OpenSearch Dashboards is a useful starting point for internet-measurement work because it combines dashboards, saved searches, data-source access, and administration in one web surface. A count of dashboards does not show whether a login page is exposed, whether anonymous access works, or which indices a role can read. It gives an owner a bounded set of candidates and a reason to check those distinctions.
A count-only ZoomEye measurement on 2026-10-29 returned 40,429 matches for app="OpenSearch Dashboards" and 21,917 for title="OpenSearch Dashboards". Both queries used sub_type=all, page 1, and page size 1. The application fingerprint produced the larger result, so it is the primary query in this review. The figures are matching asset observations at query time. They are not unique hosts, public dashboards, vulnerable clusters, or affected organizations.
Separate product presence from data access
OpenSearch security documentation describes multi-tenancy as a way to share Dashboards tenants among users while using roles to control access. Tenants can hold saved objects such as dashboards and visualizations. A role can grant access to a tenant, and role permissions also govern underlying index and cluster operations. The tenant URL is visible in some dashboard links, which helps an administrator correlate a candidate with an internal role assignment.
An external owner should not begin by trying credentials or enumerating content. Start with the public endpoint, TLS certificate, title, server behavior, and any organization registration. Then compare the observed hostname and address with an internal inventory. If the service is expected to be public, review whether the authentication provider is active, whether anonymous access was intentionally enabled, and whether the built-in security plugin is configured.
For each candidate that belongs to the organization, map the tenant to an owner. Check the roles that can see the tenant and the roles that can read the supporting indices. A user with Dashboard access but no data permissions may see an empty view or an error. A user with data privileges but no tenant permissions can still retrieve records through other clients. Both paths matter.
Use the count as a scoping tool
The 40,429 product matches are broad enough that a national or industry filter may be necessary before the data becomes actionable. Add a country, organization, certificate subject, or domain scope only when that field describes the inventory question. A country filter does not prove ownership. A certificate containing a corporate name is a lead that needs confirmation.
The title result of 21,917 is not a clean subset to compare as a control group. A title match can identify a branded page, a customized product, or unrelated content. The difference between app and title counts should prompt a review of field semantics rather than a claim that 18,512 systems are unmanaged. ZoomEye's application fingerprint and title describe different observed features.
Keep the exact query, scope, time, and total with the investigation record. If an analyst later changes the query to country="US" && app="OpenSearch Dashboards", record that version separately. Comparing a global baseline with a later regional count can show a change in discovery, not a change in deployment. Query history prevents that mistake.
Convert discovery into a dashboard review
For an owned instance, verify the authentication chain from the browser to Dashboards and then to OpenSearch. Inspect tenant membership, role mapping, index permissions, and any default tenant assigned to new users. Confirm whether public sharing or embed links are enabled. Check whether the security plugin is actually loaded, because a removed plugin can leave configuration keys that look present while the control is absent.
Next, test the data path with two low-privilege accounts. Each should see only its intended tenant and underlying indices. A role change should take effect without requiring a restart. Review logs for failed authentication, tenant access, and administrative API changes. If the endpoint is not intended for public use, remove the DNS record or close the network path after the owner confirms the service.
A measured footprint is useful when it leads to a smaller set of questions. For OpenSearch Dashboards, the questions are authentication, tenant membership, role mapping, and underlying data authorization. The product count is the beginning of that review, not a finding of exposure.