diff --git a/packages/auditd/changelog.yml b/packages/auditd/changelog.yml
index b9d207dbd7e..b0b1cc7ce6c 100644
--- a/packages/auditd/changelog.yml
+++ b/packages/auditd/changelog.yml
@@ -1,4 +1,16 @@
 # later versions go on top
+- version: "3.25.0"
+  changes:
+    - description: >-
+        Assign a stable name to the logfile input so that Fleet can preserve
+        user-configured variables (paths, tags, processors) across the
+        logfile-to-filestream migration in the next release.
+        Upgrade note: the next release changes the input type from logfile to
+        filestream. To preserve custom variable values, upgrade to this version
+        first and confirm the policy is applied before upgrading further.
+        Do not skip this version.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/21093
 - version: "3.24.2"
   changes:
     - description: Fix quadratic grok backtracking in the raw pipeline on EXECVE records with oversized split arguments (aN[0], aN[1], ...), which could exceed the grok watchdog timeout and consume excessive ingest CPU. Bracket-suffixed argument chunk keys are now also captured instead of being dropped.
diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-preparsed-syscall.log-expected.json b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-preparsed-syscall.log-expected.json
index ec03a76460a..0112e3dcae6 100644
--- a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-preparsed-syscall.log-expected.json
+++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-preparsed-syscall.log-expected.json
@@ -18,10 +18,14 @@
                 "action": [
                     "executed"
                 ],
-                "category": "process",
+                "category": [
+                    "process"
+                ],
                 "kind": "event",
                 "original": "type=SYSCALL msg=audit(1485893834.891:18877199): arch=c000003e syscall=59 success=yes exit=0 a0=7f095d0a4b88 ppid=1234 pid=5678 auid=1000 uid=0 gid=0 comm=\"ls\" exe=\"/bin/ls\"",
-                "type": "info"
+                "type": [
+                    "info"
+                ]
             },
             "host": {
                 "architecture": "x86_64"
diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json
index 735040422c1..480769000f6 100644
--- a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json
+++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json
@@ -374,11 +374,15 @@
                 "action": [
                     "booted-system"
                 ],
-                "category": "host",
+                "category": [
+                    "host"
+                ],
                 "kind": "event",
                 "original": "type=SYSTEM_BOOT msg=audit(1573844456.144:5): pid=678 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
                 "outcome": "success",
-                "type": "info"
+                "type": [
+                    "info"
+                ]
             },
             "process": {
                 "executable": "/usr/lib/systemd/systemd-update-utmp",
@@ -412,11 +416,15 @@
                 "action": [
                     "shutdown-system"
                 ],
-                "category": "host",
+                "category": [
+                    "host"
+                ],
                 "kind": "event",
                 "original": "type=SYSTEM_SHUTDOWN msg=audit(1573844517.054:1163): pid=4440 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
                 "outcome": "success",
-                "type": "info"
+                "type": [
+                    "info"
+                ]
             },
             "process": {
                 "executable": "/usr/lib/systemd/systemd-update-utmp",
@@ -508,11 +516,15 @@
                 "action": [
                     "issued-vm-control"
                 ],
-                "category": "host",
+                "category": [
+                    "host"
+                ],
                 "kind": "event",
                 "original": "type=VIRT_CONTROL msg=audit(1513507481.075:145): pid=1431 uid=0 auid=100 ses=3 subj=system_u:system_r:container_runtime_t:s0 msg='user=root reason=api op=create vm=? vm-pid=? hostname=? exe=\"/usr/bin/dockerd-current\" addr=? terminal=? res=success'",
                 "outcome": "success",
-                "type": "creation"
+                "type": [
+                    "start"
+                ]
             },
             "process": {
                 "executable": "/usr/bin/dockerd-current",
@@ -561,11 +573,15 @@
                 "action": [
                     "assigned-vm-id"
                 ],
-                "category": "host",
+                "category": [
+                    "host"
+                ],
                 "kind": "event",
                 "original": "type=VIRT_MACHINE_ID msg=audit(1481903143.572:23118): pid=5637 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm=\"rhel-work3\" uuid=5501263b-181d-47ed-ab03-a6066f3d26bf vm-ctx=system_u:system_r:svirt_t:s0:c444,c977 img-ctx=system_u:object_r:svirt_image_t:s0:c444,c977 model=selinux exe=\"/usr/sbin/libvirtd\" hostname=? addr=? terminal=? res=success'",
                 "outcome": "success",
-                "type": "creation"
+                "type": [
+                    "info"
+                ]
             },
             "process": {
                 "executable": "/usr/sbin/libvirtd",
@@ -728,11 +744,15 @@
                 "action": [
                     "booted-system"
                 ],
-                "category": "host",
+                "category": [
+                    "host"
+                ],
                 "kind": "event",
                 "original": "node=localhost.localdomain type=SYSTEM_BOOT msg=audit(1594053514.725:7): pid=1667 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
                 "outcome": "success",
-                "type": "info"
+                "type": [
+                    "info"
+                ]
             },
             "process": {
                 "executable": "/usr/lib/systemd/systemd-update-utmp",
diff --git a/packages/auditd/data_stream/log/_dev/test/system/test-preparsed-config.yml b/packages/auditd/data_stream/log/_dev/test/system/test-preparsed-config.yml
index c23e60b14c6..b392b239657 100644
--- a/packages/auditd/data_stream/log/_dev/test/system/test-preparsed-config.yml
+++ b/packages/auditd/data_stream/log/_dev/test/system/test-preparsed-config.yml
@@ -1,6 +1,3 @@
-skip:
-  reason: "Requires Elastic Agent >= 9.5.0 with the go-libaudit auditd filestream parser (beats#50791). CI runs the package's minimum supported stack, which has neither the parser nor the Fleet semverSatisfies helper (needs Kibana >= 9.4). Un-skip once the test matrix can boot a >= 9.5 stack."
-  link: https://github.com/elastic/beats/pull/50791
 data_stream:
   vars:
     use_auditd_parser: true
diff --git a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
index 1889a8e42d6..09fe1d39bb5 100644
--- a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
+++ b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -2,15 +2,23 @@
 description: Pipeline for parsing Linux auditd logs
 processors:
   - set:
+      tag: set_ecs_version_25a76f17
       field: ecs.version
       value: '8.17.0'
   - rename:
+      tag: rename_message_to_event_original_2658458a
       field: message
       target_field: event.original
       ignore_failure: true
       ignore_missing: true
       if: ctx.event?.original == null
+  - remove:
+      tag: remove_message_238aa738
+      field: message
+      ignore_missing: true
+      if: ctx.event?.original != null
   - pipeline:
+      tag: pipeline_raw_da8a4728
       if: ctx.auditd?.log?.record_type == null
       name: '{{ IngestPipeline "raw" }}'
   - script:
@@ -175,38 +183,47 @@ processors:
           - success
           - key_enforce
   - convert:
+      tag: convert_auditd_log_sequence_to_long_c6a60972
       field: auditd.log.sequence
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_lport_to_long_0c5e8d66
       field: auditd.log.lport
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_rport_to_long_af2b99b4
       field: auditd.log.rport
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_entries_to_long_a057d941
       field: auditd.log.entries
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_dst_prefixlen_to_long_cafb5d2a
       field: auditd.log.dst_prefixlen
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_ksize_to_long_a785d3d1
       field: auditd.log.ksize
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_size_to_long_c6dcf2e2
       field: auditd.log.size
       type: long
       ignore_missing: true
   - convert:
+      tag: convert_auditd_log_src_prefixlen_to_long_459aa0c3
       field: auditd.log.src_prefixlen
       type: long
       ignore_missing: true
   - set:
+      tag: set_event_kind_e8ec3c70
       field: event.kind
       value: event
   - script:
@@ -2041,6 +2058,7 @@ processors:
           }
         }
   - foreach:
+      tag: foreach_of_auditd_log_copy_93491b13
       field: auditd.log.copy
       ignore_missing: true
       processor:
@@ -2048,56 +2066,69 @@ processors:
           field: "{{{_ingest._value.target}}}"
           value: "{{{_ingest._value.value}}}"
   - set:
+      tag: set_event_category_927bc39d
       if: "ctx.auditd.log?.record_type == 'SYSTEM_BOOT' || ctx.auditd.log?.record_type == 'SYSTEM_SHUTDOWN'"
       field: event.category
-      value: host
+      value: [host]
   - set:
+      tag: set_event_type_1bd89dc7
       if: "ctx.auditd.log?.record_type == 'SYSTEM_BOOT' || ctx.auditd.log?.record_type == 'SYSTEM_SHUTDOWN'"
       field: event.type
-      value: info
+      value: [info]
   - set:
+      tag: set_event_category_9c960322
       if: "ctx.auditd.log?.record_type == 'SYSCALL' && ctx.auditd.log?.syscall == 'execve'"
       field: event.category
-      value: process
+      value: [process]
   - set:
+      tag: set_event_type_a03f1583
       if: "ctx.auditd.log?.record_type == 'SYSCALL' && ctx.auditd.log?.syscall == 'execve'"
       field: event.type
-      value: info
+      value: [info]
   - set:
+      tag: set_event_category_f8f12897
       if: "ctx.auditd.log?.record_type == 'VIRT_CONTROL' || ctx.auditd.log?.record_type == 'VIRT_MACHINE_ID'"
       field: event.category
-      value: host
+      value: [host]
   - set:
+      tag: set_event_type_a805897b
       if: "ctx.auditd.log?.record_type == 'VIRT_CONTROL' && ctx.auditd.log?.op == 'start'"
       field: event.type
-      value: start
+      value: [start]
   - set:
+      tag: set_event_type_ef080666
       if: "ctx.auditd.log?.record_type == 'VIRT_CONTROL' && ctx.auditd.log?.op == 'stop'"
       field: event.type
-      value: end
+      value: [end]
   - set:
