{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "item": { "id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "slug": "test-wazuh-indexer-api-allowlists-separately-from-the-admin-account", "url": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account.md", "json": "https://update.dsesecurity.com/api/v1/posts/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/" }, "title": "Test Wazuh indexer API allowlists separately from the admin account", "summary": "Review Wazuh indexer allowlists by endpoint and HTTP method using an appropriately authorized identity other than the named admin account. Preserve that account's documented exception in the test plan.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-30T06:47:09+00:00", "modified_at": "2026-10-30T06:47:29+00:00", "reviewed_on": "2026-10-30", "reading_minutes": 3, "word_count": 513, "potentially_affected": "Wazuh indexer API deployments considering the documented allowlist configuration; ordinary role permissions and installed-version applicability still require review.", "dse_recommendation": "DSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.", "primary_source": { "name": "Wazuh — Securing the Wazuh indexer API", "url": "https://documentation.wazuh.com/current/user-manual/indexer-api/securing-indexer-api.html", "published_on": null, "authority": "documentation.wazuh.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Use the right identity to test the allowlist. Define the intended endpoint-and-method population before changing it, and preserve the named admin user’s exception in the acceptance record.

\n

Source fact: documented behavior

\n

The Securing the Wazuh indexer API guide uses allowlist.yml to specify accessible indexer API endpoints and HTTP methods.

\n

When that allowlist is enabled, the guide permits only the listed endpoints but explicitly exempts the admin user.

\n

The guide separately recommends restricting indexer network access to trusted networks.

\n

What the source does not establish

\n

This article tests the documented allowlist scope and administrator exception. It does not replace ordinary role authorization, guarantee protection for every network path or prescribe an unreviewed administrative configuration-loading command.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.

\n
    \n
  1. List the required client operations and translate them into reviewed endpoint-and-method entries. Identify an excluded operation and obtain a safe test arrangement before enabling the list. Keep ordinary role permissions in the worksheet so a role denial is not misreported as proof that the allowlist worked. Do not make a broad administrative account the acceptance identity merely because its requests are convenient.
    2. \n
  2. Review the applicable configuration-loading procedure with the indexer administrator and preserve the prior configuration. Use a disposable environment for any negative method case that could alter state if the restriction is wrong. Prefer documented non-mutating observations where they meet the test requirement; do not invent support for an HTTP method or send an unreviewed write to a live index as a supposed harmless control.
    3. \n
  3. Run the agreed cases through the intended client path using the identified non-admin account. Keep a request from the named admin user in a separate column because that user’s documented exception changes the interpretation. Review network exposure independently. If a required client fails, reconcile its actual endpoint, method and underlying permissions before broadening the allowlist or temporarily substituting administrator credentials.
    4. \n
\n

Verification and evidence

\n

Proposed verification: compare an included request with an excluded request under the properly authorized non-admin identity. Record the actual client path, identity, method, endpoint and observed response without prescribing a response code not established by the source. Then inspect the separately authorized named admin account control to demonstrate why that account is not the restriction test.

\n

Retain the reviewed list, role reference, configuration-loading result and redacted request matrix. Keep unexpected administrative access or a blocked legitimate operation open for diagnosis. No allowlist update, authentication test or API request was performed for this article; the proposed matrix does not validate every endpoint or eliminate the need for independent network controls.

\n

Official references

\n\n

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.

