The `cisco_duo` package uses field `cisco_duo.offline_enrollment.user.name` which can be stored in the ECS field `user.name` instead.
The
cisco_duopackage uses fieldcisco_duo.offline_enrollment.user.namewhich can be stored in the ECS fielduser.nameinstead.