Beats

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (per-Beat asset row) │ $7,000 │ $8,000 High │ $3,000 │ $3,750 Medium │ $1,500 │ $1,875 Low │ $700 │ $875 Submit a vulnerability CVE history 8 Last 12 months 11 Lifetime Parsing/validation 35 % Info disclosure 25 % Code execution 20 % Denial of service 15 % Latest advisories Loading the feed Overview Beats agents run on the endpoint rather than in the datacentre tier, which makes their installed base enormous and their blast radius unusual: Filebeat is one of the most widely installed log-shipping agents in the world, deployed per host across whole fleets in the enterprises that run Elastic-based SIEM, while Winlogbeat and Auditbeat sit inside the audit path on Windows and Linux respectively. Packetbeat is more interesting still, because it decodes live network traffic, which means its protocol parsers process wholly untrusted attacker-controlled bytes by design. A memory-safety or parsing bug in a Beat is reachable across an entire monitored fleet at the same moment. Elastic N.V. pays each of the six named Beats as its own asset on HackerOne, every one of them bound to the same row running from $700 for a Low to $7,000 for a Critical, and those figures are minimums the program awards up from. sorona.xyz adds 1.25x on top of whatever Elastic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~11 hours First response ~6 days Triage ~43 days Bounty In scope Elastic prices six Beats as separate bounty-eligible assets, Filebeat, Metricbeat, Packetbeat, Auditbeat, Heartbeat and Winlogbeat, each bound to the same row up to critical severity, and each asset instruction names that Beat's platform downloads, its image on docker.elastic.co and its subtree of the repository github.com/elastic/beats is registered as a bounty-eligible source-code asset in its own right, so the Apache-2.0 tree outside x-pack is in scope as source and not only as a shipped binary Elastic sets no narrower target than its own products: 'If we wrote code with a bug in it, we want to know about it! Our code is open so use that to your advantage!' Each shipper end to end: Filebeat harvesters, the registry and the log modules; Metricbeat metricsets and the clients they use to reach the systems they poll; Packetbeat protocol decoders and the sniffer feeding them; Auditbeat auditd and file-integrity modules; Winlogbeat event-log readers; Heartbeat ICMP, TCP and HTTP monitors libbeat , the framework all of them are built on: the output and transport layer to Elasticsearch, Logstash and Kafka, TLS handling, the memory and disk queues, and the keystore holding each Beat's backend credentials Configuration handling: the YAML loader, module definitions, autodiscover providers for Docker and Kubernetes, hints-based config and dynamic reload The processor chain that runs between input and output, covering metadata enrichment, scripted processors and drop or rename rules What Elastic actually ships: the DEB, RPM, archive and Windows service packaging, and the container images each asset links to Out of scope Reports that reach Elastic by any route other than its own HackerOne program, which the policy makes a condition of bounty eligibility Osquerybeat and the generic Beats asset, neither of which carries a bound reward row, so a finding has to be filed against one of the six priced Beats Anything under x-pack , which is Elastic-Licensed and therefore not open source, though it remains bounty-eligible on the same row Findings that require root or administrator privileges on the monitored host to reach End-of-life Beats versions, which are outside the supported set the program will reproduce against Third-party libraries reported without a working proof of concept showing the path through a Beat Volumetric denial of service, which the policy rules out permanently Assets from recent Elastic acquisitions, out of scope 'for at least 6 months after the acquisition is complete' Elastic Agent, which carries the identical $7,000 row but is Elastic License 2.0 only and does not clear the open-source gate Most-valued findings A memory-safety or parsing flaw in a Packetbeat protocol decoder, driven straight off the network by an attacker with no credentials, which is the top class at 35% and the clearest path to the $7,000 critical row Code execution in Filebeat or Metricbeat triggered by content the agent was designed to ingest, such as a crafted log line or a hostile remote endpoint Disclosure of the backend credentials or API keys a Beat holds in libbeat's output layer, or a TLS-verification weakness that exposes the shipped stream Winlogbeat or Auditbeat handling that lets an attacker on the host suppress, forge or corrupt the audit record before it leaves the machine A crafted input that reliably crashes or wedges an agent fleet-wide, provided the effect is not a function of traffic volume Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. File against the specific Beat you broke: Filebeat, Metricbeat, Packetbeat, Auditbeat, Heartbeat and Winlogbeat each carry their own bound $7,000 row, while the generic Beats asset has no bound row at all Reproduce on a currently supported, non-EOL Beats version Findings that require root or administrator privileges on the host before they work are out of scope Volumetric denial of service is never eligible for a bounty reward Only the Apache-2.0 tree outside the x-pack folder is open source, so an x-pack finding is paid but should not be routed as an open-source finding Program stats 891 Reports resolved $986k Bounties paid 79% Response efficiency Disclosure Coordinated by Elastic, and the policy makes bounty eligibility conditional on the report being submitted exclusively through Elastic's own HackerOne program, so file there first. Elastic publishes the result as an Elastic Security Advisory once a fixed release is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability