Summary

When recording events performed by a user under RBAC, it is sometimes useful to record the set of roles the user had at the time the action was performed.

As an example, the Elasticsearch audit logs include this information, as described in their docs

Motivation:

Kibana is revamping its audit logging, and as part of this work, we are transitioning to be fully ECS compliant. Our logs aim to record the set of roles the end-user is assigned, and having a first-class location for this information within ECS would be beneficial to us.

We have a work-in-progress which targets this information under a custom kibana.user_roles category, but having this information exist within ECS's user category would offer a much nicer experience. We do have other alternatives if you feel this shouldn't be included in ECS, but I wanted to start a discussion to explore our options first.

Detailed Design:

Provide additional details around the design of the proposed changes.

• Field names: user.roles
• Example values for the fields

{
   "user": {
      "name": "elastic",
      "roles": ["superuser"]
   }
}

• Suggested appropriate datatypes
  I think keyword would be an appropriate datatype for this information.

• Any example events that map to the proposed use case(s)

Audit logs generated by both Elasticsearch and Kibana could benefit from this information