elasticsearch-security-troubleshooting

Risky tool definition detected

```bash curl <auth_flags> "${ELASTICSEARCH_URL}/_xpack" ``` Confirms whether security is enabled (`features.security.enabled`). If security is disabled, all security APIs return errors. ```bash curl -X POST "${ELASTICSEARCH_URL}/_security/user/_has_privileges" \ <auth_flags> \ -H "Content-Type: application/json" \ -d '{ "index": [ { "names": ["'"${INDEX_PATTERN}"'"], "privileges": ["read"] } ] }' ``` Tests whether the authenticated user holds specific privileges without requiring `manage_securit

### Users locked out after license expired **Symptom:** "Nobody can log in to Kibana. We use SAML." 1. Check license: ```bash curl -u "admin:${PASSWORD}" "${ELASTICSEARCH_URL}/_license" ``` Response shows `"status": "expired"`, `"type": "platinum"`.