[sentinel_one] Split domain-qualified user.name values into user.domain

packages/sentinel_one/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.0.1"
+  changes:
+    - description: Split domain-qualified `user.name` values into `user.domain`.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/16728
 - version: "2.0.0"
   changes:
     - description: |

packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml

@@ -664,6 +664,11 @@ processors:
       field: json.osUsername
       target_field: user.name
       ignore_missing: true
+  - dissect:
+      field: user.name
+      pattern: '%{user.domain}\%{user.name}'
+      if: ctx.user?.name?.contains('\\') == true
+      description: "Split user and domain"
   - append:
       field: related.user
       value: '{{{user.name}}}'

packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

@@ -265,6 +265,11 @@ processors:
       field: json.alertInfo.loginsUserName
       target_field: user.name
       ignore_missing: true
+  - dissect:
+      field: user.name
+      pattern: '%{user.domain}\%{user.name}'
+      if: ctx.user?.name?.contains('\\') == true
+      description: "Split user and domain"
   - append:
       field: related.user
       value: '{{{user.name}}}'

packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml

@@ -184,6 +184,11 @@ processors:
       field: user.name
       copy_from: json.threatInfo.processUser
       ignore_empty_value: true
+  - dissect:
+      field: user.name
+      pattern: '%{user.domain}\%{user.name}'
+      if: ctx.user?.name?.contains('\\') == true
+      description: "Split user and domain"
   - append:
       field: related.user
       value: '{{{user.name}}}'

packages/sentinel_one/data_stream/threat_event/elasticsearch/ingest_pipeline/default.yml

@@ -773,6 +773,11 @@ processors:
       tag: set_user_name
       copy_from: sentinel_one.threat_event.user
       ignore_empty_value: true
+  - dissect:
+      field: user.name
+      pattern: '%{user.domain}\%{user.name}'
+      if: ctx.user?.name?.contains('\\') == true
+      description: "Split user and domain"
   - append:
       field: related.user
       tag: append_user_name_into_related_user

packages/sentinel_one/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.4.0"
 name: sentinel_one
 title: SentinelOne
-version: "2.0.0"
+version: "2.0.1"
 description: Collect logs from SentinelOne with Elastic Agent.
 type: integration
 categories: