[okta] Fix user.target.email never being set for target users

[seanrathier]

Summary

user.target.email is never populated for Okta target user entities due to a field name mismatch in the ingest pipeline.

Root cause: The pipeline's Painless script (tag: okta-target-modifications) renames alternateId → alternate_id on every entry in okta.target. The first User-type entry is then stored as okta_target_user. However, the subsequent set processor references okta_target_user.login — a field that was never created — instead of okta_target_user.alternate_id.

# Before (broken): condition is always false, email never set
- set:
    field: user.target.email
    copy_from: okta_target_user.login        # ← field does not exist
    if: ctx.okta_target_user?.login != null

# After (fixed):
- set:
    field: user.target.email
    copy_from: okta_target_user.alternate_id  # ← field set by the Painless script
    if: ctx.okta_target_user?.alternate_id != null

Impact: Any feature that reads user.target.email from Okta system logs (e.g. Entity Analytics communicates_with relationship maintainer) receives no data from this index, even when hundreds of thousands of qualifying events are present.

Test plan

• Ingest an Okta application.user_membership.add or similar event with a User-type target
• Confirm user.target.email is now populated with the target user's login/email (previously null)
• Confirm user.target.full_name and user.target.id are unaffected

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 89bc4f2

Failed CI Steps

• Check integrations okta

History

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)