[hackerone] Initial release of HackerOne with Report data streams by clement-fouque · Pull Request #18662 · elastic/integrations

clement-fouque · 2026-04-27T22:58:30Z

Proposed commit message

This pull request introduces the initial release of the HackerOne integration for Elastic, providing the ability to collect bug bounty and vulnerability disclosure reports from the HackerOne Customer API into Elasticsearch.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

…template

github-actions · 2026-04-27T22:59:42Z

Vale Linting Results

Summary: 36 warnings, 47 suggestions found

⚠️ Warnings (36)

File	Line	Rule	Message
packages/hackerone/_dev/build/docs/README.md	6	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/hackerone/_dev/build/docs/README.md	14	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/hackerone/docs/README.md	7	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
packages/hackerone/docs/README.md	15	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/hackerone/docs/README.md	105	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	105	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	107	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	108	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	218	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/hackerone/docs/README.md	237	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/hackerone/docs/README.md	278	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	295	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	295	Elastic.DontUse	Don't use 'and/or'.
packages/hackerone/docs/README.md	297	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	300	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	302	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	304	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	325	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	337	Elastic.DontUse	Don't use 'Thus'.
packages/hackerone/docs/README.md	360	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	360	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	362	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	363	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	473	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/hackerone/docs/README.md	492	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/hackerone/docs/README.md	533	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	551	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	551	Elastic.DontUse	Don't use 'and/or'.
packages/hackerone/docs/README.md	553	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	556	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	558	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	559	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	560	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	581	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	581	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	605	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.

💡 Suggestions (47)

File	Line	Rule	Message
packages/hackerone/_dev/build/docs/README.md	14	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/_dev/build/docs/README.md	58	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/_dev/build/docs/README.md	58	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/docs/README.md	15	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/docs/README.md	59	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/docs/README.md	59	Elastic.Wordiness	Consider using 'because' instead of 'since'.
packages/hackerone/docs/README.md	95	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	103	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	103	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	103	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	105	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	105	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	106	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	106	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	108	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	119	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	119	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	149	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	163	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	190	Elastic.Clone	Use `cloned` only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	201	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	201	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	291	Elastic.Wordiness	Consider using 'all' instead of 'All of '.
packages/hackerone/docs/README.md	295	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.
packages/hackerone/docs/README.md	295	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	350	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	358	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	358	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	358	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	360	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	360	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	361	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	361	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	363	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	374	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	374	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	404	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	418	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	445	Elastic.Clone	Use `cloned` only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	456	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	456	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	547	Elastic.Wordiness	Consider using 'all' instead of 'All of '.
packages/hackerone/docs/README.md	551	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.
packages/hackerone/docs/README.md	551	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	559	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	572	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	603	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

macroscopeapp · 2026-04-27T23:01:47Z

+          if (sc.containsKey('asset_type') && sc.containsKey('asset_identifier') && sc.asset_identifier != null) {
+            def at = sc.asset_type;
+            def aid = sc.asset_identifier;
+            if (at instanceof String && at.equalsIgnoreCase('DOMAIN')) {


🟡 Medium ingest_pipeline/default.yml:735

When asset_type is 'HOSTNAME', the asset identifier is mapped to host.name and dns.question.name by the map_structured_scope_asset script, but append_related_hosts_users_cve only adds the identifier to related.hosts for 'DOMAIN' assets. This causes HOSTNAME assets to be missing from related.hosts despite being present in other host-related fields. Consider adding 'HOSTNAME' to the condition at line 735 to match the upstream mapping behavior.