\n", "content_text": "Bottom line: Use the right identity to test the allowlist. Define the intended endpoint-and-method population before changing it, and preserve the named admin user’s exception in the acceptance record.\nSource fact: documented behavior\nThe Securing the Wazuh indexer API guide uses allowlist.yml to specify accessible indexer API endpoints and HTTP methods.\nWhen that allowlist is enabled, the guide permits only the listed endpoints but explicitly exempts the admin user.\nThe guide separately recommends restricting indexer network access to trusted networks.\nWhat the source does not establish\nThis article tests the documented allowlist scope and administrator exception. It does not replace ordinary role authorization, guarantee protection for every network path or prescribe an unreviewed administrative configuration-loading command.\nApplicability questions\n\nWhich exact endpoints and methods must be available?\nWhich non-admin identity has the intended underlying permissions?\nWhat excluded requests can be tested without affecting production data?\nWhat separate administrator recovery and network controls remain?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.\n\nList the required client operations and translate them into reviewed endpoint-and-method entries. Identify an excluded operation and obtain a safe test arrangement before enabling the list. Keep ordinary role permissions in the worksheet so a role denial is not misreported as proof that the allowlist worked. Do not make a broad administrative account the acceptance identity merely because its requests are convenient.\nReview the applicable configuration-loading procedure with the indexer administrator and preserve the prior configuration. Use a disposable environment for any negative method case that could alter state if the restriction is wrong. Prefer documented non-mutating observations where they meet the test requirement; do not invent support for an HTTP method or send an unreviewed write to a live index as a supposed harmless control.\nRun the agreed cases through the intended client path using the identified non-admin account. Keep a request from the named admin user in a separate column because that user’s documented exception changes the interpretation. Review network exposure independently. If a required client fails, reconcile its actual endpoint, method and underlying permissions before broadening the allowlist or temporarily substituting administrator credentials.\n\nVerification and evidence\nProposed verification: compare an included request with an excluded request under the properly authorized non-admin identity. Record the actual client path, identity, method, endpoint and observed response without prescribing a response code not established by the source. Then inspect the separately authorized named admin account control to demonstrate why that account is not the restriction test.\nRetain the reviewed list, role reference, configuration-loading result and redacted request matrix. Keep unexpected administrative access or a blocked legitimate operation open for diagnosis. No allowlist update, authentication test or API request was performed for this article; the proposed matrix does not validate every endpoint or eliminate the need for independent network controls.\nOfficial references\n\nSecuring the Wazuh indexer API — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Use the right identity to test the allowlist. Define the intended endpoint-and-method population before changing it, and preserve the named admin user’s exception in the acceptance record.\n\n## Source fact: documented behavior\n\nThe [Securing the Wazuh indexer API](https://documentation.wazuh.com/current/user-manual/indexer-api/securing-indexer-api.html) guide uses allowlist.yml to specify accessible indexer API endpoints and HTTP methods.\n\nWhen that allowlist is enabled, the guide permits only the listed endpoints but explicitly exempts the admin user.\n\nThe guide separately recommends restricting indexer network access to trusted networks.\n\n## What the source does not establish\n\nThis article tests the documented allowlist scope and administrator exception. It does not replace ordinary role authorization, guarantee protection for every network path or prescribe an unreviewed administrative configuration-loading command.\n\n## Applicability questions\n\n- Which exact endpoints and methods must be available?\n\n- Which non-admin identity has the intended underlying permissions?\n\n- What excluded requests can be tested without affecting production data?\n\n- What separate administrator recovery and network controls remain?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.\n\n- List the required client operations and translate them into reviewed endpoint-and-method entries. Identify an excluded operation and obtain a safe test arrangement before enabling the list. Keep ordinary role permissions in the worksheet so a role denial is not misreported as proof that the allowlist worked. Do not make a broad administrative account the acceptance identity merely because its requests are convenient.\n\n- Review the applicable configuration-loading procedure with the indexer administrator and preserve the prior configuration. Use a disposable environment for any negative method case that could alter state if the restriction is wrong. Prefer documented non-mutating observations where they meet the test requirement; do not invent support for an HTTP method or send an unreviewed write to a live index as a supposed harmless control.\n\n- Run the agreed cases through the intended client path using the identified non-admin account. Keep a request from the named admin user in a separate column because that user’s documented exception changes the interpretation. Review network exposure independently. If a required client fails, reconcile its actual endpoint, method and underlying permissions before broadening the allowlist or temporarily substituting administrator credentials.