[aws] cloudtrail: move assumed-role session name from user.changes.* to related.user

[chemamartinez]

Proposed commit message

[aws] cloudtrail: move assumed-role session name from user.changes.* to related.user

For AssumedRole and FederatedUser events, the ARN session name was
previously stored in user.changes.name. That field is defined by ECS
for modifications made to a user account during the event, which the
session name is not; storing it there was a semantic mismatch.

Additionally, when the session name is an email address (the pattern
used by AWS Identity Center / SSO), customers needed both the full
email and the local-part prefix available for cross-source user
correlation, since other log sources may store only the short username.

The ARN session name is now extracted into a temporary scratch field
and appended to related.user directly, without writing to
user.changes.*. When the session name is an email, both the full
address and the prefix before @ are appended, enabling correlation
with sources that store only the short username. user.name continues
to hold the IAM role name, preserving existing SIEM detection rule
behaviour.

A new pipeline test fixture covers the SSO/Identity Center email
session name pattern.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Closes [aws_cloudtrail] Extract human-readable identity from ARN session name #18346

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[chemamartinez]

Failed build seems unrelated.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

No issues across the latest commits 617ad3d…ff5593c (37 commits).

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: ff5593c

History

• 💔 Build #46518 failed 773d5a3

cc @chemamartinez

[efd6]

Suggested change

	- description: "[CloudTrail] Stop storing the assumed-role ARN session name in `user.changes.*` (which conflicts with ECS semantics). The session name is now added to `related.user` for cross-source correlation; when it is an email, both the full email and the local-part prefix are added. `user.name` continues to hold the IAM role name for detection rules."
	- description: "Stop storing the assumed-role ARN session name in `user.changes.*`. The session name is now added to `related.user` for cross-source correlation; when it is an email, both the full email and the local-part prefix are added. `user.name` continues to hold the IAM role name for detection rules."

[efd6]

Using grok for this is quite expensive.

Suggested change

	- grok:
	tag: extract_session_name_email_prefix
	field: _tmp.session_name
	patterns:
	- "%{DATA:_tmp.session_name_prefix}@"
	ignore_missing: true
	if: ctx._tmp?.session_name != null && ctx._tmp.session_name.contains('@')
	- dissect:
	tag: extract_session_name_email_prefix
	field: _tmp.session_name
	pattern: '%{_tmp.session_name_prefix}@%{}'
	if: ctx._tmp?.session_name != null && ctx._tmp.session_name.contains('@')