Kibana: 161,729 fingerprints against 56,921 title matches

Two measurements, one dashboard

Kibana is the web interface for the Elasticsearch ecosystem, and it can be located either by its application fingerprint or by the title its page serves. For this product the two figures differ by a wide margin, and the gap is informative.

Query, source and collection window

Both figures come from ZoomEye with sub_type set to all, collected on 2026-10-06, in units of matching hosts.
The application fingerprint query app="Kibana" returns 161,729. The query link is: [1]
The title query title="Kibana" returns 56,921. The query link is: [2]
Neither figure is a vulnerability count. Each describes how many hosts matched the respective signature.

Reading a ratio of roughly three to one

The application fingerprint is a product-level identification and can be matched from response characteristics that do not require a rendered page. The title query requires the page to render with its default heading.
A large gap therefore suggests that a substantial share of the identified hosts do not serve a page with the default title to the requester. The explanations overlap with the general cases: a reverse proxy or rewrite rule changing the delivered content, a customised deployment, an authentication prompt appearing before the page renders, or a host that presents the product signature through a non-page route.
The last explanation is the interesting one for defenders, because it implies the product is identifiable without the interface being open.

Why the dashboard matters specifically

A Kibana instance reads from the search cluster behind it. The data sources are frequently security telemetry, application logs and infrastructure metrics. Access to the interface is therefore access to the operational record of the estate.
That changes the priority order. A host that answers the fingerprint but not the title query may be less exposed than one that answers both. A host that answers the title query has confirmed that a page is being delivered to an unauthenticated requester, and that is the finding worth acting on first.

Defensive follow-up

Administrators should confirm that the interface is not published to untrusted networks, that authentication is required and integrated with the organisation's identity provider, and that any externally reachable instance is mediated by a proxy that enforces access control.
Because the product displays logs, the review should also consider what those logs contain. A dashboard that aggregates authentication events and security alerts is a high-value target because of the content it presents.

How ZoomEye supports the work

ZoomEye makes the fingerprint and the title separately measurable, so the difference between product identification and interface visibility becomes an observable quantity. Watching that gap over time shows whether interface exposure is being reduced or is expanding, and it can be tracked as a configuration indicator rather than an incident metric.

References

[1] ZoomEye search for the Kibana application fingerprint, collected 2026-10-06.
[2] ZoomEye search for the Kibana page title, collected 2026-10-06.