+      tag: set_event_type_bc4fa046
       if: "ctx.auditd.log?.record_type == 'VIRT_CONTROL' && ctx.auditd.log?.op == 'create'"
       field: event.type
-      value: creation
+      value: [start]
   - set:
+      tag: set_event_type_f51732ca
       if: "ctx.auditd.log?.record_type == 'VIRT_CONTROL' && ctx.auditd.log?.op == 'delete'"
       field: event.type
-      value: deletion
+      value: [end]
   - set:
+      tag: set_event_type_d38b0988
       if: "ctx.auditd.log?.record_type == 'VIRT_MACHINE_ID'"
       field: event.type
-      value: creation
+      value: [info]
   - set:
+      tag: set_container_name_6e5daccd
       if: "ctx.auditd.log?.record_type == 'VIRT_MACHINE_ID'"
       field: container.name
       value: "{{{ auditd.log.vm }}}"
       ignore_empty_value: true
   - set:
+      tag: set_container_runtime_7937b24e
       if: "ctx.auditd.log?.record_type == 'VIRT_MACHINE_ID'"
       field: container.runtime
       value: "{{{ auditd.log.virt }}}"
       ignore_empty_value: true
   - set:
+      tag: set_network_direction_fce7fc5e
       if: >
         ctx.auditd.log?.record_type == 'SYSCALL' && (
         ctx.auditd.log?.syscall == 'accept' || ctx.auditd.log?.syscall == '43' ||
@@ -2107,6 +2138,7 @@ processors:
       field: network.direction
       value: ingress
   - set:
+      tag: set_network_direction_6e179a7a
       if: >
         ctx.auditd.log?.record_type == 'SYSCALL' && (
         ctx.auditd.log?.syscall == 'connect' || ctx.auditd.log?.syscall == '42' ||
@@ -2115,172 +2147,208 @@ processors:
       field: network.direction
       value: egress
   - set:
+      tag: set_host_architecture_f996cd4c
       copy_from: auditd.log.arch
       field: host.architecture
       if: ctx.auditd.log?.arch != null
   - rename:
+      tag: rename_auditd_log_acct_to_user_name_b6df19a8
       ignore_failure: true
       field: auditd.log.acct
       target_field: user.name
   - rename:
+      tag: rename_auditd_log_user_to_user_name_36a4b840
       ignore_failure: true
       field: auditd.log.user
       target_field: user.name
   - rename:
+      tag: rename_auditd_log_uid_to_user_id_c6dbebdb
       ignore_failure: true
       field: auditd.log.uid
       target_field: user.id
   - rename:
+      tag: rename_auditd_log_gid_to_user_group_id_25fef56a
       ignore_failure: true
       field: auditd.log.gid
       target_field: user.group.id
   - rename:
+      tag: rename_auditd_log_agid_to_user_audit_group_id_c114d5d0
       ignore_failure: true
       field: auditd.log.agid
       target_field: user.audit.group.id
   - rename:
+      tag: rename_auditd_log_auid_to_user_audit_id_e9b21b45
       ignore_failure: true
       field: auditd.log.auid
       target_field: user.audit.id
   - rename:
+      tag: rename_auditd_log_fsgid_to_user_filesystem_group_id_cad53b96
       ignore_failure: true
       field: auditd.log.fsgid
       target_field: user.filesystem.group.id
   - rename:
+      tag: rename_auditd_log_fsuid_to_user_filesystem_id_61150907
       ignore_failure: true
       field: auditd.log.fsuid
       target_field: user.filesystem.id
   - rename:
+      tag: rename_auditd_log_egid_to_user_effective_group_id_1f072cbe
       ignore_failure: true
       field: auditd.log.egid
       target_field: user.effective.group.id
   - rename:
+      tag: rename_auditd_log_euid_to_user_effective_id_31d38cfb
       ignore_failure: true
       field: auditd.log.euid
       target_field: user.effective.id
   - rename:
+      tag: rename_auditd_log_sgid_to_user_saved_group_id_84a65ad6
       ignore_failure: true
       field: auditd.log.sgid
       target_field: user.saved.group.id
   - rename:
+      tag: rename_auditd_log_suid_to_user_saved_id_6537cb87
       ignore_failure: true
       field: auditd.log.suid
       target_field: user.saved.id
   - rename:
+      tag: rename_auditd_log_ogid_to_user_owner_group_id_bc9ceb8e
       ignore_failure: true
       field: auditd.log.ogid
       target_field: user.owner.group.id
   - rename:
