[System] Fix system.auth IAM events event.outcome by moxarth-rathod · Pull Request #22212 · elastic/integrations

moxarth-rathod · 2026-10-28T07:03:18Z

Proposed commit message

  system: set IAM event.outcome from failed-prefix

  Change the system.auth IAM outcome processors so success and failure
  are decided with `message.startsWith("fail")` instead of
  `message.contains("fail")`. Useradd events whose username, home
  directory, or shell contains "fail" (for example `faileduser` or
  `/usr/local/fail/sh`) no longer get `event.outcome: failure`.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Closes [system.auth] event.outcome incorrectly set to "failure" when username, homedir, or shell contains the word "fail" #17662

infra-vault-gh-plugin-prod · 2026-10-28T07:03:23Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-10-28T07:05:15Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Copilot

🟡 Changes recommended

The release-note entry links to unrelated PR #1 and should instead point to this fix’s PR or related issue #17662.

1 open issue

Fix release note link to reference this fix · New

What changed in this PR

Fixes System authentication IAM outcome classification for issue #17662, so successful account operations are not marked as failures when account fields contain fail.

Changes:

Replaces substring matching with a failed prefix check for IAM outcomes.
Adds a regression fixture covering fail in the username, home directory, and shell.
Bumps the package to version 3.2.1 and adds a changelog entry.

File	Description
`packages/system/manifest.yml`	Bumps the package version to 3.2.1.
`packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml`	Uses the `failed` prefix to classify IAM outcomes.
`packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log-expected.json`	Expects a successful user-creation outcome.
`packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log-config.yml`	Configures the regression fixture’s log input.
`packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log`	Adds a user-creation event with `fail` in account fields.
`packages/system/changelog.yml`	Documents the outcome-classification fix.

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues block the IAM outcome-classification fix.

No open issues 🎉

1 resolved since last review

Fix release note link to reference this fix

_{Review effort: Balanced}

vera-review-bot · 2026-10-28T07:08:57Z

      field: event.outcome
      value: failure
-      if: ctx.process?.name != null && (ctx.message != null && ctx.message.contains("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)
+      if: ctx.process?.name != null && (ctx.message != null && ctx.message.startsWith("failed")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)


Severity: 🟡 Medium confidence: medium path: packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml:645

startsWith("failed") stops shadow-utils "failure while writing changes to ..." errors from being set to event.outcome failure; they now get success. Match the "fail" prefix instead of "failed".

Details

The old condition ctx.message.contains("fail") set event.outcome: failure for every IAM message that contained the substring. The new startsWith("failed") only matches messages beginning with failed (for example failed adding user 'aol', exit code: 4, which is in test-auth-rhel79.log). As far as I recall, useradd/usermod/userdel/groupadd/groupdel/groupmod also log failure while writing changes to <db> when committing /etc/passwd, /etc/group or /etc/shadow fails. I could not open the upstream shadow-utils source to confirm this, because the host is not allowlisted. If that wording is right, these messages start with fail but not failed. Before this PR they got event.outcome: failure. With this change the success processor at line 640 matches them instead, so a failed account or group write is reported as a successful IAM change. No fixture covers this message form, so the pipeline tests would not catch the regression. Both IAM success messages, new user: ... and new group: ..., start with fixed prefixes, so a fail prefix check still fixes issue 17662 (a username, home directory or shell containing fail).

Recommendation:

Match the fail prefix in both the success and failure conditions so that failed ... and failure ... messages are both treated as failures, while values inside new user: and new group: lines still are not. Also add a pipeline fixture line such as useradd[1234]: failure while writing changes to /etc/passwd to cover this branch.

- set: tag: set_outcome-success field: event.outcome value: success if: ctx.process?.name != null && (ctx.message == null || !ctx.message.startsWith("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name) - set: tag: set_outcome-failure field: event.outcome value: failure if: ctx.process?.name != null && (ctx.message != null && ctx.message.startsWith("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)

Also in: packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml:640

🤖 AI-Generated Review | Vera Review Bot - v0.4.3 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

elastic-vault-github-plugin-prod · 2026-10-28T07:41:58Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Copilot

🟢 Approval recommended

No active review issues were identified for the IAM outcome-classification fix.

