[o365] Add extra values to related.user

[chrisberkhout]

Proposed commit message

[o365] Add extra values to `related.user` (#8803)

The `o365.audit.Parameters.User` value will be added to `related.user`,
when it is populated.

The `o365.audit.Data.*` fields `f3u`, `suid`, `tsd` and `trc` seem to
have values that match the format of an email address, and will be added
to `related.user` in those cases.

Discussion

These changes were suggested by a user in #4319.

Available example data includes o365.audit.Parameters.User values such as

EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management
EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management

Available example data shows the o365.audit.Data.* fields f3u, suid, tsd and trc as having values that match the format of an email address. The user.email and user.id fields could potentially be populated with these values, but given the undocumented and uncertain meaning of the fields, I have chosen to add values that appear to be email addresses to related.user to aid discovery, and I will leave any further interpretation of these values to integration users.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Merge [o365] Mapping, parsing of o365.audit fields Platform and Data.* #8571 and rebase

How to test this PR locally

elastic-package stack up -d
elastic-package build -v && elastic-package install -v
elastic-package test -v

Related issues

• Relates [Office 365] - Improve ECS utilization #4319

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

LGTM after version bump change.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 87488ef

History

• 💚 Build #8162 succeeded 4ae70b6

cc @chrisberkhout

[elasticmachine]

Package o365 - 2.1.0 containing this change is available at https://epr.elastic.co/search?package=o365