+      tag: rename_auditd_log_ouid_to_user_owner_id_dee46067
       ignore_failure: true
       field: auditd.log.ouid
       target_field: user.owner.id
   # Map ENRICHED format username/group fields (UID="root", EUID=..., etc.) to ECS.
   # Only set when the target is unset, and skip placeholder values like "unset" / "?".
   - set:
+      tag: set_user_name_ea417404
       field: user.name
       copy_from: auditd.log.UID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.UID != null && !['?', 'unset'].contains(ctx.auditd.log.UID)
   - set:
+      tag: set_user_group_name_a255d963
       field: user.group.name
       copy_from: auditd.log.GID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.GID != null && !['?', 'unset'].contains(ctx.auditd.log.GID)
   - set:
+      tag: set_user_audit_name_beabb516
       field: user.audit.name
       copy_from: auditd.log.AUID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.AUID != null && !['?', 'unset'].contains(ctx.auditd.log.AUID)
   - set:
+      tag: set_user_audit_group_name_a900c4e9
       field: user.audit.group.name
       copy_from: auditd.log.AGID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.AGID != null && !['?', 'unset'].contains(ctx.auditd.log.AGID)
   - set:
+      tag: set_user_effective_name_c7803614
       field: user.effective.name
       copy_from: auditd.log.EUID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.EUID != null && !['?', 'unset'].contains(ctx.auditd.log.EUID)
   - set:
+      tag: set_user_effective_group_name_2c2bc5bf
       field: user.effective.group.name
       copy_from: auditd.log.EGID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.EGID != null && !['?', 'unset'].contains(ctx.auditd.log.EGID)
   - set:
+      tag: set_user_filesystem_name_0361dc8a
       field: user.filesystem.name
       copy_from: auditd.log.FSUID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.FSUID != null && !['?', 'unset'].contains(ctx.auditd.log.FSUID)
   - set:
+      tag: set_user_filesystem_group_name_e44e5f65
       field: user.filesystem.group.name
       copy_from: auditd.log.FSGID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.FSGID != null && !['?', 'unset'].contains(ctx.auditd.log.FSGID)
   - set:
+      tag: set_user_saved_name_dc41fdfc
       field: user.saved.name
       copy_from: auditd.log.SUID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.SUID != null && !['?', 'unset'].contains(ctx.auditd.log.SUID)
   - set:
+      tag: set_user_saved_group_name_e7b555f3
       field: user.saved.group.name
       copy_from: auditd.log.SGID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.SGID != null && !['?', 'unset'].contains(ctx.auditd.log.SGID)
   - set:
+      tag: set_user_owner_name_8767d520
       field: user.owner.name
       copy_from: auditd.log.OUID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.OUID != null && !['?', 'unset'].contains(ctx.auditd.log.OUID)
   - set:
+      tag: set_user_owner_group_name_b54a7f4f
       field: user.owner.group.name
       copy_from: auditd.log.OGID
       override: false
       ignore_empty_value: true
       if: ctx.auditd?.log?.OGID != null && !['?', 'unset'].contains(ctx.auditd.log.OGID)
   - rename:
+      tag: rename_auditd_log_comm_to_process_name_21383383
       ignore_failure: true
       field: auditd.log.comm
       target_field: process.name
   - rename:
+      tag: rename_auditd_log_exe_to_process_executable_3639cee6
       ignore_failure: true
       field: auditd.log.exe
       target_field: process.executable
   - rename:
+      tag: rename_auditd_log_pid_to_process_pid_c8b5838a
       ignore_failure: true
       field: auditd.log.pid
       target_field: process.pid
   - rename:
+      tag: rename_auditd_log_ppid_to_process_parent_pid_5678dcc6
       ignore_failure: true
       field: auditd.log.ppid
       target_field: process.parent.pid
   - convert:
+      tag: convert_process_pid_to_long_de06d5e4
       ignore_missing: true
       field: process.pid
       type: long
   - convert:
+      tag: convert_process_parent_pid_to_long_a9497eb8
       ignore_missing: true
       field: process.parent.pid
       type: long
   - rename:
+      tag: rename_auditd_log_cmd_to_process_args_85ab9f4f
       ignore_failure: true
       field: auditd.log.cmd
       target_field: process.args
   - split:
+      tag: split_process_args_35531b23
       ignore_failure: true
       field: process.args
       separator: "\\s+"
   - rename:
+      tag: rename_auditd_log_argc_to_process_args_count_25ee6eac
       ignore_failure: true
       field: auditd.log.argc
       target_field: process.args_count
@@ -2293,68 +2361,83 @@ processors:
