Add user to .fleet-actions mapping

[aleksmaus]

Summary

Add user field mapping to .fleet-actions index mappings. The format conforms to ECS
https://www.elastic.co/guide/en/ecs/current/ecs-user.html
but doesn't include all the fields.

This allows to assign the user data to the action that can be filtered/searched and rendered in UI as needed.

What do you think?

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[nchaulet]

🚀

[pzl]

lgtm

[ruflin]

I'm not super keen on adding too much metadata to each action event. I wonder if perhaps we could it in a different way that we only add user.id and reference to a user table? Where is user.id coming from? Is this an Elasticsearch user?

@scunningham Would be good to get your take on this one.

@aleksmaus We need to make sure these changes will also make it into the system indices.

[ruflin]

Do we really need the text parts of ECS? Will we run text queries on these?

[aleksmaus]

This conforms to ECS definition of the fields.
Can add user.id only for sure.
Thought the extra user fields make the actions easier to render on UI without cross referencing between the indices.
Denormalization of the data seems pretty usual with nosql dbs

[aleksmaus]

Where is user.id coming from? Is this an Elasticsearch user?

Thought the user info from .security index would be utilized here, for example the content of the user record:

      {
        "_index" : ".security-7",
        "_id" : "user-aleksmaus",
        "_score" : 1.0,
        "_source" : {
          "username" : "aleksmaus",
          "password" : "$2a$10$SZfmVRiP3WYjobZYHXwLSe1Yjmsjp4W4X05r1jEx2y1fWkWSsBapW",
          "roles" : [
            "superuser"
          ],
          "full_name" : "Aleksandr Maus",
          "email" : "[email protected]",
          "metadata" : null,
          "enabled" : true,
          "type" : "user"
        }
      }
      
      ``` 

[aleksmaus]

Thinking of the cases where you want to render a list of actions with the corresponding user and possibly email link on UI.
Also if the user is deleted we still have the original user info with the action.

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 0a43ec4
• Storybooks Preview

Metrics [docs]

✅ unchanged

History

• 💚 Build #116522 succeeded 645ab68

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[kibanamachine]

💚 Backport successful

✅ 7.x / #95968

This backport PR will be merged automatically after passing CI.