[Azure] Map Azure auditlogs initiated_by user fields to ECS user fields and populate related.user

[moxarth-rathod]

Proposed commit message

  azure: Adds ECS user field mapping to the auditlogs data stream

  This change maps the Azure Active Directory audit log initiator identity to
  ECS user fields on the auditlogs data stream. The `initiated_by.user` fields
  `userPrincipalName`, `id`, and `displayName` are now populated into `user.name`,
  `user.id`, and `user.full_name` respectively. Additionally, these identifiers
  are appended to the ECS `related.user` field.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

• Closes [Azure]: mapping user fields to ECS #17756

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

No issues across the latest commits 6992d83.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package azure 👍(5) 💚(3) 💔(5)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
platformlogs	7462.69	5128.21	-2334.48 (-31.28%)	💔
aadgraphactivitylogs	1347.71	1119.82	-227.89 (-16.91%)	💔
activitylogs	2314.81	1956.95	-357.86 (-15.46%)	💔
eventhub	1e+06	500000	-500000 (-50%)	💔
identity_protection	6493.51	5464.48	-1029.03 (-15.85%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 6992d83

cc @moxarth-rathod