{
  "Provider": "aws",
  "CheckID": "opensearch_service_domains_updated_to_the_latest_service_software_version",
  "CheckTitle": "Check if Amazon Elasticsearch/Opensearch Service domains have updates available",
  "CheckType": [
    "Detect",
    "Vulnerability, patch, and version management"
  ],
  "ServiceName": "opensearch",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "low",
  "ResourceType": "AwsOpenSearchDomain",
  "Description": "Check if Amazon Elasticsearch/Opensearch Service domains have updates available",
  "Risk": "Amazon ES regularly releases system software updates that add features or otherwise improve your domains.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Elasticsearch/version.html",
      "NativeIaC": "",
      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Elasticsearch/version.html",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "The Notifications panel in the console is the easiest way to see if an update is available or check the status of an update. You can also receive these notifications through Amazon EventBridge. If you take no action on required updates; Amazon ES still updates your domain service software automatically after a certain timeframe (typically two weeks). In this situation; Amazon ES sends notifications when it starts the update and when the update is complete.",
      "Url": "https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-service-software.html"
    }
  },
  "Categories": [],
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