No open issues 🎉

_{Review effort: Balanced}

kcreddy

The commit message says message.startsWith("failed") while the fix has message.startsWith("fail")

Co-authored-by: Krishna Chaitanya Reddy Burri <krish.reddy91@gmail.com>

Copilot

🔵 Needs a closer look

Human assessment is needed because the ingest pipeline can overwrite previously identified PAM authentication failures with success for listed tools.

No open issues 🎉

_{Review effort: Balanced}

elastic-vault-github-plugin-prod · 2026-11-02T09:58:01Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-11-02T09:58:06Z

🟢 No issues across the latest commits c857620.

⚠️ 1 comment still unresolved from earlier commits — 1 medium

🟡 startsWith("failed") stops shadow-utils "failure while writing changes to ..." errors from being set to event.outcome failure (link)

Review summary

Issues found across earlier commits 4214d1d — 1 medium

🟡 startsWith("failed") stops shadow-utils "failure while writing changes to ..." errors from being set to event.outcome failure (link) (Outdated)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.4.3 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-11-02T10:34:40Z

💚 Build Succeeded

Buildkite Build
Commit: c857620

History

💚 Build #52597 succeeded 4c1c2a1
💚 Build #52513 succeeded a72025f
💚 Build #52328 succeeded 4214d1d

cc @moxarth-rathod

mergify · 2026-11-02T10:35:12Z

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

elastic-vault-github-plugin-prod · 2026-11-02T11:48:12Z

Package system - 3.3.1 containing this change is available at https://epr.elastic.co/package/system/3.3.1/

[System] Fix system.auth IAM events event.outcome

ce82e66

moxarth-rathod self-assigned this Oct 28, 2026

moxarth-rathod added Integration:system System bugfix Pull request that fixes a bug issue labels Oct 28, 2026

Copilot AI balanced review requested due to automatic review settings October 28, 2026 07:03

moxarth-rathod added Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Oct 28, 2026

moxarth-rathod requested review from a team as code owners October 28, 2026 07:03

Copilot started reviewing on behalf of moxarth-rathod October 28, 2026 07:03

View session

Add PR link to changelog

4214d1d

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Comment thread packages/system/changelog.yml Resolved

Copilot AI balanced review requested due to automatic review settings October 28, 2026 07:06

Copilot started reviewing on behalf of moxarth-rathod October 28, 2026 07:06

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

vera-review-bot Bot reviewed Oct 28, 2026

View reviewed changes

moxarth-rathod added 2 commits October 30, 2026 11:48

Address PR comment

a72025f

Resolve merge conflicts

4c1c2a1

Copilot AI balanced review requested due to automatic review settings November 2, 2026 06:24

Copilot started reviewing on behalf of moxarth-rathod November 2, 2026 06:25

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

kcreddy reviewed Nov 2, 2026

View reviewed changes

Comment thread packages/system/changelog.yml Resolved

Update packages/system/changelog.yml

c857620

Co-authored-by: Krishna Chaitanya Reddy Burri <krish.reddy91@gmail.com>

Copilot AI balanced review requested due to automatic review settings November 2, 2026 09:53

Copilot started reviewing on behalf of moxarth-rathod November 2, 2026 09:54

View session

moxarth-rathod requested a review from kcreddy November 2, 2026 09:55

Copilot AI reviewed Nov 2, 2026

View reviewed changes

kcreddy approved these changes Nov 2, 2026

View reviewed changes

moxarth-rathod merged commit c5ed7d1 into elastic:main Nov 2, 2026
14 checks passed

Conversation

moxarth-rathod commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Related issues

Uh oh!

infra-vault-gh-plugin-prod Bot commented Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

vera-review-bot Bot Oct 28, 2026

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Oct 28, 2026

🚀 Benchmarks report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

elastic-vault-github-plugin-prod Bot commented Nov 2, 2026

Uh oh!

vera-review-bot Bot commented Nov 2, 2026

Review summary

Uh oh!

infra-vault-gh-plugin-prod Bot commented Nov 2, 2026

💚 Build Succeeded

History

Uh oh!

mergify Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

moxarth-rathod commented Oct 28, 2026 •

edited

Loading

mergify Bot commented Nov 2, 2026 •

edited

Loading