[Azure] Map Azure auditlogs initiated_by user fields to ECS user fields and populate related.user

[moxarth-rathod]

Proposed commit message

  azure: Adds ECS user field mapping to the auditlogs data stream

  This change maps the Azure Active Directory audit log initiator identity to
  ECS user fields on the auditlogs data stream. The `initiated_by.user` fields
  `userPrincipalName`, `id`, and `displayName` are now populated into `user.name`,
  `user.id`, and `user.full_name` respectively. Additionally, these identifiers
  are appended to the ECS `related.user` field.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

• Closes [Azure]: mapping user fields to ECS #17756

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[vera-review-bot]

No issues across the latest commits 6992d83.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[kcreddy]

@moxarth-rathod please fix the merge conflicts.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 55cc6fc

History

• 💚 Build #45847 succeeded 6992d83

cc @moxarth-rathod

[ishleenk17]

Code owner approval

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package azure - 1.38.0 containing this change is available at https://epr.elastic.co/package/azure/1.38.0/