- if (at instanceof String && at.equalsIgnoreCase('DOMAIN')) { + if (at instanceof String && (at.equalsIgnoreCase('DOMAIN') || at.equalsIgnoreCase('HOSTNAME'))) {

🤖 Copy this AI Prompt to have your agent fix this:

In file packages/hackerone/data_stream/report/elasticsearch/ingest_pipeline/default.yml around line 735: When `asset_type` is `'HOSTNAME'`, the asset identifier is mapped to `host.name` and `dns.question.name` by the `map_structured_scope_asset` script, but `append_related_hosts_users_cve` only adds the identifier to `related.hosts` for `'DOMAIN'` assets. This causes `HOSTNAME` assets to be missing from `related.hosts` despite being present in other host-related fields. Consider adding `'HOSTNAME'` to the condition at line 735 to match the upstream mapping behavior.

…rrect pull request number.

…-service-integrations team

elastic-vault-github-plugin-prod · 2026-04-28T09:30:31Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

…ent infinite loop.

clement-fouque · 2026-05-01T00:11:04Z

@elastic/security-service-integrations the integration is ready for review. Can you please take care of it? Thank you.

Cc @kruskall @jkakavas

…rt directories

…n, division, and team fields

P1llus · 2026-05-04T07:01:22Z

Could you add integration-experience as the current owner for now? As we will have handle more of these in the future. Requested a peer review from services for CEL as well.

Will do an initial review later today + helping with dashboards

efd6

CEL review only

efd6 · 2026-05-04T07:15:01Z

+  :
+  state.?cursor.last_activity_at.orValue("").as(curRaw,


This indentation indicates that the code was not celfmtd.

However, this is used only once. There should not be an as binding here. Maybe an state.?cursor.last_activity_at.optMap(last, (last.parse_time([time_layout.RFC3339Nano, time_layout.RFC3339]) + duration("1ms")).format(time_layout.RFC3339Nano)).orValue(string(now - duration(state.initial_interval))).

efd6 · 2026-05-04T07:16:59Z

+{{else}}
+  inbox_ids: []
+{{/if}}


It's unclear why this is done given that at L45, there's an optional value deref. This else block can be omitted.

efd6 · 2026-05-04T07:17:37Z

+{{else}}
+  program_handles: []
+{{/if}}


Same situation here as for inbox_ids.

efd6 · 2026-05-04T07:18:36Z

+    {
+      "events": {
+        "error": {
+          "code": "400",


?

If there's going to be a status code, ISTM that it should come from the API. If it doesn't, it should have a comment explaining why it's a valid insertion.

efd6 · 2026-05-04T07:29:24Z

+              "Accept": ["application/json"],
+            },
+          }).do_request().as(resp,
+            (resp.StatusCode == int(429) || resp.StatusCode == int(401) || resp.StatusCode == int(403) || resp.StatusCode > int(499)) ?


These conversions are not necessary.

efd6 · 2026-05-04T07:29:46Z

+                "want_more": false,
+              }
+            :
+              resp.StatusCode == int(200) ?


Suggested change

resp.StatusCode == int(200) ?

resp.StatusCode == 200 ?

Though suggest the happy path be put first.

efd6 · 2026-05-04T07:30:14Z

+              :
+              {


Indentation.

efd6 · 2026-05-04T07:31:09Z

+                      ""
+                    ).as(page_max,
+                      state.?cycle_max.orValue("").as(prev_max,
+                        (page_max != "" && (prev_max == "" || page_max > prev_max)) ?


What is the shape of page_max and prev_max?

efd6 · 2026-05-04T07:31:22Z

+                    "code": string(resp.StatusCode),
+                    "id": string(resp.Status),
+                    "message": "GET /v1/reports: " + (
+                      size(resp.Body) != int(0) ?


