[system] Use user.target.* in New users and groups dashboard

[nicholasberlin]

Proposed commit message

Updates the "[Logs System] New users and groups" dashboard to read the
created account from user.target.name/user.target.id instead of
user.name/user.id in the four New users panels (table, over time, by
shell, by home directory). The New groups panels are unchanged, as groupadd
events still map group.name/group.id.

Since system 2.22.0 (#20339) useradd events populate
user.target.* with the created account; user.name/user.id only carry a
deprecated duplication that a future major version will remove (contract
phase of the expand-and-contract migration, #20105).
Moving the dashboard to the new fields now means it keeps working after that
removal.

Note the New users panels only show events ingested with system 2.22.0 or
later, where user.target.* was introduced for useradd events.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs. N/A, dashboard-only change
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines. N/A, no new field types or features used
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• The New users panels intentionally switch to fields that only exist on
  events ingested with system 2.22.0+; older useradd events will no longer
  appear in them. This is disclosed in the changelog entry.

How to test this PR locally

cd packages/system
elastic-package stack up -d
elastic-package build && elastic-package install

Then in Kibana:

1. Ingest a useradd auth event, e.g. append to a file collected by the
   system auth logfile stream (or POST a doc through the
   logs-system.auth-2.24.0 pipeline into logs-system.auth-default):
   Jul 24 12:00:00 testhost useradd[1234]: new user: name=alice, UID=1001, GID=1001, home=/home/alice, shell=/bin/bash
2. Open the "[Logs System] New users and groups" dashboard and verify the
   New users table shows the account with User=alice and UID=1001, and the
   over time / by shell / by home directory panels populate.
3. Verify the New groups panels still work for a groupadd event.

Related issues

• Relates [System] : ECS user field mapping issues in password change, account creation, and group membership events #20105
• Relates [system][auth] Populate user.target.* for IAM events (expand phase) #20339

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package system 👍(1) 💚(1) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
security	1567.4	1195.03	-372.37 (-23.76%)	💔
auth	5000	2695.42	-2304.58 (-46.09%)	💔

To see the full report comment with /test benchmark fullreport

[nicholasberlin]

/test benchmark fullreport

[Copilot]

Pull request overview

Updates the System integration’s “[Logs System] New users and groups” Kibana dashboard to use ECS user.target.* fields for created accounts (useradd events), aligning the dashboard with the expand-and-contract migration away from the deprecated user.* duplication.

Changes:

• Bump the System package version to 2.23.0.
• Update the “New users” Lens panels in the dashboard to read user.target.name / user.target.id instead of user.name / user.id.
• Add a changelog entry documenting the dashboard field switch and the 2.22.0+ event requirement.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/system/manifest.yml	Bumps package version to 2.23.0.
packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json	Switches “New users” panels to user.target.* fields.
packages/system/changelog.yml	Documents the dashboard update and notes the 2.22.0+ ingestion constraint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[Copilot]

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues remain.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: d3aec31

History

• 💚 Build #49598 succeeded b21d76b
• 💚 Build #47800 succeeded c0d2841
• 💚 Build #47060 succeeded 22ed856
• 💚 Build #46694 succeeded f5eb04e
• 💚 Build #46628 succeeded 690e47a
• 💚 Build #46624 succeeded 690e47a

[iblancof]

One thing worth considering: users who upgrade but have pre-2.22.0 data will see the New Users panels go blank with no error explaining why.

The changelog already flags it:

The New users panels only show events ingested with system 2.22.0 or later, where these fields were introduced.

That covers people who read the changelog, but I wonder if users who see empty panels would connect it to the upgrade. Not sure if this is the kind of thing that has caused friction before, but if it has, a short KB article covering what changed and what to do about it might be worth having.

[nicholasberlin]

@iblancof good point about the empty panels. Follow-up in #21311: a Troubleshooting entry in the System README (which surfaces on the integration's Overview tab in Kibana) explaining why the New users panels are empty for pre-2.22.0 data, plus an _update_by_query to backfill user.target.name/user.target.id from user.name/user.id on historical useradd events. That also gives Support a linkable source if a KB article turns out to be warranted.