,"title":"Users this role may run requests as","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch role","desc":"A role and the privileges it grants: cluster privileges, per-index privileges, application privileges, and run-as targets. Built-in roles such as superuser are marked with isReserved. The name field selects the role, for example elasticsearch.cluster.roles.where(name == \"superuser\").","min_provider_version":"13.0.0","defaults":"name isReserved","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.role.indexPrivilege":{"id":"elasticsearch.role.indexPrivilege","name":"elasticsearch.role.indexPrivilege","fields":{"allowRestrictedIndices":{"name":"allowRestrictedIndices","type":"\u0004","is_mandatory":true,"title":"Whether the grant extends to restricted (internal) indices","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"hasDocumentSecurity":{"name":"hasDocumentSecurity","type":"\u0004","is_mandatory":true,"title":"Whether document-level security restricts which documents are readable","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"hasFieldSecurity":{"name":"hasFieldSecurity","type":"\u0004","is_mandatory":true,"title":"Whether field-level security restricts which fields are readable","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"names":{"name":"names","type":"\u0019\u0007","is_mandatory":true,"title":"Index name patterns the grant applies to","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"privileges":{"name":"privileges","type":"\u0019\u0007","is_mandatory":true,"title":"Privileges granted on the matching indices, for example \"read\" or \"all\"","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch index privilege","desc":"A single per-index privilege grant of a role: the index patterns it applies to, the privileges granted, and whether field- or document-level security narrows access. For example the privileges \"read\" on the index pattern \"logs-*\".","min_provider_version":"13.0.0","defaults":"names privileges","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.roleMapping":{"id":"elasticsearch.roleMapping","name":"elasticsearch.roleMapping","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the mapping is enabled","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role mapping name","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles assigned by the mapping","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch role mapping","desc":"A rule that assigns roles to users and groups based on their realm attributes. The name field selects the mapping, for example elasticsearch.cluster.roleMappings.where(name == \"admins\").","min_provider_version":"13.0.0","defaults":"name enabled","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.security":{"id":"elasticsearch.security","name":"elasticsearch.security","fields":{"anonymousAccessEnabled":{"name":"anonymousAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether anonymous access is enabled","desc":"When true, unauthenticated requests are served as an anonymous user.","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"auditLoggingEnabled":{"name":"auditLoggingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether audit logging is enabled","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"available":{"name":"available","type":"\u0004","is_mandatory":true,"title":"Whether the security features are available under the current license","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the security features are enabled","desc":"When false, the cluster performs no authentication or authorization and any client that can reach it has full access.","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"httpTlsEnabled":{"name":"httpTlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the HTTP (REST) layer uses TLS","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"transportTlsEnabled":{"name":"transportTlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the transport (node-to-node) layer uses TLS","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch security posture","desc":"Cluster-wide security settings: whether the security features are enabled, whether anonymous access is allowed, whether the HTTP and transport layers use TLS, and whether audit logging is on. Read from the security usage API.","min_provider_version":"13.0.0","defaults":"enabled httpTlsEnabled anonymousAccessEnabled","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"elasticsearch.user":{"id":"elasticsearch.user","name":"elasticsearch.user","fields":{"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address, when set","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the user is enabled","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Full name, when set","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"isReserved":{"name":"isReserved","type":"\u0004","is_mandatory":true,"title":"Whether this is a built-in, reserved user","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles assigned to the user","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}},"title":"Elasticsearch user","desc":"A user in the native realm, its assigned roles, and whether it is enabled. Built-in users such as elastic and kibana_system are marked with isReserved. The name field selects the user, for example elasticsearch.cluster.users.where(name == \"elastic\").","min_provider_version":"13.0.0","defaults":"name enabled isReserved","provider":"go.mondoo.com/mql/v13/providers/elasticsearch"}}}