[Azure] Map Azure auditlogs initiated_by user fields to ECS user fields and populate related.user

packages/azure/changelog.yml

@@ -1,3 +1,8 @@
+- version: "1.38.0"
+  changes:
+    - description: Map Azure auditlogs initiated_by user fields to ECS user fields and populate related.user.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20075
 - version: "1.37.0"
   changes:
     - description: Add azure.aadgraphactivitylogs dataset to ingest legacy Azure AD Graph (graph.windows.net) AzureADGraphActivityLogs diagnostic events.

packages/azure/data_stream/auditlogs/_dev/test/pipeline/test-auditlogs-raw.log-expected.json

@@ -143,11 +143,21 @@
             "related": {
                 "entity": [
                     "8a4de8b5-095c-47d0-a96f-a75130c61d53"
+                ],
+                "user": [
+                    "8a4de8b5-095c-47d0-a96f-a75130c61d53",
+                    "UserName",
+                    "User Registration Service"
                 ]
             },
             "tags": [
                 "preserve_original_event"
-            ]
+            ],
+            "user": {
+                "full_name": "User Registration Service",
+                "id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
+                "name": "UserName"
+            }
         },
         {
             "@timestamp": "2019-10-18T15:30:51.027Z",
@@ -217,11 +227,19 @@
             "related": {
                 "entity": [
                     "8a4de8b5-095c-47d0-a96f-a75130c61d53"
+                ],
+                "user": [
+                    "8a4de8b5-095c-47d0-a96f-a75130c61d53",
+                    "UserName"
                 ]
             },
             "tags": [
                 "preserve_original_event"
-            ]
+            ],
+            "user": {
+                "id": "8a4de8b5-095c-47d0-a96f-a75130c61d53",
+                "name": "UserName"
+            }
         }
     ]
 }

packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml

@@ -235,6 +235,22 @@ processors:
       field: azure.auditlogs.properties.initiatedBy
       target_field: azure.auditlogs.properties.initiated_by
       ignore_missing: true
+  - set:
+      field: user.name
+      tag: set_user_name
+      copy_from: azure.auditlogs.properties.initiated_by.user.userPrincipalName
+      ignore_empty_value: true
+  - convert:
+      field: azure.auditlogs.properties.initiated_by.user.id
+      tag: convert_user_id
+      target_field: user.id
+      type: string
+      ignore_missing: true
+  - set:
+      field: user.full_name
+      tag: set_user_full_name
+      copy_from: azure.auditlogs.properties.initiated_by.user.displayName
+      ignore_empty_value: true
   - geoip:
       field: source.ip
       target_field: source.geo
@@ -287,6 +303,24 @@ processors:
             description: Add error reason
             field: error.message
             value: "{{{ _ingest.on_failure_message }}}"
+  - append:
+      field: related.user
+      tag: append_user_id_to_related_user
+      value: '{{{user.id}}}'
+      allow_duplicates: false
+      if: ctx.user?.id != null
+  - append:
+      field: related.user
+      tag: append_user_name_to_related_user
+      value: '{{{user.name}}}'
+      allow_duplicates: false
+      if: ctx.user?.name != null
+  - append:
+      field: related.user
+      tag: append_user_full_name_to_related_user
+      value: '{{{user.full_name}}}'
+      allow_duplicates: false
+      if: ctx.user?.full_name != null
   - pipeline:
       name: '{{ IngestPipeline "azure-shared-pipeline" }}'
   - set:

packages/azure/manifest.yml

@@ -1,6 +1,6 @@
 name: azure
 title: Azure Logs
-version: "1.37.0"
+version: "1.38.0"
 description: This Elastic integration collects logs from Azure
 type: integration
 icons: