Least Privileged User: DX, Linux
Purpose
The Data Indexer accepts logs for indexing, reads lists from the EMDBs, and returns log data upon request from the Web Console and Client Console.
Shared Services
N/A. At this time, Linux-based Data Indexers do not share data storage or any other resource outside the Data Indexer environment.
Registry Access
N/A. The Linux-based Data Indexer uses alternate mechanisms for persistent settings.
Database Access
The Elasticsearch database is accessed through service layers only, and user context is tied to the services.
Database access to the EMDB is controlled through specific services executing calls to the Platform Manager on port 1433.
Ports
Data Indexer port configuration is handled automatically on the Data Indexer. All required ports are explicitly opened in the Linux firewall. All other ports are explicitly blocked.
Micro-Service | Protocol | Destination Port | Direction | Operating System | Purpose |
---|---|---|---|---|---|
Bulldozer | TCP | 1433 | Outbound from DX to PM | Linux | SQL Server access to EMDB |
Carpenter | TCP | 1433 | Outbound from DX to PM | Linux | SQL Server access to EMDB |
Columbo | TCP | 13130 | Inbound to DX | Linux | Web Console/Client Console queries |
TCP | 13132 | Inbound to DX | Linux | Web Console Threat Activity Map port (GumShoe) | |
ElasticSearch | TCP | 9200 | DX Local Only | Linux | Curl queries to Elasticsearch |