           ctx.process.args_count = ctx.process.args.length;
         }
   - convert:
+      tag: convert_process_args_count_to_long_7efbaa6a
       ignore_missing: true
       field: process.args_count
       type: long
   - rename:
+      tag: rename_auditd_log_exit_to_process_exit_code_8fbdf91e
       ignore_failure: true
       field: auditd.log.exit
       target_field: process.exit_code
   - convert:
+      tag: convert_process_exit_code_to_long_a411f969
       ignore_missing: true
       field: process.exit_code
       type: long
   - rename:
+      tag: rename_auditd_log_cwd_to_process_working_directory_023a984f
       ignore_missing: true
       field: auditd.log.cwd
       target_field: process.working_directory
   - rename:
+      tag: rename_auditd_log_terminal_to_user_terminal_6cb4371e
       ignore_failure: true
       field: auditd.log.terminal
       target_field: user.terminal
   - rename:
+      tag: rename_auditd_log_msg_to_message_28d7d7a7
       ignore_failure: true
       field: auditd.log.msg
       target_field: message
   - set:
+      tag: set_event_outcome_cf3cf250
       if: (ctx?.auditd?.log?.res != null && ["1", "success"].contains(ctx.auditd.log.res))
       field: event.outcome
       value: "success"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_f9515ef8
       if: (ctx?.auditd?.log?.res != null && ["0", "failed"].contains(ctx.auditd.log.res))
       field: event.outcome
       value: "failure"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_c9bb4e85
       if: (ctx?.auditd?.log?.res != null && !["0", "1", "success", "failed"].contains(ctx.auditd.log.res))
       field: event.outcome
       value: "unknown"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_d73de7a4
       if: (ctx?.event?.outcome == null && ctx?.auditd?.log?.result != null && ["1", "success"].contains(ctx.auditd.log.result))
       field: event.outcome
       value: "success"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_c128b930
       if: (ctx?.event?.outcome == null && ctx?.auditd?.log?.result != null && ["0", "failed"].contains(ctx.auditd.log.result))
       field: event.outcome
       value: "failure"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_d609b2e9
       if: (ctx?.event?.outcome == null && ctx?.auditd?.log?.result != null && !["0", "1", "success", "failed"].contains(ctx.auditd.log.result))
       field: event.outcome
       value: "unknown"
       ignore_failure: true
   - set:
+      tag: set_event_outcome_c634ebb2
       field: event.outcome
       value: unknown
       if: ctx.auditd?.log?.avc?.action != null && ctx.event?.outcome == null
   - set:
+      tag: set_event_outcome_92f35a42
       field: event.outcome
       value: success
       if: ctx.auditd?.log?.avc?.action == 'granted'
   - set:
+      tag: set_event_outcome_47556ea9
       field: event.outcome
       value: failure
       if: ctx.auditd?.log?.avc?.action == 'denied'
@@ -2405,38 +2488,47 @@ processors:
          }
       on_failure:
         - append:
+            tag: append_error_message_983a22e0
             field: error.message
             value: "failed extracting process arguments: {{{ _ingest.on_failure_message }}}"
   - set:
+      tag: set_event_action_4219c9b1
       field: event.action
       copy_from: auditd.log.record_type
       override: false
   - lowercase:
+      tag: lowercase_event_action_720d270c
       ignore_failure: true
       field: event.action
   - rename:
+      tag: rename_auditd_log_src_to_source_address_2040006a
       ignore_failure: true
       field: auditd.log.src
       target_field: source.address
   - rename:
+      tag: rename_auditd_log_addr_to_source_address_a23d1d45
       ignore_failure: true
       field: auditd.log.addr
       target_field: source.address
       if: ctx?.source?.address == null
   - rename:
+      tag: rename_auditd_log_dst_to_destination_address_f091d828
       ignore_failure: true
       field: auditd.log.dst
       target_field: destination.address
   - grok:
+      tag: grok_source_address_ece5d0e4
       field: source.address
       patterns:
         - "^%{IP:source.ip}$"
       ignore_failure: true
   - geoip:
+      tag: geoip_source_ip_into_source_geo_d88f28d6
       field: source.ip
       target_field: source.geo
       ignore_failure: true
   - geoip:
+      tag: geoip_source_ip_into_source_as_6d389c1f
       database_file: GeoLite2-ASN.mmdb
       field: source.ip
       target_field: source.as
@@ -2445,49 +2537,59 @@ processors:
         - organization_name
       ignore_missing: true
   - rename:
+      tag: rename_source_as_asn_to_source_as_number_766b2c3b
       field: source.as.asn
       target_field: source.as.number
