[elasticsearch] Fix audit event.outcome for security config changes

packages/elasticsearch/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.22.1"
+  changes:
+    - description: Fix audit `event.outcome` so successful security configuration changes are not labeled as failure, and map the target user to `destination.user`.
+      type: bugfix
+      link: https://github.com/elastic/integrations/issues/12163
 - version: "1.22.0"
   changes:
     - description: Add security_stats data stream to collect per-node Document Level Security (DLS) bitset cache metrics from the Security Stats API (requires Elasticsearch 9.2+).

packages/elasticsearch/data_stream/audit/_dev/test/pipeline/test-audit-logs.log-expected.json

@@ -33,11 +33,16 @@
             },
             "event": {
                 "action": "access_granted",
-                "category": "database",
+                "category": [
+                    "database"
+                ],
                 "created": "2022-09-04T22:54:53.028Z",
                 "ingested": "2023-04-26T12:37:09.665259800Z",
                 "kind": "event",
-                "outcome": "success"
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
             },
             "host": {
                 "id": "rsRsMdvhREeQqLkk3twtqA"
@@ -93,11 +98,16 @@
             },
             "event": {
                 "action": "anonymous_access_denied",
-                "category": "database",
+                "category": [
+                    "database"
+                ],
                 "created": "2022-09-04T22:54:53.034Z",
                 "ingested": "2023-04-26T12:37:09.665284400Z",
                 "kind": "event",
-                "outcome": "failure"
+                "outcome": "failure",
+                "type": [
+                    "access"
+                ]
             },
             "host": {
                 "id": "rsRsMdvhREeQqLkk3twtqA"
@@ -162,11 +172,16 @@
             },
             "event": {
                 "action": "access_granted",
-                "category": "database",
+                "category": [
+                    "database"
+                ],
                 "created": "2022-09-04T22:54:53.040Z",
                 "ingested": "2023-04-26T12:37:09.665297300Z",
                 "kind": "event",
-                "outcome": "success"
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
             },
             "host": {
                 "id": "rsRsMdvhREeQqLkk3twtqA"
@@ -222,11 +237,16 @@
             },
             "event": {
                 "action": "authentication_success",
-                "category": "database",
+                "category": [
+                    "database"
+                ],
                 "created": "2019-01-27T20:15:10.380Z",
                 "ingested": "2023-04-26T12:37:09.665308800Z",
                 "kind": "event",
-                "outcome": "success"
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
             },
             "host": {
                 "id": "y8fa3M5zSSGo1M_KJRMUXw",
@@ -266,4 +286,4 @@
             }
         }
     ]
-}
+}

packages/elasticsearch/data_stream/audit/_dev/test/pipeline/test-security-config-change.log

@@ -0,0 +1,7 @@
+{"type":"audit", "timestamp":"2026-07-27T21:40:16,915+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"security_config_change", "event.action":"put_user", "request.id":"XzZOwjI5R2eau63Ol5hFTw", "put":{"user":{"name":"testuser","enabled":true,"roles":["viewer"],"full_name":"Test User","email":"testuser@example.com","has_password":true}}}
+{"type":"audit", "timestamp":"2026-07-27T21:40:16,920+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"security_config_change", "event.action":"put_user", "authentication.type":"REALM", "user.name":"chaison", "user.realm":"default_native", "request.id":"actorPutUserReq", "put":{"user":{"name":"testuser","enabled":true,"roles":["viewer"],"full_name":"Test User","email":"testuser@example.com","has_password":true}}}
+{"type":"audit", "timestamp":"2026-07-28T01:37:21,977+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"security_config_change", "event.action":"change_password", "request.id":"hvwql0rXQEerGN0dIx6_Cw", "change":{"password":{"user":{"name":"testuser"}}}}
+{"type":"audit", "timestamp":"2026-07-28T01:37:22,010+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"security_config_change", "event.action":"put_role", "request.id":"putRoleReq", "put":{"role":{"name":"audit_test_role","role_descriptor":{"cluster":["monitor"]}}}}
+{"type":"audit", "timestamp":"2026-07-28T01:37:22,050+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"security_config_change", "event.action":"delete_user", "request.id":"deleteUserReq", "delete":{"user":{"name":"testuser"}}}
+{"type":"audit", "timestamp":"2026-07-28T01:37:22,100+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"transport", "event.action":"access_denied", "authentication.type":"REALM", "user.name":"viewer", "user.realm":"default_native", "origin.type":"rest", "origin.address":"172.31.18.32:38722", "request.id":"accessDeniedReq", "action":"cluster:admin/xpack/security/user/put", "request.name":"PutUserRequest"}
+{"type":"audit", "timestamp":"2026-07-28T01:37:22,150+0000", "cluster.uuid":"TKAQJQZ4TVyphvg6roSeLA", "node.id":"TinMBx3vSfShqMncoK-jgQ", "event.type":"rest", "event.action":"authentication_failed", "origin.type":"rest", "origin.address":"172.31.18.32:38723", "url.path":"/_security/user/testuser", "request.method":"PUT", "request.id":"authFailedReq"}