Suggested change

size(resp.Body) != int(0) ?

size(resp.Body) != 0 ?

elasticmachine · 2026-05-05T07:15:12Z

💚 Build Succeeded

Buildkite Build
Commit: 5fe7ea1

History

💔 Build #42244 failed 8216750
💚 Build #42205 succeeded 21f858f
💚 Build #42156 succeeded 5a0d24a
💔 Build #42155 failed b8ea076
💔 Build #42154 failed c7f50fd

cc @P1llus

clement-fouque · 2026-05-11T23:59:12Z

Superseded by #18951.

clement-fouque added 3 commits April 28, 2026 00:46

HackerOne integration initial commit

30708b6

Remove max_executions comment

df691ae

Add workaround for HackerOne API limitation on time precision in CEL …

10eb89b

…template

macroscopeapp Bot reviewed Apr 27, 2026

View reviewed changes

clement-fouque added 4 commits April 28, 2026 09:43

Remove LICENSE.txt file for HackerOne integration

6de9b61

Add HackerOne to CODEOWNERS for integration ownership

a5dad23

Update changelog link for HackerOne initial release to reflect the co…

5bea6c9

…rrect pull request number.

Update HackerOne manifest to reflect new ownership under the security…

bd432be

…-service-integrations team

Update HackerOne logo in manifest and remove old sample logo file

e131274

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Apr 28, 2026

Add report latest transform

15293c1

macroscopeapp Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/qualys_gav/elasticsearch/transform/latest_asset/transform.yml

clement-fouque added 3 commits April 30, 2026 23:00

Rename transform folder

c0afe15

Change dest index and alias to align with other integrations and prev…

69a18f2

…ent infinite loop.

Revert change affecting a different package

c7f50fd

clement-fouque changed the title ~~Hackerone new integration~~ [hackerone] Initial release of HackerOne with Report data streams Apr 30, 2026

clement-fouque added New Integration Issue or pull request for creating a new integration package. Integration:hackerone HackerOne [Integration not found in source] labels Apr 30, 2026

clement-fouque added 3 commits May 1, 2026 01:07

Regenerate doc

b8ea076

Fixing field mapping in transform

750f05c

Regenerate package and documentation

5a0d24a

clement-fouque marked this pull request as ready for review May 1, 2026 00:08

clement-fouque requested a review from a team as a code owner May 1, 2026 00:08

andrewkroh removed New Integration Issue or pull request for creating a new integration package. Integration:hackerone HackerOne [Integration not found in source] labels May 1, 2026

clement-fouque added 2 commits May 3, 2026 00:18

Remove log.offset field from beats.yml in both report and latest_repo…

03c4dc6

…rt directories

Change parsing of amount fields from keyword to float.

84e29b7

Replace nested field type by group

248ad78

macroscopeapp Bot reviewed May 2, 2026

View reviewed changes

Comment thread packages/hackerone/data_stream/report/elasticsearch/ingest_pipeline/default.yml Outdated

Update condition in ingest pipeline to use logical OR for organizatio…

21f858f

…n, division, and team fields

efd6 reviewed May 4, 2026

View reviewed changes

P1llus self-assigned this May 4, 2026

clement-fouque added 7 commits May 4, 2026 10:51

Change amount field type from float to double

92c6aa1

Change owner to elastic/integration-experience

8216750

Change amount fields type from float to double

5c08652

Add draft dashboard

8f6542a

Add dashboard screenshot

ed9e4a1

Add exclusion as dashboard is based on ES|QL queries

f6b60a2

Regenerate package

5fe7ea1

github-actions Bot mentioned this pull request May 11, 2026

[docs-patrol] Update CI docs for schedule changes and skip-CI file matching #18934

Open

4 tasks

andrewkroh added the New Integration Issue or pull request for creating a new integration package. label May 11, 2026

clement-fouque closed this May 11, 2026

Conversation

clement-fouque commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

github-actions Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

Uh oh!

macroscopeapp Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 28, 2026

🚀 Benchmarks report

Uh oh!

Uh oh!

clement-fouque commented May 1, 2026

Uh oh!

Uh oh!

P1llus commented May 4, 2026

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented May 5, 2026

💚 Build Succeeded

History

Uh oh!

clement-fouque commented May 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

clement-fouque commented Apr 27, 2026 •

edited

Loading

github-actions Bot commented Apr 27, 2026 •

edited

Loading