       ignore_missing: true
   - rename:
+      tag: rename_source_as_organization_name_to_source_as_organization_name_075d7193
       field: source.as.organization_name
       target_field: source.as.organization.name
       ignore_missing: true
   - append:
+      tag: append_related_user_d07f17ca
       field: related.user
       value: "{{{ user.name }}}"
       allow_duplicates: false
       if: ctx.user?.name != null && ctx.user.name != ''
   - append:
+      tag: append_related_user_1e286456
       field: related.user
       value: "{{{ user.audit.name }}}"
       allow_duplicates: false
       if: ctx.user?.audit?.name != null && ctx.user.audit.name != ''
   - append:
+      tag: append_related_user_f9169814
       field: related.user
       value: "{{{ user.effective.name }}}"
       allow_duplicates: false
       if: ctx.user?.effective?.name != null && ctx.user.effective.name != ''
   - append:
+      tag: append_related_user_62607c36
       field: related.user
       value: "{{{ user.filesystem.name }}}"
       allow_duplicates: false
       if: ctx.user?.filesystem?.name != null && ctx.user.filesystem.name != ''
   - append:
+      tag: append_related_user_7ba06c12
       field: related.user
       value: "{{{ user.saved.name }}}"
       allow_duplicates: false
       if: ctx.user?.saved?.name != null && ctx.user.saved.name != ''
   - append:
+      tag: append_related_user_22f42546
       field: related.user
       value: "{{{ user.owner.name }}}"
       allow_duplicates: false
       if: ctx.user?.owner?.name != null && ctx.user.owner.name != ''
   - append:
+      tag: append_related_user_cd9406d0
       field: related.user
       value: "{{{ user.target.name }}}"
       allow_duplicates: false
       if: ctx.user?.target?.name != null && ctx.user.target.name != ''
   - remove:
+      tag: remove_8a8d6c32
       field:
         - auditd.log.kv
         - auditd.log.sub_kv
@@ -2501,8 +2603,18 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      tag: set_event_kind_72b1902f
       field: event.kind
       value: pipeline_error
   - append:
+      tag: append_error_message_14080786
       field: error.message
-      value: Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" failed with message "{{{ _ingest.on_failure_message }}}"
+      value: >-
+        Processor '{{{ _ingest.on_failure_processor_type }}}'
+        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
+        {{{/_ingest.on_failure_processor_tag}}}in pipeline '{{{ _ingest.pipeline }}}' failed with message '{{{ _ingest.on_failure_message }}}'
+  - append:
+      tag: append_tags_279d5a5c
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: false
diff --git a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/raw.yml b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/raw.yml
index bfc3a14c11a..c74c9958dec 100644
--- a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/raw.yml
+++ b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/raw.yml
@@ -64,49 +64,75 @@ processors:
         - '%{AUDIT_PREFIX}\s*$'
         - '%{AUDIT_TYPE} %{AUDIT_KEY_VALUES}'
   - gsub:
+      tag: gsub_auditd_log_sub_kv_d17a8a4a
       field: auditd.log.sub_kv
       pattern: '(res=[a-z]+)([A-Z][A-Za-z_]+=)'
       replacement: '$1 $2'
       ignore_missing: true
       ignore_failure: true
   - gsub:
+      tag: gsub_auditd_log_kv_d66bfe3f
       field: auditd.log.kv
       pattern: '(res=[a-z]+)([A-Z][A-Za-z_]+=)'
       replacement: '$1 $2'
       ignore_missing: true
       ignore_failure: true
   - kv:
+      tag: kv_auditd_log_kv_into_auditd_log_fa7ccfa2
       if: ctx.auditd?.log?.kv != null
       field: auditd.log.kv
       field_split: '(?:\s+|\x1d)(?=[^\s\x1d]+=)'
       value_split: '(?<!\\)='
       target_field: auditd.log
   - kv:
+      tag: kv_auditd_log_sub_kv_into_auditd_log_03d79d68
       field: auditd.log.sub_kv
       field_split: '\s+(?=[^\s]+=)'
       value_split: '='
       target_field: auditd.log
       ignore_missing: true
   - kv:
+      tag: kv_auditd_log_sub_kv_enriched_into_auditd_log_d80ffcbd
       field: auditd.log.sub_kv_enriched
       field_split: '\s+(?=[^\s]+=)'
       value_split: '='
       target_field: auditd.log
       ignore_missing: true
   - date:
+      tag: date_auditd_log_epoch_into_@timestamp_459c0b1a
       field: auditd.log.epoch
       target_field: "@timestamp"
       formats:
         - UNIX
       ignore_failure: true
   - lowercase:
+      tag: lowercase_auditd_log_original_field_cf857b97
       field: auditd.log.original_field
       ignore_missing: true
   - rename:
+      tag: rename_auditd_log_old-auid_to_auditd_log_old_auid_d30b8a28
       ignore_failure: true