\n\n## Verification and evidence\n\nProposed verification: compare an included request with an excluded request under the properly authorized non-admin identity. Record the actual client path, identity, method, endpoint and observed response without prescribing a response code not established by the source. Then inspect the separately authorized named admin account control to demonstrate why that account is not the restriction test.\n\nRetain the reviewed list, role reference, configuration-loading result and redacted request matrix. Keep unexpected administrative access or a blocked legitimate operation open for diagnosis. No allowlist update, authentication test or API request was performed for this article; the proposed matrix does not validate every endpoint or eliminate the need for independent network controls.\n\n## Official references\n\n- [Securing the Wazuh indexer API](https://documentation.wazuh.com/current/user-manual/indexer-api/securing-indexer-api.html) — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "url": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Test Wazuh indexer API allowlists separately from the admin account", "item": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/#article", "identifier": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "url": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/", "headline": "Test Wazuh indexer API allowlists separately from the admin account", "description": "Review Wazuh indexer allowlists by endpoint and HTTP method using an appropriately authorized identity other than the named admin account.", "abstract": "Review Wazuh indexer allowlists by endpoint and HTTP method using an appropriately authorized identity other than the named admin account. Preserve that account's documented exception in the test plan.", "articleBody": "Bottom line: Use the right identity to test the allowlist. Define the intended endpoint-and-method population before changing it, and preserve the named admin user’s exception in the acceptance record.\nSource fact: documented behavior\nThe Securing the Wazuh indexer API guide uses allowlist.yml to specify accessible indexer API endpoints and HTTP methods.\nWhen that allowlist is enabled, the guide permits only the listed endpoints but explicitly exempts the admin user.\nThe guide separately recommends restricting indexer network access to trusted networks.\nWhat the source does not establish\nThis article tests the documented allowlist scope and administrator exception. It does not replace ordinary role authorization, guarantee protection for every network path or prescribe an unreviewed administrative configuration-loading command.\nApplicability questions\n\nWhich exact endpoints and methods must be available?\nWhich non-admin identity has the intended underlying permissions?\nWhat excluded requests can be tested without affecting production data?\nWhat separate administrator recovery and network controls remain?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.\n\nList the required client operations and translate them into reviewed endpoint-and-method entries. Identify an excluded operation and obtain a safe test arrangement before enabling the list. Keep ordinary role permissions in the worksheet so a role denial is not misreported as proof that the allowlist worked. Do not make a broad administrative account the acceptance identity merely because its requests are convenient.\nReview the applicable configuration-loading procedure with the indexer administrator and preserve the prior configuration. Use a disposable environment for any negative method case that could alter state if the restriction is wrong. Prefer documented non-mutating observations where they meet the test requirement; do not invent support for an HTTP method or send an unreviewed write to a live index as a supposed harmless control.\nRun the agreed cases through the intended client path using the identified non-admin account. Keep a request from the named admin user in a separate column because that user’s documented exception changes the interpretation. Review network exposure independently. If a required client fails, reconcile its actual endpoint, method and underlying permissions before broadening the allowlist or temporarily substituting administrator credentials.\n\nVerification and evidence\nProposed verification: compare an included request with an excluded request under the properly authorized non-admin identity. Record the actual client path, identity, method, endpoint and observed response without prescribing a response code not established by the source. Then inspect the separately authorized named admin account control to demonstrate why that account is not the restriction test.\nRetain the reviewed list, role reference, configuration-loading result and redacted request matrix. Keep unexpected administrative access or a blocked legitimate operation open for diagnosis. No allowlist update, authentication test or API request was performed for this article; the proposed matrix does not validate every endpoint or eliminate the need for independent network controls.\nOfficial references\n\nSecuring the Wazuh indexer API — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:47:09+00:00", "dateModified": "2026-10-30T06:47:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/test-wazuh-indexer-api-allowlists-separately-from-the-admin-account/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test Wazuh indexer API allowlists separately from the admin account" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 513, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Wazuh — Securing the Wazuh indexer API", "url": "https://documentation.wazuh.com/current/user-manual/indexer-api/securing-indexer-api.html" } } ] } }