Inquiry About Quarantined Kibana Task Manager Index File

Elastic Stack Elasticsearch
1

We would like to raise a case regarding a quarantined file related to one of our Elasticsearch/Kibana indices.

While checking the index UUID, we found that it appears to be related to the following Kibana index

".kibana_task_manager_8.11.4_001": {
"settings": {
"index": {
"uuid": "..."
}
}
}

A file named below was detected as a suspected backdoor and has been quarantined

_tmov0_ES812Postings_0.doc

Could you please help confirm the following?

  1. What is the purpose of the file _tmov0_ES812Postings_0.doc?
  2. Is this file part of the .kibana_task_manager_8.11.4_001 index?
  3. Is it safe to remove this file from quarantine, or should it be restored?
  4. If the file remains missing or quarantined, will there be any impact on the Elasticsearch cluster or Kibana Task Manager functionality?
  5. Are there any recommended checks we should perform to confirm the health and integrity of the related index?
2

This is answered by this warning in the docs:

Don’t modify anything within the data directory or run processes that might interfere with its contents. If something other than Elasticsearch modifies the contents of the data directory, then Elasticsearch may fail, reporting corruption or other data inconsistencies, or may appear to work correctly having silently lost some of your data. Don’t attempt to take filesystem backups of the data directory; there is no supported way to restore such a backup. Instead, use Snapshot and restore to take backups safely. Don’t run virus scanners on the data directory. A virus scanner can prevent Elasticsearch from working correctly and may modify the contents of the data directory. The data directory contains no executables so a virus scan will only find false positives.

Yes, modifying the contents of the data directory (e.g. by removing a file) is very harmful to Elasticsearch.