       field: auditd.log.old-auid
       target_field: auditd.log.old_auid
   - rename:
+      tag: rename_auditd_log_old-ses_to_auditd_log_old_ses_128f83d6
       ignore_failure: true
       field: auditd.log.old-ses
       target_field: auditd.log.old_ses
+on_failure:
+  - set:
+      tag: set_event_kind_72b1902f
+      field: event.kind
+      value: pipeline_error
+  - append:
+      tag: append_error_message_14080786
+      field: error.message
+      value: >-
+        Processor '{{{ _ingest.on_failure_processor_type }}}'
+        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
+        {{{/_ingest.on_failure_processor_tag}}}in pipeline '{{{ _ingest.pipeline }}}' failed with message '{{{ _ingest.on_failure_message }}}'
+  - append:
+      tag: append_tags_279d5a5c
+      field: tags
+      value: preserve_original_event
+      allow_duplicates: false
diff --git a/packages/auditd/data_stream/log/manifest.yml b/packages/auditd/data_stream/log/manifest.yml
index 53f0567fa8a..784578b95a9 100644
--- a/packages/auditd/data_stream/log/manifest.yml
+++ b/packages/auditd/data_stream/log/manifest.yml
@@ -1,7 +1,7 @@
 type: logs
 title: Auditd logs
 streams:
-  - input: logfile
+  - input: auditd-logfile
     vars:
       - name: paths
         type: text
diff --git a/packages/auditd/data_stream/log/sample_event.json b/packages/auditd/data_stream/log/sample_event.json
index 5cf2b97db09..070c75d91b5 100644
--- a/packages/auditd/data_stream/log/sample_event.json
+++ b/packages/auditd/data_stream/log/sample_event.json
@@ -1,55 +1,68 @@
 {
-    "@timestamp": "2016-01-03T00:37:51.394Z",
+    "@timestamp": "2008-11-16T22:21:13.147Z",
     "agent": {
-        "ephemeral_id": "53541396-a320-4477-b6d9-a2a7d072269b",
-        "id": "2b104c8f-2997-496b-ae72-508caa53046e",
-        "name": "elastic-agent-28605",
+        "ephemeral_id": "75aa903f-41e0-4d1d-a447-bac357ac804f",
+        "id": "eb088d3b-5a12-4acd-a2e3-f195eee4809e",
+        "name": "elastic-agent-55655",
         "type": "filebeat",
-        "version": "8.17.3"
+        "version": "9.6.0"
     },
     "auditd": {
         "log": {
-            "proctitle": "bash",
-            "record_type": "PROCTITLE",
-            "sequence": 194438
+            "avc": {
+                "action": "denied",
+                "request": "getattr"
+            },
+            "dev": "dm-0",
+            "ino": "284133",
+            "path": "/var/www/html/file1",
+            "record_type": "AVC",
+            "scontext": "unconfined_u:system_r:httpd_t:s0",
+            "sequence": 96,
+            "tclass": "file",
+            "tcontext": "unconfined_u:object_r:samba_share_t:s0"
         }
     },
     "data_stream": {
         "dataset": "auditd.log",
-        "namespace": "69581",
+        "namespace": "34736",
         "type": "logs"
     },
     "ecs": {
         "version": "8.17.0"
     },
     "elastic_agent": {
-        "id": "2b104c8f-2997-496b-ae72-508caa53046e",
-        "snapshot": false,
-        "version": "8.17.3"
+        "id": "eb088d3b-5a12-4acd-a2e3-f195eee4809e",
+        "snapshot": true,
+        "version": "9.6.0"
     },
     "event": {
-        "action": "proctitle",
+        "action": "avc",
         "agent_id_status": "verified",
         "dataset": "auditd.log",
-        "ingested": "2025-03-13T12:15:48Z",
-        "kind": "event"
+        "ingested": "2026-09-07T10:58:39Z",
+        "kind": "event",
+        "module": "auditd",
+        "outcome": "failure"
     },
     "host": {
         "architecture": "x86_64",
-        "containerized": true,
-        "hostname": "elastic-agent-28605",
+        "containerized": false,
+        "hostname": "elastic-agent-55655",
         "ip": [
-            "172.20.0.2",
-            "172.18.0.7"
+            "10.89.11.2",
+            "fe80::100d:4eff:fe1d:ef0d",
+            "10.89.0.175",
+            "fe80::a0fa:9eff:fe79:6977"
         ],
         "mac": [
-            "02-42-AC-12-00-07",
-            "02-42-AC-14-00-02"
+            "12-0D-4E-1D-EF-0D",
+            "A2-FA-9E-79-69-77"
         ],
-        "name": "elastic-agent-28605",
+        "name": "elastic-agent-55655",
         "os": {
             "family": "",
-            "kernel": "5.15.153.1-microsoft-standard-WSL2",
+            "kernel": "6.17.0-14-generic",
             "name": "Wolfi",
             "platform": "wolfi",
             "type": "linux",
@@ -61,11 +74,13 @@
     },
     "log": {
         "file": {
-            "path": "/tmp/service_logs/audit.log"
+            "path": "/tmp/service_logs/avc.log"
         },
-        "offset": 1706
+        "offset": 0
     },
-    "tags": [
-        "auditd-log"
-    ]
+    "process": {
+        "name": "httpd",
+        "pid": 2465
+    },
+    "tags": "auditd-log"
 }
diff --git a/packages/auditd/docs/README.md b/packages/auditd/docs/README.md
index 4c49b8e519d..11679338131 100644
--- a/packages/auditd/docs/README.md
+++ b/packages/auditd/docs/README.md
@@ -14,57 +14,70 @@ An example event for `log` looks as following:
 
 ```json
 {
-    "@timestamp": "2016-01-03T00:37:51.394Z",
+    "@timestamp": "2008-11-16T22:21:13.147Z",
     "agent": {
-        "ephemeral_id": "53541396-a320-4477-b6d9-a2a7d072269b",
-        "id": "2b104c8f-2997-496b-ae72-508caa53046e",
-        "name": "elastic-agent-28605",
+        "ephemeral_id": "75aa903f-41e0-4d1d-a447-bac357ac804f",
+        "id": "eb088d3b-5a12-4acd-a2e3-f195eee4809e",
+        "name": "elastic-agent-55655",
         "type": "filebeat",
-        "version": "8.17.3"
+        "version": "9.6.0"
     },
     "auditd": {
         "log": {
-            "proctitle": "bash",
-            "record_type": "PROCTITLE",
-            "sequence": 194438
+            "avc": {
+                "action": "denied",
+                "request": "getattr"
+            },
+            "dev": "dm-0",
+            "ino": "284133",
+            "path": "/var/www/html/file1",
+            "record_type": "AVC",
+            "scontext": "unconfined_u:system_r:httpd_t:s0",
+            "sequence": 96,
+            "tclass": "file",
+            "tcontext": "unconfined_u:object_r:samba_share_t:s0"
         }
     },
     "data_stream": {
         "dataset": "auditd.log",
-        "namespace": "69581",
+        "namespace": "34736",
         "type": "logs"
     },
     "ecs": {
         "version": "8.17.0"
     },
     "elastic_agent": {
-        "id": "2b104c8f-2997-496b-ae72-508caa53046e",
-        "snapshot": false,
-        "version": "8.17.3"
+        "id": "eb088d3b-5a12-4acd-a2e3-f195eee4809e",
+        "snapshot": true,
+        "version": "9.6.0"
     },
     "event": {
-        "action": "proctitle",
+        "action": "avc",
         "agent_id_status": "verified",
         "dataset": "auditd.log",
-        "ingested": "2025-03-13T12:15:48Z",
-        "kind": "event"
+        "ingested": "2026-09-07T10:58:39Z",
+        "kind": "event",
+        "module": "auditd",
+        "outcome": "failure"
     },
     "host": {
         "architecture": "x86_64",
-        "containerized": true,
-        "hostname": "elastic-agent-28605",
+        "containerized": false,
+        "hostname": "elastic-agent-55655",
         "ip": [
-            "172.20.0.2",
-            "172.18.0.7"
+            "10.89.11.2",
+            "fe80::100d:4eff:fe1d:ef0d",
+            "10.89.0.175",
+            "fe80::a0fa:9eff:fe79:6977"
         ],
         "mac": [
-            "02-42-AC-12-00-07",
-            "02-42-AC-14-00-02"
+            "12-0D-4E-1D-EF-0D",
+            "A2-FA-9E-79-69-77"
         ],
-        "name": "elastic-agent-28605",
+        "name": "elastic-agent-55655",
         "os": {
             "family": "",
-            "kernel": "5.15.153.1-microsoft-standard-WSL2",
+            "kernel": "6.17.0-14-generic",
             "name": "Wolfi",
             "platform": "wolfi",
             "type": "linux",
@@ -76,13 +89,15 @@ An example event for `log` looks as following:
     },
     "log": {
         "file": {
-            "path": "/tmp/service_logs/audit.log"
+            "path": "/tmp/service_logs/avc.log"
         },
-        "offset": 1706
+        "offset": 0
     },
-    "tags": [
-        "auditd-log"
-    ]
+    "process": {
+        "name": "httpd",
+        "pid": 2465
+    },
+    "tags": "auditd-log"
 }
 ```
 
diff --git a/packages/auditd/manifest.yml b/packages/auditd/manifest.yml
index 0ad6f96c913..fed2a36a19b 100644
--- a/packages/auditd/manifest.yml
+++ b/packages/auditd/manifest.yml
@@ -1,6 +1,6 @@
 name: auditd
 title: Auditd Logs
-version: "3.24.2"
+version: "3.25.0"
 description: Collect logs from Linux audit daemon with Elastic Agent.
 type: integration
 icons:
@@ -8,13 +8,13 @@ icons:
     title: linux
     size: 299x354
     type: image/svg+xml
-format_version: "3.0.0"
+format_version: "3.6.0"
 categories:
   - security
   - auditd
 conditions:
   kibana:
-    version: ^8.11.0 || ^9.0.0
+    version: ^9.6.0
 screenshots:
   - src: /img/kibana-audit-auditd.png
     title: Auditd Kibana Dashboard
@@ -25,7 +25,8 @@ policy_templates:
     title: Auditd logs
     description: Collect logs from Auditd instances
     inputs:
-      - type: logfile
+      - name: auditd-logfile
+        type: logfile
         title: "Collect Auditd application logs (input: logfile)"
         description: "Collecting application logs from Auditd instances (input: logfile)"
 owner: