Test Wazuh indexer API allowlists separately from the admin account

Bottom line: Use the right identity to test the allowlist. Define the intended endpoint-and-method population before changing it, and preserve the named admin user’s exception in the acceptance record.

Source fact: documented behavior

The Securing the Wazuh indexer API guide uses allowlist.yml to specify accessible indexer API endpoints and HTTP methods.

When that allowlist is enabled, the guide permits only the listed endpoints but explicitly exempts the admin user.

The guide separately recommends restricting indexer network access to trusted networks.

What the source does not establish

This article tests the documented allowlist scope and administrator exception. It does not replace ordinary role authorization, guarantee protection for every network path or prescribe an unreviewed administrative configuration-loading command.

Applicability questions

• Which exact endpoints and methods must be available?
• Which non-admin identity has the intended underlying permissions?
• What excluded requests can be tested without affecting production data?
• What separate administrator recovery and network controls remain?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends an endpoint-and-method test matrix using a non-admin identity, with administrator observations kept as a separate control.

1. List the required client operations and translate them into reviewed endpoint-and-method entries. Identify an excluded operation and obtain a safe test arrangement before enabling the list. Keep ordinary role permissions in the worksheet so a role denial is not misreported as proof that the allowlist worked. Do not make a broad administrative account the acceptance identity merely because its requests are convenient.
2. Review the applicable configuration-loading procedure with the indexer administrator and preserve the prior configuration. Use a disposable environment for any negative method case that could alter state if the restriction is wrong. Prefer documented non-mutating observations where they meet the test requirement; do not invent support for an HTTP method or send an unreviewed write to a live index as a supposed harmless control.
3. Run the agreed cases through the intended client path using the identified non-admin account. Keep a request from the named admin user in a separate column because that user’s documented exception changes the interpretation. Review network exposure independently. If a required client fails, reconcile its actual endpoint, method and underlying permissions before broadening the allowlist or temporarily substituting administrator credentials.

Verification and evidence

Proposed verification: compare an included request with an excluded request under the properly authorized non-admin identity. Record the actual client path, identity, method, endpoint and observed response without prescribing a response code not established by the source. Then inspect the separately authorized named admin account control to demonstrate why that account is not the restriction test.

Retain the reviewed list, role reference, configuration-loading result and redacted request matrix. Keep unexpected administrative access or a blocked legitimate operation open for diagnosis. No allowlist update, authentication test or API request was performed for this article; the proposed matrix does not validate every endpoint or eliminate the need for independent network controls.

Official references

• Securing the Wazuh indexer API — Wazuh; official product documentation.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.