[system][auth] Populate user.target.* for IAM events (expand phase)

packages/system/changelog.yml

@@ -1,4 +1,10 @@
 # later versions go on top
+- version: "2.22.0"
+  changes:
+    - description: >-
+        Populate `user.target.name` (and `user.target.id` for useradd) with the affected account for useradd account creation, usermod group membership, userdel deletion, and PAM password change events, and extract `user.target.name` and `group.name` from userdel messages. For backward compatibility these events keep writing the affected account to `user.name`/`user.id`; this duplication is deprecated and will be removed in a future major version — update detection rules, dashboards, and other content that reads the affected account from `user.name` to use `user.target.name` instead.
+      type: enhancement
+      link: https://github.com/elastic/integrations/issues/20105
 - version: "2.21.0"
   changes:
     - description: Parse Windows Security scheduled task XML and task names into structured winlog.scheduled_task.* fields for detection and hunting.

packages/system/data_stream/auth/_dev/test/pipeline/test-5424.log-expected.json

@@ -604,7 +604,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-23T16:54:59.000Z",
+            "@timestamp": "2026-10-23T16:54:59.000Z",
             "ecs": {
                 "version": "8.11.0"
             },
@@ -660,7 +660,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-23T17:12:58.000Z",
+            "@timestamp": "2026-10-23T17:12:58.000Z",
             "ecs": {
                 "version": "8.11.0"
             },

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json

@@ -90,7 +90,11 @@
                     "id": "0"
                 },
                 "id": "107",
-                "name": "systemd-journal-remote"
+                "name": "systemd-journal-remote",
+                "target": {
+                    "id": "107",
+                    "name": "systemd-journal-remote"
+                }
             }
         },
         {
@@ -978,7 +982,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {
@@ -1054,7 +1061,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {
@@ -1130,7 +1140,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json

@@ -87,7 +87,11 @@
                     "id": "0"
                 },
                 "id": "107",
-                "name": "systemd-journal-remote"
+                "name": "systemd-journal-remote",
+                "target": {
+                    "id": "107",
+                    "name": "systemd-journal-remote"
+                }
             }
         },
         {
@@ -945,7 +949,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {
@@ -1018,7 +1025,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {
@@ -1094,7 +1104,10 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo"
+                "name": "foo",
+                "target": {
+                    "name": "foo"
+                }
             }
         },
         {

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json

@@ -1,7 +1,7 @@
 {
     "expected": [
         {
-            "@timestamp": "2025-10-11T09:10:48.000Z",
+            "@timestamp": "2026-10-11T09:10:48.000Z",
             "ecs": {
                 "version": "8.11.0"
             },
@@ -44,7 +44,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-14T16:49:59.000Z",
+            "@timestamp": "2026-10-14T16:49:59.000Z",
             "ecs": {
                 "version": "8.11.0"
             },
@@ -83,11 +83,14 @@
                 "auth": {}
             },
             "user": {
-                "name": "jce"
+                "name": "jce",
+                "target": {
+                    "name": "jce"
+                }
             }
         },
         {
-            "@timestamp": "2025-10-19T12:54:40.000Z",
+            "@timestamp": "2026-10-19T12:54:40.000Z",
             "ecs": {
                 "version": "8.11.0"
             },
@@ -126,7 +129,10 @@
                 "auth": {}
             },
             "user": {
-                "name": "acris"
+                "name": "acris",
+                "target": {
+                    "name": "acris"
+                }
             }
         }
     ]