[system][auth] Remove deprecated user.name/user.id duplication for IAM events

packages/system/changelog.yml

@@ -1,4 +1,10 @@
 # later versions go on top
+- version: "3.0.0"
+  changes:
+    - description: >-
+        The auth data stream no longer writes the affected account to `user.name`/`user.id` for useradd account creation, usermod group membership, userdel deletion, and PAM password change events. Since system 2.22.0 the affected account is available in `user.target.name` (and `user.target.id` for useradd), and `user.name` on these events is reserved for the acting user, matching ECS semantics. This completes the deprecation announced in 2.22.0. Before upgrading, update detection rules, saved searches, dashboards, and other content that reads the affected account from `user.name`/`user.id` on these events to use `user.target.*` instead — content still keyed on `user.name` will stop matching these events after this upgrade. The bundled New users and groups dashboard already uses `user.target.*` as of 2.23.0.
+      type: breaking-change
+      link: https://github.com/elastic/integrations/issues/20105
 - version: "2.22.1"
   changes:
     - description: Fix `@timestamp` being overwritten by `ClientCreationTime` (process start time) on Windows Security events 5058, 5059, and 5061. The `date_clientcreationtime` processor was missing `target_field`, causing it to default to `@timestamp` instead of writing back to `winlog.event_data.ClientCreationTime`.

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json

@@ -89,8 +89,7 @@
                     },
                     "id": "0"
                 },
-                "id": "107",
-                "name": "systemd-journal-remote",
+                "id": "1000",
                 "target": {
                     "id": "107",
                     "name": "systemd-journal-remote"
@@ -982,7 +981,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1061,7 +1059,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1140,7 +1137,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1360,7 +1356,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "fred",
                 "target": {
                     "name": "fred"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json

@@ -86,8 +86,7 @@
                     },
                     "id": "0"
                 },
-                "id": "107",
-                "name": "systemd-journal-remote",
+                "id": "1000",
                 "target": {
                     "id": "107",
                     "name": "systemd-journal-remote"
@@ -949,7 +948,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1025,7 +1023,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1104,7 +1101,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "foo",
                 "target": {
                     "name": "foo"
                 }
@@ -1315,7 +1311,6 @@
                     "id": "0"
                 },
                 "id": "1000",
-                "name": "fred",
                 "target": {
                     "name": "fred"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json

@@ -83,7 +83,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "jce",
                 "target": {
                     "name": "jce"
                 }
@@ -129,7 +128,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "acris",
                 "target": {
                     "name": "acris"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json

@@ -2477,8 +2477,6 @@
                 }
             },
             "user": {
-                "id": "1001",
-                "name": "tsg",
                 "target": {
                     "id": "1001",
                     "name": "tsg"
@@ -2526,7 +2524,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "tsg",
                 "target": {
                     "name": "tsg"
                 }
@@ -4803,8 +4800,6 @@
                 }
             },
             "user": {
-                "id": "106",
-                "name": "mysql",
                 "target": {
                     "id": "106",
                     "name": "mysql"

packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json

@@ -553,8 +553,6 @@
                 }
             },
             "user": {
-                "id": "48",
-                "name": "apache",
                 "target": {
                     "id": "48",
                     "name": "apache"

packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json

@@ -40,7 +40,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "user123",
                 "target": {
                     "name": "user123"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json

@@ -143,7 +143,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "jsmith",
                 "target": {
                     "name": "jsmith"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json

@@ -138,7 +138,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "siem_test",
                 "target": {
                     "name": "siem_test"
                 }

packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json

@@ -44,7 +44,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "testuser",
                 "target": {
                     "name": "testuser"
                 }
@@ -94,7 +93,6 @@
                 "auth": {}
             },
             "user": {
-                "name": "testuser",
                 "target": {
                     "name": "testuser"
                 }

packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml

@@ -21,24 +21,6 @@ processors:
         - '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
         - '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
         - '^new user: name=%{DATA:user.target.name}, UID=%{NUMBER:user.target.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'
-  - set:
-      description: >-
-        Deprecated duplication of user.target.name for backward compatibility;
-        will be removed for useradd events in a future major version.
-      tag: set_user_name_useradd_compat
-      field: user.name
-      copy_from: user.target.name
-      ignore_empty_value: true
-      if: ctx.user?.target?.name != null
-  - set:
-      description: >-
-        Deprecated duplication of user.target.id for backward compatibility;
-        will be removed for useradd events in a future major version.
-      tag: set_user_id_useradd_compat
-      field: user.id
-      copy_from: user.target.id
-      ignore_empty_value: true
-      if: ctx.user?.target?.id != null
   - append:
       tag: append_category_process
       field: event.category
@@ -192,15 +174,6 @@ processors:
       copy_from: _temp.usermod_user
       ignore_empty_value: true
       if: ctx._temp?.usermod_user != null
-  - set:
-      description: >-
-        Deprecated duplication of user.target.name for backward compatibility;
-        will be removed for usermod events in a future major version.
-      tag: set_user_name_usermod_compat
-      field: user.name
-      copy_from: _temp.usermod_user
-      ignore_empty_value: true
-      if: ctx._temp?.usermod_user != null
   - set:
       tag: set_group_name_usermod_group
       field: group.name
@@ -218,17 +191,6 @@ processors:
       copy_from: _temp.userdel_user
       ignore_empty_value: true
       if: ctx._temp?.userdel_user != null
-  - set:
-      description: >-
-        Deprecated duplication of user.target.name for backward compatibility;
-        will be removed for userdel events in a future major version. Limited
-        to "delete user" messages, matching the events that populated
-        user.name before user.target.name was introduced.
-      tag: set_user_name_userdel_compat
-      field: user.name
-      copy_from: _temp.userdel_user
-      ignore_empty_value: true
-      if: ctx._temp?.userdel_user != null && ctx.message != null && ctx.message.startsWith("delete user '")
   - set:
       tag: set_group_name_userdel
       field: group.name
@@ -445,15 +407,6 @@ processors:
       ignore_missing: true
       ignore_failure: true
       if: ctx._temp?.pam_user != null && ctx._temp.pam_user != '' && (ctx.user?.name == null || ctx.user?.name == '')
-  - set:
-      description: >-
-        Deprecated duplication of user.target.name for backward compatibility;
-        will be removed for password change events in a future major version.
-      tag: set_user_name_pam_target_compat
-      field: user.name
-      copy_from: _temp.pam_target
-      ignore_empty_value: true
-      if: ctx._temp?.pam_target != null && ctx._temp.pam_target != '' && (ctx.user?.name == null || ctx.user?.name == '')
   - set:
       tag: set_user_target_name_chauthtok
       field: user.target.name

packages/system/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "2.22.1"
+version: "3.0.0"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories: