[nicholasberlin]

Proposed commit message

WHAT: Map the enriched auditd username/group fields (UID, GID, EUID, EGID, FSUID, FSGID, SUID, SGID, AUID, AGID) that appear as key=value suffixes on kernel audit records (e.g. UID="root" AUID="unset") to their corresponding ECS user.* name fields. The mapping uses set processors with override: false so pre-existing values are never clobbered, and skips placeholder values ("unset", "?") that carry no meaningful identity. All mapped names are also appended to related.user for cross-referencing.

WHY: The auditd enriched format already maps the numeric ID fields (e.g. user.id, user.audit.id) from type=SYSCALL records, but the human-readable name counterparts were left unmapped. This meant searches and alerts built on user.name or related.user would miss events where only the enriched format was available, making the integration inconsistent compared to the go-libaudit preparsed path which does populate these fields.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Pipeline test regenerated with elastic-package test pipeline --generate and expected output reviewed

How to test this PR locally

cd packages/auditd
elastic-package stack up -d --services=elasticsearch
elastic-package test pipeline
elastic-package stack down

Related issues

• Closes [Auditd Logs]: User-related ECS fields (user.name, user.effective.name, related.user) are not populated for SERVICE_STOP events #20136

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/auditd/changelog.yml	4	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The auditd package check failed because the committed generated packages/auditd/docs/README.md is stale. The PR adds related.user and user.group.name in packages/auditd/data_stream/log/fields/ecs.yml, but those exported-field rows are missing from the generated README.

Remediation

• From packages/auditd, run elastic-package build to regenerate the package documentation.
• Commit the resulting packages/auditd/docs/README.md update, including the related.user and user.group.name rows.
• Re-run the Check integrations auditd package check.

Investigation details

Root Cause

The PR adds the ECS field definitions related.user and user.group.name in packages/auditd/data_stream/log/fields/ecs.yml and uses them in the ingest pipeline. The generated documentation was not rebuilt, so CI detects a mismatch between the generated README and its source metadata.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/46292
• Job/step: Check integrations auditd
• Key log excerpt: README.md is outdated. Rebuild the package with elastic-package build; the diff shows missing related.user and user.group.name rows, followed by checking readme files are up-to-date failed.
• PR source: packages/auditd/data_stream/log/fields/ecs.yml contains both new fields, while packages/auditd/docs/README.md does not.

Verification

• Not run; this is a read-only CI diagnosis based on the failed Buildkite log and PR contents.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[nicholasberlin]

This conflicts with #20237, update this or that depending on merge order.

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 6ea4ae8

History

• 💔 Build #46294 failed 060d127
• 💔 Build #46292 failed 8210b2b

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• 🟠 Waiting for queue conditions
• ⏳ Enter queue
• ⏳ Run checks
• ⏳ Merge

Required conditions to enter a queue

• -closed [📌 queue requirement]
• -conflict [📌 queue requirement]
• -draft [📌 queue requirement]
• any of [📌 queue -> configuration change requirements]:
  • -mergify-configuration-changed
  • check-success = Configuration changed
• any of [🔀 queue conditions]:
  • all of [📌 queue conditions of queue rule default]:
    • github-review-approved [🛡 GitHub branch protection] (documentation)
    • github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR for Renovate] (documentation)
    • github-review-approved [🛡 GitHub repository ruleset rule [org] Require a PR] (documentation)
    • github-review-decision = APPROVED [🛡 GitHub branch protection] (documentation)
    • any of [🛡 GitHub branch protection]:
      • check-success = CLA
      • check-neutral = CLA
      • check-skipped = CLA
    • any of [🛡 GitHub branch protection]:
      • check-success = buildkite/integrations
      • check-neutral = buildkite/integrations
      • check-skipped = buildkite/integrations

[mergify]

queue

☑️ The pull request has been merged manually

Details

The pull request has been merged manually at da13a70