Adds support for cloud identity providers so the user-auditor module can track user lifecycle events. #2989

Describe the feature

The user-auditor module currently only recognizes user accounts in Windows and Linux. This request adds support for cloud identity providers so the same module can track user lifecycle events — created, deleted, disabled, enabled, and last login — from Microsoft 365, Microsoft Graph, Azure, Google Cloud, and AWS. All sources feed into the same user list, with each user tagged by where it came from, so a single view shows accounts from every environment.

Use Case

Many organizations have the same people across on-premises and cloud. Today, a user created in Microsoft 365, Azure, Google Cloud, or AWS simply never appears in the user-auditor module, so I can't see who has an account, when it was created, or whether it was later disabled or deleted unless I go into each provider's console separately. I need one consolidated view of all user accounts, no matter which environment they live in.

Proposed Solution

The audit agent already receives raw logs from these providers through the existing input plugins. The change is to teach the audit module how to read each cloud's user events from the log data and store them alongside the existing Windows and Linux entries. Each user record carries a source label (o365, azure, gcp, aws) and is matched by the user's email address within that tenant, so re-seeing the same user updates the record instead of creating duplicates. A user deleted or disabled in the cloud is marked as inactive the same way it is today for local accounts.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change