[hackerone] Initial release of HackerOne with Report data streams by clement-fouque · Pull Request #18951 · elastic/integrations

clement-fouque · 2026-05-11T23:58:37Z

Proposed commit message

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

github-actions · 2026-05-11T23:59:55Z

Vale Linting Results

Summary: 9 warnings, 35 suggestions found

⚠️ Warnings (9)

File	Line	Rule	Message
packages/hackerone/docs/README.md	116	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	116	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	359	Elastic.DontUse	Don't use 'just'.
packages/hackerone/docs/README.md	375	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	375	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	488	Elastic.DontUse	Don't use 'Thus'.
packages/hackerone/docs/README.md	510	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	510	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	754	Elastic.DontUse	Don't use 'just'.

💡 Suggestions (35)

File	Line	Rule	Message
packages/hackerone/_dev/build/docs/README.md	87	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/_dev/build/docs/README.md	93	Elastic.Semicolons	Use semicolons judiciously.
packages/hackerone/docs/README.md	88	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	94	Elastic.Semicolons	Use semicolons judiciously.
packages/hackerone/docs/README.md	106	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	114	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	114	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	114	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	116	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	116	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	117	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	117	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	124	Elastic.Clone	Use `cloning` only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	227	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	242	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	259	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	326	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	336	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	359	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	500	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	508	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	508	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	508	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	510	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	510	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	511	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	511	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	518	Elastic.Clone	Use `cloning` only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	621	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	636	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	653	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	720	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	730	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	754	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	793	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

clement-fouque · 2026-05-12T00:01:30Z

@efd6 can you perform a review of the CEL part? Thanks.

elastic-vault-github-plugin-prod · 2026-05-12T23:53:04Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

…ment-fouque/elastic-integrations into hackerone-new-integration-v5

…s for JSON acceptance

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

efd6

CEL code LGTM

…file

github-actions · 2026-05-20T08:22:02Z

TL;DR

Check integrations netbox failed, but the provided Buildkite log is truncated to teardown/output-upload lines and does not include the first failing command or assertion. Immediate action: re-run that job with full step log retention (or share the uploaded build/test-results/netbox-system-*.xml) so the exact failing test can be identified.

Remediation

Re-run Check integrations netbox and capture the full step output from the first failure line (not just the teardown tail).
Inspect/upload build/test-results/netbox-system-*.xml from that run; this should contain the failing test name and assertion message.
If the rerun passes without code changes, classify as transient infrastructure/test flake and retry CI.

Investigation details

Root Cause

The root cause is not identifiable from the available log artifact. The only captured lines are stack teardown and artifact upload, followed by a generic non-zero exit.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/43133
Job/step: Check integrations netbox
Key log excerpt (/tmp/gh-aw/buildkite-logs/integrations-check-integrations-netbox.txt):
- --- [netbox] failed (line 73)
- 🚨 Error: The command exited with status 1 (line 76)
- user command error: exit status 1 (line 78)
- No earlier test/assertion output present in this file.
Uploaded artifacts listed in the same log include build/test-results/netbox-system-*.xml, indicating likely useful failure details exist outside the provided excerpt.
PR diff checked locally at commit d2cd987a65f6067e9387ed2e73d530c90477c1c5: changes are under packages/hackerone/** (plus .github/CODEOWNERS), with no direct packages/netbox/** edits.

Verification

Not run in this environment: reproducing .buildkite/scripts/test_one_package.sh depends on Buildkite runtime env/config and failed early here due missing pipeline env (YQ_VERSION unset).

Follow-up

Share the failing netbox-system xUnit XML (or full pre-teardown job logs) and I can provide a precise root-cause + patch-level remediation.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

[hackerone] Initial release of HackerOne with Report data streams #18951 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#18951 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

P1llus · 2026-05-22T10:21:56Z

+        description: |-
+          Program handles to restrict results (`filter[program][]`).
+          Provide at least one program handle **or** one inbox id — the API requires one scope filter.
+        multi: true
+        required: false
+        show_user: true
+      - name: inbox_ids
+        type: text
+        title: Inbox IDs
+        description: |-
+          Inbox identifiers (`filter[inbox_ids][]`). At least one program handle **or** one inbox id is required by the API.


How does this work? I don't really understand the format the user has to provide this in. You could possibly have a default value but have it commented out?

If these are an array of just values, its better that we just ask them to give us a list of values as for example type text and multi true, then build the array in the configuration itself?

This is how it looks like.

… inbox IDs

…product, and vulnerability.scanner.vendor in ecs.yml

…clarity and consistency. Updated mappings for event ID, vulnerability details, user information, and organization attributes to use 'rename' instead of 'set' for better alignment with ECS standards.

…ation to clarify usage and accepted units.

…ration-v5

elasticmachine · 2026-05-22T15:31:10Z

💚 Build Succeeded

Buildkite Build
Commit: ffe2a01

History

💔 Build #43355 failed 7d36b5a
💚 Build #43155 succeeded 83adde1
💔 Build #43145 failed dc99b72
💔 Build #43133 failed d2cd987
💔 Build #43128 failed 5aea268
💔 Build #43103 failed 4a95ba7

P1llus · 2026-05-22T15:55:42Z

Will finalize the review on monday, but starting this up from draft to trigger a few more CI jobs

clement-fouque mentioned this pull request May 11, 2026

[hackerone] Initial release of HackerOne with Report data streams #18662

Closed

5 tasks

This comment has been minimized.

Sign in to view

efd6 reviewed May 12, 2026

View reviewed changes

andrewkroh added New Integration Issue or pull request for creating a new integration package. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels May 12, 2026

This comment has been minimized.

Sign in to view

clement-fouque force-pushed the hackerone-new-integration-v5 branch from 7ab7673 to 92037e3 Compare May 14, 2026 16:18

This comment has been minimized.

Sign in to view

clement-fouque closed this May 14, 2026

clement-fouque force-pushed the hackerone-new-integration-v5 branch from d394b3e to ce28db2 Compare May 14, 2026 16:38

This comment has been minimized.

Sign in to view

Initial commit

e95dfe1

clement-fouque reopened this May 14, 2026

This comment has been minimized.

Sign in to view

clement-fouque added 4 commits May 14, 2026 22:08

Merge branch 'hackerone-new-integration-v5' of https://github.com/cle…

39b1c93

…ment-fouque/elastic-integrations into hackerone-new-integration-v5

Update CODEOWNERS to include hackerone integration ownership

ff41eb7

Update CEL configuration to use dynamic request tracer and add header…

4455eb5

…s for JSON acceptance

Generate package

f0de135

clement-fouque requested a review from efd6 May 14, 2026 23:15

github-actions Bot mentioned this pull request May 15, 2026

[breaking-change] Undocumented breaking changes detected (2026-05-15) #19035

Open

3 tasks

Refactor CEL configuration

b75f9e2

This comment has been minimized.

Sign in to view

clement-fouque and others added 7 commits May 19, 2026 15:16

Implement suggestion from efd6

e6d2369

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Update packages/hackerone/data_stream/report/agent/stream/cel.yml.hbs

52fb06f

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Implement suggestion from efd6

5a4185b

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Implement suggestion from efd6

0a7e322

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Implement suggestion from efd6

5f27e64

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Fix attribute access in CEL template

d0cab9c

Regenerate package

2765324

This comment has been minimized.

Sign in to view

Merge branch 'main' into hackerone-new-integration-v5

4a95ba7

This comment has been minimized.

Sign in to view

efd6 reviewed May 19, 2026

View reviewed changes

Comment thread packages/hackerone/data_stream/report/agent/stream/cel.yml.hbs Outdated

clement-fouque added 2 commits May 20, 2026 09:02

Fix formatting in CEL template by adding a newline at the end of the …

5aea268

…file

Regenerate package

d2cd987

clement-fouque added 2 commits May 20, 2026 12:02

Merge branch 'main' into hackerone-new-integration-v5

dc99b72

Remove /tmp folder

83adde1

P1llus reviewed May 22, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 22, 2026

[docs-patrol] Document AWS VPC Flow unsupported-format pipeline_error behavior #19165

Open

4 tasks

clement-fouque added 7 commits May 22, 2026 14:55

Update HackerOne report manifest descriptions for program handles and…

1519121

… inbox IDs

Remove constant_keyword type and value for observer.vendor, observer.…

e1f0bdc

…product, and vulnerability.scanner.vendor in ecs.yml

Refactor Elasticsearch ingest pipeline to rename fields for improved …

c2b5545

…clarity and consistency. Updated mappings for event ID, vulnerability details, user information, and organization attributes to use 'rename' instead of 'set' for better alignment with ECS standards.

Update HackerOne report manifest description for initial lookback dur…

0351091

…ation to clarify usage and accepted units.

Update description for clearer documentation

f172073

Regenerate package

7d36b5a

Merge remote-tracking branch 'upstream/main' into hackerone-new-integ…

ffe2a01

…ration-v5

P1llus marked this pull request as ready for review May 22, 2026 15:55

P1llus requested a review from a team as a code owner May 22, 2026 15:55

Conversation

clement-fouque commented May 11, 2026

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vale Linting Results

Uh oh!

clement-fouque commented May 12, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

Uh oh!

P1llus May 22, 2026

Choose a reason for hiding this comment

Uh oh!

clement-fouque May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented May 22, 2026

💚 Build Succeeded

History

Uh oh!

P1llus commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions Bot commented May 11, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented May 12, 2026 •

edited

Loading